linuser/zabbix-network-topology v5.6.12

v5.6.12 — recheck host visibility before serving the stale snapshot (#35 review)

on GitHub

Fixed

• The stale-while-rebuild snapshot now rechecks host visibility before it is served (#35 review). v5.6.11 added a longer-lived "last good snapshot" so concurrent requests get an instant map while one request rebuilds. The map cache key carries only role and user type, not effective host-group rights (computing those is the expensive fetch) — so a user who lost access to a host group while keeping the same role and user type could be served that snapshot, showing hosts they may no longer see, until it expired. That widened the permission-staleness window the 60 s response cache already has.

  The snapshot is now gated by a cheap host.get on just the snapshot's node host IDs, as the requesting user: it is served only when all are still visible, otherwise the request falls through to a fresh, correctly permission-filtered build. The check runs only on the rare stale path, not on the 60 s cache hit, and withholds the snapshot only on a confirmed visibility loss — a transient API error serves it (no worse than the 60 s cache, which serves the same key's data unchecked) rather than sending every concurrent request off to rebuild. Snapshot lifetime reduced to 5 minutes; the 60 s response-cache behaviour is unchanged.

Thanks to @rhysjoseph for catching this in review of the #35 part-1 change.