Found while reviewing geowiki_public_website's map module (modules/geowiki_map/geowiki_map/service.py).
The module keeps a process-global cache of CSP origins derived from its table (the CSP middleware reads it on every response, so it cannot query per request). Writes refresh that cache — but the only points a module can hook are before commit: after flush(), the transaction can still fail or roll back, leaving cache and database diverged until the next successful write or a restart.
Concrete failure: a layer delete whose commit fails still removes that layer's origin from every response's Content-Security-Policy — the overlay goes dark site-wide with only console evidence. The create-side mirror pollutes the CSP with a host that was never committed.
What would fix it: a supported post-commit callback on the request-scoped session (e.g. session.on_commit(fn) or an event the hosting layer fires after a successful commit), so modules can refresh derived caches only from committed state.
Workaround today is refreshing after flush and accepting the divergence window, which is what geowiki does — noted in review rather than patched, since the correct fix lives here.
Found while reviewing geowiki_public_website's map module (modules/geowiki_map/geowiki_map/service.py).
The module keeps a process-global cache of CSP origins derived from its table (the CSP middleware reads it on every response, so it cannot query per request). Writes refresh that cache — but the only points a module can hook are before commit: after
flush(), the transaction can still fail or roll back, leaving cache and database diverged until the next successful write or a restart.Concrete failure: a layer delete whose commit fails still removes that layer's origin from every response's Content-Security-Policy — the overlay goes dark site-wide with only console evidence. The create-side mirror pollutes the CSP with a host that was never committed.
What would fix it: a supported post-commit callback on the request-scoped session (e.g.
session.on_commit(fn)or an event the hosting layer fires after a successful commit), so modules can refresh derived caches only from committed state.Workaround today is refreshing after flush and accepting the divergence window, which is what geowiki does — noted in review rather than patched, since the correct fix lives here.