mrhid6/vantage
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 22 Wiki Activity

feat(admin): one password change reaches every instance

Browse Source 
Best-effort by design: refusing the change because one instance was
unreachable would leave the customer holding the password they were trying
to replace. A failure is flagged and hqsync repairs it.

Also corrects two pieces of copy this makes false — CreateInstance's doc
comment and the instance-ready email both claimed the two passwords
diverge.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
mrhid6
2026-07-26 16:29:50 +01:00
co-authored by Claude Opus 5
parent cca0ffbeae
commit 0f5ad1d836
4 changed files with 82 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/internal/cloudprov/cloudprov.go
+4 -3
View File
@@ -24,9 +24,10 @@ import (
// CreateInstance creates a control-plane instance and its owner.
//
// The owner's password hash is COPIED from the HQ account rather than shared.
// Changing the password on either side does not propagate, and they diverge from
// that moment — accepted deliberately, because propagating a hash across two
// services' databases is a worse problem than two passwords that started equal.
// HQ remains the single source of truth: a password change there copies the new
// hash to every projected row (see SetPasswordHash), and hqsync repairs any that
// a failed write left stale. The control plane has no local password-change path
// for an hq-sourced row, so there is no competing writer.
//
// On owner-insert failure the instance is rolled back, so a failed provision
// never leaves a slug permanently occupied by an instance nobody owns.