hubcio commented on code in PR #4506:
URL: https://github.com/apache/iggy/pull/4506#discussion_r4270521778
##########
core/server/src/http/forward.rs:
##########
@@ -332,92 +534,69 @@ fn record_relayed_floor(state: &HttpInner, user_id: u32,
response: &Response) {
state.metadata_watermarks.record(user_id, applied);
}
-async fn forward_partition_or_pass(state: HttpState, request: Request, next:
Next) -> Response {
- if !state.forward.active ||
request.headers().contains_key(FORWARDED_HEADER) {
- return next.run(request).await;
- }
- // A read that does not move consumer progress is answered by whichever
- // replica the caller reached, which is the point of reading from one. Only
- // an automatic commit needs a replica that can originate the offset
- // operation, so only that poll pays for the buffering and the credential
- // resolution below.
- if request.method() == Method::GET &&
!wants_auto_commit(request.uri().query()) {
- return next.run(request).await;
- }
+async fn attach_partition_request(state: HttpState, request: Request, next:
Next) -> Response {
+ let received = Instant::now();
+ let hop = match partition_hop(request.headers()) {
+ Ok(hop) => hop,
+ Err(error) => return CustomError::from(error).into_response(),
+ };
+ // Verify-only, like the metadata relay: an unauthenticated caller gets no
+ // buffered body and no relay. The handler authenticates again.
let bearer = match bearer_token(request.headers()) {
Ok(bearer) => bearer,
Err(error) => return CustomError::from(error).into_response(),
};
if let Err(rejection) = resolve_credential(&state, bearer).await {
return rejection.into_response();
}
-
- let (parts, request_body) = request.into_parts();
+ let _guard = if matches!(hop, PartitionHop::Target(_)) {
+ let Some(guard) = ForwardGuard::admit(&state.forward.in_flight) else {
Review Comment:
Deferred to PR6 under B7's HTTP target-hold isolation and relay-provenance
gate. The docs now explicitly include the untimed body-read path: 128
authenticated slow-body uploads must not exhaust outbound forwarding capacity.
Acceptance requires bounded body-read time/resources, isolated or reserved
target capacity, authorized relay progress while the uploads are stalled, and
cancellation/permit recovery. Moving the permit after to_bytes alone would
leave body-read resource use unproven, so this remains open alongside the
earlier admission-isolation finding.
##########
core/metadata/src/impls/metadata.rs:
##########
@@ -4231,6 +4224,9 @@ where
#[allow(clippy::future_not_send)]
pub async fn commit_journal(&self) {
let consensus = self.consensus.as_ref().unwrap();
+ if consensus.view_log_unproven() {
Review Comment:
Deferred to PR6 as a recovery release blocker in B5's durable metadata
history certification gate. The metadata superblock can record the adopted
log_view while proof remains fenced, and the fence is not recovered. Simply
postponing the whole superblock write would violate the mandatory
view-persistence-before-send gate. PR6 must separate the certified history view
from the adopted view, bind it to verified durable WAL history, and cover
checkpoint writes. Acceptance includes crash/reopen before repair, during
divergence removal/refill, after proof and during checkpoint publication, plus
conflicting-suffix quorum recovery without advertising unproven history under
the new log_view or stalling the merge.
##########
core/simulator/src/bin/workload-fuzz.rs:
##########
@@ -625,6 +653,23 @@ fn run_quiesce_phase(
args.min_metadata_ops_compared, convergence.ops_compared,
));
}
+ if sim.is_shell()
+ && workload.options.weights.draws_fixture_groups()
+ && convergence.owners_compared < args.min_owners_compared
+ {
+ vacuous(format_args!(
+ "--min-owners-compared {}: the run joined fixture groups, but the
owner oracle \
+ compared only {} settled owner(s) (seed={seed:#x})",
+ args.min_owners_compared, convergence.owners_compared,
+ ));
+ }
+ if sim.is_shell() && args.plane == Plane::Lifecycle &&
workload.owner_fence_refusals() == 0 {
Review Comment:
Deferred to PR6 in the consolidated simulator acceptance plan and B6. Extend
the existing lifecycle workload scheduler to force a valid owner transition and
at least one stale-owner store per run, then retain the random fault workload.
Acceptance includes seeds 1, 2, 5, 8, 18, 21 and 23, nonzero stale-store
attempts and generation refusals, successful valid-owner stores, and a
production owner-check mutation caught end to end. The existing exit 3 for
vacuous coverage stays; such runs will not be relabeled as passing or silently
retried. The reported lifecycle seed 20037 was rerun with its supplied flags
after these fixes: it converges without the reversed-range panic, then
correctly exits 3 with stale_owner_stores=0 and owner_fence_refusals=0. That
result is recorded as vacuous, not a passing lifecycle gate.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
