Skip to content

Fix sQL findById resolvers invoke NonEmpty callbacks with an empty batch - #7119

Merged
tim-smart merged 2 commits into
mainfrom
audit/repro-b206fa5d76-sql-resolver-empty-id-batch
Aug 7, 2026
Merged

Fix sQL findById resolvers invoke NonEmpty callbacks with an empty batch#7119
tim-smart merged 2 commits into
mainfrom
audit/repro-b206fa5d76-sql-resolver-empty-id-batch

Conversation

@fubhy

@fubhy fubhy commented Aug 7, 2026

Copy link
Copy Markdown
Member

Summary

Both resolvers invoke options.execute(inputs) unconditionally after partitioning. When all requests fail encoding, inputs is [], despite the public callback type being NonEmptyArray.

Important

This PR starts with focused failing reproduction tests. Add the implementation fix to this same branch; CI is expected to fail until that fix is included.

SQL findById resolvers invoke NonEmpty callbacks with an empty batch

Module: packages/effect/src/unstable/sql/SqlResolver.ts
Audit ID: relsem-sql-empty-id-batch
Severity / confidence: medium / high

What happens

Both resolvers invoke options.execute(inputs) unconditionally after partitioning. When all requests fail encoding, inputs is [], despite the public callback type being NonEmptyArray.

Why it happens

The owning implementation diverges from relation unstable-services-018.

Expected behavior

ordered.execute and findById.execute receive Arr.NonEmptyArray encoded inputs. Per-request encoding failures complete those requests with SchemaError and must not create an impossible empty execute batch.

Relevant implementation

These links and excerpts are pinned to audit base b206fa5d7655c1634c9993410a9203f6616a5ca2.

View problematic code at packages/effect/src/unstable/sql/SqlResolver.ts:101
export const ordered = <Req extends Schema.Constraint, Res extends Schema.Constraint, _, E, R>(

View exact lines on GitHub

Reproduction

pnpm --filter effect test --run test/unstable/sql/SqlResolver.test.ts -t "does not execute a batch when every id fails encoding"

Observed failure: Independently rerun; failed at the intended semantic assertion.

Implementation handoff

The initial reproduction tests on this branch are the regression specification for the implementation fix that should follow in this PR.

  1. Start with the pinned implementation excerpts and the Why it happens analysis above.
  2. Change the implementation so it satisfies the stated Expected behavior; do not weaken or remove the reproduction assertions.
  3. Run the focused reproduction command(s) and confirm the observed failures become passing tests:
pnpm --filter effect test --run test/unstable/sql/SqlResolver.test.ts -t "does not execute a batch when every id fails encoding"
  1. Run the affected package's existing tests, then the repository lint and type checks before requesting review.

Audit provenance

  • Audit base: b206fa5d7655c1634c9993410a9203f6616a5ca2
  • Reproduction base: b206fa5d7655c1634c9993410a9203f6616a5ca2
  • Findings: relsem-sql-empty-id-batch
  • Initial patch: focused reproduction tests; implementation fix pending

Closes EFF-554

@fubhy fubhy added the audit Findings originating from the Effect runtime correctness audit label Aug 7, 2026
@changeset-bot

changeset-bot Bot commented Aug 7, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 0e9a296

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 30 packages
Name Type
effect Patch
@effect/ai-anthropic Patch
@effect/ai-openai Patch
@effect/ai-openai-compat Patch
@effect/ai-openrouter Patch
@effect/atom-react Patch
@effect/atom-solid Patch
@effect/atom-vue Patch
@effect/docgen Patch
@effect/doctest Patch
@effect/openapi-generator Patch
@effect/opentelemetry Patch
@effect/platform-browser Patch
@effect/platform-bun Patch
@effect/platform-deno Patch
@effect/platform-node Patch
@effect/platform-node-shared Patch
@effect/sql-clickhouse Patch
@effect/sql-d1 Patch
@effect/sql-libsql Patch
@effect/sql-mssql Patch
@effect/sql-mysql2 Patch
@effect/sql-pg Patch
@effect/sql-pglite Patch
@effect/sql-sqlite-bun Patch
@effect/sql-sqlite-do Patch
@effect/sql-sqlite-node Patch
@effect/sql-sqlite-react-native Patch
@effect/sql-sqlite-wasm Patch
@effect/vitest Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@effect-slopcop effect-slopcop Bot added 4.0 bug Something isn't working labels Aug 7, 2026

@pullfrog pullfrog Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Important

This PR adds a correct reproduction test for findById, but the implementation fix is still pending and the ordered resolver (which the description says is also affected) lacks a matching regression test.

Reviewed changes

  • Added a focused regression test in packages/effect/test/unstable/sql/SqlResolver.test.ts that verifies SqlResolver.findById does not call execute when every id fails schema encoding.

⚠️ Implementation fix still pending

The PR description states this branch intentionally starts with failing reproduction tests and that the implementation fix should be added to the same branch. The current commit only adds the test; the unconditional options.execute(inputs) calls in SqlResolver.ordered, SqlResolver.findById, SqlResolver.grouped, and SqlResolver.void_ still pass an empty array when all requests fail encoding.

⚠️ Missing regression test for ordered

The description explicitly identifies ordered as one of the two affected resolvers, but the diff only adds a regression test for findById. Add an equivalent test under describe("ordered") that verifies execute is not invoked when every request fails encoding.

Pullfrog  | ⚠️ this action is pinned to a commit SHA, which freezes the cleanup step — switch to @v0 or keep the SHA fresh with Dependabot | Fix it ➔View workflow run | Using Kimi K2 (free via Pullfrog for OSS) | 𝕏

@pullfrog pullfrog Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ No new issues found.

Reviewed changes

Since the prior review at 6db67574, the author added the implementation fix and the missing regression test.

  • Added empty-batch guards in SqlResolver.ts before every unconditional options.execute(inputs) call in ordered, grouped, findById, and void_.
  • Added the missing ordered regression test that verifies execute is not invoked when every request fails encoding.
  • Added a changeset marking effect as a patch release for the fix.

Pullfrog  | ⚠️ this action is pinned to a commit SHA, which freezes the cleanup step — switch to @v0 or keep the SHA fresh with Dependabot | View workflow run | Using Kimi K2 (free via Pullfrog for OSS) | 𝕏

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Bundle Size Analysis

Generated from PR build output; treat the content below as untrusted.

File Name Current Size Previous Size Difference
basic.ts 6.92 KB 6.92 KB 0.00 KB (0.00%)
batching.ts 9.72 KB 9.72 KB 0.00 KB (0.00%)
brand.ts 6.60 KB 6.60 KB 0.00 KB (0.00%)
cache.ts 10.59 KB 10.59 KB 0.00 KB (0.00%)
config.ts 20.83 KB 20.83 KB 0.00 KB (0.00%)
differ.ts 19.67 KB 19.67 KB 0.00 KB (0.00%)
http-client.ts 21.50 KB 21.50 KB 0.00 KB (0.00%)
logger.ts 10.81 KB 10.81 KB 0.00 KB (0.00%)
metric.ts 8.86 KB 8.86 KB 0.00 KB (0.00%)
optic.ts 6.68 KB 6.68 KB 0.00 KB (0.00%)
pubsub.ts 14.86 KB 14.86 KB 0.00 KB (0.00%)
queue.ts 11.54 KB 11.54 KB 0.00 KB (0.00%)
schedule.ts 10.71 KB 10.71 KB 0.00 KB (0.00%)
schema-class.ts 19.38 KB 19.38 KB 0.00 KB (0.00%)
schema-fromJsonSchemaDocument.ts 29.24 KB 29.24 KB 0.00 KB (0.00%)
schema-representation-roundtrip.ts 25.51 KB 25.51 KB 0.00 KB (0.00%)
schema-string-transformation.ts 13.49 KB 13.49 KB 0.00 KB (0.00%)
schema-string.ts 11.03 KB 11.03 KB 0.00 KB (0.00%)
schema-template-literal.ts 15.30 KB 15.30 KB 0.00 KB (0.00%)
schema-toArbitraryLazy.ts 21.43 KB 21.43 KB 0.00 KB (0.00%)
schema-toCodeDocument.ts 23.87 KB 23.87 KB 0.00 KB (0.00%)
schema-toCodecJson.ts 18.64 KB 18.64 KB 0.00 KB (0.00%)
schema-toEquivalence.ts 18.47 KB 18.47 KB 0.00 KB (0.00%)
schema-toFormatter.ts 18.32 KB 18.32 KB 0.00 KB (0.00%)
schema-toJsonSchemaDocument.ts 22.09 KB 22.09 KB 0.00 KB (0.00%)
schema-toRepresentation.ts 19.01 KB 19.01 KB 0.00 KB (0.00%)
schema.ts 18.62 KB 18.62 KB 0.00 KB (0.00%)
stm.ts 12.59 KB 12.59 KB 0.00 KB (0.00%)
stream.ts 9.67 KB 9.67 KB 0.00 KB (0.00%)

@tim-smart
tim-smart merged commit 7aff81a into main Aug 7, 2026
20 checks passed
@tim-smart
tim-smart deleted the audit/repro-b206fa5d76-sql-resolver-empty-id-batch branch August 7, 2026 21:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

4.0 audit Findings originating from the Effect runtime correctness audit bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants