fix(rbac): publish durable metadata despite staging failures

Remote metadata is authoritative at runtime and startup. Log a failed local staging refresh with tenant context and return success once the durable write commits, so callers continue their live map and session updates. Keep durable write errors fatal and route the standalone role and OIDC writers through the shared helper.

Co-Authored-By: GPT-6.1 Sol <noreply@openai.com>

Author: VibeSWE

src/handlers/http/modal/utils/rbac_utils.rs

@@ -35,22 +35,35 @@ pub async fn get_metadata(
     Ok(serde_json::from_slice::<StorageMetadata>(&metadata)?)
 }
 
+/// Persist authoritative metadata and refresh its best-effort local staging copy.
+/// Success lets callers publish the committed change to live RBAC state.
 pub async fn put_metadata(
     metadata: &StorageMetadata,
     tenant_id: &Option<String>,
 ) -> Result<(), ObjectStorageError> {
-    put_metadata_with_writers(storage::put_remote_metadata(metadata, tenant_id), || {
-        storage::put_staging_metadata(metadata, tenant_id)
-    })
+    put_metadata_with_writers(
+        storage::put_remote_metadata(metadata, tenant_id),
+        || storage::put_staging_metadata(metadata, tenant_id),
+        tenant_id,
+    )
     .await
 }
 
 async fn put_metadata_with_writers(
     remote_write: impl Future<Output = Result<(), ObjectStorageError>>,
     staging_write: impl FnOnce() -> io::Result<()>,
+    tenant_id: &Option<String>,
 ) -> Result<(), ObjectStorageError> {
     remote_write.await?;
-    staging_write()?;
+    // A staging failure cannot undo the durable commit. Returning an error here
+    // would leave callers' live authorization state behind the source of truth.
+    if let Err(error) = staging_write() {
+        tracing::error!(
+            error = %error,
+            tenant_id = ?tenant_id,
+            "Failed to refresh staging metadata after durable metadata write"
+        );
+    }
     Ok(())
 }
 
@@ -80,6 +93,7 @@ mod tests {
                     "staging is read-only",
                 ))
             },
+            &None,
         )
         .await;
 
@@ -95,6 +109,7 @@ mod tests {
         let result = put_metadata_with_writers(
             async { Err(ObjectStorageError::Custom("durable write failed".into())) },
             || panic!("staging must not be changed after a failed durable write"),
+            &None,
         )
         .await;
 
@@ -117,6 +132,7 @@ mod tests {
                 staging_written.set(true);
                 Ok(())
             },
+            &None,
         )
         .await;
 

src/handlers/http/oidc.rs

@@ -47,7 +47,9 @@ use crate::{
     handlers::{
         COOKIE_AGE_DAYS, SESSION_COOKIE_NAME, USER_COOKIE_NAME, USER_ID_COOKIE_NAME,
         http::{
-            API_BASE_PATH, API_VERSION, cluster::sync_user_creation, modal::OIDC_CLIENT,
+            API_BASE_PATH, API_VERSION,
+            cluster::sync_user_creation,
+            modal::{OIDC_CLIENT, utils::rbac_utils::put_metadata},
             rbac::UPDATE_LOCK,
         },
     },
@@ -58,7 +60,7 @@ use crate::{
         map::{DEFAULT_ROLE, SessionKey, mut_sessions, mut_users, roles, write_user_groups},
         user::{self, GroupUser, User, UserType},
     },
-    storage::{self, ObjectStorageError, StorageMetadata},
+    storage::{ObjectStorageError, StorageMetadata},
     utils::{
         actix::extract_session_key_from_req, get_tenant_id_from_key, get_tenant_id_from_request,
     },
@@ -825,15 +827,6 @@ async fn get_metadata(
     Ok(serde_json::from_slice::<StorageMetadata>(&metadata)?)
 }
 
-async fn put_metadata(
-    metadata: &StorageMetadata,
-    tenant_id: &Option<String>,
-) -> Result<(), ObjectStorageError> {
-    storage::put_remote_metadata(metadata, tenant_id).await?;
-    storage::put_staging_metadata(metadata, tenant_id)?;
-    Ok(())
-}
-
 #[derive(Debug, thiserror::Error)]
 pub enum OIDCError {
     #[error("Failed to connect to storage: {0}")]

src/handlers/http/role.rs

@@ -25,6 +25,7 @@ use actix_web::{
     web::{self, Json},
 };
 
+use super::modal::utils::rbac_utils::put_metadata;
 use crate::rbac::map::roles;
 use crate::rbac::role::model::{Role, RoleType, RoleUI};
 use crate::{
@@ -34,7 +35,7 @@ use crate::{
         map::{DEFAULT_ROLE, mut_roles, mut_sessions, mut_users, read_user_groups, users},
         user::UserType,
     },
-    storage::{self, ObjectStorageError, StorageMetadata},
+    storage::{ObjectStorageError, StorageMetadata},
     utils::get_tenant_id_from_request,
     validator::{self, error::UsernameValidationError},
 };
@@ -302,15 +303,6 @@ async fn get_metadata(
     Ok(serde_json::from_slice::<StorageMetadata>(&metadata)?)
 }
 
-async fn put_metadata(
-    metadata: &StorageMetadata,
-    tenant_id: &Option<String>,
-) -> Result<(), ObjectStorageError> {
-    storage::put_remote_metadata(metadata, tenant_id).await?;
-    storage::put_staging_metadata(metadata, tenant_id)?;
-    Ok(())
-}
-
 #[derive(Debug, thiserror::Error)]
 pub enum RoleError {
     #[error("Default OIDC role must name an existing role.")]