Skip to content

fix(blueprints): hash basic-auth before header-auth delete - #3922

Open
Tyagiquamar wants to merge 2 commits into
fosrl:mainfrom
Tyagiquamar:fix/blueprint-basic-auth-race-3835
Open

Tyagiquamar wants to merge 2 commits into
fosrl:mainfrom
Tyagiquamar:fix/blueprint-basic-auth-race-3835

Conversation

@Tyagiquamar

@Tyagiquamar Tyagiquamar commented Oct 18, 2026 •

Copy link
Copy Markdown
Contributor

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

AI Disclosure

AI (Composer) assisted with drafting the fix and PR text. I reviewed the change against the reported race, matched the existing API hashing path, and verified via GitHub Actions on this PR.

Description

Hash Docker blueprint basic-auth credentials before deleting existing resourcePolicyHeaderAuth rows. Matches the API router path and shrinks the race where concurrent applies interleave argon2 with delete/insert.

Fixes #3835

How to test?

  • GitHub Actions on this PR: build-postgres, build-sqlite, and test all pass

Compute the header-auth hash before deleting existing rows so
concurrent blueprint applies keep delete and insert adjacent.

Fixes fosrl#3835
@oschwartz10612

Copy link
Copy Markdown
Member

Hi! Thanks for the change! Could you update your PR to include the CLA from the template at the top please?

@Tyagiquamar

Copy link
Copy Markdown
Contributor Author

Updated the PR description to put the Community Contribution License Agreement and AI Disclosure at the top per the template. Thanks for the heads-up.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Blueprint auth.basic-auth from Docker labels sometimes leaves two header-auth rows after a container is recreated

3 participants