2.7 KiB
2026-08-15 — Auth-version review reconciliation
Incident / review result
An asynchronous reviewer packet returned passed=false with one claimed blocker: a concurrent self-service password change and admin password reset could both compute the same next auth_version. That verdict was produced from an earlier tree state and was not treated as approval for the current tree.
Current root-cause check
The current UserStore.update_user_fields() path acquires users.collection_lock() and then users.record_lock(username) before reading the current user or computing the next auth_version. change_password() acquires the same per-user record lock before reading the current hash/version and writing the replacement hash. complete_setup() uses the same collection-lock → record-lock order. The only production password-bearing mutations found are in backend/app/auth/users.py.
The existing deterministic regression test_concurrent_admin_reset_cannot_reuse_stale_auth_version specifically gates a self-service change_password() against the set_password() / update_user_fields(password=...) path and asserts the version advances twice. It passed on the current tree.
Verification evidence
./.venv/bin/python -m pytest tests/test_password_change.py -q— 9 passed../.venv/bin/python -m pytest -q— 176 passed.- Executable backend scripts — 12/12 passed.
./.venv/bin/python -m compileall -q app tests— passed.git diff --check— passed.- Current source scan found no production password mutation outside
backend/app/auth/users.py.
Review gate
The surgical independent review of the current password-session path returned a complete five-key verdict with passed=true, security_concerns=[], and logic_errors=[]. It independently confirmed that change_password(), update_user_fields(password=...), set_password(), and complete_setup() serialize auth_version reads/increments under the shared per-user record lock.
The full exact-tree review remains pending: several broader reviewer runs were interrupted before returning the required JSON schema. Their partial outputs are not approval and contain no valid blocking finding.
Operational limits
No commit, push, deploy, public-access change, credential rotation, or authenticated production smoke was performed. Docker, PostgreSQL, Redis/persistent audit verification, real-provider QA, and production browser/mobile verification remain pending.
Next action
Obtain a complete full exact-tree reviewer verdict. If it passes, keep the live-operation gate closed until explicit operator approval for restricted deployment, credential/JWT rotation, audit inspection, and authenticated smoke.