[3.0.4 Backport] Update UserHasDocAccess to check most recent rather than rev

Description

Currently before we send a revocation / removal message in 3.x we first check whether the user has access to that doc / revision through another grant. If they have access through another grant we won't send the revocation / removal. 

At present there is a situation in which we could end up revoking rev 2 leaving channel A when the user has access to rev 3 through channel B. If there are multiple replications to one client, one running A and one running B we could end up getting into a race condition where the revocation will arrive last and purge the document from the device.

One possible solution is to ignore the revision and do a check to see if the user has access to the most recent version of the document.

A couple things to verify:

  1. This is only the case if CBL ignores the rev and deleted the document based on doc id - I assume this is the case.

  2. Explore any edge cases to ensure this wouldn't cause any adverse affects which would dimish security

  3. Would this be better suited for CBL or SGW (or both)

 

Activity

Show:

CB robot October 20, 2022 at 8:32 PM

Build sync_gateway-3.0.4-13 contains sync_gateway commit fe16b93 with commit message:
[3.0.4 Backport] Update UserDocAccess based on current revision (#5826)

Fixed
Pinned fields
Click on the next to a field label to start pinning.

Details

Assignee

Reporter

Components

Fix versions

Priority

Instabug

Open Instabug

PagerDuty

Sentry

Zendesk Support

Created October 5, 2022 at 10:31 PM
Updated August 31, 2024 at 11:00 AM
Resolved October 20, 2022 at 8:41 PM
Instabug