#83 residual: reap abandoned-pending link-probe rooms (periodic sweep) #87

New issue

Closed

opened 2026-07-11 16:51:02 +00:00 by robocub · 1 comment

robocub commented

2026-07-11 16:51:02 +00:00

Collaborator

Follow-up to the #83 core (shipped alpha.18: leave-only-probe-created-joins on the FAILURE path). Residual: a probe that SUCCEEDS mints a pending link and retains the room join; if the pending is never approved and expires, the probe-created membership is never reaped (pending expiry is lazy — no timer, no on-expiry hook). Fix: track probe_joined: bool on PendingLink, add a periodic mgmt maintenance task (hook mgmt.rs:~530, mirror rtc/mod.rs:238 reaper) that prunes expired pendings AND leaves each expired-pending room whose probe_joined is set and which no committed tenant uses. Share this task with the #84/#85 residuals.

Follow-up to the #83 core (shipped alpha.18: leave-only-probe-created-joins on the FAILURE path). Residual: a probe that SUCCEEDS mints a pending link and retains the room join; if the pending is never approved and expires, the probe-created membership is never reaped (pending expiry is lazy — no timer, no on-expiry hook). Fix: track `probe_joined: bool` on `PendingLink`, add a periodic mgmt maintenance task (hook mgmt.rs:~530, mirror rtc/mod.rs:238 reaper) that prunes expired pendings AND leaves each expired-pending room whose `probe_joined` is set and which no committed tenant uses. Share this task with the #84/#85 residuals.

robocub referenced this issue

2026-07-11 16:51:31 +00:00

#79 finding 1 (HIGH): link probe pins the shared bot into attacker-named rooms; reap only probe-created joins #83

robocub referenced this issue from a commit

2026-07-11 17:22:14 +00:00

fix(mgmt,config): #87/#88/#89 open-registration hardening residuals

robocub commented

2026-07-11 17:50:13 +00:00

Author

Collaborator

Fixed + shipped in v0.3.0-alpha.19 (master 688d3a9, deployed to prod 2026-07-11). PendingLink records whether the probe created the room join; a 5-min management-bot maintenance sweep leaves rooms from expired, unapproved, probe-created pending links — never a room a bridge holds. Safe set = running bridges (ControlMsg::Status, static+tenant) unioned with configured tenant rooms (new nvb_config::tenant_rooms); the sweep is skipped entirely if that set can't be read (fail-safe). Live: mgmt scenario PASS, prod first-sweep left nothing. Note: idle-but-occupied rooms are out of scope (only empty rooms are left — see #89).

Fixed + shipped in **v0.3.0-alpha.19** (master `688d3a9`, deployed to prod 2026-07-11). `PendingLink` records whether the probe created the room join; a 5-min management-bot maintenance sweep leaves rooms from expired, unapproved, probe-created pending links — never a room a bridge holds. Safe set = running bridges (`ControlMsg::Status`, static+tenant) unioned with configured tenant rooms (new `nvb_config::tenant_rooms`); the sweep is skipped entirely if that set can't be read (fail-safe). Live: mgmt scenario PASS, prod first-sweep left nothing. Note: idle-but-*occupied* rooms are out of scope (only empty rooms are left — see #89).

robocub closed this issue

2026-07-11 17:50:13 +00:00

robocub referenced this issue

2026-07-11 17:50:13 +00:00

#85 residual: per-sender invite cooldown + idle DM-room TTL leave #89

robocub referenced this issue

2026-07-13 04:26:37 +00:00

mgmt: self-serve link of an invite-only room is unsatisfiable — the invite gate rejects the invite the link reply instructs #111

robocub referenced this issue

2026-07-13 17:45:39 +00:00

mgmt: self-serve link of an invite-only room is unsatisfiable — the invite gate rejects the invite the link reply instructs #111