Repository navigation
Harden account departure and purge flows - #28
Merged
Merged
Conversation
Abort before mutation when fetched membership contains no stored users, refuse purges on empty membership, and avoid repeating unfinished account removal for current members. Refs #26
Persist an in-progress marker before userdel and retain it after ambiguous failures. A later run can finish the store update when the account is already gone without treating independent removal as success. Refs #26
Delete the complete authorized_keys file when an account expires, including manually configured entries. Resolve and remove it through pinned directory descriptors so symlink or replacement races cannot redirect the operation. Refs #26
Report crontab listing failures that are not an absent crontab. Attempt cron and at cleanup independently, and treat a missing atrm like the optional atq command. Refs #26
Use getspnam_r with caller-owned storage and grow the buffer on ERANGE. Propagate lookup errors instead of relying on libc static storage. Refs #26
Use disabled for accounts retained after departure and deleted for accounts removed by purge. Apply the same names to actor messages, store fields, v2 JSON keys, logs, comments, and tests. Refs #26
Describe disabled and deleted accounts consistently in the README. Reorganize the unreleased changelog into focused lifecycle, synchronization, identity, SSH key, and store sections. Refs #26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.sshdirectories during updatesatrmgetspnam_rWhy
The departure and purge flow still had error, race, and interruption paths that could modify the wrong account, leave access material behind, disable a member who was rejoining, or leave the users database inconsistent with the machine.
Impact
Departures remain reversible during retention while removing active access. Purge only permanently deletes eligible accounts, resumes interrupted octosync deletions safely, and preserves account IDs for a later rejoin. Dry runs no longer create migration artifacts.
Validation
cargo test --all-targetswith 115 tests passingcargo zigbuild --all-targets --target x86_64-unknown-linux-gnuCloses #26