Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unauthorize live subscriptions which are no longer authorized. #668

Open
LiranCohen opened this issue Jan 22, 2024 · 2 comments
Open

Unauthorize live subscriptions which are no longer authorized. #668

LiranCohen opened this issue Jan 22, 2024 · 2 comments
Labels
feature New feature or request

Comments

@LiranCohen
Copy link
Member

Currently RecordsSubscribe does not check if a subscription is valid beyond when it is processed. This means that while the subscription is live, if something changes that would make the subscription invalid (ex. delete of protocol role, or revocation of a grant) the subscriber will still receive updates until they close the connection.

We would like to proactively evict these subscriptions where possible, or potentially re-authorize on a TTL if evicting is too cumbersome.

Copy link

Can you just drop any connections associated with a revoked subscription?

@LiranCohen
Copy link
Member Author

Can you just drop any connections associated with a revoked subscription?

Well the subscription itself is not revoked, but rather a user's protocol role may be deleted, or a grant which invalidates the subscription authorization.

But yeah that's the idea, is to stop emitting messages to the handler provided.

The dwn-sdk-js package itself keeps this transport agnostic, so the dwn-server itself will deal with dropping web socket connections if necessary.

Nothing too complex, just breaking it out into separate issues so that we can prioritize and chunk out subscriptions into smaller PRs.

LiranCohen added a commit that referenced this issue Jan 24, 2024
This PR builds on top of the existing `EventStream` and adds a subscription specifically for the `Records` interface which follows similar rules as those for `RecordsQuery`.

Currently the subscription does not evict or re-authorize subscriptions after the initial processing of the message. So if a revocation of permissions happens after the subscription is live, the user will continue getting notified until they close the connection.

This will be addressed in a separate PR to keep things more concise and easier to follow. #668
@thehenrytsai thehenrytsai added the feature New feature or request label Sep 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature New feature or request
Projects
None yet
Development

No branches or pull requests

3 participants