@redis/core-team we have discussed this in issue #5292 please read the history, and now I find another new bug, so as not to disturb antirez, I open this new one.

This new bug is about ACL, if a user execute lua script with limited ACLs in master, and then replicate the script verbatim to replica, it will result in data inconsistency, because master client can execute all commands, for example: 1. master

127.0.0.1:6379> debug LUA-ALWAYS-REPLICATE-COMMANDS 0
127.0.0.1:6379> acl setuser test on nopass ~* -@all +set +eval +keys
OK
127.0.0.1:6379> auth test abc
OK
127.0.0.1:6379> eval "redis.call('set','foo','bar') redis.call('lpush','list','element')" 0
(error) ERR Error running script (call to f_d067a2e509dfa98f9a3cbfe499c8ad2a5226acce): @user_script:1: @user_script: 1: The user executing the script can't run this command or subcommand
127.0.0.1:6379> keys *
1) "foo"
  1. replica
127.0.0.1:6666> keys *
1) "foo"
2) "list"

I don't wanna fix this, as antirez said this is a design error, the question is should we remove the previous mechanism to replicate the script verbatim or just keep the configuration lua-replicate-commands and debug LUA-ALWAYS-REPLICATE-COMMANDS?

Comment From: oranagra

@soloestoy good catch. i think we agreed to drop script replication in redis 7.0, i don't think we can do that before. considering that this is a serious issue, i wonder if we can somehow solve it in the meanwhile (without a huge effort).

p.s. there no need to worry about not posting in old issues, Salvatore isn't following notifications from this repo unless maybe if we @ mention him explicitly.

Comment From: yossigo

I think we can settle for adding a "dangerous" warning in the DEBUG LUA-ALWAYS-REPLICATE-COMMANDS command, I don't think it really makes sense to try to fix that at this point.

Comment From: oranagra

@yossigo it's also a config lua-replicate-commands

Comment From: madolson

I would also advocate just dropping support for script replication in Redis 7, and not doing anything else explicit to resolve it. We could consider throwing a warning in the log if a lua command errors for ACLs, but I don't feel strongly about it.