rpcperms: allow multiple read-only middleware#10611
rpcperms: allow multiple read-only middleware#10611calvinrzachman wants to merge 2 commits intolightningnetwork:masterfrom
Conversation
There is validation which requires "read-only" middle ware not specify a caveat name. But when you try to register a second read-only middleware, there's validation which prevents double registration for same caveat (though in this case the caveat name is the empty string). Update the dameon to permit the registration of multiple read-only rpc middleware.
Summary of ChangesHello @calvinrzachman, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request enhances the RPC middleware system by allowing multiple read-only middlewares to be registered concurrently. Previously, the system prevented the registration of more than one middleware if they shared the same (empty) custom caveat name, which was a constraint for read-only middlewares. This change addresses a user-reported issue, providing increased flexibility for users who need to apply multiple non-modifying interceptors to RPC calls without conflict. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
🟡 PR Severity: MEDIUM
🟡 Medium (1 file)
⚪ Excluded (test/generated) (1 file)
AnalysisThis PR modifies two files:
Severity bump evaluation:
Final severity: MEDIUM — focused review by a knowledgeable engineer is appropriate given the security-adjacent nature of RPC permission interceptor changes. To override, add a |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request correctly implements the ability to register multiple read-only RPC middlewares, which was previously not possible due to a check that prevented multiple registrations with the same (empty) caveat name. The logic change in rpcperms/interceptor.go is concise and correct. A new integration test, multipleReadOnlyMiddlewareTest, has been added to verify the new functionality, ensuring that multiple read-only middlewares can be registered and will all receive interception messages. The changes are well-implemented and tested. I have one minor suggestion to improve code clarity by removing an unused parameter in the new test function.
| ht.EnsureConnected(alice, bob) | ||
| ht.Run("multiple read-only middlewares", func(tt *testing.T) { | ||
| multipleReadOnlyMiddlewareTest( | ||
| tt, alice, bob, readonlyMac, |
There was a problem hiding this comment.
The bob argument (for the peer parameter) is unused in multipleReadOnlyMiddlewareTest and should be removed.
| tt, alice, bob, readonlyMac, | |
| tt, alice, readonlyMac, |
| func multipleReadOnlyMiddlewareTest(t *testing.T, node, | ||
| peer *node.HarnessNode, userMac *macaroon.Macaroon) { |
There was a problem hiding this comment.
The peer parameter is unused in this function and can be removed to improve code clarity. The call site will also need to be updated.
| func multipleReadOnlyMiddlewareTest(t *testing.T, node, | |
| peer *node.HarnessNode, userMac *macaroon.Macaroon) { | |
| func multipleReadOnlyMiddlewareTest(t *testing.T, node *node.HarnessNode, | |
| userMac *macaroon.Macaroon) { |
3 participants
Change Description
There is validation which requires "read-only" middle ware not specify a caveat name. But when you try to register a second read-only middleware, there's validation which prevents double registration for same caveat (though in this case the caveat name is the empty string).
Update the daemon to permit the registration of multiple read-only rpc middleware.
NOTE: This was motivated by request from a user in Slack asking whether lnd can support multiple read-only RPC middleware. The user is getting this error:
Steps to Test
make itest icase=rpc_middleware_interceptor