parallel quest smoke test

docker-compose-test-with-kafka.yaml

@@ -70,19 +70,21 @@ services:
     image: ghcr.io/parseablehq/quest:main
     platform: linux/amd64
     pull_policy: always
-    command: [
-      "load",
-      "http://parseable:8000",
-      "parseableadmin",
-      "parseableadmin",
-      "20",
-      "10",
-      "5m",
-      "minio:9000",
-      "parseable",
-      "supersecret",
-      "parseable"
-    ]
+    entrypoint:
+      - sh
+      - -c
+      - |
+        STREAM=$$(head /dev/urandom | tr -dc a-z | head -c10) && \
+        ./quest.test -test.v -test.parallel=10 \
+          -mode=load \
+          -query-url=http://parseable:8000 \
+          -stream=$$STREAM \
+          -query-user=parseableadmin \
+          -query-pass=parseableadmin \
+          -minio-url=minio:9000 \
+          -minio-user=parseable \
+          -minio-pass=supersecret \
+          -minio-bucket=parseable
     depends_on:
       parseable:
         condition: service_healthy

docker-compose-test.yaml

@@ -65,7 +65,7 @@ services:
     platform: linux/amd64
     pull_policy: always
     command: [
-      "load",
+      "load-parallel",
       "http://parseable:8000",
       "parseableadmin",
       "parseableadmin",

src/handlers/http/middleware.rs

@@ -459,16 +459,27 @@ pub async fn refresh_token(
                 roles_to_permission(user_roles, tenant_id.as_deref().unwrap_or(DEFAULT_TENANT)),
                 &tenant_id,
             );
-        } else if let Some(users) = users().get(tenant_id.as_deref().unwrap_or(DEFAULT_TENANT))
-            && let Some(user) = users.get(&userid)
-        {
-            mut_sessions().track_new(
-                userid.clone(),
-                key.clone(),
-                Utc::now() + EXPIRY_DURATION,
-                roles_to_permission(user.roles(), tenant_id.as_deref().unwrap_or(DEFAULT_TENANT)),
-                &tenant_id,
-            );
+        } else {
+            // Clone user roles under USERS read lock, then drop it before
+            // acquiring SESSIONS write lock to preserve lock ordering.
+            let user_roles = if let Some(users) =
+                users().get(tenant_id.as_deref().unwrap_or(DEFAULT_TENANT))
+                && let Some(user) = users.get(&userid)
+            {
+                Some(user.roles())
+            } else {
+                None
+            };
+            // USERS read lock dropped here
+            if let Some(user_roles) = user_roles {
+                mut_sessions().track_new(
+                    userid.clone(),
+                    key.clone(),
+                    Utc::now() + EXPIRY_DURATION,
+                    roles_to_permission(user_roles, tenant_id.as_deref().unwrap_or(DEFAULT_TENANT)),
+                    &tenant_id,
+                );
+            }
         }
     }
     Ok(())