causalConsistency: false not used in updateUser/grantRole/revokeRole

[ElectricNroff]

For example:

cve-services/src/controller/registry-user.controller/registry-user.controller.js

Line 216 in 0e528de

const session = await mongoose.startSession()

[david-rocca]

Developers Notes

Background:

Causal Consistency is responsible for handling read-after-writes. DocumentDB handles this differently than mongo / mongoose out of the box. This only becomes an issue in the following cases:

IF you are using sessions AND You perform a read after writing to the same object in the database. In general, reads are done against the shards of the database, and writes are to the primary.

updateUser

Debugging

This function does have a read-after-write issue. However, the field that is being read after the write is a field that is not able to be edited ever. So it will always return the right value, but is bad practice.

• Write: In src/controller/registry-user.controller/registry-user.controller.js on line 335, the controller calls updatedUser = await userRepo.updateUserFull(userToEdit.UUID, body, { session }). The transaction is then committed immediately on line 336. (The repository function updateUserFull performs writes to both newOrg and currentOrg without subsequent reads).

• Read: After the transaction commits, down on line 351, the controller executes payload.user_UUID = await userRepo.getUserUUID(...). This is a database read to get the requesting user's UUID, which happens after the user and org writes have been committed to the database.

Action

As far as I can tell, this bug will not break code at this time. However, it should be fixed at a normal priority. We will investigate to see if we can force it into a broken state and adjust priority.

grantRole

Debugging

I do not see an explicit read after write in this call:

• In src/controller/registry-user.controller/registry-user.controller.js at line 440, the controller calls await orgRepo.addAdmin(orgShortName, targetUser.UUID, { session }) and commits the transaction on the next line. No further reads occur in the controller.

• Inside the repository function addAdmin (src/repositories/baseOrgRepository.js), the code first performs a read at line 175 (const org = await this.findOneByShortName(...)). It modifies the array in memory, and then performs the single write at line 181 (await org.save(options)). There are no reads after this line.

Action

causalConsistency: false, while not needed, could be added for code readability.

revokerole

Debugging

There is no read after write in this function stack:

• In src/controller/registry-user.controller/registry-user.controller.js at line 508, the controller calls await orgRepo.removeAdmin(...) and commits the transaction on the next line. No further reads occur in the controller (the user UUID lookup on line 501 correctly happens beforehand).

• Inside the repository function removeAdmin (src/repositories/baseOrgRepository.js), the code performs the read at line 195 (const org = await this.findOneByShortName(...)) and then performs the write at line 199 (await org.save(options)). There are no reads after this line.

Action

causalConsistency: false, while not needed, could be added for code readability.