fix(internal): run system work as a QSystemUserSession #18

2026-10-14T20:12:41Z

KofTwentyTwo commented

2026-10-14 20:12:41 +00:00

(Migrated from github.com)

Problem

Db.asSystem ran work under an anonymous QSession subclass that holds every permission but has no token. Token-based authentication modules (OAuth2, Auth0) treat only a QSystemUserSession as valid without a token. On those hosts every system read and write failed in ActionHelper.validateSession with JWTDecodeException: The token is null.

On kof22 (OAuth2/Authentik), prod logs show ConfigSync failing with "Could not sync the storage configuration to its tables" on every call. As a result:

all 12 object_storage_* tables stayed empty, so Admin -> Storage shows no connections or buckets
the operation log, object index, capabilities and protection/header rule scoping all silently did nothing

The S3 I/O still worked because it is built from the code config.

Fix

systemSession(instance) now returns new QSystemUserSession(instance) (available since QQQ 4.1.0-RC.6). It keeps every permission and every all-access security key.

Tests

New DbSystemSessionTest checks that asSystem work sees a QSystemUserSession with the all-access keys and that the caller's session is restored. It fails without the fix and passes with it.
./mvnw verify is green locally.

Hosts need a release of this to pick it up. kof22 is on 0.1.0-RC.2.

🤖 Generated with Claude Code

## Problem `Db.asSystem` ran work under an anonymous `QSession` subclass that holds every permission but has no token. Token-based authentication modules (OAuth2, Auth0) treat only a `QSystemUserSession` as valid without a token. On those hosts every system read and write failed in `ActionHelper.validateSession` with `JWTDecodeException: The token is null`. On kof22 (OAuth2/Authentik), prod logs show `ConfigSync` failing with "Could not sync the storage configuration to its tables" on every call. As a result: - all 12 `object_storage_*` tables stayed empty, so Admin -> Storage shows no connections or buckets - the operation log, object index, capabilities and protection/header rule scoping all silently did nothing The S3 I/O still worked because it is built from the code config. ## Fix `systemSession(instance)` now returns `new QSystemUserSession(instance)` (available since QQQ 4.1.0-RC.6). It keeps every permission and every all-access security key. ## Tests - New `DbSystemSessionTest` checks that `asSystem` work sees a `QSystemUserSession` with the all-access keys and that the caller's session is restored. It fails without the fix and passes with it. - `./mvnw verify` is green locally. Hosts need a release of this to pick it up. kof22 is on 0.1.0-RC.2. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-object-storage#18