brokered_connections: two reads carry no provider predicate (blocks the provider sunset flow)
Maintainer antworten meist innerhalb von 1 Tag
Dieses Issue hat noch niemand übernommen.
Bewertung
- Schwierigkeit
- 3/5
- Geschätzter Aufwand
- 1-2 Tage
- Anfängerfreundlichkeit
- 35/100
- Issue-Typ
- Bug
- Klarheit
- Klar beschrieben
- Aktivitätsstatus
- Aktiv
- Tech-Stack
- typescript
- Bereich
- authorization, backend
Rechercherichtung
Start in server/src/plugins/store.ts at retireConnectionsFor and brokeredConnectionsFor, which lack the provider predicate the other selects use, and check the comments there that point to assertActivatable in server/src/index.ts. Done means both reads filter on the active broker provider and a test covering the offboarding sweep with a foreign-provider row shows it is neither revoked through the active broker nor audited as revoked. The fix is gated on the provider sunset flow, so confirm with maintainers before starting.
Vom Indexierungsmodell aus dem Issue-Text verfasst.
Beschreibung
Two brokered_connections reads in server/src/plugins/store.ts carry no provider predicate, where the other 11 selects in that file all filter on the active broker:
retireConnectionsFor— the offboarding sweepbrokeredConnectionsFor— the settings-page read
Both are keyed (holder = 'person', userId) only.
Why it matters
retireConnectionsFor finds a person's connections and then calls the active broker's revoke() for each row it found. On a deployment holding rows from both providers, that is a revocation requested at the wrong vendor — which would not recognise the connection — while the audit row records vendorRevocationRequested about access that was never removed. A departed employee keeps live access and the record says otherwise.
brokeredConnectionsFor is milder: rows are resolved at the active provider's canonical URL, so another provider's connections are silently dropped from the settings page.
Why it is not urgent
Unreachable today. The startup activation refusal (assertActivatable, called from server/src/index.ts) refuses to boot when the configured provider differs from the provider on the existing rows, so a mixed deployment cannot start and neither read can see a foreign row.
Both sites were already unfiltered before the Arcade provider work began (base 7b1c20a) — this is pre-existing, not a regression.
Why it needs an issue rather than a fix now
The provider sunset flow is exactly the change that relaxes assertActivatable's refusal, and it turns both sites live. Whoever builds it must add the brokerProvider predicate to both reads. Both call sites now carry comments saying so and naming assertActivatable, but a comment is not a work item.
Also to correct
The design spec's inventory of provider-filtered sites lists the offboarding sweep among them. It is not one — the sweep has no provider filter at all. That line should be corrected when the sunset flow is specced.
Acceptance
- Both reads filter on the active broker provider.
- A test drives the offboarding sweep on a deployment holding a foreign-provider row and asserts it is not revoked through the active broker and not audited as revoked.
Context: filed from the Arcade provider PR (#770), which does not change either read.
- Vorherrschende Sprache
- TypeScript
- Sterne
- 6.6k
- Forks
- 914
- Ø Merge
- 23 Std. 27 Min.
- Gemergte PRs (30 T.)
- 136
Entwicklungsumgebung
- Enthält ein Dockerfile oder eine Docker-Compose-Datei
- Hat eine Pull-Request-Vorlage
- Kein Beitragsleitfaden
Erste Schritte
- Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
- Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
- Forken Sie das Repository und arbeiten Sie in einem Branch.
- Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.
Mehr aus CopilotKit/OpenBot
-
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 78/100
CopilotKit/OpenBot#817 ·
Maintainer antworten meist innerhalb von 1 Tag
-
Telemetry scrubber: case-insensitive mysql rule redacts an attached port (-P3306) and lets a real password survive in the same commandEvtl. vergeben Ein verknüpfter Pull Request ist offen oder bereits gemergt. Offen
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 82/100
CopilotKit/OpenBot#815 ·
Maintainer antworten meist innerhalb von 1 Tag
-
Wrong key location at startupEvtl. vergeben @charan-rathore hat das vor 4 Tagen übernommen. Offen
Schwierigkeit 1/5 Unter einer Stunde Anfängerfreundlichkeit 68/100
CopilotKit/OpenBot#800 ·
Maintainer antworten meist innerhalb von 1 Tag
-
setup-learning.ts fails on Windows with "spawn npx.cmd EINVAL"Evtl. vergeben @Caldas hat das vor 7 Tagen übernommen. Offen
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 80/100
CopilotKit/OpenBot#792 ·
Maintainer antworten meist innerhalb von 1 Tag
-
Remote AG-UI Bots can't use the browser in chat: `computer_*` calls refused as "unavailable for this headless turn"Evtl. vergeben @charan-rathore hat das vor 3 Tagen übernommen. Offen
Schwierigkeit 3/5 1-2 Tage Anfängerfreundlichkeit 68/100
CopilotKit/OpenBot#804 ·
Maintainer antworten meist innerhalb von 1 Tag
Alle Issues in CopilotKit/OpenBot
Ähnliche Issues
-
bug P3 UI/UX
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 78/100
Maintainer antworten meist innerhalb von 1 Tag
-
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 78/100
StellarState/SS-backend#712 ·
Maintainer antworten meist innerhalb von 1 Tag
-
area: backend bug
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 78/100
snapotter-hq/SnapOtter#3473 ·
Maintainer antworten meist innerhalb von 1 Tag
-
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 82/100
gitroomhq/postiz-app#2304 ·
Maintainer antworten meist innerhalb von 1 Tag
-
harlan-agent-ready-to-implement routine:ci-review
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 72/100
harlan-zw/unlighthouse#454 · 2 Kommentare ·
Maintainer antworten meist innerhalb von 1 Tag