Repository navigation
WPB-29578: migrate session cookies to PostGreSQL - #5644
Open
blackheaven wants to merge 8 commits into
Open
blackheaven wants to merge 8 commits into
blackheaven wants to merge 8 commits into
Conversation
zebot
added
the
ok-to-test
blackheaven
force-pushed
the
gdifolco/WPB-29578-migration-postgres-session-store
branch
2 times, most recently
from
October 29, 2026 17:43
55712b3 to
1145bd0
Compare
blackheaven
force-pushed
the
gdifolco/WPB-29578-migration-postgres-session-store
branch
from
November 4, 2026 14:53
b61ab0a to
4b831a0
Compare
blackheaven
force-pushed
the
gdifolco/WPB-29578-migration-postgres-session-store
branch
from
November 5, 2026 13:47
4b831a0 to
e8ca66a
Compare
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The session backfill cannot decode its Cassandra scan and can resurrect revoked cookies or extend cookie validity, creating critical migration and authentication risks.
6 open issues
What changed in this PR
Adds PostgreSQL storage for session cookies, with dual writes and a background backfill worker to support migration from Cassandra.
Changes:
- Adds the session schema, PostgreSQL interpreter, dual-write mode, and migration worker.
- Wires storage selection and migration controls into Brig, deployment configuration, and operator documentation.
- Adds cookie marshalling checks and an integration test covering migration phases.
| File | Description |
|---|---|
| services/galley/galley.integration.yaml | Selects PostgreSQL session storage for integration environments. |
| services/brig/src/Brig/CanonicalInterpreter.hs | Selects the configured session-store interpreter. |
| services/brig/src/Brig/App.hs | Supports PostgreSQL in the ad hoc session-store runner. |
| services/brig/brig.integration.yaml | Enables PostgreSQL session storage. |
| services/background-worker/test/Test/Wire/Util.hs | Adds session storage to test configuration. |
| services/background-worker/test/Test/Wire/BackendNotificationPusherSpec.hs | Updates configuration fixtures with the sessions field. |
| services/background-worker/src/Wire/PostgresMigrations.hs | Starts session backfill with metrics and cleanup. |
| services/background-worker/src/Wire/BackgroundWorker/Options.hs | Adds the session migration flag. |
| services/background-worker/src/Wire/BackgroundWorker.hs | Wires migration startup and shutdown. |
| services/background-worker/background-worker.integration.yaml | Configures session storage and migration defaults. |
| postgres-schema.sql | Records the cookie table, primary key, and index. |
| libs/wire-subsystems/wire-subsystems.cabal | Exposes the new session-store modules. |
| libs/wire-subsystems/src/Wire/SessionStore/Postgres.hs | Implements PostgreSQL cookie storage and validity filtering. |
| libs/wire-subsystems/src/Wire/SessionStore/Migration.hs | Implements Cassandra-to-PostgreSQL session backfill. |
| libs/wire-subsystems/src/Wire/SessionStore/DualWrite.hs | Mirrors mutations while retaining Cassandra reads. |
| libs/wire-subsystems/src/Wire/SessionStore/Cassandra.hs | Adds the session scan used by backfill. |
| libs/wire-subsystems/src/Wire/PostgresMigrationOpts.hs | Adds session storage selection. |
| libs/wire-subsystems/postgres-migrations/20261022090000-user-cookies.sql | Creates the PostgreSQL session schema. |
| libs/wire-api/test/unit/Test/Wire/API/Roundtrip/PostgresMarshall.hs | Adds cookie marshalling round-trip checks. |
| libs/wire-api/src/Wire/API/User/Auth.hs | Adds PostgreSQL conversions for cookie types. |
| integration/test/Test/Migration/Sessions.hs | Adds phased session migration coverage. |
| integration/integration.cabal | Registers the migration test module. |
| hack/helm_vars/wire-server/values.yaml.gotmpl | Passes session storage selection into Helm values. |
| hack/helm_vars/common.yaml.gotmpl | Defines the preferred session store. |
| docs/src/developer/reference/config-options.md | Documents session migration settings and metrics. |
| charts/wire-server/values.yaml | Adds session storage and worker defaults. |
| charts/wire-server/templates/background-worker/configmap.yaml | Renders the session migration flag. |
| changelog.d/gdifolco-WPB-29578-migration-postgres-session-store | Adds a session migration changelog fragment. |
Review effort: Balanced
blackheaven
force-pushed
the
gdifolco/WPB-29578-migration-postgres-session-store
branch
from
November 10, 2026 08:36
e8ca66a to
9ac86a5
Compare
…xpired rows in list
…er-cookies pg_cron job (ADR-0005) - DualWrite mutations hold a shared per-user migration lock so they serialize against the backfill's exclusive lock: a revoke racing the copy loop either lands before the lock (row skipped) or after (Postgres row deleted), never resurrecting a cookie (5685 connections pattern). The backfill re-reads the Cassandra row inside the locked section. - Backfill stamps an absolute validity deadline computed from the row's remaining Cassandra TTL at page-fetch time (never now()+TTL at insert, which would restart and extend the cookie's validity); expired rows are skipped. - Backfill insert is ON CONFLICT DO NOTHING (insertCookieWithDeadline); the runtime renew path keeps DO UPDATE. - Reads filter expired rows; inserts purge expired rows in-statement. - New guarded migration 20261110121000-user-cookies-ttl-cleanup.sql schedules cron job expire-user-cookies (hourly) and adds user_cookies_expires_at_idx (hand-merged into postgres-schema.sql; the shared backendA database does not carry this PR's tables, so the full pg_dump regen shows only unrelated blocks). - Changelog renamed to changelog.d/5-internal/WPB-29578.
…gs, migration tests)
blackheaven
force-pushed
the
gdifolco/WPB-29578-migration-postgres-session-store
branch
from
November 13, 2026 11:12
9ac86a5 to
036ce60
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://wearezeta.atlassian.net/browse/WPB-29578
Checklist
changelog.d