fix(apotheke): period-scoped stats, checked writes, transactional streaks - #496
Merged
Conversation
…eaks - #405: top_items aggregates over play_sessions scoped to the query period, instead of returning lifetime play counters for a date-range query. - #406: rank_table_for returns a hard UnknownMediaType error for an unknown media type instead of silently returning music quality ranks; kritike's health report skips the unknown type best-effort, assessment propagates. - #407: update_streak runs its read-modify-write inside one BEGIN IMMEDIATE transaction, closing the duplicate-active-streak and streak-loss races. - #450: user and API-key write functions return NotFound when the target id matches zero rows, instead of silently succeeding. - #451: revoke_api_key is user-scoped (WHERE id=? AND user_id=?); the unscoped variant is removed (least privilege), closing a cross-user IDOR. Closes #405 Closes #406 Closes #407 Closes #450 Closes #451 Gate-Passed: kanon 0.1.5 +stages:fmt,check,clippy,nextest,lint sha:501fc3306d6a07ca729dbe580b7453c3dad6b236
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #405, #406, #407, #450, #451.
revoke_api_keyis now user-scoped (WHERE id=? AND user_id=?); the unscoped variant is removed (least privilege), closing a DB-layer cross-user IDOR. (API:AuthService::revoke_api_keyarity changed; all workspace callers wired.)NotFoundon a zero-row match instead of silently succeeding. (The same class recurs across the media-entity/quality repos — tracked in Repo-wide: apotheke UPDATE/DELETE repo functions silently succeed on zero-row match #492.)top_itemsaggregates overplay_sessionsscoped to the query period (was lifetime counters).rank_table_forreturns a hardUnknownMediaTypeerror instead of silently returning music ranks for unknown types.update_streakruns inside oneBEGIN IMMEDIATEtransaction, closing duplicate-active-streak and streak-loss races.kanon gate --fullgreen.Follow-up filed: #492 (repo-wide zero-row-write class + a lint to guard it).