fix(BA-7861): refuse a fragment write at an owner nothing answers to as not found - #14568
Draft
jopemachine wants to merge 3 commits into
Draft
fix(BA-7861): refuse a fragment write at an owner nothing answers to as not found#14568jopemachine wants to merge 3 commits into
jopemachine wants to merge 3 commits into
Conversation
…as not found Writing an app config fragment for a domain or user id that names no row answered VirtualEntityNotFound, a 500: the row has no foreign key to its owner, so it was inserted first and the graph write behind it found no owner node. An atomic entity upsert action may now name the operation scopes it writes in, and the ops write validates their existence checks before any row, in the same transaction. The fragment write names its owner's scope, so a missing owner is refused as DomainNotFound or UserNotFound, the way the scoped reads already refuse it. Every other upsert names no scope and is unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011BnvoxSA2RSKgBkJ1yvC9P
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011BnvoxSA2RSKgBkJ1yvC9P
github-actions
Bot
added
size:M
…face alone Undo the operation_scopes hook on the generic upsert action, service, repository and write ops. The fragment write's processor appends a scope validator instead — the extension point the group already offers — which reads the owner row through the existing get path and refuses a missing one as DomainNotFound or UserNotFound before the write starts. Nothing outside the app config domain changes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011BnvoxSA2RSKgBkJ1yvC9P
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
scoped_upsert_app_config_fragments) answeredVirtualEntityNotFound— an HTTP 500.app_config_fragments.scope_idhas no foreign key (the owner is polymorphic), so the row went in first and the RBAC graph write behind it found no owner node.FragmentOwnerExistsValidator, through thevalidators=extension pointProcessorGroupalready offers. It reads the owner row through the existingOpsRepository.getpath and refuses a missing one asDomainNotFound/UserNotFound(404) — the same errors the scoped reads give — before the write starts. It runs after the RBAC validator, so a plain user is still refused for permission first.services/app_config/changes: no generic action, service, repository or write-ops signature is touched, and the write stays on the generic ops path (services/AGENTS.md: an action validator is what keeps a pass-through operation pass-through).Not changed:
VirtualEntityNotFoundstays a 500 for what it is — a scope row that exists without its graph node is still an invariant violation, and only a check on the real owner row can tell the two apart.Follow-up: the scenario row
the-superadmin-naming-an-owner-nothing-answers-to-is-refusedin #14513 pins the old 500 and switches toUserNotFoundonce this lands (one line and its document row); whichever of the two merges second carries it.Found by the BA-7804 scenario research.
Test plan
tests/unit/manager/services/app_config/test_validators.py— a missing domain / user owner is refused asDomainNotFound/UserNotFound; an existing one passestests/unit/manager/actions/test_registry_catalog.pyunchanged — the wiring adds a validator, not an actionUserNotFound, the other 14 unchangedResolves BA-7861
🤖 Generated with Claude Code
https://claude.ai/code/session_011BnvoxSA2RSKgBkJ1yvC9P