mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-28 02:21:30 +02:00
4f6caa1110
A client that reads the Agent Network settings, computes a change and writes the whole object back will silently revert anything that changed in between — Terraform's read-modify-write is exactly this shape. The consequence worth guarding is RedactPii: an operator enabling PII redaction in the dashboard can have it turned back off by an apply that was planned before their change, with no error and no drift warning on that run. Conditional requests need a validator. Derive one instead of storing it: a timestamp cannot separate two writes within a clock tick, and a revision column costs a migration plus the bump-discipline that goes with it. A hash of the representation needs neither and is correct by construction. The hash covers an explicit field tuple rather than the marshalled API types, whose field ordering is not a contract. AccountID stays out — it identifies the resource, not the representation — and so does UpdatedAt, so that a write changing nothing observable cannot invalidate a precondition someone else is holding. The identity fields and CreatedAt are in: a validator over only the mutable toggles would survive a delete and fresh bootstrap onto the same toggle values, and an If-Match held across that gap would then authorize a write against what is really a different resource. This only derives the validator. Nothing emits or honours it yet.