This repository has been archived by the owner on Apr 26, 2024. It is now read-only.
Long running user deactivations via admin API are not deduplicated and can starve DB connections #16055
Labels
A-Account-Deactivation
"Deleting"/"Removing" a user, GDPR erasure (erased)
A-Admin-API
S-Minor
Blocks non-critical functionality, workarounds exist.
T-Defect
Bugs, crashes, hangs, security vulnerabilities, or other reported issues.
https://matrix-org.github.io/synapse/latest/admin_api/user_admin_api.html#deactivate-account can be used to deactivate a users session. However, because it does (potentially) expensive things like deleting devices it can take a long time to run. For serious device hoarders, this can cause the request to time out.
The HTTP request will time out but the DB query does not, leading to the case where it's an easy footgun to retry a "failed" user deactivation and end up having multiple concurreent slow queries jamming up the database connection pool. Do it enough times, or to enough users and the main process will be starved out of connections.
Separately, it's probably not good that deactivations are taking minutes to run.
Example output:
SELECT left(query, 90) as query, state FROM pg_stat_activity WHERE state IS NOT NULL AND query LIKE 'DELETE%';
The text was updated successfully, but these errors were encountered: