session: guard nil migrated macaroon recipe

Initialize the migrated session's MacaroonRecipe before applying the
nil-perms and nil-caveats normalization used during migration
validation.

This is needed because the SQL store can represent a session with no
macaroon permission or caveat rows as a nil MacaroonRecipe, while the
KV store may still have a non-nil recipe wrapper. Without this guard,
overrideMacaroonRecipe can dereference a nil migrated recipe and panic
instead of letting the migration validation complete normally.

Using an empty MacaroonRecipe preserves the intended normalization
behavior for the nil/empty recipe cases while still allowing genuine
mismatches to fail through DeepEqual.
This commit is contained in:
Viktor Torstensson 2026-06-04 20:23:36 +02:00
parent b61f62d7d9
commit 29b3a9b8db
No known key found for this signature in database
GPG key ID: 961CC8259AE675D4

View file

@ -656,6 +656,13 @@ func overrideMacaroonRecipe(kvSession *Session, migratedSession *Session) {
kvPerms := kvSession.MacaroonRecipe.Permissions
kvCaveats := kvSession.MacaroonRecipe.Caveats
// If the migratedSession.MacaroonRecipe is nil, we set it to
// an empty MacaroonRecipe, as that can be correct when both
// kvPerms and kvCaveats are nil.
if migratedSession.MacaroonRecipe == nil {
migratedSession.MacaroonRecipe = &MacaroonRecipe{}
}
// If the kvSession has a MacaroonRecipe with nil set for any
// of the fields, we need to override the migratedSession
// MacaroonRecipe to match that.