From addd1875d37d585cfe261f3f3c008ef297fbc506 Mon Sep 17 00:00:00 2001 From: Jade Ellis Date: Mon, 12 Oct 2026 18:17:20 +0100 Subject: [PATCH] refactor(uiaa): Defer uiaa_sessions lock until session insert Do not hold the uiaa_sessions lock across device lookup in OAuth or during initial validation. Lock the map only when inserting the newly created session. --- src/service/uiaa/mod.rs | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/service/uiaa/mod.rs b/src/service/uiaa/mod.rs index 0aebaed7e..96a92eb0f 100644 --- a/src/service/uiaa/mod.rs +++ b/src/service/uiaa/mod.rs @@ -278,8 +278,6 @@ impl Service { params: Box, initiator: Option>, ) -> Result { - let mut uiaa_sessions = self.uiaa_sessions.lock().await; - let session_id = utils::random_string(Self::SESSION_ID_LENGTH); let mut info = assign!(UiaaInfo::new(flows), { params: Some(params), session: Some(session_id.clone()) }); @@ -355,7 +353,10 @@ impl Service { ))); } - uiaa_sessions.insert(session_id, UiaaSession { session_metadata, info: info.clone() }); + self.uiaa_sessions + .lock() + .await + .insert(session_id, UiaaSession { session_metadata, info: info.clone() }); Ok(info) }