Access session keys by account only by End-rey · Pull Request #3817 · nspcc-dev/neofs-node

End-rey · 2026-02-12T20:51:49Z

Closes #3793.

End-rey · 2026-02-12T20:53:34Z

Blocked by #3785.

pkg/services/object/server.go

pkg/services/object/get/service.go

pkg/services/object/util/key.go

pkg/services/session/server.go

pkg/util/state/migratation.go

roman-khimov · 2026-02-20T09:40:10Z

pkg/util/state/migratation.go

+		}
+	}
+
+	privKey, err := x509.ParseECPrivateKey(rawKey)


Wow. We really use DER here.

What's the problem with them?

Not that it's a big problem, but not something I'd expect either. NeoGo never does it, for example. To be fair, the most appropriate storage format here would probably be NEP-2, but that can be done in #3426.

can be migrated too if it is a problem

roman-khimov · 2026-02-20T09:41:56Z

pkg/util/state/token.go

-							zap.String("token_id", hex.EncodeToString(k)),
-						)
-					}
+		// iterating over accounts


Iterating over all of them is a bad idea. Rather there should be an index like {epoch}{user.ID}, but that's a different issue.

Is there already such an issue? Or should I create one?

Please add an issue for it.

I was thinking, how should we do GetToken then? It occurred to me that we could either have a separate bucket for such an index, in which case we would have two buckets, or GetToken would search by cursor, which removes O(1) token retrieval.

You're storing {acc} -> {key} now, it can be {pref_0}{acc} -> {key}, then a separate {pref_1}{epoch}{acc} key without any value. Adding a key is adding two keys into the same bucket. Then checking for obsolete values is trivial, Seek() to {pref_1} and grab items till epoch is not current. Then drop all of them.

Oh, I understand. I overthought it, just need another key.

pkg/util/state/token.go

pkg/util/state/migratation.go

codecov · 2026-02-20T14:57:39Z

Codecov Report

❌ Patch coverage is 43.79085% with 86 lines in your changes missing coverage. Please review.
✅ Project coverage is 25.62%. Comparing base (5ab98cc) to head (18553f8).

Files with missing lines	Patch %	Lines
pkg/util/state/migratation.go	48.88%	31 Missing and 15 partials ⚠️
pkg/services/object/delete/delete.go	0.00%	5 Missing ⚠️
pkg/services/object/get/exec.go	0.00%	5 Missing ⚠️
pkg/services/object/search/util.go	0.00%	5 Missing ⚠️
pkg/services/object/server.go	0.00%	5 Missing ⚠️
pkg/util/state/token.go	68.75%	4 Missing and 1 partial ⚠️
cmd/neofs-node/object.go	0.00%	4 Missing ⚠️
cmd/neofs-node/config.go	0.00%	2 Missing ⚠️
pkg/services/object/put/remote.go	60.00%	1 Missing and 1 partial ⚠️
pkg/services/object/put/streamer.go	60.00%	1 Missing and 1 partial ⚠️
... and 3 more

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3817      +/-   ##
==========================================
+ Coverage   25.58%   25.62%   +0.03%     
==========================================
  Files         667      667              
  Lines       42941    43011      +70     
==========================================
+ Hits        10988    11021      +33     
- Misses      30949    30974      +25     
- Partials     1004     1016      +12

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

roman-khimov · 2026-02-20T15:32:30Z

CHANGELOG.md

 ### Changed
 - SN retries notary requests if `insufficient amount of gas` error appears (#3739)
 - Speed up metabase resync by using batch operations (#3804)
+- Session key storage access session keys by account only (#3817)


Wrong section

roman-khimov · 2026-02-20T15:34:54Z

pkg/util/state/migratation.go

+			}
+		}
+
+		p.l.Info("duality token migration completed",


session token storage migration completed

And this can logged outside of transaction, btw.

roman-khimov · 2026-02-20T15:38:32Z

pkg/util/state/migratation.go

+
+		owners := make(map[user.ID]int)
+		c := rootBucket.Cursor()
+		for ownerKeyBytes, v := c.First(); ownerKeyBytes != nil; ownerKeyBytes, v = c.Next() {


Looks like this will be performed on every node start, while in fact it's needed only once. Can this be solved?

If data has migrated, then their v != nil, meaning that continue will be called below, on the first check. Or should we avoid the for loop as well?

Ideally you should just read something (no DB changes at all) and move on if there is nothing to do.

Because Update() itself will write to the DB even if there are no changes done. Also we'd get a migration message when no migration was done in fact.

If we assume that migration is performed only once and only for the old version of token storage, then before starting migration, we can first View the first key in the bucket, and if it has a value, which means that it is not a nested bucket, then the data has already been migrated. Is this option acceptable?

Yeah, should be ok.

roman-khimov · 2026-02-20T15:40:06Z

pkg/util/state/migratation.go

+		}
+	}
+
+	privKey, err := x509.ParseECPrivateKey(rawKey)


Not that it's a big problem, but not something I'd expect either. NeoGo never does it, for example. To be fair, the most appropriate storage format here would probably be NEP-2, but that can be done in #3426.

roman-khimov · 2026-02-20T15:40:25Z

pkg/util/state/token.go

-							zap.String("token_id", hex.EncodeToString(k)),
-						)
-					}
+		// iterating over accounts


Please add an issue for it.

carpawell · 2026-02-20T15:38:12Z

cmd/neofs-node/config.go

 		fatalOnErr(err)
 	}

+	err = persistate.MigrateSessionTokensToAccounts()


it gonna migrate until we remove it? can be tight to node's version. but no-op migration should not be a problem though

I think we'll remove it at some point, but I don't know how to determine when that point will be.

carpawell · 2026-02-20T15:42:51Z

pkg/util/state/migratation.go

+				}
+				privKey, err := p.extractKeyFromPackedToken(tokenData)
+				if err != nil {
+					if p.l != nil {


do we expect it to be nil?

No, if dropped.

carpawell · 2026-02-20T16:11:19Z

pkg/util/state/migratation.go

+		}
+	}
+
+	privKey, err := x509.ParseECPrivateKey(rawKey)


can be migrated too if it is a problem

Contains obtaining auth key from session token. Also contains fix #3805. Signed-off-by: Andrey Butusov <andrey@nspcc.io>

There is no need to store session information in two formats in session key storage. An ID is not required, as it can be retrieved using the public key account of the open session. Closes #3793. Signed-off-by: Andrey Butusov <andrey@nspcc.io>

End-rey self-assigned this Feb 12, 2026

End-rey requested review from carpawell and roman-khimov as code owners February 12, 2026 20:51

End-rey added the blocked Can't be done because of something label Feb 12, 2026

End-rey requested a review from cthulhu-rider as a code owner February 12, 2026 20:51

End-rey mentioned this pull request Feb 12, 2026

session: add AuthUser func nspcc-dev/neofs-sdk-go#779

Merged

roman-khimov reviewed Feb 13, 2026

View reviewed changes

pkg/services/object/server.go Outdated Show resolved Hide resolved

End-rey force-pushed the 3793-access-session-keys-by-account-only branch from 2a3b793 to 6aa3143 Compare February 16, 2026 19:39

roman-khimov reviewed Feb 20, 2026

View reviewed changes

roman-khimov removed the blocked Can't be done because of something label Feb 20, 2026

End-rey force-pushed the 3793-access-session-keys-by-account-only branch from 6aa3143 to 175c665 Compare February 20, 2026 14:54

End-rey requested a review from roman-khimov February 20, 2026 15:07

roman-khimov reviewed Feb 20, 2026

View reviewed changes

carpawell approved these changes Feb 20, 2026

View reviewed changes

End-rey mentioned this pull request Feb 20, 2026

Prefixed keys in session token storage #3841

Open

End-rey force-pushed the 3793-access-session-keys-by-account-only branch 2 times, most recently from ea12b52 to 18553f8 Compare February 20, 2026 17:06

End-rey added 2 commits February 20, 2026 20:07

go.mod: update SDK

987b8cd

Contains obtaining auth key from session token. Also contains fix #3805. Signed-off-by: Andrey Butusov <andrey@nspcc.io>

Comments

Conversation

End-rey commented Feb 12, 2026

Uh oh!

End-rey commented Feb 12, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

codecov bot commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

codecov bot commented Feb 20, 2026 •

edited

Loading