fix(store): fail export when its WORM audit write fails #268

2026-07-31T16:39:07Z

KofTwentyTwo commented

2026-07-31 16:39:07 +00:00

(Migrated from github.com)

Summary

DatabaseEngine::export_messages_to_file (crates/nuncio-store/src/db.rs) discarded the result of its WORM audit-log write with let _ = ..., so an export whose audit record failed to persist still returned Ok -- an unaudited export was indistinguishable from a properly audited one, defeating the tamper-evidence the WORM log exists to provide.
The audit write is now ?-propagated: any failure to append the WORM audit record now fails the export with DatabaseError (surfaced by the gRPC handler in crates/nunciod/src/grpc.rs as Status::internal, which was already correctly wired to map an Err here -- it just never received one).

Test plan

Added export_messages_to_file_fails_when_worm_audit_write_fails in crates/nuncio-store/src/db.rs, which forces a genuine storage failure (closing the connection pool out from under the engine, mirroring the existing check_integrity_pool_propagates_transient_timeout_without_masking_as_corrupt technique in the same file) and asserts the export returns Err.
cargo fmt --all -- --check
cargo check-all (clippy --all-targets --workspace -D warnings, 0 warnings)
cargo test-all (0 failed, 0 ignored)

Refs #246

## Summary - `DatabaseEngine::export_messages_to_file` (`crates/nuncio-store/src/db.rs`) discarded the result of its WORM audit-log write with `let _ = ...`, so an export whose audit record failed to persist still returned `Ok` -- an unaudited export was indistinguishable from a properly audited one, defeating the tamper-evidence the WORM log exists to provide. - The audit write is now `?`-propagated: any failure to append the WORM audit record now fails the export with `DatabaseError` (surfaced by the gRPC handler in `crates/nunciod/src/grpc.rs` as `Status::internal`, which was already correctly wired to map an `Err` here -- it just never received one). ## Test plan - [x] Added `export_messages_to_file_fails_when_worm_audit_write_fails` in `crates/nuncio-store/src/db.rs`, which forces a genuine storage failure (closing the connection pool out from under the engine, mirroring the existing `check_integrity_pool_propagates_transient_timeout_without_masking_as_corrupt` technique in the same file) and asserts the export returns `Err`. - [x] `cargo fmt --all -- --check` - [x] `cargo check-all` (clippy `--all-targets --workspace -D warnings`, 0 warnings) - [x] `cargo test-all` (0 failed, 0 ignored) Refs #246

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/nuncio#268