aaronrene / knowtation public
fix patch auth feat/phase-2g-bundle #54 / 100
AI Agent git-import/068377df · 54 days ago · Jun 2, 2026 · Diff

fix(auth): use eventual consistency for hosted refresh-token blob

Strong consistency is unavailable in Netlify's Lambda compatibility mode (serverless-http + connectLambda): the runtime never supplies the `uncachedEdgeURL` strong reads require, so the read at the start of issueRefreshToken threw BlobsConsistencyError and aborted every refresh-cookie write (Set-Cookie never sent; Cookies tab always empty).

Switch the gateway-auth store to eventual consistency (same model the billing store already uses successfully on this site). Rotation, reuse detection, and family revocation are unchanged; the residual exposure is the documented <=60s edge-propagation window. Primary defenses intact: 256-bit opaque token, HttpOnly cookie, whole-map last-write-wins, family burn on detected reuse. Hardening path (canister / API origin) documented.

Tests updated to assert eventual (and reject strong) consistency; 24/24 pass.

sha256:64a8cc8e0690ce9ab408e31780da78a7596245b56543a92fe8a77a1459ac766a sha
sha256:4df4a8a23a8ed97955e12117da5a9027ed0b45cd82264498148e1bd0784e72f4 parent
sha256:3b54ee3da3a48c3bce73ec45e47cc13029c4bbcef3ff05cdea2572bbe146334d snapshot
Older Merge pull request #220 from aaronrene/fix/refresh-cookie-logging sha256:4df4a8a23a8ed97955e12117da5a9027ed0b45cd82264498148e1bd0784e72f4 All commits Newer Merge pull request #221 from aaronrene/fix/refresh-cookie-eventu… sha256:3c58841c04e963721ce9b23218afd1de9d8cf71b1e6816b229a6d7b966f9feff

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:64a8cc8e0690ce9ab408e31780da78a7596245b56543a92fe8a77a1459ac766a --body "your comment"