Repository navigation
feat(flowspec): preview manual admission without side effects - #325
Merged
Merged
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
The admission display rounds police rates instead of exposing the exact server action operators need to verify.
1 open issue
What changed in this PR
Adds an optional manual FlowSpec admission preview on top of destination-CIDR support, letting operators check controller policy without saving intent or contacting the speaker.
Changes:
- Shares preparation and safety checks between preview and creation, while retaining atomic admission during creation.
- Adds dashboard results for passed, refused and unavailable checks, with response validation and stale-result invalidation.
- Adds backend/frontend coverage and documents the preview’s limits.
| File | Description |
|---|---|
tests/integration_postgres.rs |
Checks read-only creation-rate parity. |
src/db/traits.rs |
Defines the creation-rate snapshot interface. |
src/db/repository.rs |
Implements the database snapshot check. |
src/db/mock.rs |
Adds snapshot checks and failure simulation. |
src/api/routes.rs |
Registers the preview endpoint. |
src/api/openapi.rs |
Registers preview API schemas. |
src/api/handlers/manual_flowspec.rs |
Implements shared admission checks, preview responses and tests. |
src/api/handlers.rs |
Reuses admission logic during creation. |
frontend/lib/api.ts |
Adds the preview client and response validation. |
frontend/components/dashboard/flowspec-rule-dialog.tsx |
Adds admission checks and result display. |
frontend/__tests__/amplification-surfaces.test.tsx |
Updates expected keyboard navigation order. |
frontend/__tests__/admission-preview.test.tsx |
Covers response validation and preview interactions. |
docs/reference/api.md |
Documents the endpoint and evidence limits. |
docs/cookbook/manual-mitigation.md |
Explains the optional preview workflow. |
CHANGELOG.md |
Records the admission-preview feature. |
Review effort: Balanced
lance0
force-pushed
the
feature/flowspec-destination-cidrs
branch
from
October 24, 2026 03:22
b2fd374 to
5fffa9c
Compare
This was referenced Oct 24, 2026
lance0
force-pushed
the
feature/flowspec-admission-preview
branch
from
October 24, 2026 03:24
011bc6d to
b7e04d9
Compare
lance0
marked this pull request as ready for review
October 24, 2026 04:32
lance0
changed the base branch from
feature/flowspec-destination-cidrs
to
main
October 24, 2026 15:43
Run each bounded read in a BEGIN READ ONLY transaction with a transaction-local statement_timeout instead of a session setting on a connection closed after every read. Rollback ends the setting and returns the connection to the pool. BEGIN runs in a detached task so cancellation cannot return an unrecorded open transaction to the pool.
The early creation-rate refusal counted the guardrail rejection but dropped the admission rejected new mitigation warning that the persistence-time recheck emits. Emit the same event and fields.
Preview is a read-only snapshot and creation rechecks under the mutex, so preview no longer delays ingest, expiry or withdrawal. The five-second deadline still bounds preparation and safety reads. The no-mutation helper now lists with an explicit limit, covers safelist, operator and signal-group writes, and has a should_panic negative control. Add a Viewer 403 test, a rate-refusal log test, a pooled connection-count test, OpenAPI bodies for 422/503, and document that a safelisted target fails the guardrails check.
…ssion-preview # Conflicts: # CHANGELOG.md # docs/how-to/upgrading.md # docs/project/scrubber-diversion-contract.md # docs/reference/api.md # frontend/components/dashboard/flowspec-rule-dialog.tsx # src/api/handlers.rs # src/config/inventory.rs # src/db/repository.rs # src/scheduler/reconcile.rs # tests/integration.rs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add an optional authenticated admission check for manual discard/police FlowSpec using creation’s preparation and policy. Return the exact candidate, customer, remaining lifetime, mode and admissible/refused/unavailable outcome without saving intent, consuming quota, auditing or calling the speaker. Creation rechecks under atomic admission; router enforcement remains unobserved.
Bound mutex acquisition and read-only preparation to five seconds. Database reads use server-side deadlines and discarded connections so cancellation releases shared pool capacity. The dashboard validates the complete response, shows exact police bps and invalidates results on edits, close, cancellation and creation.
Validation: 11 shared admission cases, SQL/mock rate-window parity, both strict Clippy configurations and real PostgreSQL one-connection tests pass. Repeated blocked reads recover pool capacity before the blocker is released, preserve stricter server deadlines and leave all mutation tables unchanged. The previous handler fails the pool-recovery negative control. Pinned frontend regressions include late response after Cancel/reopen. All 18 hosted checks pass on
e04b3ca; the PR is clean and ready for review.This PR targets #324 and contains only admission preview. Merge order: #323 → #327 → #322 → #324 → #325 → #326. Use merge commits; after the predecessor lands, retarget the next PR to
mainbefore merging.