Loading
Fix truncated diffs for signed-out users
Summary
Signed-out visitors get a truncated diff on the Changes tab: streaming stops after the first couple of files and the page shows "Could not fetch all changes". Signed-in users are unaffected.
The Rack env is released as soon as the application returns a response, which for a streamed response happens while the diffs are still being rendered. The "Viewed" checkbox tooltip asks Devise for the current user, and Devise re-resolves anonymous users through Warden on every call. Warden lives in the env, so by the second or third file it is gone and the stream dies.
Two parts: the env is now released once the response has been fully sent, and the rapid diffs streaming endpoints resolve the user before they start streaming.
Reproduction steps
- Sign out of GitLab, or open an incognito window.
- Open a public merge request with more than a couple of changed files, for example !247629 (diffs)
- Only the first two files render, then "Could not fetch all changes" appears.
Same thing without a browser:
curl -s "https://gitlab.com/gitlab-org/gitlab/-/merge_requests/247629/diffs_stream?view=inline" | grep -o "<streaming-error[^>]*>"