mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-04 02:21:02 +08:00
rosstimothy
a91ad82708
* Test concurrent compare and swaps The backend test suite was not validating that simultaneous CAS operations result in only one attempt succeeding. The test now runs multiple concurrent CAS operations and ensures that only a single operation succeeds. This shortcoming with the test allowed the Firestore backend to pass the compliance test while not perfoming CAS in an atomic manner. * Firestore backend improvements 1) CAS now utilizes a transaction to ensure the operation is atomic The original implementation did not use transactions which violated the atomic guarantees of the CAS operation. The backend compliance test was able to catch this when it was updated to run concurrent CAS opertations. 2) Update is limited to updating a value The original implementation of Update was actually doing a get and then upsert. However, there are no guarantees that prevent a delete from occurring between get and upsert, which means Update would upsert the value instead of failing. Instead of get and then upsert we now update the document using the (firestore.DocumentRef) Update method. 3) Watching items from the collection filters out any audit events If Teleport is configured to use the same collection for backend state and audit events the collection watcher ends up consuming all audit events as empty backend items. To avoid this the watcher is now filtering out any collections which have an empty key since it is not possible for backend resources to be written without a key this will only exclude audit events which have a different schema. 4) SearchEvents now filters out backend resources Similar to above, the Firestore events implementation now excludes any documents which have an empty session id to prevent backend resources from getting included in queries for audit events if the collection is being shared. * speed up backend test suite * conditionally delete expired items on get * fix: cleanup tests