domain: redeem_authorization_code deletes the code before loading the user, burning it on transient errors #61

New issue

Closed

opened 2026-07-03 01:42:23 +00:00 by rosa · 1 comment

rosa commented

2026-07-03 01:42:23 +00:00

Owner

Found during a code review of the domain crate.

Location: crates/domain/src/services.rs:833 (redeem_authorization_code)
Severity: Correctness

Problem

The code is deleted before find_user_by_id and token issuance. A transient repo error or missing user after the delete permanently burns a valid single-use code with nothing granted, and the client retry gets invalid_grant.

Failure scenario

A legitimate client redeems a fresh code; the DELETE succeeds but the following find_user_by_id returns a transient Err or None. The client must restart the whole authorization flow even though nothing was granted.

Suggested fix

Load the user and issue the token first, deleting/consuming the code only once issuance is guaranteed (ideally folded into the same atomic consume from #49).

Found during a code review of the `domain` crate. **Location:** `crates/domain/src/services.rs:833` (`redeem_authorization_code`) **Severity:** Correctness ## Problem The code is deleted before `find_user_by_id` and token issuance. A transient repo error or missing user after the delete permanently burns a valid single-use code with nothing granted, and the client retry gets invalid_grant. ## Failure scenario A legitimate client redeems a fresh code; the DELETE succeeds but the following `find_user_by_id` returns a transient Err or None. The client must restart the whole authorization flow even though nothing was granted. ## Suggested fix Load the user and issue the token first, deleting/consuming the code only once issuance is guaranteed (ideally folded into the same atomic consume from #49).

rosa added the

needs-triage

label

2026-07-03 01:43:56 +00:00

rosa referenced this issue

2026-07-03 20:55:18 +00:00

domain: authorization code redemption is non-atomic, concurrent redeems bypass single-use #49

rosa commented

2026-07-03 20:55:23 +00:00

Author

Owner

This was generated by AI during triage.

Verified during triage: the delete precedes the user load in the redemption flow, so a transient failure after the consume burns the code with nothing granted. This defect shares its fix with issue #49 (the atomic consume must also settle the ordering), so both are covered by the single Agent Brief posted on #49. An agent picking this up should work from that brief; this issue closes with #49's fix.

> *This was generated by AI during triage.* Verified during triage: the delete precedes the user load in the redemption flow, so a transient failure after the consume burns the code with nothing granted. This defect shares its fix with issue #49 (the atomic consume must also settle the ordering), so both are covered by the single Agent Brief posted on #49. An agent picking this up should work from that brief; this issue closes with #49's fix.

rosa added

bug

ready-for-agent

and removed

needs-triage

labels

2026-07-03 20:55:32 +00:00

rosa referenced this issue from a commit

2026-07-03 21:14:20 +00:00

fix: Consume authorization codes atomically, after fallible loads

rosa referenced this issue from a pull request that will close it,

2026-07-03 21:14:46 +00:00