admin/felhom-controller
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

offsiteapply: include QuotaGB in the descriptor hash — quota changes re-apply

Browse Source 
A hub-side quota raise now reaches the target: the marker hash changes and
the bridge re-applies via key-auth-first (no password consumed). Test:
quota-only change remaps the new quota with a panicking consumer.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
This commit is contained in:
authentik Default Admin
2026-07-09 23:58:30 +02:00
parent 8917014991
commit f830325ca3
2 changed files with 24 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
controller/internal/offsiteapply/offsiteapply.go
+5 -3
View File
@@ -72,10 +72,12 @@ func (b *Bridge) logf(f string, a ...any) {
}
}
// descriptorHash is the applied-marker key: a hash of the identity-bearing descriptor fields. A change
// (re-provision → new host/user/fingerprint) yields a new hash → the bridge re-applies (new password).
// descriptorHash is the applied-marker key: a hash of the APPLY-RELEVANT descriptor fields. A change
// (re-provision → new host/user/fingerprint, or a quota adjustment) yields a new hash → the bridge
// re-applies. QuotaGB is included (SLICE 4) so a hub-side quota raise reaches the target — on an
// already-provisioned guest that re-apply is a cheap key-auth-first re-pin (no password consumed).
func descriptorHash(o config.OffsiteConfig) string {
s := fmt.Sprintf("%s|%s|%s|%d|%s|%s", o.Type, o.Host, o.User, o.Port, o.RepoPath, o.HostFingerprint)
s := fmt.Sprintf("%s|%s|%s|%d|%s|%s|%d", o.Type, o.Host, o.User, o.Port, o.RepoPath, o.HostFingerprint, o.QuotaGB)
sum := sha256.Sum256([]byte(s))
return hex.EncodeToString(sum[:])
}