mirror of
https://github.com/multica-ai/multica.git
synced 2026-06-17 03:38:32 +02:00
* refactor(server): make ParseUUID error-returning to prevent silent data loss (MUL-1410) util.ParseUUID previously swallowed errors and returned a zero pgtype.UUID on invalid input. When this zero UUID reached a write query (DELETE/UPDATE), the SQL matched zero rows and the handler returned 2xx success — producing silent data corruption. #1661 (DeleteIssue with identifier-style ID) was the visible symptom; PR #1680 patched that one site, this commit closes the class of bug. Changes: - util.ParseUUID now returns (pgtype.UUID, error). Add util.MustParseUUID for trusted round-trips that should panic on invalid input. - handler/handler.go: parseUUID wrapper now calls MustParseUUID — any unguarded user-input string reaching it surfaces as a recovered panic (chi middleware.Recoverer → 500) instead of silently corrupting data. Add parseUUIDOrBadRequest(w, s, fieldName) for handler entry points. - Convert every Queries.Delete*/Update* call site reachable from raw user input (autopilot, comment, project, skill, skill_file, label, pin, attachment, feedback, issue assignee, daemon runtime, workspace) to validate UUIDs explicitly with parseUUIDOrBadRequest, returning 400 on invalid input. Where a resolved entity.ID is already in scope, write queries now use it directly instead of re-parsing the URL string. - Update getWorkspaceMember + loadIssueForUser to handle invalid UUIDs gracefully (404/400 instead of panic). - Update util/middleware/cmd-level callers (subscriber_listeners, notification_listeners, activity_listeners, scope_authorizer, middleware/workspace) to use the error-returning API. - Add server/internal/util/pgx_test.go covering valid/invalid input and the MustParseUUID panic contract. - Add TestDeleteIssueByIdentifier + TestDeleteIssueRejectsInvalidUUID regression tests in handler_test.go (the original #1661 bug + the invalid-input case). - Document the handler UUID parsing convention in CLAUDE.md so the rule is enforceable in future PR review. * fix(server): address GPT-Boy review of #1748 P1 fixes from PR #1748 review: 1. Migrate remaining request-boundary UUIDs to parseUUIDOrBadRequest so malformed input returns 400 instead of panic/500. Was missing on: - issue.go: workspace_id in CreateIssue/ChildIssueProgress/ListIssues/ SearchIssues/BatchUpdateIssues/BatchDeleteIssues; project_id / parent_issue_id / lead_id / assignee_id / assignee_ids / creator_id filters; batch issue_ids and assignee/parent/project fields in BatchUpdateIssues (skip on bad input via util.ParseUUID, matching the existing per-row continue semantics). - project.go: project id + workspace_id in GetProject/UpdateProject/ DeleteProject; lead_id in CreateProject/UpdateProject; workspace_id in ListProjects + SearchProjects. - handler.go: resolveActor now uses util.ParseUUID for X-Agent-ID / X-Task-ID headers; invalid UUID falls back to "member" (matches pre-existing semantics) instead of panicking. - issue.go: validateAssigneePair returns 400 on invalid workspace_id instead of panicking. 2. Fix issue:deleted WS event payloads to emit uuidToString(issue.ID) instead of the raw URL string. After an identifier-path delete ("MUL-7"), the previous payload would have leaked the identifier to subscribers, leaving stale entries in frontend caches that key by UUID. Updated DeleteIssue (issue.go:1341) and BatchDeleteIssues (issue.go:1641). The slog "issue deleted" log line also now records the resolved UUID so logs match the WS payload. 3. Extend TestDeleteIssueByIdentifier to subscribe to the bus and assert issue:deleted.payload.issue_id is the resolved UUID, not the identifier. * fix(server): validate remaining reviewed UUID inputs * fix(server): validate remaining handler UUID inputs * fix(server): finish request boundary UUID audit * fix(server): validate remaining request body UUIDs * fix(server): validate runtime path UUIDs * fix(server): validate remaining audit UUID inputs --------- Co-authored-by: Eve <eve@multica.ai>
313 lines
9.0 KiB
Go
313 lines
9.0 KiB
Go
package handler
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"log/slog"
|
|
"net/http"
|
|
|
|
"github.com/go-chi/chi/v5"
|
|
"github.com/jackc/pgx/v5/pgtype"
|
|
"github.com/multica-ai/multica/server/internal/logger"
|
|
db "github.com/multica-ai/multica/server/pkg/db/generated"
|
|
"github.com/multica-ai/multica/server/pkg/protocol"
|
|
)
|
|
|
|
type InboxItemResponse struct {
|
|
ID string `json:"id"`
|
|
WorkspaceID string `json:"workspace_id"`
|
|
RecipientType string `json:"recipient_type"`
|
|
RecipientID string `json:"recipient_id"`
|
|
Type string `json:"type"`
|
|
Severity string `json:"severity"`
|
|
IssueID *string `json:"issue_id"`
|
|
Title string `json:"title"`
|
|
Body *string `json:"body"`
|
|
Read bool `json:"read"`
|
|
Archived bool `json:"archived"`
|
|
CreatedAt string `json:"created_at"`
|
|
IssueStatus *string `json:"issue_status"`
|
|
ActorType *string `json:"actor_type"`
|
|
ActorID *string `json:"actor_id"`
|
|
Details json.RawMessage `json:"details"`
|
|
}
|
|
|
|
func inboxToResponse(i db.InboxItem) InboxItemResponse {
|
|
return InboxItemResponse{
|
|
ID: uuidToString(i.ID),
|
|
WorkspaceID: uuidToString(i.WorkspaceID),
|
|
RecipientType: i.RecipientType,
|
|
RecipientID: uuidToString(i.RecipientID),
|
|
Type: i.Type,
|
|
Severity: i.Severity,
|
|
IssueID: uuidToPtr(i.IssueID),
|
|
Title: i.Title,
|
|
Body: textToPtr(i.Body),
|
|
Read: i.Read,
|
|
Archived: i.Archived,
|
|
CreatedAt: timestampToString(i.CreatedAt),
|
|
ActorType: textToPtr(i.ActorType),
|
|
ActorID: uuidToPtr(i.ActorID),
|
|
Details: json.RawMessage(i.Details),
|
|
}
|
|
}
|
|
|
|
func inboxRowToResponse(r db.ListInboxItemsRow) InboxItemResponse {
|
|
return InboxItemResponse{
|
|
ID: uuidToString(r.ID),
|
|
WorkspaceID: uuidToString(r.WorkspaceID),
|
|
RecipientType: r.RecipientType,
|
|
RecipientID: uuidToString(r.RecipientID),
|
|
Type: r.Type,
|
|
Severity: r.Severity,
|
|
IssueID: uuidToPtr(r.IssueID),
|
|
Title: r.Title,
|
|
Body: textToPtr(r.Body),
|
|
Read: r.Read,
|
|
Archived: r.Archived,
|
|
CreatedAt: timestampToString(r.CreatedAt),
|
|
IssueStatus: textToPtr(r.IssueStatus),
|
|
ActorType: textToPtr(r.ActorType),
|
|
ActorID: uuidToPtr(r.ActorID),
|
|
Details: json.RawMessage(r.Details),
|
|
}
|
|
}
|
|
|
|
func (h *Handler) enrichInboxResponse(ctx context.Context, resp InboxItemResponse, issueID pgtype.UUID) InboxItemResponse {
|
|
if !issueID.Valid {
|
|
return resp
|
|
}
|
|
issue, err := h.Queries.GetIssue(ctx, issueID)
|
|
if err == nil {
|
|
s := issue.Status
|
|
resp.IssueStatus = &s
|
|
}
|
|
return resp
|
|
}
|
|
|
|
func (h *Handler) ListInbox(w http.ResponseWriter, r *http.Request) {
|
|
userID, ok := requireUserID(w, r)
|
|
if !ok {
|
|
return
|
|
}
|
|
workspaceID := ctxWorkspaceID(r.Context())
|
|
wsUUID, ok := parseUUIDOrBadRequest(w, workspaceID, "workspace id")
|
|
if !ok {
|
|
return
|
|
}
|
|
|
|
items, err := h.Queries.ListInboxItems(r.Context(), db.ListInboxItemsParams{
|
|
WorkspaceID: wsUUID,
|
|
RecipientType: "member",
|
|
RecipientID: parseUUID(userID),
|
|
})
|
|
if err != nil {
|
|
writeError(w, http.StatusInternalServerError, "failed to list inbox")
|
|
return
|
|
}
|
|
|
|
resp := make([]InboxItemResponse, len(items))
|
|
for i, item := range items {
|
|
resp[i] = inboxRowToResponse(item)
|
|
}
|
|
|
|
writeJSON(w, http.StatusOK, resp)
|
|
}
|
|
|
|
func (h *Handler) MarkInboxRead(w http.ResponseWriter, r *http.Request) {
|
|
id := chi.URLParam(r, "id")
|
|
prev, ok := h.loadInboxItemForUser(w, r, id)
|
|
if !ok {
|
|
return
|
|
}
|
|
item, err := h.Queries.MarkInboxRead(r.Context(), prev.ID)
|
|
if err != nil {
|
|
writeError(w, http.StatusInternalServerError, "failed to mark read")
|
|
return
|
|
}
|
|
|
|
userID := requestUserID(r)
|
|
workspaceID := uuidToString(item.WorkspaceID)
|
|
h.publish(protocol.EventInboxRead, workspaceID, "member", userID, map[string]any{
|
|
"item_id": uuidToString(item.ID),
|
|
"recipient_id": uuidToString(item.RecipientID),
|
|
})
|
|
|
|
resp := h.enrichInboxResponse(r.Context(), inboxToResponse(item), item.IssueID)
|
|
writeJSON(w, http.StatusOK, resp)
|
|
}
|
|
|
|
func (h *Handler) ArchiveInboxItem(w http.ResponseWriter, r *http.Request) {
|
|
id := chi.URLParam(r, "id")
|
|
prev, ok := h.loadInboxItemForUser(w, r, id)
|
|
if !ok {
|
|
return
|
|
}
|
|
item, err := h.Queries.ArchiveInboxItem(r.Context(), prev.ID)
|
|
if err != nil {
|
|
writeError(w, http.StatusInternalServerError, "failed to archive")
|
|
return
|
|
}
|
|
|
|
// Archive all sibling inbox items for the same issue (issue-level archive)
|
|
if item.IssueID.Valid {
|
|
h.Queries.ArchiveInboxByIssue(r.Context(), db.ArchiveInboxByIssueParams{
|
|
WorkspaceID: item.WorkspaceID,
|
|
RecipientType: item.RecipientType,
|
|
RecipientID: item.RecipientID,
|
|
IssueID: item.IssueID,
|
|
})
|
|
}
|
|
|
|
userID := requestUserID(r)
|
|
workspaceID := uuidToString(item.WorkspaceID)
|
|
h.publish(protocol.EventInboxArchived, workspaceID, "member", userID, map[string]any{
|
|
"item_id": uuidToString(item.ID),
|
|
"issue_id": uuidToPtr(item.IssueID),
|
|
"recipient_id": uuidToString(item.RecipientID),
|
|
})
|
|
|
|
resp := h.enrichInboxResponse(r.Context(), inboxToResponse(item), item.IssueID)
|
|
writeJSON(w, http.StatusOK, resp)
|
|
}
|
|
|
|
func (h *Handler) CountUnreadInbox(w http.ResponseWriter, r *http.Request) {
|
|
userID, ok := requireUserID(w, r)
|
|
if !ok {
|
|
return
|
|
}
|
|
workspaceID := ctxWorkspaceID(r.Context())
|
|
wsUUID, ok := parseUUIDOrBadRequest(w, workspaceID, "workspace id")
|
|
if !ok {
|
|
return
|
|
}
|
|
|
|
count, err := h.Queries.CountUnreadInbox(r.Context(), db.CountUnreadInboxParams{
|
|
WorkspaceID: wsUUID,
|
|
RecipientType: "member",
|
|
RecipientID: parseUUID(userID),
|
|
})
|
|
if err != nil {
|
|
writeError(w, http.StatusInternalServerError, "failed to count unread inbox")
|
|
return
|
|
}
|
|
|
|
writeJSON(w, http.StatusOK, map[string]int64{"count": count})
|
|
}
|
|
|
|
func (h *Handler) MarkAllInboxRead(w http.ResponseWriter, r *http.Request) {
|
|
userID, ok := requireUserID(w, r)
|
|
if !ok {
|
|
return
|
|
}
|
|
workspaceID := ctxWorkspaceID(r.Context())
|
|
wsUUID, ok := parseUUIDOrBadRequest(w, workspaceID, "workspace id")
|
|
if !ok {
|
|
return
|
|
}
|
|
|
|
count, err := h.Queries.MarkAllInboxRead(r.Context(), db.MarkAllInboxReadParams{
|
|
WorkspaceID: wsUUID,
|
|
RecipientID: parseUUID(userID),
|
|
})
|
|
if err != nil {
|
|
writeError(w, http.StatusInternalServerError, "failed to mark all inbox read")
|
|
return
|
|
}
|
|
|
|
slog.Info("inbox: mark all read", append(logger.RequestAttrs(r), "user_id", userID, "count", count)...)
|
|
h.publish(protocol.EventInboxBatchRead, workspaceID, "member", userID, map[string]any{
|
|
"recipient_id": userID,
|
|
"count": count,
|
|
})
|
|
|
|
writeJSON(w, http.StatusOK, map[string]any{"count": count})
|
|
}
|
|
|
|
func (h *Handler) ArchiveAllInbox(w http.ResponseWriter, r *http.Request) {
|
|
userID, ok := requireUserID(w, r)
|
|
if !ok {
|
|
return
|
|
}
|
|
workspaceID := ctxWorkspaceID(r.Context())
|
|
wsUUID, ok := parseUUIDOrBadRequest(w, workspaceID, "workspace id")
|
|
if !ok {
|
|
return
|
|
}
|
|
|
|
count, err := h.Queries.ArchiveAllInbox(r.Context(), db.ArchiveAllInboxParams{
|
|
WorkspaceID: wsUUID,
|
|
RecipientID: parseUUID(userID),
|
|
})
|
|
if err != nil {
|
|
writeError(w, http.StatusInternalServerError, "failed to archive all inbox")
|
|
return
|
|
}
|
|
|
|
slog.Info("inbox: archive all", append(logger.RequestAttrs(r), "user_id", userID, "count", count)...)
|
|
h.publish(protocol.EventInboxBatchArchived, workspaceID, "member", userID, map[string]any{
|
|
"recipient_id": userID,
|
|
"count": count,
|
|
})
|
|
|
|
writeJSON(w, http.StatusOK, map[string]any{"count": count})
|
|
}
|
|
|
|
func (h *Handler) ArchiveAllReadInbox(w http.ResponseWriter, r *http.Request) {
|
|
userID, ok := requireUserID(w, r)
|
|
if !ok {
|
|
return
|
|
}
|
|
workspaceID := ctxWorkspaceID(r.Context())
|
|
wsUUID, ok := parseUUIDOrBadRequest(w, workspaceID, "workspace id")
|
|
if !ok {
|
|
return
|
|
}
|
|
|
|
count, err := h.Queries.ArchiveAllReadInbox(r.Context(), db.ArchiveAllReadInboxParams{
|
|
WorkspaceID: wsUUID,
|
|
RecipientID: parseUUID(userID),
|
|
})
|
|
if err != nil {
|
|
writeError(w, http.StatusInternalServerError, "failed to archive all read inbox")
|
|
return
|
|
}
|
|
|
|
slog.Info("inbox: archive all read", append(logger.RequestAttrs(r), "user_id", userID, "count", count)...)
|
|
h.publish(protocol.EventInboxBatchArchived, workspaceID, "member", userID, map[string]any{
|
|
"recipient_id": userID,
|
|
"count": count,
|
|
})
|
|
|
|
writeJSON(w, http.StatusOK, map[string]any{"count": count})
|
|
}
|
|
|
|
func (h *Handler) ArchiveCompletedInbox(w http.ResponseWriter, r *http.Request) {
|
|
userID, ok := requireUserID(w, r)
|
|
if !ok {
|
|
return
|
|
}
|
|
workspaceID := ctxWorkspaceID(r.Context())
|
|
wsUUID, ok := parseUUIDOrBadRequest(w, workspaceID, "workspace id")
|
|
if !ok {
|
|
return
|
|
}
|
|
|
|
count, err := h.Queries.ArchiveCompletedInbox(r.Context(), db.ArchiveCompletedInboxParams{
|
|
WorkspaceID: wsUUID,
|
|
RecipientID: parseUUID(userID),
|
|
})
|
|
if err != nil {
|
|
writeError(w, http.StatusInternalServerError, "failed to archive completed inbox")
|
|
return
|
|
}
|
|
|
|
slog.Info("inbox: archive completed", append(logger.RequestAttrs(r), "user_id", userID, "count", count)...)
|
|
h.publish(protocol.EventInboxBatchArchived, workspaceID, "member", userID, map[string]any{
|
|
"recipient_id": userID,
|
|
"count": count,
|
|
})
|
|
|
|
writeJSON(w, http.StatusOK, map[string]any{"count": count})
|
|
}
|