Pillar: P0 Trust. Follow-up to #757 (#834), from its security review.
Suspending or removing an account now closes its event streams and app sockets, and refuses its push at the ref update. Two narrower cases remain:
A rollout's draining process. The closing hangs off the event bus of the process that did the suspending. During a rollout the old process, which is draining, keeps the account's streams and sockets open until they close by themselves or the process exits.
A read-only HTTP clone in progress. A clone or fetch over HTTP that was authenticated before the suspension runs to the end. It only reads what the account could already read.
Acceptance criteria
[ ] A process that is draining after a rollout learns of a suspension or removal (from the shared database, not only its own bus) and closes that account's streams and sockets too.
[ ] A clone or fetch over HTTP in progress when its account is suspended is cut, or the issue records why finishing it is acceptable.
Pillar: P0 Trust. Follow-up to #757 (#834), from its security review.
Suspending or removing an account now closes its event streams and app sockets, and refuses its push at the ref update. Two narrower cases remain:
Acceptance criteria