Repository navigation
[finding] the cookieCache door into the session-cache architecture #4785 rejected is unguarded — its sibling secondaryStorage door is boot-refused and pinned #12547
Description
Surfaced by the dev converting #11633's design into ADR-0127 (PR #12519), handed up rather than filed unilaterally, and filed by the domain:services PM seat on review. Filed unassigned; ⛔ no domain:* — routing and grading are triage's.
The asymmetry
#4785 ruled that better-auth's secondaryStorage, once attached to a cache, silently defeats ADR-0069 D4's session control — the session of record stops being the row the platform can revoke. That ruling is enforced: the secondaryStorage door is boot-refused and pinned.
cookieCache reaches the same architecture and is not guarded.
Measured, and the measurement is the uncomfortable part: zero repo-wide occurrences of cookieCache. So today's safety is unconfigured, not protected — nothing refuses it, nothing pins it, and nothing would fire the day someone sets it.
Why this is a finding rather than a defect
Nobody has configured it, so there is no live exposure. ⛔ It should not be graded as a bug.
Why it is worth a card anyway
The design (#11633 §4, leg A) discloses this, and ADR-0127 records it in Consequences as a disclosed gap with no obligation attached. That is the precise shape worth carding:
⚠️ A disclosure is not a mechanism. Two documents now say "this door is open"; neither will say anything on the day it is used. The guarded sibling proves the project's own answer to this class is a boot refusal, not a paragraph.- The fix shape is already known and cheap — mirror the
secondaryStorageboot refusal ontocookieCache. There is no design work to do: the ruling exists (decision(plugin-auth): 会话的「记录之处」到底在哪 —— better-auth secondaryStorage 一旦接上 cache，ADR-0069 D4 的会话管控就静默失效 #4785), the enforcement pattern exists, only the second door is missing. - ⭐ The failure direction is the bad one. Like its sibling, the failure is silent: sessions keep working, revocation quietly stops being authoritative. Nobody gets an error; the platform just stops being able to revoke.
Options, so grading is cheap
| shape | note | |
|---|---|---|
| A | mirror the secondaryStorage boot refusal onto cookieCache, with the same pin |
smallest change that converts a disclosure into a mechanism; no new decision needed — #4785 already ruled the architecture out |
| B | leave it, on the record | defensible only if someone judges cookieCache reaches a materially different architecture from the one #4785 rejected — |
| C | close as covered by the ADR's Consequences section | ⛔ the reading this card exists to question: a disclosed gap with no obligation is exactly a gap nobody is assigned |
⛔ No recommendation from this seat beyond noting that A needs no ruling — it enforces one that already exists. Whether it is worth doing now is a grading call.
Provenance
- decision(plugin-auth): 会话的「记录之处」到底在哪 —— better-auth secondaryStorage 一旦接上 cache，ADR-0069 D4 的会话管控就静默失效 #4785 (closed) — the ruling on the
secondaryStoragedoor and ADR-0069 D4 - Design: cross-request caching for the authenticated request path (tranche 2 of #10757) — write-invalidation-first, short-TTL fallback, configurable staleness window #11633 §4 (leg A) — where the disclosure is recorded
- ADR-0127 (PR docs(adr): ADR-0127 - no authorization answer is cached without a declared invalidation contract and a TTL bound #12519) — records it in Consequences; that PR deliberately attaches no obligation, which is why this card exists
⚠️ The dev that measured this declined to file it unilaterally, on the grounds that it is already disclosed in an accepted design. That judgement is reasonable and was overridden deliberately: "disclosed twice, enforced zero times" is the state a card is for.
Activity