Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Caches aren't sufficiently invalidated on logout #9431

Open
ntindle opened this issue Feb 5, 2025 — with Linear · 0 comments
Open

Caches aren't sufficiently invalidated on logout #9431

ntindle opened this issue Feb 5, 2025 — with Linear · 0 comments

Comments

Copy link
Member

ntindle commented Feb 5, 2025

Credentials can get filled (But not leak details) between accounts if you log out of one and into another
Error is:

2025-02-05 20:36:17,558 INFO  [PID-1|THREAD-1|AgentServer|Pyro-789dcc11-5e76-42c6-b2f1-fbcb810fe7c9] Connecting to [DatabaseManager] completed successfully.
2025-02-05 20:36:17,643 ERROR  POST /api/graphs failed: Node #f5be7a33-23e2-4575-b8f2-431031b404c5 input 'credentials' updated with non-existent credentials #eb892fee-ce45-4af0-9c9c-cb76dab90cd0
Traceback (most recent call last):
  File "/usr/local/lib/python3.11/site-packages/starlette/_exception_handler.py", line 42, in wrapped_app
    await app(scope, receive, sender)
  File "/usr/local/lib/python3.11/site-packages/starlette/routing.py", line 73, in app
    response = await f(request)
               ^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/sentry_sdk/integrations/fastapi.py", line 143, in _sentry_app
    return await old_app(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/fastapi/routing.py", line 301, in app
    raw_response = await run_endpoint_function(
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/fastapi/routing.py", line 212, in run_endpoint_function
    return await dependant.call(**values)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/autogpt_platform/backend/backend/server/routers/v1.py", line 332, in create_new_graph
    return await do_create_graph(create_graph, is_template=False, user_id=user_id)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/autogpt_platform/backend/backend/server/routers/v1.py", line 367, in do_create_graph
    graph = await on_graph_activate(
            ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/autogpt_platform/backend/backend/integrations/webhooks/graph_lifecycle_hooks.py", line 50, in on_graph_activate
    raise ValueError(
ValueError: Node #f5be7a33-23e2-4575-b8f2-431031b404c5 input 'credentials' updated with non-existent credentials #eb892fee-ce45-4af0-9c9c-cb76dab90cd0
INFO:     130.211.0.63:38136 - "POST /api/graphs HTTP/1.1" 400 Bad Request

Repro:
** do not refresh in this process until told**

have two accounts

Log into account1 and go to builder and set an api key.

Go to integrations page

Log out

Log into account2 and go to integrations page

Notice the other accounts keys shown

Refresh

Notice the correct integrations are shown

You can verify the repro steps with the integrations page

[email protected]
GitHub
account_name
OAuth2 credentials - cf70502f-46fd-4e23-87e4-3f5a5ed34a63    Delete
Jina
jina
API key - 7886fd52-9d76-4440-83a3-78ff6e9c6b30

----
[email protected]
Provider    Name    Actions
GitHub
account_name
OAuth2 credentials - cf70502f-46fd-4e23-87e4-3f5a5ed34a63    Delete
Jina
jina
API key - 7886fd52-9d76-4440-83a3-78ff6e9c6b30

*refresh*
[email protected]
Connections & Credentials
Provider    Name    Actions
Jina
jina
API key - eb892fee-ce45-4af0-9c9c-cb76dab90cd0    Delete 

Resolution is probably pushing to a /logout route and invalidating the caches by refreshing

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant