Skip to content

fix: do not fail connection setup when ACL denies both CLIENT SETINFO and ECHO - #679

Open
Aryan-Pardeshi wants to merge 2 commits into
redis:mainfrom
Aryan-Pardeshi:fix/acl-denied-echo-fallback
Open

fix: do not fail connection setup when ACL denies both CLIENT SETINFO and ECHO#679
Aryan-Pardeshi wants to merge 2 commits into
redis:mainfrom
Aryan-Pardeshi:fix/acl-denied-echo-fallback

Conversation

@Aryan-Pardeshi

@Aryan-Pardeshi Aryan-Pardeshi commented Aug 9, 2026

Copy link
Copy Markdown

Fixes #673

Client identification is best-effort telemetry, so it should never be the reason a connection cannot be created. Today it can be.

NoPermissionError subclasses ResponseError, so an ACL user denied CLIENT SETINFO lands in the except ResponseError branch as intended — but the echo fallback inside that branch is not itself guarded. If the same ACL also denies ECHO, the second NoPermissionError propagates straight out of connection setup, and the user sees a confusing message about the echo command when all they did was connect.

The same unguarded-fallback shape appears in four places in redisvl/redis/connection.py, so all four are fixed:

  • RedisConnectionFactory.get_redis_connection
  • RedisConnectionFactory._get_aredis_connection
  • RedisConnectionFactory.validate_sync_redis
  • RedisConnectionFactory.validate_async_redis

Each fallback echo is now wrapped in its own try/except ResponseError that logs at debug level and continues. No other behaviour changes: a client whose ACL permits either command still gets its library name set exactly as before.

tests/unit/test_connection_acl.py covers all four entry points. The two validate_* tests construct real Redis/AsyncRedis instances rather than mocks, because validate_sync_redis gates on issubclass(type(redis_client), ...), which a MagicMock(spec=Redis) does not satisfy — construction opens no socket and both commands are patched, so no server is contacted.

Verified the tests fail against unmodified main (4 failed) and pass with the change (4 passed). Full unit suite is green, and isort --profile black / black --target-version py311 report no changes.

Happy to fold the four guards into one shared private helper if you would prefer that shape — I kept the diff local so the fix is easy to read.


Note

Low Risk
Narrow error-handling change around best-effort client identification; successful paths unchanged and covered by new unit tests.

Overview
Connection setup no longer fails when Redis ACL denies both CLIENT SETINFO and the ECHO fallback used for library-name telemetry.

After client_setinfo raises ResponseError, the existing echo fallback in get_redis_connection, _get_aredis_connection, validate_sync_redis, and validate_async_redis is now wrapped in its own try/except ResponseError. Denied ECHO is logged at debug and setup continues; behavior is unchanged when either command is allowed.

Adds tests/unit/test_connection_acl.py with four unit tests (sync/async factory and validate paths) asserting both commands are attempted without raising.

Reviewed by Cursor Bugbot for commit 02d5409. Bugbot is set up for automated code reviews on this repo. Configure here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Connection fails outright when ACL denies both CLIENT SETINFO and ECHO

1 participant