fix: clean up login tokens in users.deactivateidle#40559
Conversation
🦋 Changeset detectedLatest commit: 9e99fc0 The changes in this PR will be included in the next version bump. This PR includes changesets to release 42 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
There was a problem hiding this comment.
1 issue found across 5 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="apps/meteor/app/api/server/v1/users.ts">
<violation number="1" location="apps/meteor/app/api/server/v1/users.ts:551">
P2: This introduces a read-then-update race: notifications are emitted from a pre-update ID snapshot, so users that no longer match at update time can still be broadcast as deactivated.
(Based on your team's feedback about concurrency-impacting behavioral changes.) [FEEDBACK_USED]</violation>
</file>
Tip: cubic used a learning from your PR history. Let your coding agent read cubic learnings directly with the cubic MCP.
Re-trigger cubic
| lastLoggedIn.setDate(lastLoggedIn.getDate() - daysIdle); | ||
|
|
||
| // since we're deactiving users that are not logged in, there is no need to send data through WS | ||
| const ids = await Users.findActiveNotLoggedInAfterWithRole(lastLoggedIn, role, { projection: { _id: 1 } }) |
There was a problem hiding this comment.
P2: This introduces a read-then-update race: notifications are emitted from a pre-update ID snapshot, so users that no longer match at update time can still be broadcast as deactivated.
(Based on your team's feedback about concurrency-impacting behavioral changes.)
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/meteor/app/api/server/v1/users.ts, line 551:
<comment>This introduces a read-then-update race: notifications are emitted from a pre-update ID snapshot, so users that no longer match at update time can still be broadcast as deactivated.
(Based on your team's feedback about concurrency-impacting behavioral changes.) </comment>
<file context>
@@ -548,9 +548,20 @@ API.v1.post(
lastLoggedIn.setDate(lastLoggedIn.getDate() - daysIdle);
- // since we're deactiving users that are not logged in, there is no need to send data through WS
+ const ids = await Users.findActiveNotLoggedInAfterWithRole(lastLoggedIn, role, { projection: { _id: 1 } })
+ .map(({ _id }: { _id: string }) => _id)
+ .toArray();
</file context>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## release-8.4.2 #40559 +/- ##
=================================================
+ Coverage 69.90% 69.92% +0.01%
=================================================
Files 3307 3307
Lines 120581 120581
Branches 21576 21645 +69
=================================================
+ Hits 84294 84314 +20
+ Misses 32986 32966 -20
Partials 3301 3301
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
Backport of #40496