fix(aitesis): atomic approval workflow and request authorization - #487
Merged
Conversation
- #395: submit_request always inserts a Submitted row and the auto-approve path delegates to the same validated approve sequence, so a validation or create-want failure leaves a recoverable Submitted row instead of an orphaned Approved one. - #396: idempotent want creation via a new apotheke upsert_want_by_source_ref keyed on (source='request', source_ref=request id) inside a BEGIN IMMEDIATE transaction; a retried approve reuses the same want instead of double- inserting and orphaning one. - #397: list_requests takes the caller's UserId and denies unless the caller is an admin or querying their own requests; the HTTP layer passes the JWT-derived caller id, never the query parameter. Closes #395 Closes #396 Closes #397 Gate-Passed: kanon 0.1.5 +stages:fmt,check,clippy,nextest,lint sha:0d3f1742fb15e1f513bfc3a27503cbfa176bb20f
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #395, #396, #397.
Changes
Approvedrequest before identity validation — orphaned non-terminal row on validation failure #395 — orphaned Approved row.submit_request/auto_approvepersisted anApprovedrequest before identity validation, leaving an orphaned non-terminal row on failure.submit_requestnow always inserts aSubmittedrow and the auto-approve path delegates to the same validated approve sequence, so a validation or create-want failure leaves a recoverableSubmittedrow an admin can retry.approve_requestcreates the want before persisting the status update — orphaned want and duplicate acquisition on DB failure #396 — orphaned want / duplicate acquisition.approve_requestcreated the want before persisting the status, so a DB failure orphaned the want and allowed duplicate acquisition. Now idempotent: a newapotheke::upsert_want_by_source_refkeyed on(source='request', source_ref=request id)runs insideBEGIN IMMEDIATE, so a retried approve reuses the same want instead of double-inserting.list_requestsenumerates all users' requests with no caller identity or role check #397 (security) — request enumeration.list_requestsenumerated all users' requests with no caller check. It now takes the caller'sUserIdand denies unless the caller is an admin or querying their own requests; the HTTP layer passes the JWT-derived caller id, never the query parameter.Verification
kanon gate --fullgreen (fmt, check, advisory-parity, cargo-deny, clippy workspace, nextest, kanon lint). Authorization, idempotency (real DB-failure injection via a trigger), and retry-convergence paths tested.Follow-ups noted
A unique index on
(source, source_ref)was deliberately not added (it could fail startup on deployments that already have duplicate wants from this bug); a guarded dedup migration is the right place for it. A separate lingering-want-on-cancel-after-approve-failure path is pre-existing and worth its own issue.