Copy authorization slices on update, drain queued input on close, and drop input when the desktop switch fails

This commit is contained in:
Viktor Liu
2026-09-22 19:46:36 +02:00
parent 921aa2b543
commit 2f03ea4051
2 changed files with 48 additions and 12 deletions
+7 -5
View File
@@ -117,14 +117,16 @@ func (a *Authorizer) Update(config *Config) {
}
a.userIDClaim = userIDClaim
// Store authorized users list
a.authorizedUsers = config.AuthorizedUsers
// Copy rather than alias: the caller keeps its Config, and everything
// published here is read by authorization decisions on other goroutines
// under a.mu. A retained slice would let a later write by the caller
// change who is authorized, outside that lock and with no write barrier.
a.authorizedUsers = slices.Clone(config.AuthorizedUsers)
// Store machine users mapping
machineUsers := make(map[string][]uint32)
machineUsers := make(map[string][]uint32, len(config.MachineUsers))
for osUser, indexes := range config.MachineUsers {
if len(indexes) > 0 {
machineUsers[osUser] = indexes
machineUsers[osUser] = slices.Clone(indexes)
}
}
a.machineUsers = machineUsers