Skip to content

Conversation

@cfm
Copy link
Member

@cfm cfm commented Dec 5, 2025

As previously discussed with @legoktm: v2 Journalist API event-handlers reuse utility functions that are are inconsistent in when they session.commit() and/or session.refresh(). The event-handlers themselves inherit these inconsistent transaction boundaries.

On the one hand, this is too bad. We'd like event-handlers to be (approximately) pure functions on the received event data and the current server state, but in practice they're as fuzzy as our transaction isolation. We could eliminate these intra-event races by constructing a session for each event-handler invocation, returning only values read within that session, and committing its changes explicitly.

On the other hand, I don't actually think this is worth fixing. Either way—with or without strict per-event isolation—a server that receives events from multiple clients close enough together will wind up signalling those clients to sync again in order to catch up to one another's writes. Eventual convergence is good enough in both cases, so let's just document explicitly that this is an expected exception to single-round-trip consistency.

Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR documents an expected exception to single-round-trip consistency in the v2 Journalist API, specifically related to interleaved SQLite commits when multiple clients are active. Rather than fixing the underlying technical issue (which would provide marginal benefit), the documentation explicitly acknowledges this limitation.

  • Adds clarification that single-round-trip consistency doesn't hold when the server has multiple active clients
  • Explains the technical cause: reused utility functions from v1 Journalist API inherit inconsistent transaction isolation
  • Restructures the consistency exception documentation to clearly enumerate both cases where the property doesn't hold

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…consistency

As previously discussed with @legoktm:  v2 Journalist API event-handlers
reuse utility functions that are are inconsistent in when they
session.commit() and/or session.refresh().  The event-handlers
themselves inherit these inconsistent transaction boundaries.

On the one hand, this is too bad.  We'd like event-handlers to be
(approximately) pure functions on the received event data and the
current server state, but in practice they're as fuzzy as our
transaction isolation.  We could eliminate these intra-event races by
constructing a session for each event-handler invocation, returning only
values read within that session, and committing its changes explicitly.

On the other hand, I don't actually think this is worth fixing.  *Either
way*---with or without strict per-event isolation---a server that
receives events from multiple clients close enough together will wind up
signalling those clients to sync again in order to catch up to one
another's writes.  Eventual convergence is good enough in both cases, so
let's just document explicitly that this is an expected exception to
single-round-trip consistency.
@cfm cfm force-pushed the apiv2-data-races branch from e3ae21d to dfac798 Compare December 5, 2025 23:07
@cfm cfm marked this pull request as ready for review December 5, 2025 23:07
@cfm cfm requested a review from a team as a code owner December 5, 2025 23:07
@cfm cfm added this to SecureDrop Dec 5, 2025
@cfm cfm moved this to Ready For Review in SecureDrop Dec 5, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Ready For Review

Development

Successfully merging this pull request may close these issues.

2 participants