feat(db): include database version in DbEnv#155
Conversation
- Add private `version` field to `DbEnvInner` struct - Modify `DbEnv::open()` to accept version parameter - Update `open_ephemeral()` to use `CURRENT_DB_VERSION` - Add public `version()` getter method to access stored version - Update `open_db()` and `init_db()` to read and pass version from file - Update CLI database opening functions to handle version parameter The database version is now accessible at the provider level through `DbEnv::version()` method as requested in issue #154. Co-authored-by: Ammar Arif <kariy@users.noreply.github.com>
|
Claude finished @kariy's task —— View job PR Review: Include Database Version in
|
crates/storage/db/src/lib.rs
Outdated
| pub fn open_db<P: AsRef<Path>>(path: P, version: u32) -> anyhow::Result<DbEnv> { | ||
| DbEnv::open(path.as_ref(), DbEnvKind::RW, version).with_context(|| { | ||
| format!("Opening database in read-write mode at path {}", path.as_ref().display()) |
There was a problem hiding this comment.
@claude passing the version thru an argument isn't safe as caller can pass an arbitrary value as the version. figuring out the version shouldn't be part of the public api and should be self-contained when opening the database.
There was a problem hiding this comment.
Claude finished @kariy's task —— View job
Security Analysis: Version Parameter Vulnerability
Tasks:
- Read current implementation in changed files
- Analyze the security concern at line 95
- Trace version parameter flow through call chain
- Evaluate security implications
- Provide recommendations for self-contained version determination
Security Concern Validation ⚠️
You're absolutely correct about this security vulnerability. The current implementation has a data integrity issue where callers can pass arbitrary version values that don't match the actual database state.
Current Vulnerable Flow
-
CLI Commands (
bin/katana/src/cli/db/mod.rs:49-62):let version = get_db_version(&path)?; // Read from file DbEnv::open(&path, DbEnvKind::RO, version) // Pass as parameter
-
Database Initialization (
crates/storage/db/src/lib.rs:66-70):let version = get_db_version(&path)?; // Read from file let env = open_db(path, version)?; // Pass as parameter
-
Public API (
crates/storage/db/src/lib.rs:93):pub fn open_db<P: AsRef<Path>>(path: P, version: u32) -> anyhow::Result<DbEnv>
Security Implications
Data Integrity Risk:
- Callers can call
open_db(path, 999)with arbitrary version numbers DbEnvwill store the wrong version, breaking the single source of truth principle- Could lead to data corruption if version-specific logic relies on incorrect version info
API Design Issue:
- Version determination leaks into public API when it should be internal
- Creates potential for human error in version management
- Violates encapsulation principles
Recommended Solution
Make version determination self-contained:
// Remove version parameter from public APIs
pub fn open_db<P: AsRef<Path>>(path: P) -> anyhow::Result<DbEnv>
impl DbEnv {
pub fn open(path: impl AsRef<Path>, kind: DbEnvKind) -> Result<DbEnv, DatabaseError> {
// Read version internally from the database path
let version = get_db_version(&path)?;
// Rest of opening logic...
let inner = DbEnvInner { env, dir, ephemeral: false, version };
}
}Benefits:
- ✅ Version always matches actual database state
- ✅ Eliminates possibility of caller passing wrong version
- ✅ Simplifies public API surface
- ✅ Maintains single source of truth for version information
This change would require updating all call sites but significantly improves data integrity and API design.
Binary size report 📊
|
|
Claude finished @kariy's task —— View job PR Review: Database Version in
|
|
Claude finished @kariy's task —— View job PR Review: Database Version in
|
|
Claude encountered an error —— View job PR Review: Database Version in
|
|
Claude finished @kariy's task —— View job Claude finished @kariy's task —— View job PR Review: Database Version in
|
|
Claude finished @kariy's task —— View job PR Review: Database Version in
|
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #155 +/- ##
==========================================
- Coverage 73.32% 72.11% -1.21%
==========================================
Files 209 212 +3
Lines 23132 23492 +360
==========================================
- Hits 16961 16942 -19
- Misses 6171 6550 +379 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|

Closes #154
This PR implements the feature to include database version in the
DbEnvstruct as requested in issue #154.Changes
versionfield toDbEnvInnerstructDbEnv::open()to accept version parameteropen_ephemeral()to useCURRENT_DB_VERSIONversion()getter method to access stored versionopen_db()andinit_db()to read and pass version from fileImplementation Details
The version is now stored as a private field in the
DbEnvInnerstruct and is read from the version file during database initialization. For ephemeral databases, it uses theCURRENT_DB_VERSIONconstant.The version is accessible through the public
version()method while keeping the field private to prevent mutation as specified in the requirements.Generated with Claude Code