headscale/hscontrol
Kristoffer Dalby 46daa659e2 state: omit AuthKeyID/AuthKey in node Updates to prevent FK errors
When a PreAuthKey is deleted, the database correctly sets auth_key_id
to NULL on referencing nodes via ON DELETE SET NULL. However, the
NodeStore (in-memory cache) retains the old AuthKeyID value.

When nodes send MapRequests (e.g., after tailscaled restart), GORM's
Updates() tries to persist the stale AuthKeyID, causing a foreign key
constraint error when trying to reference a deleted PreAuthKey.

Fix this by adding AuthKeyID and AuthKey to the Omit() call in all
three places where nodes are updated via GORM's Updates():
- persistNodeToDB (MapRequest processing)
- HandleNodeFromAuthPath (re-auth via web/OIDC)
- HandleNodeFromPreAuthKey (re-registration with preauth key)

This tells GORM to never touch the auth_key_id column or AuthKey
association during node updates, letting the database handle the
foreign key relationship correctly.

Added TestDeletedPreAuthKeyNotRecreatedOnNodeUpdate to verify that
deleted PreAuthKeys are not recreated when nodes send MapRequests.
2026-01-26 12:12:11 +00:00
..
assets editorconfig: add basic editor config 2025-12-16 10:12:36 +01:00
capver capver: generate 2025-12-18 10:02:23 +01:00
db db: use PolicyManager for RequestTags migration 2026-01-21 15:10:29 +01:00
derp derp: migrate to derpserver package API 2026-01-21 19:17:10 +00:00
dns integration: replace time.Sleep with assert.EventuallyWithT (#2680) 2025-07-10 23:38:55 +02:00
mapper db: use PolicyManager for RequestTags migration 2026-01-21 15:10:29 +01:00
policy policy: update tests for SSH validation rules 2026-01-21 17:01:30 +00:00
routes debug: add json and improve 2025-09-09 09:40:00 +02:00
state state: omit AuthKeyID/AuthKey in node Updates to prevent FK errors 2026-01-26 12:12:11 +00:00
templates Link to headscale.net for docs 2026-01-16 14:54:04 +01:00
types gen: regenerate protobuf and type views 2026-01-21 19:17:10 +00:00
util util/dns: fix variable redeclaration in ValidateDNSName 2026-01-17 10:13:24 +01:00
app.go app: only wire up debug server if set 2025-12-17 12:32:04 +01:00
auth.go cli: ensure tagged-devices is included in profile list (#2991) 2026-01-09 16:31:23 +01:00
auth_tags_test.go state: disable key expiry for tagged nodes 2026-01-16 17:05:59 +01:00
auth_test.go state: omit AuthKeyID/AuthKey in node Updates to prevent FK errors 2026-01-26 12:12:11 +00:00
debug.go lint and leftover 2025-09-09 09:40:00 +02:00
grpcv1.go grpc: support expire/delete API keys by ID 2026-01-20 17:13:38 +01:00
grpcv1_test.go grpc: support expire/delete API keys by ID 2026-01-20 17:13:38 +01:00
handlers.go all: remove deadcode (#2952) 2025-12-10 15:55:15 +01:00
metrics.go all: remove deadcode (#2952) 2025-12-10 15:55:15 +01:00
noise.go all: remove deadcode (#2952) 2025-12-10 15:55:15 +01:00
oidc.go oidc: make email verification configurable 2025-12-18 11:42:32 +00:00
oidc_template_test.go make tags first class node owner (#2885) 2025-12-02 12:01:25 +01:00
oidc_test.go oidc: make email verification configurable 2025-12-18 11:42:32 +00:00
platform_config.go Return better web errors to the user (#2398) 2025-02-01 15:25:18 +01:00
poll.go all: remove deadcode (#2952) 2025-12-10 15:55:15 +01:00
tailsql.go integration: replace time.Sleep with assert.EventuallyWithT (#2680) 2025-07-10 23:38:55 +02:00
templates_consistency_test.go Link to headscale.net for docs 2026-01-16 14:54:04 +01:00