fix: AAD deserialization bug + dead code removal#83
Open
Conversation
Five deserialize_data() calls were missing cache_key=cache_key: - L1+L2 sync path (line 678) - L1+L2 async path (line 973) - L2 async get after lock acquire (line 1035) - L2 async get after lock wait, path A (line 1109) - L2 async get after lock wait, path B (line 1132) Without cache_key, encrypted cache entries using AAD v0x03 would fail verification on every hit, silently falling through to cache miss. The L1-only paths (lines 591, 935) already passed cache_key correctly. Found by code-craftsman expert panel review of remediation spec.
❌ 1 Tests Failed:
View the full list of 1 ❄️ flaky test(s)
To view more test analytics, go to the Test Analytics Dashboard |
Two tests exercising the thundering herd protection paths where deserialize_data(cache_key=cache_key) was added: 1. Lock acquired, double-check finds cache already populated (another request filled it during lock wait) 2. Lock timeout, final cache check finds it populated (another request completed while waiting for lock) Both use FakeLockableBackend with acquire_lock protocol to trigger the lock-then-deserialize code paths.
a5cda04 to
6f582eb
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
deserialize_data()calls missingcache_keyfor AAD v0x03 verification — encrypted L1+L2 and L2 cache hits would fail AAD verification silentlyAAD Bug (fix: commit)
All
deserialize_data()calls in the L1+L2 and L2 paths were missingcache_key=cache_key, causing AAD verification failure for encrypted caches. L1-only paths already passed it correctly. The bug meant encrypted cache hits would fail silently and fall through to cache miss on every request.Dead Code Removed
setup_distributed_tracinglogging.pysetup_correlation_trackinglogging.pyreset_session_iddecorators/session.pyget_async_http_clientbackends/cachekitio/client.pyrecord_cache_operation(module)reliability/metrics_collection.pyrecord_circuit_breaker_state(module)reliability/metrics_collection.pyrecord_timeout_adjustment(module)reliability/metrics_collection.py_use_pipelined(variable)decorators/wrapper.pyuse_pipelined(variable)decorators/wrapper.pylock_key(sync only)decorators/wrapper.pyTest plan
__all__exportsclose_async_clientthread-local cleanup preserved (SEC-001)get_session_iddoctests updated