[pdm-devel] [PATCH datacenter-manager/yew-widget-toolkit 0/7] avoid more race conditions on log in

[pdm-devel] [PATCH datacenter-manager/yew-widget-toolkit 0/7] avoid more race conditions on log in

[Shannon Sterz]

previously [1] a commit addressed an issue that could log out users
right after they logged in again. this series tries to address several
more races that could have the same effect. to achieve that all requests
need to be aborted once a log out occurs. this should reduce the
possibility that one of these requests ends up in a race with a log in
request. if one of the requests addressed in this series runs with an
invalid ticket in parallel to a login request and finishes after the
login, the user will be kicked out again right after logging in.

hence, all occurrences of `Scope::send_future()` are replaced with
either AsyncAbortGuard or AsyncPool. AsyncAbortGuard is chosen when it's
about a one of requests, whereas AsyncPool is more useful in cases where
several (potentially parallel) requests may occur. these will abort any
requests when they are dropped. so once the login panel is rendered an
all other components are destroyed, the requests will be aborted.

we also need to refactor the DatacenterManagerApp a little bit. it
always gets rendered. so any requests it makes won't be dropped on log
out as it always gets rendered. hence, manually abort all its request
by:

- aborting the Loader for running tasks
- dropping its AsyncPool
- not rendering the AclContext when logged out

[1]: https://git.proxmox.com/?p=proxmox-datacenter-manager.git;a=commit;h=6a14f4571b0a8cf67949a13391671bba7c91c95b

proxmox-yew-widget-toolkit:

Shannon Sterz (1):
  loader: add helper to allow aborting a load

 src/state/loader.rs | 5 +++++
 1 file changed, 5 insertions(+)


proxmox-datacenter-manager:

Shannon Sterz (6):
  ui: main: abort running task load on log out
  ui: main: move requests into an async pool and drop it on logout
  ui: main: only render acl context when we are logged in
  ui: resource tree: use an async pool for requests
  ui: node status: handle the request via an AsyncAbortGuard
  ui: top nav bar: use an abort guard for loading the version

 ui/src/administration/node_status.rs | 20 ++++++++++----
 ui/src/main.rs                       | 41 +++++++++++++++++++---------
 ui/src/top_nav_bar.rs                |  9 ++++--
 ui/src/widget/resource_tree.rs       |  6 +++-
 4 files changed, 54 insertions(+), 22 deletions(-)


Summary over all repositories:
  5 files changed, 59 insertions(+), 22 deletions(-)

--
Generated by git-murpp 0.8.1


_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] [PATCH yew-widget-toolkit 1/1] loader: add helper to allow aborting a load

[Shannon Sterz]

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 src/state/loader.rs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/state/loader.rs b/src/state/loader.rs
index c189853f..8bafb656 100644
--- a/src/state/loader.rs
+++ b/src/state/loader.rs
@@ -182,6 +182,11 @@ impl<T: 'static + DeserializeOwned + Serialize> Loader<T> {
         drop(state);
     }
 
+    /// Abort any currently running load.
+    pub fn abort(&mut self) {
+        self.write().async_abort_guard = None;
+    }
+
     pub fn reload_button(&self) -> Button {
         let loader = self.clone();
         Button::refresh(self.loading()).onclick(move |_| loader.load())
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] [PATCH datacenter-manager 1/6] ui: main: abort running task load on log out

[Shannon Sterz]

loading currently running tasks wasn't aborted on logout. this is due
to the Loader not being dropped as the DatacenterManagerApp is always
rendered and it never drops its loader. this could trigger a race
condition between a load with a potentially expired ticket and a new
log in request. if the load returned after the login, a user would be
kicked out right after logging in again.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 ui/src/main.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ui/src/main.rs b/ui/src/main.rs
index 2cbc7a9..026b7ab 100644
--- a/ui/src/main.rs
+++ b/ui/src/main.rs
@@ -249,6 +249,7 @@ impl Component for DatacenterManagerApp {
             }
             Msg::Logout => {
                 //log::info!("CLEAR COOKIE");
+                self.running_tasks.abort();
                 self.remote_list_timeout = None;
                 proxmox_yew_comp::http_clear_auth();
                 self.login_info = None;
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] [PATCH datacenter-manager 2/6] ui: main: move requests into an async pool and drop it on logout

[Shannon Sterz]

this will abort requests that are still in flight during a log out.
such requests can then end up in a race condition with the next login.
if the login goes through before these requests return, a user will be
logged out right after logging in again.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 ui/src/main.rs | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/ui/src/main.rs b/ui/src/main.rs
index 026b7ab..985220c 100644
--- a/ui/src/main.rs
+++ b/ui/src/main.rs
@@ -12,6 +12,7 @@ use pwt::prelude::*;
 use pwt::props::TextRenderFn;
 use pwt::state::{Loader, PersistentState, SharedStateObserver};
 use pwt::widget::{Column, DesktopApp, Dialog, Mask};
+use pwt::AsyncPool;
 
 use pbs_api_types::TaskListItem;
 use proxmox_login::Authentication;
@@ -60,6 +61,8 @@ struct DatacenterManagerApp {
     view_list: Vec<String>,
     view_list_context: ViewListContext,
     _view_list_observer: SharedStateObserver<usize>,
+
+    async_pool: AsyncPool,
 }
 
 async fn check_subscription() -> Msg {
@@ -95,7 +98,8 @@ impl DatacenterManagerApp {
                 if self.subscription_confirmed {
                     ctx.link().send_message(Msg::ConfirmSubscription);
                 } else {
-                    ctx.link().send_future(check_subscription());
+                    self.async_pool
+                        .send_future(ctx.link().clone(), check_subscription());
                 }
             } else {
                 ctx.link().send_message(Msg::ConfirmSubscription);
@@ -103,13 +107,13 @@ impl DatacenterManagerApp {
             }
             //ctx.link().send_future_batch(get_fingerprint());
             //
-            self.remote_list_timeout = Self::poll_remote_list(ctx, true);
+            self.remote_list_timeout = self.poll_remote_list(ctx, true);
             self.update_views(ctx);
         }
     }
 
     fn update_views(&mut self, ctx: &Context<Self>) {
-        ctx.link().send_future(async move {
+        self.async_pool.send_future(ctx.link().clone(), async move {
             let res = http_get("/config/views", None)
                 .await
                 .map(|list: Vec<ViewConfig>| {
@@ -123,7 +127,7 @@ impl DatacenterManagerApp {
     }
 
     fn update_remotes(&mut self, ctx: &Context<Self>, result: MsgRemoteList) -> bool {
-        self.remote_list_timeout = Self::poll_remote_list(ctx, false);
+        self.remote_list_timeout = self.poll_remote_list(ctx, false);
         let mut changed = false;
         match result {
             Err(err) => {
@@ -160,10 +164,13 @@ impl DatacenterManagerApp {
         changed
     }
 
-    fn poll_remote_list(ctx: &Context<Self>, first: bool) -> Option<Timeout> {
+    fn poll_remote_list(&self, ctx: &Context<Self>, first: bool) -> Option<Timeout> {
         let link = ctx.link().clone();
+        let async_pool = self.async_pool.clone();
         let timeout = Timeout::new(if first { 0 } else { 5_000 }, move || {
-            link.send_future(async move { Msg::RemoteList(Self::get_remote_list().await) })
+            async_pool.send_future(link, async move {
+                Msg::RemoteList(Self::get_remote_list().await)
+            })
         });
         Some(timeout)
     }
@@ -226,6 +233,7 @@ impl Component for DatacenterManagerApp {
             view_list: Vec::new(),
             view_list_context,
             _view_list_observer,
+            async_pool: AsyncPool::new(),
         };
 
         this.on_login(ctx, false);
@@ -249,6 +257,8 @@ impl Component for DatacenterManagerApp {
             }
             Msg::Logout => {
                 //log::info!("CLEAR COOKIE");
+                // this will drop the pool and abort all current requests
+                self.async_pool = AsyncPool::new();
                 self.running_tasks.abort();
                 self.remote_list_timeout = None;
                 proxmox_yew_comp::http_clear_auth();
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] [PATCH datacenter-manager 3/6] ui: main: only render acl context when we are logged in

[Shannon Sterz]

otherwise it will only log errors about not being able to load the
current users acls. the request to load the acl tree could also end up
in a race with a login attempt. if the context loading with an invalid
ticket and a log in request end up running in parallel, a user will be
kicked out after logging in if the context is done loading after the
login request.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 ui/src/main.rs | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/ui/src/main.rs b/ui/src/main.rs
index 985220c..a06f569 100644
--- a/ui/src/main.rs
+++ b/ui/src/main.rs
@@ -7,6 +7,7 @@ use web_sys::HtmlElement;
 //use pbs::utils::init_task_descr_table_pbs;
 //use pbs_api_types::NodeStatus;
 use yew::prelude::*;
+use yew::virtual_dom::VNode;
 
 use pwt::prelude::*;
 use pwt::props::TextRenderFn;
@@ -319,7 +320,7 @@ impl Component for DatacenterManagerApp {
         });
 
         let username = self.login_info.as_ref().map(|info| info.userid.to_owned());
-        let body = Column::new()
+        let mut body: Html = Column::new()
             .class("pwt-viewport")
             .with_child(
                 TopNavBar::new(self.running_tasks.clone())
@@ -343,7 +344,12 @@ impl Component for DatacenterManagerApp {
                 };
                 main_view
             })
-            .with_optional_child(subscription_alert);
+            .with_optional_child(subscription_alert)
+            .into();
+
+        if self.login_info.is_some() && !loading {
+            body = html! { <AclContextProvider>{body}</AclContextProvider> };
+        }
 
         let context = self.remote_list.clone();
         let search_context = self.search_provider.clone();
@@ -352,11 +358,9 @@ impl Component for DatacenterManagerApp {
         DesktopApp::new(html! {
             <ContextProvider<SearchProvider> context={search_context}>
                 <ContextProvider<RemoteList> {context}>
-                    <AclContextProvider>
-                        <ContextProvider<ViewListContext> context={view_list_context}>
-                            {body}
-                        </ContextProvider<ViewListContext>>
-                    </AclContextProvider>
+                    <ContextProvider<ViewListContext> context={view_list_context}>
+                        {body}
+                    </ContextProvider<ViewListContext>>
                 </ContextProvider<RemoteList>>
             </ContextProvider<SearchProvider>>
         })
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] [PATCH datacenter-manager 4/6] ui: resource tree: use an async pool for requests

[Shannon Sterz]

the async pool will abort the requests it is managing when the
component is dropped. this avoids a potential race condition between
these requests and a log in attempted right after a log out.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 ui/src/widget/resource_tree.rs | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/ui/src/widget/resource_tree.rs b/ui/src/widget/resource_tree.rs
index 9f17634..c7d6e67 100644
--- a/ui/src/widget/resource_tree.rs
+++ b/ui/src/widget/resource_tree.rs
@@ -22,6 +22,7 @@ use pwt::{
         },
         ActionIcon, Column, Container, Fa, Panel, Progress, Row, Tooltip,
     },
+    AsyncPool,
 };
 use pwt_macros::{builder, widget};
 
@@ -143,6 +144,7 @@ pub struct PdmResourceTree {
     _context_listener: ContextHandle<RemoteList>,
     selection: Selection,
     _load_timeout: Option<Timeout>,
+    async_pool: AsyncPool,
 }
 
 impl PdmResourceTree {}
@@ -173,6 +175,7 @@ impl Component for PdmResourceTree {
             _context_listener,
             selection,
             _load_timeout: None,
+            async_pool: AsyncPool::new(),
         }
     }
 
@@ -189,8 +192,9 @@ impl Component for PdmResourceTree {
                     .and_then(|(context, _)| context.name);
 
                 if !props.search_only || !search_term.is_empty() {
+                    let async_pool = self.async_pool.clone();
                     self._load_timeout = Some(Timeout::new(INPUT_BUFFER_MS, move || {
-                        link.send_future(async move {
+                        async_pool.send_future(link, async move {
                             Msg::LoadResult(load_resources(search_term, view).await)
                         });
                     }));
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] [PATCH datacenter-manager 5/6] ui: node status: handle the request via an AsyncAbortGuard

[Shannon Sterz]

this makes it possible to abort a request when another one is
triggered here. in theory this could also trigger a race condition
with a potential login. however, as a user would need to trigger it
manually, this is rather unlikely to happen in practice.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 ui/src/administration/node_status.rs | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/ui/src/administration/node_status.rs b/ui/src/administration/node_status.rs
index cce3426..a3338bb 100644
--- a/ui/src/administration/node_status.rs
+++ b/ui/src/administration/node_status.rs
@@ -7,6 +7,7 @@ use proxmox_node_status::NodePowerCommand;
 use proxmox_yew_comp::{http_post, ConfirmButton, NodeStatusPanel};
 use pwt::prelude::*;
 use pwt::widget::{Column, Container, Row};
+use pwt::AsyncAbortGuard;
 
 #[derive(Properties, Clone, PartialEq)]
 pub(crate) struct NodeStatus {}
@@ -31,18 +32,22 @@ enum Msg {
 
 struct PdmNodeStatus {
     error: Option<Error>,
+    abort_guard: Option<AsyncAbortGuard>,
 }
 
 impl PdmNodeStatus {
-    fn change_power_state(&self, ctx: &yew::Context<Self>, command: NodePowerCommand) {
-        ctx.link().send_future(async move {
+    fn change_power_state(&mut self, ctx: &yew::Context<Self>, command: NodePowerCommand) {
+        let link = ctx.link().clone();
+        self.abort_guard.replace(AsyncAbortGuard::spawn(async move {
             let data = Some(serde_json::json!({"command": command}));
 
-            match http_post("/nodes/localhost/status", data).await {
+            let res = match http_post("/nodes/localhost/status", data).await {
                 Ok(()) => Msg::Reload,
                 Err(e) => Msg::Error(e),
-            }
-        });
+            };
+
+            link.send_message(res);
+        }));
     }
 }
 
@@ -51,7 +56,10 @@ impl Component for PdmNodeStatus {
     type Properties = NodeStatus;
 
     fn create(_ctx: &yew::Context<Self>) -> Self {
-        Self { error: None }
+        Self {
+            error: None,
+            abort_guard: None,
+        }
     }
 
     fn update(&mut self, ctx: &yew::Context<Self>, msg: Self::Message) -> bool {
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] [PATCH datacenter-manager 6/6] ui: top nav bar: use an abort guard for loading the version

[Shannon Sterz]

so that the request gets aborted when the component is destroyed. this
avoids a potential race condition between this request and a potential
log in.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 ui/src/top_nav_bar.rs | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/ui/src/top_nav_bar.rs b/ui/src/top_nav_bar.rs
index 7e2af71..aa6d6cb 100644
--- a/ui/src/top_nav_bar.rs
+++ b/ui/src/top_nav_bar.rs
@@ -7,6 +7,7 @@ use wasm_bindgen::UnwrapThrowExt;

 use pwt::prelude::*;
 use pwt::widget::menu::{Menu, MenuButton, MenuEntry, MenuEvent, MenuItem};
+use pwt::AsyncAbortGuard;
 use yew::html::{IntoEventCallback, IntoPropValue};
 use yew::virtual_dom::{VComp, VNode};

@@ -74,6 +75,7 @@ pub struct PdmTopNavBar {
     dark_mode: bool,
     version_info: Option<VersionInfo>,
     view_state: Option<ViewState>,
+    abort_guard: Option<AsyncAbortGuard>,
 }

 impl Component for PdmTopNavBar {
@@ -95,6 +97,7 @@ impl Component for PdmTopNavBar {
             dark_mode,
             version_info: None,
             view_state: None,
+            abort_guard: None,
         }
     }

@@ -121,8 +124,10 @@ impl Component for PdmTopNavBar {
                 true
             }
             Msg::Load => {
-                ctx.link()
-                    .send_future(async move { Msg::LoadResult(load_version().await) });
+                let link = ctx.link().clone();
+                self.abort_guard.replace(AsyncAbortGuard::spawn(async move {
+                    link.send_message(Msg::LoadResult(load_version().await))
+                }));
                 true
             }
             Msg::LoadResult(result) => {
--
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] applied: [PATCH yew-widget-toolkit 1/1] loader: add helper to allow aborting a load

[Thomas Lamprecht]

On Thu, 27 Nov 2025 16:36:03 +0100, Shannon Sterz wrote:
> 


Applied, thanks!

[1/1] loader: add helper to allow aborting a load
      commit: d5fb74e56e1dd197f54504e025c54b4b21dec61e


_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel

[pdm-devel] applied: [PATCH datacenter-manager/yew-widget-toolkit 0/7] avoid more race conditions on log in

[Thomas Lamprecht]

On Thu, 27 Nov 2025 16:36:02 +0100, Shannon Sterz wrote:
> previously [1] a commit addressed an issue that could log out users
> right after they logged in again. this series tries to address several
> more races that could have the same effect. to achieve that all requests
> need to be aborted once a log out occurs. this should reduce the
> possibility that one of these requests ends up in a race with a log in
> request. if one of the requests addressed in this series runs with an
> invalid ticket in parallel to a login request and finishes after the
> login, the user will be kicked out again right after logging in.
> 
> [...]

Applied, thanks!

[1/6] ui: main: abort running task load on log out
      commit: 3455e64361ab3e3f31cd3f687f06cd234d01589d
[2/6] ui: main: move requests into an async pool and drop it on logout
      commit: a61143f86a90e532982e3db330a7f282aefce10f
[3/6] ui: main: only render acl context when we are logged in
      commit: fb8228027dd934f91db2ce5b9f68e5770a49f6da
[4/6] ui: resource tree: use an async pool for requests
      commit: 82940257c4f8eb742a9f1fdbb72c69849dde55fe
[5/6] ui: node status: handle the request via an AsyncAbortGuard
      commit: 685b8980ed26f7cdb5038f3ce88135d27de308a5
[6/6] ui: top nav bar: use an abort guard for loading the version
      commit: 71c2ea6ae38dbd1abe5f746743ed0b9ddd1419d0


_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel