fix(acl): fail-closed key extraction from command metadata (#566)

.github/workflows/ci.yml

@@ -362,28 +362,33 @@ jobs:
         with:
           shared-key: memory-gate
       - name: Install redis tools
-        # Hardened after three hangs-to-timeout on hosted runners (2026-08-19):
+        # Hardened after repeated hangs-to-timeout on hosted runners (2026-08-19):
         # force IPv4 (azure apt mirrors black-hole IPv6), bound every network
-        # operation, and retry — a hung apt must fail THIS step in minutes,
-        # not cancel the whole run at the workflow timeout.
-        timeout-minutes: 5
+        # operation, retry, and — crucially — try the install from the runner's
+        # PRE-BAKED apt lists BEFORE any network `update`. `apt-get update` was
+        # observed timing out at 120s repeatedly during an apt-mirror incident;
+        # redis-tools/jq are already indexed on the ubuntu-latest image, so a
+        # cache-first install succeeds without ever touching the failing mirror.
+        # timeout-minutes must exceed 3 full attempts (install+update+install) so
+        # the retry loop is not cut off mid-flight (the old 5m killed attempt 3).
+        timeout-minutes: 9
         run: |
           # set +e is load-bearing: GitHub's default `shell: bash` is `bash -e`,
           # so the FIRST `apt-get` non-zero (e.g. `timeout` exit 124) aborts the
           # whole step instantly -- the retry loop below never reaches attempt 2.
-          # Observed 2026-08-19: attempt-1 update timed out, step exited 124, no
-          # retry. Disable -e here so a failed attempt falls through to the next.
           set +e
           # DPkg::Lock::Timeout: fresh runners often hold the dpkg frontend
           # lock via unattended-upgrades; without it apt waits FOREVER with no
-          # output (observed: 5-min step timeout, zero log lines). The outer
-          # `timeout` bounds each attempt against any other silent stall.
+          # output. The outer `timeout` bounds each op against any silent stall.
           APT_OPTS="-o Acquire::ForceIPv4=true -o Acquire::Retries=3 -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 -o DPkg::Lock::Timeout=60"
+          install() { sudo timeout 120 apt-get $APT_OPTS install -y -qq redis-tools jq; }
           for i in 1 2 3; do
             echo "apt attempt $i"
-            sudo timeout 120 apt-get $APT_OPTS update -qq \
-              && sudo timeout 120 apt-get $APT_OPTS install -y -qq redis-tools jq \
-              && { echo "apt attempt $i ok"; exit 0; }
+            # 1) cache-first: no network `update`, works during a mirror outage.
+            install && { echo "apt attempt $i ok (cached lists)"; exit 0; }
+            # 2) fall back to refreshing lists, then install again.
+            sudo timeout 120 apt-get $APT_OPTS update -qq
+            install && { echo "apt attempt $i ok (after update)"; exit 0; }
             echo "apt attempt $i failed; retrying" >&2
             sleep 15
           done

CHANGELOG.md

@@ -6,6 +6,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+- **ACL `~pattern` restrictions were silently unenforced for most multi-key commands** (#566).
+  `AclTable::check_key_permission` read a command's keys from `extract_command_keys`, a
+  hand-maintained match on the command name whose fallthrough returned an EMPTY key list — and an
+  empty key list is not "checked less precisely", it makes the permission loop a no-op, so every
+  `~pattern` was ignored outright for any command the list forgot. Measured against a live server,
+  a user restricted to `~app:*` reached arbitrary keys through 21 distinct commands, in both
+  `--shards 1` and `--shards 4`: `COPY`, `ZRANGESTORE` (both positions), `SMOVE`'s DESTINATION (it
+  was listed, but as a single-key command), `LMPOP`/`ZMPOP`/`BLMPOP`/`BZMPOP`, `SINTERCARD`,
+  `ZDIFF`/`ZINTER`/`ZUNION`/`ZINTERCARD`, `SORT ... STORE`, `SORT ... BY <pattern>`,
+  `GEORADIUS ... STORE`, `EVAL`'s declared keys and `MEMORY USAGE`.
+  Key extraction is now **derived from the command registry's key specs**
+  (`COMMAND_META` `first_key`/`last_key`/`step`), so a command that declares its keys is enforced
+  automatically; hand-written arms remain only for layouts a fixed spec cannot express (`numkeys`
+  vectors, positional `STORE` clauses, the `STREAMS` token, subcommand-shaped key positions).
+  Extraction **fails closed**: a command that names keys but whose argv cannot be enumerated — or a
+  command missing from the registry entirely — is DENIED with the standard `NOPERM` error and
+  logged once per command name, so the next command that ships without a key spec fails safe
+  instead of falling open. `SORT`'s `BY`/`GET` patterns read key names computed at runtime and are
+  therefore refused for key-restricted users (`BY nosort` / `GET #` are unaffected). Commands that
+  genuinely name no key (`PING`, `CONFIG`, `SUBSCRIBE`, `KEYS`, the `FT.*`/`GRAPH.*` families, ...)
+  are unaffected, and a registry sweep test now fails if a NEW command declares no keys without
+  being reviewed. Unrestricted and `~*` users still short-circuit before any extraction; the new
+  path borrows key slices into a `SmallVec` and no longer heap-allocates per command.
+
 ### Fixed
 - **Blocking pops queued inside `MULTI` answer the wrong reply SHAPE** (#524). `BLPOP`/`BRPOP`/
   `BZPOPMIN`/`BZPOPMAX` were rewritten at queue time into `LPOP`/`RPOP`/`ZPOPMIN`/`ZPOPMAX`, whose