fix(server): race condition in revoked token logic (#23311)

server/server.go

@@ -561,13 +561,15 @@ func (server *ArgoCDServer) Run(ctx context.Context, listeners *Listeners) {
 		}
 	}()
 
-	server.userStateStorage.Init(ctx)
-
 	metricsServ := metrics.NewMetricsServer(server.MetricsHost, server.MetricsPort)
 	if server.RedisClient != nil {
 		cacheutil.CollectMetrics(server.RedisClient, metricsServ, server.userStateStorage.GetLockObject())
 	}
 
+	// Don't init storage until after CollectMetrics. CollectMetrics adds hooks to the Redis client, and Init
+	// reads those hooks. If this is called first, there may be a data race.
+	server.userStateStorage.Init(ctx)
+
 	svcSet := newArgoCDServiceSet(server)
 	server.serviceSet = svcSet
 	grpcS, appResourceTreeFn := server.newGRPCServer()

util/session/state.go

@@ -38,6 +38,8 @@ func NewUserStateStorage(redis *redis.Client) *userStateStorage {
 	}
 }
 
+// Init sets up watches on the revoked tokens and starts a ticker to periodically resync the revoked tokens from Redis.
+// Don't call this until after setting up all hooks on the Redis client, or you might encounter race conditions.
 func (storage *userStateStorage) Init(ctx context.Context) {
 	go storage.watchRevokedTokens(ctx)
 	ticker := time.NewTicker(storage.resyncDuration)