feat: enroll multiple cvlt installations - #12
Conversation
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
codeant-ai
Bot
added
the
size:XXL
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
| const device = existing ?? await generateDeviceKey() | ||
| if (!existing) { | ||
| await saveDeviceKey(origin, device) | ||
| rememberDeviceKey(origin, device) | ||
| } |
There was a problem hiding this comment.
Suggestion: When two processes call createClientEnrollmentRequest while the origin has no stored key, both can observe existing as null, generate different keys, and overwrite the same origin-scoped store. The request returned by the process that saves first can then refer to a key that is no longer stored, so approval succeeds but that process cannot later read or authenticate. Serialize creation across processes or re-read the store after generation and preserve the winning key. [race condition]
Severity Level: Major ⚠️
- ❌ One concurrent enrollment request becomes unusable.
- ⚠️ Origin key storage can orphan a newly registered installation.
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** node/src/e2ee-client.ts
**Line:** 1288:1292
**Comment:**
*Race Condition: When two processes call `createClientEnrollmentRequest` while the origin has no stored key, both can observe `existing` as null, generate different keys, and overwrite the same origin-scoped store. The request returned by the process that saves first can then refer to a key that is no longer stored, so approval succeeds but that process cannot later read or authenticate. Serialize creation across processes or re-read the store after generation and preserve the winning key.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix1 participant
User description
Part of #11
Changes
cvlt client request,approve,list, andrevokeTesting
bun test node/src/ cli/src/— 143 tests pass, 1 host-store test skipped in the generic runCVLT_TEST_OS_KEYSTORE=1 bun test node/src/key-store.test.ts— macOS Keychain passesnpm run build:sdkbun run build(cd go && go test ./...)shellcheck -S warning scripts/*.shNotes
CodeAnt-AI Description
Enable secure enrollment and management of multiple Vault installations
What Changed
cvlt client request,approve,list, andrevokefor adding, reviewing, listing, disabling, and re-enabling installations without destructive recoveryImpact
✅ Add a second machine without recovery✅ Revoked installations lose Vault read access✅ Safer enrollment confirmation✅ Stable automation output💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.