gsadmin/pad
1
0
Fork 0
mirror of https://github.com/PerpetualSoftware/pad.git synced 2026-09-10 23:15:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(server): artifact import wrote a UUID into created_by (BUG-2542)

Browse Source 
Found by Codex while reviewing the attribution fix. handleImportArtifact
set `input.CreatedBy = u.ID`, which is the wrong DOMAIN for the field
rather than merely the wrong value: created_by holds the role — "user"
or "agent" — and consumers compare it against those literals
(CommentThread.svelte, TimelineVersionCard.svelte). An imported item
matched neither and rendered as neither.

It also would have defeated the fix in the parent commit at this path: a
non-empty CreatedBy suppresses the actor stamp, so imports would have
kept a UUID while every other create path started recording the actor.

The line contradicted the comment directly above it, which said Source
was being left blank precisely so createItemChecked could stamp it "like
every other create path". Now both fields are left blank and stamped
together.

The user's identity has its own home — the items.created_by_user_id
column — which no create path currently populates. That is a separate
gap and is not widened into this change.

Claude-Session: https://claude.ai/code/session_01QGbUKZBAZoWdEgiTNWsXag
This commit is contained in:
xarmian
2026-08-13 19:32:40 +00:00
parent 0693807906
commit 6fac5dec91
1 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/server/handlers_artifact_import.go
+13 -6
View File
@@ -140,12 +140,19 @@ func (s *Server) handleImportArtifact(w http.ResponseWriter, r *http.Request) {
Content: body, Content: body,
Fields: string(fieldsJSON), Fields: string(fieldsJSON),
} }
// Attribution: a normal agent/api create. Source is left blank here so // Attribution: a normal agent/api create. CreatedBy and Source are both
// createItemChecked stamps it from the request auth context (cli/web), // left blank so createItemChecked stamps them from the request auth
// matching every other create path. // context, matching every other create path.
if u := currentUser(r); u != nil { //
input.CreatedBy = u.ID // This used to set CreatedBy to the user's UUID, which is the wrong
} // DOMAIN for the field, not just the wrong value: created_by holds the
// role — "user" or "agent" — and consumers compare it to those literals
// (CommentThread.svelte, TimelineVersionCard.svelte). An imported item
// therefore matched neither and rendered as neither. Found while fixing
// BUG-2542; it also would have defeated that fix here, since a non-empty
// CreatedBy suppresses the actor stamp. The user's identity is already
// carried by the items.created_by_user_id column, which no create path
// currently populates — separate gap, not widened into this change.
// Enforce the workspace item-count limit (workspace-scoped), identical to // Enforce the workspace item-count limit (workspace-scoped), identical to
// handleCreateItem. Writes the 403 plan_limit_exceeded response itself when // handleCreateItem. Writes the 403 plan_limit_exceeded response itself when