What changed, and why it matters
This change simply threads a request-scoped cancellation context through the ChannelView database call. It does not fix an active bug by itself, but it is a small cleanup that lets long-running graph queries respect cancellation signals. There is no direct security vulnerability visible in the diff.
No immediate action required. Treat as routine code hygiene. If auditing, verify that downstream callers eventually pass a real, cancellable context rather than context.TODO().
Security signals we found
Context propagation refactor in database query path
Removes a context.TODO() inside SQLStore.ChannelView
No input validation, authorization, or cryptographic changes
No bug fix or vulnerability description in commit message
Evidence from the diff
The commit updates the ChannelView method signature to accept a context.Context across the ChannelGraph facade, Store interface, KVStore, and SQLStore implementations. The SQL implementation previously used context.TODO(); it now uses the caller-provided context. The KV implementation accepts but ignores the context. The caller in graph/builder.go passes context.TODO(). This is a refactor/cleanup enabling future cancellation propagation, not a security patch.
Changed components
graph/builder.gograph/db/graph.gograph/db/interfaces.gograph/db/kv_store.gograph/db/sql_store.gograph/db/graph_test.goInspect captured patch +10 / −13
diff --git a/graph/builder.go b/graph/builder.go
index 7e1910c..ba3c508 100644
--- a/graph/builder.go
+++ b/graph/builder.go
@@ -231,7 +231,7 @@ func (b *Builder) Start() error {
// FilteredChainView instance. We do this before, as otherwise
// we may miss on-chain events as the filter hasn't properly
// been applied.
- channelView, err := b.cfg.Graph.ChannelView()
+ channelView, err := b.cfg.Graph.ChannelView(context.TODO())
if err != nil && !errors.Is(
err, graphdb.ErrGraphNoEdgesFound,
) {
diff --git a/graph/db/graph.go b/graph/db/graph.go
index e7e2027..38924c8 100644
--- a/graph/db/graph.go
+++ b/graph/db/graph.go
@@ -755,8 +755,8 @@ func (c *ChannelGraph) FetchChannelEdgesByID(ctx context.Context,
}
// ChannelView returns the verifiable edge information for each active channel.
-func (c *ChannelGraph) ChannelView() ([]EdgePoint, error) {
- return c.db.ChannelView()
+func (c *ChannelGraph) ChannelView(ctx context.Context) ([]EdgePoint, error) {
+ return c.db.ChannelView(ctx)
}
// IsZombieEdge returns whether the edge is considered zombie.
diff --git a/graph/db/graph_test.go b/graph/db/graph_test.go
index d0d4501..7e69e49 100644
--- a/graph/db/graph_test.go
+++ b/graph/db/graph_test.go
@@ -2274,7 +2274,7 @@ func TestGraphPruning(t *testing.T) {
// With all the channel points added, we'll consult the graph to ensure
// it has the same channel view as the one we just constructed.
- channelView, err := graph.ChannelView()
+ channelView, err := graph.ChannelView(ctx)
require.NoError(t, err, "unable to get graph channel view")
assertChanViewEqual(t, channelView, edgePoints)
@@ -2301,7 +2301,7 @@ func TestGraphPruning(t *testing.T) {
assertNumChans(t, graph, 2)
// Those channels should also be missing from the channel view.
- channelView, err = graph.ChannelView()
+ channelView, err = graph.ChannelView(ctx)
require.NoError(t, err, "unable to get graph channel view")
assertChanViewEqualChanPoints(t, channelView, channelPoints[2:])
@@ -2350,7 +2350,7 @@ func TestGraphPruning(t *testing.T) {
// Finally, the channel view at this point in the graph should now be
// completely empty. Those channels should also be missing from the
// channel view.
- channelView, err = graph.ChannelView()
+ channelView, err = graph.ChannelView(ctx)
require.NoError(t, err, "unable to get graph channel view")
require.Empty(t, channelView)
}
diff --git a/graph/db/interfaces.go b/graph/db/interfaces.go
index 923bc8e..dec3dba 100644
--- a/graph/db/interfaces.go
+++ b/graph/db/interfaces.go
@@ -323,7 +323,7 @@ type Store interface { //nolint:interfacebloat
// channel within the known channel graph. The set of UTXO's (along with
// their scripts) returned are the ones that need to be watched on chain
// to detect channel closes on the resident blockchain.
- ChannelView() ([]EdgePoint, error)
+ ChannelView(ctx context.Context) ([]EdgePoint, error)
// MarkEdgeZombie attempts to mark a channel identified by its channel
// ID as a zombie. This method is used on an ad-hoc basis, when channels
diff --git a/graph/db/kv_store.go b/graph/db/kv_store.go
index 280a4cb..b6e40d8 100644
--- a/graph/db/kv_store.go
+++ b/graph/db/kv_store.go
@@ -4180,7 +4180,7 @@ func (e *EdgePoint) String() string {
// within the known channel graph. The set of UTXO's (along with their scripts)
// returned are the ones that need to be watched on chain to detect channel
// closes on the resident blockchain.
-func (c *KVStore) ChannelView() ([]EdgePoint, error) {
+func (c *KVStore) ChannelView(_ context.Context) ([]EdgePoint, error) {
var edgePoints []EdgePoint
if err := kvdb.View(c.db, func(tx kvdb.RTx) error {
// We're going to iterate over the entire channel index, so
diff --git a/graph/db/sql_store.go b/graph/db/sql_store.go
index 9156f0f..70fd26c 100644
--- a/graph/db/sql_store.go
+++ b/graph/db/sql_store.go
@@ -2985,11 +2985,8 @@ func (s *SQLStore) deleteChannels(ctx context.Context, db SQLQueries,
// closes on the resident blockchain.
//
// NOTE: part of the Store interface.
-func (s *SQLStore) ChannelView() ([]EdgePoint, error) {
- var (
- ctx = context.TODO()
- edgePoints []EdgePoint
- )
+func (s *SQLStore) ChannelView(ctx context.Context) ([]EdgePoint, error) {
+ var edgePoints []EdgePoint
err := s.db.ExecTx(ctx, sqldb.ReadTxOpt(), func(db SQLQueries) error {
handleChannel := func(_ context.Context,
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.