Summary
MDK should expose OpenMLS's MlsGroup::clear_pending_commit method so that applications can clean up stale pending commits when evolution event publishing fails.
Problem
When an application calls an MDK operation that creates a pending commit (add_members, remove_members, update_group_data, self_update), and then fails to publish the resulting evolution event to relays, the pending commit remains stranded in the MLS group's internal state.
OpenMLS documents this scenario and provides MlsGroup::clear_pending_commit:
pub fn clear_pending_commit<Storage: StorageProvider>(
&mut self,
storage: &Storage,
) -> Result<(), Storage::Error>
Sets the group_state to MlsGroupState::Operational, thus clearing any potentially pending commits.
However, MDK does not currently wrap or expose this method. Without it, a failed publish leaves the group in a state where subsequent MLS operations may fail with OwnCommitPending errors.
Context
This came up while implementing MIP-03 compliant publish-before-merge ordering in whitenoise-rs#505. The correct flow is:
- Create the pending commit via MDK (e.g.,
mdk.add_members())
- Publish the evolution event to relays
- Only after relay acceptance, call
mdk.merge_pending_commit()
If step 2 fails after retries, there is no way to clear the pending commit from step 1 through the MDK API. The group is effectively stuck until the pending commit is either merged or overwritten.
Proposed API
Add a method to MDK<Storage>:
pub fn clear_pending_commit(&self, group_id: &GroupId) -> Result<(), Error>
This should call through to OpenMLS's MlsGroup::clear_pending_commit with appropriate error mapping.
Safety Note
OpenMLS's documentation warns: "Use with caution! This function should only be used if it is clear that the pending commit will not be used in the group." The MDK wrapper should include similar documentation, and applications should only call it when they are certain the evolution event was not published (i.e., all publish attempts failed).
Summary
MDK should expose OpenMLS's
MlsGroup::clear_pending_commitmethod so that applications can clean up stale pending commits when evolution event publishing fails.Problem
When an application calls an MDK operation that creates a pending commit (
add_members,remove_members,update_group_data,self_update), and then fails to publish the resulting evolution event to relays, the pending commit remains stranded in the MLS group's internal state.OpenMLS documents this scenario and provides
MlsGroup::clear_pending_commit:However, MDK does not currently wrap or expose this method. Without it, a failed publish leaves the group in a state where subsequent MLS operations may fail with
OwnCommitPendingerrors.Context
This came up while implementing MIP-03 compliant publish-before-merge ordering in whitenoise-rs#505. The correct flow is:
mdk.add_members())mdk.merge_pending_commit()If step 2 fails after retries, there is no way to clear the pending commit from step 1 through the MDK API. The group is effectively stuck until the pending commit is either merged or overwritten.
Proposed API
Add a method to
MDK<Storage>:This should call through to OpenMLS's
MlsGroup::clear_pending_commitwith appropriate error mapping.Safety Note
OpenMLS's documentation warns: "Use with caution! This function should only be used if it is clear that the pending commit will not be used in the group." The MDK wrapper should include similar documentation, and applications should only call it when they are certain the evolution event was not published (i.e., all publish attempts failed).