Skip to content

Enable AMQP Publisher Confirms in transaction RabbitMQ producer to prevent silent message loss #1803

@ClaraTersi

Description

@ClaraTersi

The ProducerDefault method in the transaction component uses fire-and-forget Channel.Publish(), which only guarantees bytes were written to the TCP buffer — not that the broker received or persisted the message. This creates a silent data loss window: if the broker crashes between TCP accept and disk persistence, the producer believes the message was delivered when it was not. As a result, transactions currently become dependent on the Redis outbox mechanism to recover from these undetected losses, adding unnecessary coupling and latency to the critical path.

The most critical impact is on the balance/transaction/operations async path (send-bto-execute-async.go), where a false-positive success prevents the synchronous DB fallback from triggering, leading to silent data loss.

Proposed fix: Enable AMQP Publisher Confirms using PublishWithDeferredConfirmWithContext + DeferredConfirmation.WaitContext so the producer only returns success after the broker explicitly acknowledges receipt. Scope limited to the transaction component's producer.rabbitmq.go.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions