Bot-token pool leaks and races: preferred_token_id silently dropped, re-join double-assigns, failed MQTT send never releases #204

New Issue

2026-10-04T15:34:20-04:00

logan commented

2026-10-04 15:34:20 -04:00

Found during the Discord system design audit (2026-10-04, design-canvas/discord-system-notes.md).

drb-c2-core/app/routers/tokens.py + routers/nodes.py:95-127:

preferred_token_id is dropped before it is read. CommandPayload (models.py:111-114) declares only action/guild_id/channel_id; pydantic ignores extras, so payload.pop("preferred_token_id") at nodes.py:111 is always None. The Discord bot's /join token: option (radio.py:43-77) has never worked. Only the system-level preferred_token_id path is live.
Re-join double-assigns. A second discord_join to a node that already holds a token calls assign_token again without releasing the first. The edge swaps to the new token (discord_radio._start_bot -> stop()), the old token stays in_use=True, assigned_node_id=<node> until a discord_leave or the offline sweeper. Repeated /joins drain the pool.
Assigned, never delivered. If mqtt_handler.send_command fails (nodes.py:125) the endpoint 503s after assign_token already marked the token in use. Never released.
Not atomic. assign_token is a query-then-update outside a transaction (tokens.py:116-138); two concurrent joins can receive the same token, which then runs two gateway sessions on two nodes.
No validation on add. POST /tokens stores any string. A token whose application lacks the Message Content privileged intent (the edge requests it, discord_radio.py:213) fails at bot.start(), times out after 15s, and the user sees nothing.
GET /tokens (L21) has no per-route dependency, so any Firebase user of any org (viewer included) lists the platform pool. Masked, but tokens carry no org_id at all.

Fix direction: add preferred_token_id to CommandPayload; make assign a Firestore transaction keyed on node (re-join reuses the node's existing token); release on send failure; validate a token on add via GET https://discord.com/api/v10/users/@me + applications/@me flags; admin-only list. Related: node-26 edge session issue (release must also stop the edge gateway session).

Found during the Discord system design audit (2026-10-04, `design-canvas/discord-system-notes.md`). `drb-c2-core/app/routers/tokens.py` + `routers/nodes.py:95-127`: 1. **`preferred_token_id` is dropped before it is read.** `CommandPayload` (`models.py:111-114`) declares only `action/guild_id/channel_id`; pydantic ignores extras, so `payload.pop("preferred_token_id")` at `nodes.py:111` is always `None`. The Discord bot's `/join token:` option (`radio.py:43-77`) has never worked. Only the system-level `preferred_token_id` path is live. 2. **Re-join double-assigns.** A second `discord_join` to a node that already holds a token calls `assign_token` again without releasing the first. The edge swaps to the new token (`discord_radio._start_bot` -> `stop()`), the old token stays `in_use=True, assigned_node_id=<node>` until a `discord_leave` or the offline sweeper. Repeated `/join`s drain the pool. 3. **Assigned, never delivered.** If `mqtt_handler.send_command` fails (`nodes.py:125`) the endpoint 503s after `assign_token` already marked the token in use. Never released. 4. **Not atomic.** `assign_token` is a query-then-update outside a transaction (`tokens.py:116-138`); two concurrent joins can receive the same token, which then runs two gateway sessions on two nodes. 5. **No validation on add.** `POST /tokens` stores any string. A token whose application lacks the Message Content privileged intent (the edge requests it, `discord_radio.py:213`) fails at `bot.start()`, times out after 15s, and the user sees nothing. 6. `GET /tokens` (L21) has no per-route dependency, so any Firebase user of any org (viewer included) lists the platform pool. Masked, but tokens carry no `org_id` at all. **Fix direction:** add `preferred_token_id` to `CommandPayload`; make assign a Firestore transaction keyed on node (re-join reuses the node's existing token); release on send failure; validate a token on add via `GET https://discord.com/api/v10/users/@me` + `applications/@me` flags; admin-only list. Related: node-26 edge session issue (release must also stop the edge gateway session).

logan referenced this issue from a commit

2026-10-04 18:05:46 -04:00

Discord radio channels: wire leases + desired-state streams (server-26#203, #204)

logan referenced this issue

2026-10-04 18:10:01 -04:00

Discord: no self-serve guild->org link and no admin UI for radio channels/bots (follow-up to #203/#204) #213

logan referenced this issue

2026-10-04 18:10:32 -04:00

Discord radio channels: transactional token leases + desired-state streams (#203, #204) #216

logan commented

2026-10-04 18:10:41 -04:00

PR: #216 (server) + logan/node-26#32 (edge). Merge both together. Follow-ups filed: server-26#213 (guild link UI/admin page), server-26#214 (ad-hoc idle dismiss). drb-audio-review still to run on the edge PR before merge.

PR: https://git.vpn.cusano.net/logan/server-26/pulls/216 (server) + https://git.vpn.cusano.net/logan/node-26/pulls/32 (edge). Merge both together. Follow-ups filed: server-26#213 (guild link UI/admin page), server-26#214 (ad-hoc idle dismiss). drb-audio-review still to run on the edge PR before merge.

logan referenced this issue from a commit

2026-10-04 18:34:11 -04:00

Merge pull request 'Discord radio channels: transactional token leases + desired-state streams (#203, #204)' (#216) from feat/discord-system into main

logan added the area/discord

labels 2026-10-05 02:05:02 -04:00

logan commented