From 29b3a9b8db56b47a6163781d53201dac1d222378 Mon Sep 17 00:00:00 2001 From: Viktor Torstensson Date: Thu, 4 Jun 2026 20:23:36 +0200 Subject: [PATCH] session: guard nil migrated macaroon recipe Initialize the migrated session's MacaroonRecipe before applying the nil-perms and nil-caveats normalization used during migration validation. This is needed because the SQL store can represent a session with no macaroon permission or caveat rows as a nil MacaroonRecipe, while the KV store may still have a non-nil recipe wrapper. Without this guard, overrideMacaroonRecipe can dereference a nil migrated recipe and panic instead of letting the migration validation complete normally. Using an empty MacaroonRecipe preserves the intended normalization behavior for the nil/empty recipe cases while still allowing genuine mismatches to fail through DeepEqual. --- session/sql_migration.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/session/sql_migration.go b/session/sql_migration.go index 5861a001..edf9b8ae 100644 --- a/session/sql_migration.go +++ b/session/sql_migration.go @@ -656,6 +656,13 @@ func overrideMacaroonRecipe(kvSession *Session, migratedSession *Session) { kvPerms := kvSession.MacaroonRecipe.Permissions kvCaveats := kvSession.MacaroonRecipe.Caveats + // If the migratedSession.MacaroonRecipe is nil, we set it to + // an empty MacaroonRecipe, as that can be correct when both + // kvPerms and kvCaveats are nil. + if migratedSession.MacaroonRecipe == nil { + migratedSession.MacaroonRecipe = &MacaroonRecipe{} + } + // If the kvSession has a MacaroonRecipe with nil set for any // of the fields, we need to override the migratedSession // MacaroonRecipe to match that.