-
Notifications
You must be signed in to change notification settings - Fork 12.7k
fix: Room ownership after auto removal #37842
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: feat/abac
Are you sure you want to change the base?
Conversation
|
Looks like this PR is not ready to merge, because of the following issues:
Please fix the issues and try again If you have any trouble, please check the PR guidelines |
|
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## feat/abac #37842 +/- ##
============================================
Coverage ? 54.35%
============================================
Files ? 2639
Lines ? 50102
Branches ? 11212
============================================
Hits ? 27232
Misses ? 20696
Partials ? 2174
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
This PR fixes a critical issue with room ownership management when users are automatically removed from rooms due to ABAC (Attribute-Based Access Control) policy violations. When non-compliant owners are removed, the system now intelligently promotes remaining compliant members to maintain room ownership.
Key changes:
- Added ownership transfer logic that promotes the oldest remaining member when all owners are removed
- Implemented helper methods to check for owner presence in subscription sets
- Enhanced user removal logic to handle ownership transitions before removing users
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/models/src/models/Subscriptions.ts | Added three new database methods for ownership management: promoting oldest member to owner, and checking for owner presence in/excluding user ID sets |
| packages/model-typings/src/models/ISubscriptionsModel.ts | Added type definitions for the three new subscription model methods |
| ee/packages/abac/src/index.ts | Implemented core ownership handling logic in removeUsersFromRoomWithOwnershipHandling method and integrated it into user removal flows; updated type signatures to include usersCount |
| ee/packages/abac/src/helper.ts | Updated getAbacRoom return type and projection to include usersCount field |
| ee/packages/abac/src/can-access-object.spec.ts | Added mock implementations for the three new subscription methods in unit tests |
| ee/packages/abac/src/user-auto-removal.spec.ts | Added comprehensive integration tests covering three ownership scenarios: promoting remaining members, handling last owner removal, and maintaining existing compliant owners; moved Subscriptions import to module level |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| removalPromises.push(limit(() => this.removeUserFromRoom(room, user, reason))); | ||
| const roomForRemoval: Pick<IRoom, '_id' | 'usersCount'> = { | ||
| _id: room._id, | ||
| usersCount: room.usersCount, |
Copilot
AI
Dec 17, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Similar to line 553, usersCount may be undefined here. While line 599 uses room.usersCount || 0, the type signature on line 567 declares usersCount as required (not optional). However, IRoom's usersCount field is likely optional in the actual type definition. Consider using the nullish coalescing operator ?? instead of || to handle the case where usersCount is legitimately 0 (though this would be a valid count), or ensure the type signature reflects that usersCount is optional.
| const [anyOwnerRemoved, anyOwnerStaying] = await Promise.all([ | ||
| Subscriptions.hasAnyOwnerInUserIds(room._id, idsToRemove, { projection: { _id: 1 } }), | ||
| Subscriptions.hasAnyOwnerNotInUserIds(room._id, idsToRemove, { projection: { _id: 1 } }), | ||
| ]); | ||
|
|
||
| if (!anyOwnerRemoved || anyOwnerStaying) { | ||
| await Promise.all(users.map((user) => limit(() => this.removeUserFromRoom(room, user, reason)))); | ||
| return; | ||
| } | ||
|
|
||
| const remainingMemberSub = await Subscriptions.promoteOldestByRoomIdExcludingUserIdsToOwner(room._id, idsToRemove, { |
Copilot
AI
Dec 17, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There is a potential race condition between checking for owners (lines 654-657) and promoting a new owner (line 664). If another process removes or adds owners between these operations, the logic could fail or produce incorrect results. After promoting a new owner, the code does not verify if the promotion was successful before proceeding with user removal. Consider implementing a transaction or adding verification that a new owner was successfully assigned before removing the old owners.
| const query = { | ||
| 'rid': roomId, | ||
| 'u._id': { $nin: excludedUserIds }, | ||
| }; |
Copilot
AI
Dec 17, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The promoteOldestByRoomIdExcludingUserIdsToOwner method does not filter for subscriptions that don't already have the 'owner' role. Using $addToSet will not cause an error if the user is already an owner, but it means the "oldest" member promoted might already be an owner. This could lead to unexpected behavior where an existing owner is selected instead of promoting a regular member. Consider adding a filter to exclude users who already have the 'owner' role: 'roles': { $ne: 'owner' } or 'roles': { $not: { $in: ['owner'] } }.
| if (!remainingMemberSub) { | ||
| this.logger.warn({ | ||
| msg: 'Cannot assign new owner', | ||
| rid: room._id, | ||
| reason, | ||
| }); | ||
| } | ||
|
|
||
| await Promise.all(users.map((user) => limit(() => this.removeUserFromRoom(room, user, reason)))); |
Copilot
AI
Dec 17, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The warning message states "Cannot assign new owner" when remainingMemberSub is null, but the code still proceeds to remove all users regardless (line 676). This could leave a room without any owner. Consider whether this is the intended behavior, or if the removal should be aborted when no suitable member can be promoted to owner. If rooms without owners are acceptable in this scenario, the warning message should clarify this is expected.
| async hasAnyOwnerInUserIds(roomId: string, userIds: IUser['_id'][], options?: FindOptions<ISubscription>): Promise<boolean> { | ||
| const query = { | ||
| 'rid': roomId, | ||
| 'roles': 'owner', | ||
| 'u._id': { $in: userIds }, | ||
| }; | ||
|
|
||
| const result = await this.findOne(query, options); | ||
| return !!result; | ||
| } | ||
|
|
||
| async hasAnyOwnerNotInUserIds(roomId: string, userIds: IUser['_id'][], options?: FindOptions<ISubscription>): Promise<boolean> { | ||
| const query = { | ||
| 'rid': roomId, | ||
| 'roles': 'owner', | ||
| 'u._id': { $nin: userIds }, | ||
| }; | ||
|
|
||
| const result = await this.findOne(query, options); | ||
| return !!result; | ||
| } |
Copilot
AI
Dec 17, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
When userIds is an empty array, the queries $in: [] and $nin: [] will behave in specific ways: $in: [] matches nothing (returns false), while $nin: [] matches everything (returns true if any owner exists). Consider adding explicit guards at the beginning of these methods to handle empty arrays appropriately and make the behavior explicit. For hasAnyOwnerInUserIds with an empty array, returning false seems correct, but for hasAnyOwnerNotInUserIds with an empty array, the current behavior might be surprising to callers.
| const currentMembersCount = room.usersCount; | ||
| const remainingMembersCount = currentMembersCount - users.length; |
Copilot
AI
Dec 17, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The calculation of remaining members count is incorrect when users array contains duplicate user IDs. Line 637 creates a Set of user IDs, but line 641 subtracts users.length (which can include duplicates) from the member count. This should subtract userIdsToRemove.size instead to accurately reflect the number of unique users being removed.
| // When a user is not compliant, remove them from the room automatically | ||
| await this.removeUserFromRoom(room, fullUser, 'realtime-policy-eval'); | ||
| await this.removeUsersFromRoomWithOwnershipHandling( | ||
| { _id: room._id, usersCount: room.usersCount }, |
Copilot
AI
Dec 17, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The usersCount field may be undefined for rooms that were created before this field was added, or if the projection doesn't include it. Line 553 passes room.usersCount directly without a fallback, unlike line 599 which uses room.usersCount || 0. When usersCount is undefined, the calculation on line 641 will result in NaN, causing incorrect logic in the ownership handling. Consider adding a default value like room.usersCount ?? 0 to handle undefined cases consistently.
Proposed changes (including videos or screenshots)
Issue(s)
Steps to test or reproduce
Further comments