Oliver Kieselbach d3a10dfb96 fix(backend): tenant activation is race-proof - conditional insert dedupes welcome mail and ops event ...

Double signup on two instances enqueued two auto-approve envelopes; both
workers could pass the approved-check (stale 30s negative cache) and both
ran the activation side effects - duplicate welcome mail plus duplicate
TenantAutoApproved ops event/Telegram ping. Same duplicate on queue
redelivery after a failed message delete.

The whitelist add is now a conditional INSERT (AddEntity, 409 = already
approved) so storage arbitrates concurrent activations: exactly one caller
sees "newly added" and runs mail/promote/ops event; losers drop quietly.
The GA approve endpoint stays idempotent (200 + alreadyApproved instead of
a duplicate mail on re-approve).

Also fixes a silent-failure path: the repo swallowed storage errors and
returned false, which ApproveAsync ignored - a failed whitelist write
still sent the welcome mail and reported success. Storage errors now
throw (queue path retries, HTTP path 500s).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-02 16:32:13 +02:00

..

AutopilotMonitor.DecisionCore

feat(esp): recovery story for terminally reported ESP failures (session 4910a5a5)

2026-07-23 17:03:44 +02:00

AutopilotMonitor.Shared

fix(backend): tenant activation is race-proof - conditional insert dedupes welcome mail and ops event

2026-08-02 16:32:13 +02:00

LICENSE

update license

2026-03-26 07:02:33 +01:00