fix: wildcard server sends interactions to all clients

[dogancanbakir]

Summary

• In wildcard mode (-wc), GetInteractionsWithId clears data on the first client's poll, starving all other clients
• Add per-consumer read offsets (GetInteractionsWithIdForConsumer) so each client independently tracks its position in the shared data buffer
• Clean up consumer offsets on deregister, evict stale consumers lazily, enforce configurable max buffer cap (INTERACTSH_MAX_SHARED_INTERACTIONS, default 10000)

Fixes #1296

[neo-by-projectdiscovery-dev]

Neo - PR Security Review

No security issues found

Highlights

• Implements per-consumer read offsets for wildcard mode to fix multi-client polling starvation
• Adds buffer cap enforcement (INTERACTSH_MAX_SHARED_INTERACTIONS, default 10000) to prevent unbounded memory growth
• Includes consumer cleanup on deregister and stale consumer eviction based on EvictionTTL

Hardening Notes

• Consider adding rate limiting on the /poll endpoint to prevent abuse from authenticated clients making excessive polling requests
• Add logging/metrics for buffer cap enforcement events in enforceMaxBuffer (storagedb.go:367) to monitor when the limit is reached and data is being trimmed
• Consider adding a configurable maximum number of concurrent consumers per wildcard ID to prevent resource exhaustion from a single attacker registering many clients

_{Comment @neo help for available commands. · Open in Neo}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/wildcard-multi-client-poll

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Mzack9999]

LGTM - This was an original design choice as the instance was supposed to be single authenticated user with the capability to obtain full interactions without per-user tracking. This also handled the case of instance reconnection with a potential different correlationId.