Repository navigation
buzz-db: build the community deletion lock key in Rust - #9396
Merged
Merged
Conversation
TheSentinel454
marked this pull request as ready for review
November 12, 2026 15:39
github-actions
Bot
added
the
codex-security-review-current
🔐 Codex Security Review
Review SummaryOverall Risk: NONE
FindingsNo concrete security, correctness, or reliability findings were identified. Notes
Generated by Codex Security Review | |
brow
approved these changes
Nov 12, 2026
brow
enabled auto-merge (squash)
November 12, 2026 17:23
TheSentinel454
force-pushed
the
elrond/community-deletion-lock-key-app
branch
from
November 12, 2026 20:37
3020a44 to
bffe06c
Compare
github-actions
Bot
added
codex-security-review-current
brow
disabled auto-merge
November 12, 2026 22:05
Every relay lock on a community's deletion advisory lock now binds the key `deletion::community_deletion_lock_key` builds and hashes it with the built-in `hashtextextended($1, 0)`, instead of calling the SQL function `community_deletion_lock_key(uuid)`. The key bytes are the function's, so old and new relays, and the fence functions still in the database, keep taking the same lock. The deletion startup check no longer requires the function. The test that drops the fence objects now drops the function too and still exercises serving leases, the bulk NIP-FI bind, and the exclusive deletion lock. A parity test pins the Rust key against the function. A later migration drops the function once this release and the fence-function drop have shipped. Co-authored-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz> Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Luke Tornquist <[email protected]>
TheSentinel454
force-pushed
the
elrond/community-deletion-lock-key-app
branch
from
November 12, 2026 22:27
bffe06c to
b9fcec5
Compare
github-actions
Bot
added
codex-security-review-current
kazemek21
approved these changes
Nov 13, 2026
kazemek21
left a comment
kazemek21
left a comment
Contributor
There was a problem hiding this comment.
Kyle reviewed this PR and the Nexus review-tracker notes and approved with no comments.
Posted by Codex (gpt-6.1-sol) on behalf of kylez.
bostonaholic
added a commit
that referenced
this pull request
Nov 13, 2026
Co-authored-by: mboston.Engineer <932d3b6ebea6cc83e091551ae46d1c7e7f8f7d0fa8e9cef5e6facc8544af413b@buzz.block.builderlab.xyz> * origin/main: fix(mobile): require Builderlab consent for existing identities (#8823) feat(mobile): use HTTP/2 on iOS through app-wide URLSessions (#8897) fix(relay): publish a git push only when refs changed; check the protocol by refinement (#9425) fix(mobile): show shared chats under Solo (#9348) chore(release): release Buzz Desktop version 0.5.29 (#9456) feat(mobile): render messages with gpt_markdown 1.3.4 plusparse (#8945) fix(acp): bound observer retention by bytes (#7987) (#9436) Tune release codegen for faster/smaller binaries (#9434) feat(desktop): add dismissible banner pointing to the new buzz app (#9379) fix(mobile): keep publishing presence while the app is open (#9441) feat(mobile): share into Buzz from the iOS share sheet (#9433) fix(mobile): qualify every namesake mention and keep authored mention casing (#9325) fix(mobile): match browser GIF timing in the iOS reaction sheet (#9437) fix(mobile): play short-delay animation frames at browser speed (#9432) buzz-search: read profile names without the profile_name_fields function (#9397) buzz-db: build the community deletion lock key in Rust (#9396) fix(cli): pair for the active community, skip stopped desktops, accept a bare relay host (#9417) test(mobile): run push tests without a gateway dart-define (#9423) fix(mobile): never pop Home when archiving from channel settings (#9387) perf(acp): reduce observer CPU and lock overhead (#9381) Signed-off-by: Matthew Boston <[email protected]>
bostonaholic
added a commit
that referenced
this pull request
Nov 13, 2026
…count-backfill Co-authored-by: mboston.Engineer <932d3b6ebea6cc83e091551ae46d1c7e7f8f7d0fa8e9cef5e6facc8544af413b@buzz.block.builderlab.xyz> * bostonaholic--agent-reply-count: fix(mobile): require Builderlab consent for existing identities (#8823) feat(mobile): use HTTP/2 on iOS through app-wide URLSessions (#8897) fix(relay): publish a git push only when refs changed; check the protocol by refinement (#9425) fix(mobile): show shared chats under Solo (#9348) chore(release): release Buzz Desktop version 0.5.29 (#9456) feat(mobile): render messages with gpt_markdown 1.3.4 plusparse (#8945) fix(acp): bound observer retention by bytes (#7987) (#9436) Tune release codegen for faster/smaller binaries (#9434) feat(desktop): add dismissible banner pointing to the new buzz app (#9379) fix(mobile): keep publishing presence while the app is open (#9441) feat(mobile): share into Buzz from the iOS share sheet (#9433) fix(mobile): qualify every namesake mention and keep authored mention casing (#9325) fix(mobile): match browser GIF timing in the iOS reaction sheet (#9437) fix(mobile): play short-delay animation frames at browser speed (#9432) buzz-search: read profile names without the profile_name_fields function (#9397) buzz-db: build the community deletion lock key in Rust (#9396) fix(cli): pair for the active community, skip stopped desktops, accept a bare relay host (#9417) test(mobile): run push tests without a gateway dart-define (#9423) fix(mobile): never pop Home when archiving from channel settings (#9387) perf(acp): reduce observer CPU and lock overhead (#9381) Signed-off-by: Matthew Boston <[email protected]>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
This is phase 1 of 2 for retiring the SQL function
community_deletion_lock_key(uuid). Every relay caller now builds the lock name in Rust, withbuzz_db::deletion::community_deletion_lock_key(CommunityId) -> String. It then locks with the built-inhashtextextended($1, 0), the same pattern the other advisory locks here use (channel_ttl_lock_key,push_gate_lock_key). The string is byte-for-byte the one the function hashes ('buzz-community-deletion:' || target::text), so the lock is identical. Old and new relays, and the fence functions still in the database (community_write_allowed,assert_community_write_allowed), keep excluding each other during a rolling deploy.lock_community_deletion, sharedlock_community_deletion_shared, and the bulk shared lock inbind_nip_fi_issuers_to_active. The bulk lock now binds atext[]of keys, sorted by community id in Rust and lockedWITH ORDINALITY. That keeps the oldORDER BY idlock order, becauseUuidand Postgresuuidboth compare bytewise.validate_serving_catalog_onno longer requires the function to exist, so the phase-2 drop can't make this release refuse to serve or delete.docs/database.mdgives repair scripts the inline expression, which keeps working after the drop.api/bridge.rsandhandlers/ingest.rsstay. Test schemas still copy the fence functions that call the function.Phase 2 (not here): a migration and desired-state change drops the function after this release is fully deployed and the fence functions are gone (#8323). It also removes the two test shims.
Tests
deletion::postgres_tests::community_deletion_lock_key_matches_the_sql_functionchecks thathashtextextended(rust_key, 0)equalscommunity_deletion_lock_key(uuid)for the nil UUID, the max UUID and 64 random ones.migration_schema_fence_objects_are_optional_for_serving_and_deletionalready drops the universal fence objects by hand. It now also dropscommunity_deletion_lock_key(UUID). With both present and absent, it runs the startup and readiness checks, serving leases (shared lock),bind_nip_fi_issuers_to_active(bulk shared lock) andlock_community_deletion(exclusive lock).Must-fail mutants, each run on Blox against its guarding test: a changed key prefix, the shared, exclusive and bulk locks reverted to the SQL function, and the startup check requiring the function again.
What got simpler
No relay code path calls a database function to build this lock any more. The key has one definition in Rust instead of one in SQL plus about 20 SQL call sites. One fewer object stands between the schema and declarative-only management (
docs/database.mdRule 1).Verification
Blox, at
3020a44148d942f1502395640730cd0548a76400(clean tree):cargo fmt --all --checkcargo clippy -p buzz-db -p buzz-relay --all-targets -- -D warningscargo nextest run -p buzz-db --libscripts/postgres-test-run.sh -p buzz-db --liboverdeletion::postgres_tests,nip_fi_binding::postgres_testsand the reaction and channel-member lock testsCI runs the full Postgres lanes.
🤖 Generated with Claude Code
buzz-review-completed