dohertj2/scadaproj
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

[LocalDb/Auth] Follow-ups: snapshot dead-letters uncounted, unbounded held-back rows, duplicate app sync interceptors, GC-forest sAMAccountName match #50

New Issue
Closed
opened 2026-11-09 15:03:20 -05:00 by dohertj2 · 1 comment
dohertj2 commented 2026-11-09 15:03:20 -05:00
Owner
Copy Link
Copy Source

Follow-ups from the LocalDb 0.3.6 / Auth 0.4.4 fixes (#36–#40):

  • LocalDb: rows dead-lettered on the snapshot path (FK orphans #37, drift #39) are not counted in the localdb.sync.dead_lettered metric.
  • LocalDb: snapshot rows held back for a missing parent (#37) are kept in memory unbounded — with an older child-first sender that could be a whole table. Cap it (spill to dead-letter past N).
  • Cross-repo: once ScadaBridge and OtOpcUa adopt LocalDb 0.3.6, their own LocalDbSyncAuthInterceptor duplicates the library's check (they differ only in refusing all streams when no key is set) — decide whether to keep the stricter app behaviour or drop the interceptors.
  • Auth: the #40 sAMAccountName match assumes the search base covers one AD domain; a Global Catalog search across a forest could match a same-named account in another domain — prefer DN/objectSid comparison when available.
Follow-ups from the LocalDb 0.3.6 / Auth 0.4.4 fixes (#36–#40): - LocalDb: rows dead-lettered on the snapshot path (FK orphans #37, drift #39) are not counted in the `localdb.sync.dead_lettered` metric. - LocalDb: snapshot rows held back for a missing parent (#37) are kept in memory unbounded — with an older child-first sender that could be a whole table. Cap it (spill to dead-letter past N). - Cross-repo: once ScadaBridge and OtOpcUa adopt LocalDb 0.3.6, their own `LocalDbSyncAuthInterceptor` duplicates the library's check (they differ only in refusing all streams when no key is set) — decide whether to keep the stricter app behaviour or drop the interceptors. - Auth: the #40 sAMAccountName match assumes the search base covers one AD domain; a Global Catalog search across a forest could match a same-named account in another domain — prefer DN/objectSid comparison when available.
dohertj2 added the type:followuppriority:p3 labels 2026-11-09 15:03:20 -05:00
dohertj2 commented 2026-11-09 15:26:49 -05:00
Author
Owner
Copy Link
Copy Source

Fixed on main (b2adddb, b8d3fa2) except the cross-repo interceptor decision (note in LocalDb CLAUDE.md/README): snapshot-path dead-letters now counted in localdb.sync.dead_lettered; held-back snapshot rows capped by new LocalDb:Replication:MaxSnapshotDeferredRows (default 100,000 — oldest get one more apply then dead-letter); AD u:DOMAIN\name sign-ins must match the account's msDS-PrincipalName where AD provides it, else the account name must have exactly one holder under SearchBase (3 forest cases fail pre-fix; 3 compatibility cases pass both ways) — not tested against a real AD; filed for live verification before Auth is published. Evidence: LocalDb 249/249; Auth 363 passed / 81 skipped offline and 440 / 4 LDAP-live skips against a throwaway SQL Server 2022; each new regression test fails without its fix; findings 0 open, README --check consistent. Ships in LocalDb 0.3.6 / Auth 0.4.4 (unpublished).

Fixed on main (b2adddb, b8d3fa2) except the cross-repo interceptor decision (note in LocalDb CLAUDE.md/README): snapshot-path dead-letters now counted in localdb.sync.dead_lettered; held-back snapshot rows capped by new LocalDb:Replication:MaxSnapshotDeferredRows (default 100,000 — oldest get one more apply then dead-letter); AD `u:DOMAIN\name` sign-ins must match the account's msDS-PrincipalName where AD provides it, else the account name must have exactly one holder under SearchBase (3 forest cases fail pre-fix; 3 compatibility cases pass both ways) — **not tested against a real AD**; filed for live verification before Auth is published. Evidence: LocalDb 249/249; Auth 363 passed / 81 skipped offline and 440 / 4 LDAP-live skips against a throwaway SQL Server 2022; each new regression test fails without its fix; findings 0 open, README --check consistent. Ships in LocalDb 0.3.6 / Auth 0.4.4 (unpublished).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
blocked
Blocked by dependency or external hold
 cross-repo
Needs coordinated change in another family repo (wire contract etc.)
 migrated
Migrated from a markdown backlog (2026-11 standardization)
 priority:p0
Must-have / blocking
 priority:p1
High priority
 priority:p2
Normal priority
 priority:p3
Low priority / nice to have
 type:bug
Defect in shipped behaviour
 type:debt
Technical debt / hygiene
 type:deploy-gate
Rollout/deploy/migration step not yet done on an environment
 type:docs
Documentation work
 type:feature
Feature implementation
 type:followup
Follow-up deferred from a plan, PR or gate
 type:infra
Infrastructure and scaffolding
 type:review-finding
Unfixed finding from an architecture/code review
 type:test
Test work
No Label priority:p3 type:followup
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dohertj2 (dohertj2)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dohertj2/scadaproj#50
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?