fix: caching issues in config signing

lint

lint

Author: yuvrajjsingh0

airborne_dashboard/components/settings/integrity/signing-keys-card.tsx

@@ -228,9 +228,7 @@ export function SigningKeysCard({ canRead, canCreate, canUpdate }: SigningKeysCa
                         {!signingKey.is_default && !signingKey.disabled && <Badge variant="outline">Active</Badge>}
                       </div>
                     </TableCell>
-                    <TableCell className="text-muted-foreground">
-                      {formatDate(signingKey.created_at)}
-                    </TableCell>
+                    <TableCell className="text-muted-foreground">{formatDate(signingKey.created_at)}</TableCell>
                     <TableCell className="text-right">
                       <KeyActions
                         signingKey={signingKey}

airborne_docs/docs/dashboard/integrity.mdx

@@ -9,8 +9,10 @@ Airborne signs every [release config](/docs/guides/verify-the-release-config-sig
 
 Each key is an **ECDSA P-256** keypair. The **private key never leaves the server**: it cannot be downloaded and is never returned by the API. The **public key** is downloadable at any time — that is the half your apps verify with.
 
-:::info[You already have a key]
-Every application is given a keypair with the key ID `default` the moment it is created, and existing applications were backfilled with one. Signing is on out of the box; there is nothing to switch on.
+:::info[New applications get a key automatically]
+Every application is given a keypair with the key ID `default` when it is created, so signing is on from the first release config it serves.
+
+Applications that **predate signing** need a one-time backfill: add `signingkeys` to [`MIGRATIONS_TO_RUN_ON_BOOT`](/docs/server/configuration#boot-time-migrations) and restart the server. It is idempotent, so it is safe to leave enabled. Until it runs, those applications serve release configs with **no** signature header — never an error in itself, but a client that requires a signature will reject them.
 :::
 
 ## The key list
@@ -32,6 +34,8 @@ The page lists every key the application owns:
 
 A new key is **not** the default — it signs nothing until you promote it. That is deliberate: it gives you a window to distribute the new public key to your apps before anything starts signing with it.
 
+The exception is an application's **first** key, which becomes the default the moment it is created — an application with keys but no default would have nothing to sign with. You only land here if the application has no keys at all, which normally means it predates signing and has not been backfilled.
+
 Key IDs must be unique within the application and are immutable. They must:
 
 - contain only lowercase letters (`a-z`), digits (`0-9`), and dashes (`-`);
@@ -46,13 +50,15 @@ This is the file you ship to your apps. See [Verify the release config signature
 
 ## Set the default
 
-**Set as default** promotes a key. From that moment, every release-config response that does not name a specific key is signed with it, and the change takes effect immediately — there is no cache to wait out.
+**Set as default** promotes a key. From that moment, every release-config response that does not name a specific key is signed with it.
+
+Airborne drops its own cached signatures and invalidates the application's release route at the CDN, so promoting a key does not leave clients on the 24-hour edge cache — they pick up the new `keyid` as soon as the invalidation propagates, usually within a minute.
 
 Exactly one key is the default at any time; promoting a key demotes the previous one.
 
 ## Enable and disable
 
-**Disable** takes a key out of service. Airborne will refuse to sign with it, and any request that names it in `X-Signing-Key-Id` is rejected with a **400**. Re-enabling restores it.
+**Disable** takes a key out of service. Airborne will refuse to sign with it, and any request that names it in `X-Signing-Key-Id` is rejected with a **400**. Disabling also invalidates the cached release configs that key signed, so responses carrying its `keyid` stop being served from the edge. Re-enabling restores it.
 
 Two rules keep you from locking your own apps out:
 

airborne_docs/docs/guides/verify-the-release-config-signature.mdx

@@ -123,7 +123,7 @@ Omit the header and Airborne signs with the application's **default** key. To pi
 X-Signing-Key-Id: release-signing-2026
 ```
 
-An unknown or disabled key ID — or one belonging to a different application — is rejected with **400**.
+Sending the header with an **empty** value is the same as omitting it: the default key signs. A *non-empty* key ID that is unknown or disabled — or that belongs to a different application — is rejected with **400**.
 
 Key IDs contain only lowercase letters (`a-z`), digits (`0-9`), and single dashes. They cannot start or end with a dash.
 

airborne_docs/openapi/airborne.openapi.json

@@ -2888,13 +2888,13 @@
                     {
                         "name": "x-signing-key-id",
                         "in": "header",
-                        "description": "ID of the signing key to sign the response with. This is the readable ID chosen\nwhen the key was created. Optional — when omitted, the application's default\nsigning key is used. A key ID that is invalid, unknown, disabled, or belongs to\nanother application is rejected with a 400.",
+                        "description": "ID of the signing key to sign the response with. This is the readable ID chosen\nwhen the key was created. Optional — when omitted, or sent with an empty value,\nthe application's default signing key is used. A non-empty key ID that is\ninvalid, unknown, disabled, or belongs to another application is rejected with\na 400.",
                         "schema": {
                             "type": "string",
                             "maxLength": 50,
                             "minLength": 1,
                             "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$",
-                            "description": "ID of the signing key to sign the response with. This is the readable ID chosen\nwhen the key was created. Optional — when omitted, the application's default\nsigning key is used. A key ID that is invalid, unknown, disabled, or belongs to\nanother application is rejected with a 400."
+                            "description": "ID of the signing key to sign the response with. This is the readable ID chosen\nwhen the key was created. Optional — when omitted, or sent with an empty value,\nthe application's default signing key is used. A non-empty key ID that is\ninvalid, unknown, disabled, or belongs to another application is rejected with\na 400."
                         }
                     }
                 ],
@@ -3012,13 +3012,13 @@
                     {
                         "name": "x-signing-key-id",
                         "in": "header",
-                        "description": "ID of the signing key to sign the response with. This is the readable ID chosen\nwhen the key was created. Optional — when omitted, the application's default\nsigning key is used. A key ID that is invalid, unknown, disabled, or belongs to\nanother application is rejected with a 400.",
+                        "description": "ID of the signing key to sign the response with. This is the readable ID chosen\nwhen the key was created. Optional — when omitted, or sent with an empty value,\nthe application's default signing key is used. A non-empty key ID that is\ninvalid, unknown, disabled, or belongs to another application is rejected with\na 400.",
                         "schema": {
                             "type": "string",
                             "maxLength": 50,
                             "minLength": 1,
                             "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$",
-                            "description": "ID of the signing key to sign the response with. This is the readable ID chosen\nwhen the key was created. Optional — when omitted, the application's default\nsigning key is used. A key ID that is invalid, unknown, disabled, or belongs to\nanother application is rejected with a 400."
+                            "description": "ID of the signing key to sign the response with. This is the readable ID chosen\nwhen the key was created. Optional — when omitted, or sent with an empty value,\nthe application's default signing key is used. A non-empty key ID that is\ninvalid, unknown, disabled, or belongs to another application is rejected with\na 400."
                         }
                     }
                 ],

airborne_server/src/organisation/application/properties.rs

@@ -18,7 +18,7 @@ use crate::{
     middleware::auth::{require_org_and_app, AuthResponse},
     organisation::application::properties::types::ConfigProperty,
     release::utils::parse_kv_string,
-    types as airborne_types,
+    signing, types as airborne_types,
     types::{ABError, AppState},
     utils::document::{
         document_to_json_value, dotted_docs_to_nested, hashmap_to_json_value,
@@ -287,16 +287,25 @@ async fn put_properties_schema_api(
     }
 
     let metadata_for_rollback = task_metadata.clone();
-    match transaction::run_fail_end(tasks, move |success_indices| async move {
-        rollback_config_update(
-            success_indices,
-            metadata_for_rollback,
-            &state.superposition_client,
-        )
-        .await;
+    // Hand the rollback its own client rather than the whole `AppState`, so
+    // `state` is still available to invalidate caches once the writes land.
+    let client_for_rollback = state.superposition_client.clone();
+    let outcome = transaction::run_fail_end(tasks, move |success_indices| async move {
+        rollback_config_update(success_indices, metadata_for_rollback, &client_for_rollback).await;
     })
-    .await
-    {
+    .await;
+
+    // `config.properties` is part of the release config the serve path signs, but
+    // editing a property does not mint a new `config.version` — and that version is
+    // what the signature cache is keyed on. Drop the cached signatures so the next
+    // serve re-signs the body it actually returns instead of handing back a
+    // signature computed over the old one.
+    //
+    // Done regardless of outcome: a rollback can itself fail, so a failed request
+    // is not a guarantee that nothing changed.
+    signing::utils::invalidate_signature_cache(&state, &organisation, &application).await;
+
+    match outcome {
         Ok(values) => info!("All good: {:?}", values),
         Err(e) => match e {
             transaction::TxnError::Operation { source, .. } => return Err(source),

airborne_server/src/release.rs

@@ -526,17 +526,7 @@ async fn create_release(
 
     let response_resources = final_resources.unwrap_or_default();
 
-    let path = format!("/release/{}/{}*", organisation.clone(), application.clone());
-
-    if let Err(e) = utils::invalidate_cf(
-        &state.cf_client,
-        path,
-        &state.env.cloudfront_distribution_id,
-    )
-    .await
-    {
-        info!("Failed to invalidate CloudFront cache: {:?}", e);
-    }
+    utils::invalidate_release_cache(&state, &organisation, &application).await;
 
     let now = Utc::now();
     let nested_config_props_result = dotted_docs_to_nested(config_properties.clone());
@@ -991,17 +981,7 @@ async fn ramp_release(
 
     info!("Successfully ramped experiment {}", experiment_id);
 
-    let path = format!("/release/{}/{}*", organisation.clone(), application.clone());
-
-    if let Err(e) = utils::invalidate_cf(
-        &state.cf_client,
-        path,
-        &state.env.cloudfront_distribution_id,
-    )
-    .await
-    {
-        info!("Failed to invalidate CloudFront cache: {:?}", e);
-    }
+    utils::invalidate_release_cache(&state, &organisation, &application).await;
 
     Ok(Json(RampReleaseResponse {
         success: true,
@@ -1139,17 +1119,7 @@ async fn conclude_release(
         experiment_id, transformed_variant_id
     );
 
-    let path = format!("/release/{}/{}*", organisation.clone(), application.clone());
-
-    if let Err(e) = utils::invalidate_cf(
-        &state.cf_client,
-        path,
-        &state.env.cloudfront_distribution_id,
-    )
-    .await
-    {
-        info!("Failed to invalidate CloudFront cache: {:?}", e);
-    }
+    utils::invalidate_release_cache(&state, &organisation, &application).await;
 
     Ok(Json(ConcludeReleaseResponse {
         success: true,
@@ -1492,10 +1462,11 @@ async fn serve_release_handler(
         ABError::InternalServerError(format!("Failed to serialize release config: {e}"))
     })?;
 
-    let requested_key_id = req
-        .headers()
-        .get(signing::utils::SIGNING_KEY_ID_HEADER)
-        .and_then(|value| value.to_str().ok());
+    let requested_key_id = signing::utils::requested_key_id(
+        req.headers()
+            .get(signing::utils::SIGNING_KEY_ID_HEADER)
+            .and_then(|value| value.to_str().ok()),
+    );
 
     // config.version is a UUID minted with the resolved release variant. The
     // signing helper combines it with the selected key so repeat serves can

airborne_server/src/release/utils.rs

@@ -493,6 +493,21 @@ pub async fn invalidate_cf(
     Ok(())
 }
 
+/// Best-effort: drop the CDN's cached release-config responses for an application.
+pub async fn invalidate_release_cache(state: &AppState, organisation: &str, application: &str) {
+    let path = format!("/release/{organisation}/{application}*");
+
+    if let Err(e) = invalidate_cf(
+        &state.cf_client,
+        path,
+        &state.env.cloudfront_distribution_id,
+    )
+    .await
+    {
+        info!("Failed to invalidate CloudFront cache: {:?}", e);
+    }
+}
+
 pub async fn check_non_concluded_releases(
     superposition_org_id: String,
     dims: HashMap<String, Value>,

airborne_server/src/signing.rs

@@ -29,6 +29,7 @@ use airborne_authz_macros::authz;
 
 use crate::{
     middleware::auth::{require_org_and_app, AuthResponse},
+    release::utils as release_utils,
     signing::types::{CreateSigningKeyRequest, SigningKeyResponse, UpdateSigningKeyRequest},
     types as airborne_types,
     types::{ABError, AppState, ListResponse, WithHeaders},
@@ -104,6 +105,13 @@ async fn create_signing_key(
     // "no default key" result has to go.
     utils::invalidate_key_cache(&state, &organisation, &application, &key.name).await;
 
+    // That same first key flips the application from serving unsigned configs to
+    // signed ones, and the edge is still holding the unsigned responses. A key
+    // that did not become the default changes nothing about what is served.
+    if key.is_default {
+        release_utils::invalidate_release_cache(&state, &organisation, &application).await;
+    }
+
     Ok(WithHeaders::new(Json(SigningKeyResponse::from(key))).status(StatusCode::CREATED))
 }
 
@@ -161,18 +169,26 @@ async fn update_signing_key(
     )?;
 
     let key_id = utils::validate_key_id(&path.into_inner())?;
+    let disabled = req.into_inner().disabled;
 
     let key = utils::set_key_disabled(
         state.db_pool.clone(),
         organisation.clone(),
         application.clone(),
         key_id,
-        req.into_inner().disabled,
+        disabled,
     )
     .await?;
 
     utils::invalidate_key_cache(&state, &organisation, &application, &key.name).await;
 
+    // Disabling a key has to stop its signatures from being served, and the edge
+    // is still holding responses it signed. Enabling one invalidates nothing:
+    // no cached response becomes wrong by a key becoming usable again.
+    if disabled {
+        release_utils::invalidate_release_cache(&state, &organisation, &application).await;
+    }
+
     Ok(Json(SigningKeyResponse::from(key)))
 }
 
@@ -206,5 +222,9 @@ async fn set_default_signing_key(
 
     utils::invalidate_key_cache(&state, &organisation, &application, &key.name).await;
 
+    // Every release config cached at the edge was signed by the key this one just
+    // replaced, so it has to be re-fetched to pick up the new `keyid`.
+    release_utils::invalidate_release_cache(&state, &organisation, &application).await;
+
     Ok(Json(SigningKeyResponse::from(key)))
 }