Simon AxelssonandClaude Sonnet 5
dc6aaa0e10
CI (SIAX Cloud) / quality (push) Successful in 51s
Security Scan (SIAX Cloud) / security (push) Successful in 26s
CI (SIAX Cloud) / security (push) Successful in 28s
CI (SIAX Cloud) / integration (push) Successful in 1m1s
CI (SIAX Cloud) / integration (pull_request) Successful in 30s
CI (SIAX Cloud) / security (pull_request) Successful in 24s
CI (SIAX Cloud) / quality (pull_request) Successful in 48s
Security Scan (SIAX Cloud) / security (pull_request) Successful in 22s
Tenant isolation (security-critical): every app/api/0pt/** route reading
tenant_id from client-controlled query/body never cross-checked it against
the token middleware.ts already verified (x-0pt-verified-tenant). Adds a
shared assertTenantMatchesVerified guard and wires it into all 20+ affected
routes. Also closes two full-leak-by-omission bugs found in this pass
(documents/capture and lakehouse/mappings GETs returned every tenant's rows
when tenant_id was simply omitted) and two "no tenant check at all" reads
(rate-policies/[id], lakehouse/mappings/[id]) reachable by ID alone.
Duplicate-delivery idempotency (correctness-critical): POST /api/orders now
honors Idempotency-Key (sql/006, replay-or-409-on-conflict, Postgres +
in-memory); the Python orchestrator's POST /orders/{id}/run — the actual
delivery trigger — is now idempotent under an asyncio lock, closing a real
concurrent-request race, not just the sequential-retry case.
Engine-duplication resolution: adaptive_router.py's docstring wrongly
invited a bypass ("see b0ts for scraping") contradicting the product's own
compliance stance; corrected, and given real (additive, not escalating)
block-signal tracking so a rate-limited/blocked source is excluded from the
plan instead of hammered. Also fixes a previously-undiscovered production
bug: the Python engine's only call into the TS quality bridge
(X-Internal-Token) was unconditionally 401'd by middleware.ts, which never
checked that credential — the advisory quality bridge was unreachable in any
environment enforcing auth.
Restore drill: executed for real against throwaway Docker Postgres
containers (not simulated). Found and fixed two real blockers along the way:
sql/004 referenced opt_datasets, which no migration ever created (chain was
never actually runnable end to end); lib/db.ts hardcoded ssl:"require",
making any non-TLS Postgres (incl. compose.dev.yaml's own local-dev
container) unreachable. After both fixes: full migration chain applies
cleanly, pg_dump/pg_restore round-trip is byte-identical (row counts +
content checksums), and real application code (lib/orders-store.ts,
SourceRegistryService's Postgres repository) reads the restored data back
correctly, including cross-tenant isolation still holding.
82 new tests (55 TS + 27 Python), all passing; full existing suite (291 TS +
55 Python) still green; typecheck clean on every changed/added file.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
63 lines
2.8 KiB
TypeScript
63 lines
2.8 KiB
TypeScript
/**
|
|
* P014: HTTP-level proof that POST /api/orders honors the `Idempotency-Key`
|
|
* header end to end (route -> lib/orders-store.ts), matching the pattern
|
|
* used elsewhere in this suite (tests/api/anonymous-routes-auth.test.ts) of
|
|
* calling the route handler directly with a hand-built NextRequest.
|
|
*/
|
|
import { describe, it, expect } from "vitest";
|
|
import { NextRequest } from "next/server";
|
|
import { POST as ordersPOST } from "@/app/api/orders/route";
|
|
|
|
function postReq(body: unknown, headers: Record<string, string> = {}): NextRequest {
|
|
return new NextRequest(new URL("/api/orders", "http://localhost"), {
|
|
method: "POST",
|
|
headers: { "content-type": "application/json", ...headers },
|
|
body: JSON.stringify(body),
|
|
});
|
|
}
|
|
|
|
const BODY = { flow: "custom", config: { markets: ["SE"], type: "Bolag", fieldIds: ["identity"], volume: 1000 } };
|
|
const BODY_DIFFERENT = { flow: "custom", config: { markets: ["NO"], type: "Bolag", fieldIds: ["identity"], volume: 9000 } };
|
|
|
|
describe("POST /api/orders — Idempotency-Key", () => {
|
|
it("no header: two identical requests create two distinct orders (201, 201)", async () => {
|
|
const r1 = await ordersPOST(postReq(BODY));
|
|
const r2 = await ordersPOST(postReq(BODY));
|
|
expect(r1.status).toBe(201);
|
|
expect(r2.status).toBe(201);
|
|
const b1 = await r1.json();
|
|
const b2 = await r2.json();
|
|
expect(b1.order_id).not.toBe(b2.order_id);
|
|
});
|
|
|
|
it("REGRESSION: same Idempotency-Key replays the original order (201 then 200, same order_id)", async () => {
|
|
const key = `idem_${crypto.randomUUID()}`;
|
|
const r1 = await ordersPOST(postReq(BODY, { "Idempotency-Key": key }));
|
|
const r2 = await ordersPOST(postReq(BODY, { "Idempotency-Key": key }));
|
|
expect(r1.status).toBe(201);
|
|
expect(r2.status).toBe(200); // replayed, not created
|
|
const b1 = await r1.json();
|
|
const b2 = await r2.json();
|
|
expect(b2.order_id).toBe(b1.order_id);
|
|
expect(b2.total_ore).toBe(b1.total_ore);
|
|
});
|
|
|
|
it("reusing the same key for a materially different order is a 409, not a silent merge", async () => {
|
|
const key = `idem_${crypto.randomUUID()}`;
|
|
const r1 = await ordersPOST(postReq(BODY, { "Idempotency-Key": key }));
|
|
expect(r1.status).toBe(201);
|
|
const r2 = await ordersPOST(postReq(BODY_DIFFERENT, { "Idempotency-Key": key }));
|
|
expect(r2.status).toBe(409);
|
|
const b2 = await r2.json();
|
|
expect(b2.error.code).toBe("idempotency_key_conflict");
|
|
});
|
|
|
|
it("header name is case-insensitive (Fetch/Next Headers normalize casing)", async () => {
|
|
const key = `idem_${crypto.randomUUID()}`;
|
|
const r1 = await ordersPOST(postReq(BODY, { "idempotency-key": key }));
|
|
const r2 = await ordersPOST(postReq(BODY, { "IDEMPOTENCY-KEY": key }));
|
|
expect(r1.status).toBe(201);
|
|
expect(r2.status).toBe(200);
|
|
});
|
|
});
|