Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

brokered_connections: two reads carry no provider predicate (blocks the provider sunset flow)

オープン
  • 何か問題がありますか？
#783 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
35/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
typescript
領域
authorization, backend

調査の方向性

Start in server/src/plugins/store.ts at retireConnectionsFor and brokeredConnectionsFor, which lack the provider predicate the other selects use, and check the comments there that point to assertActivatable in server/src/index.ts. Done means both reads filter on the active broker provider and a test covering the offboarding sweep with a foreign-provider row shows it is neither revoked through the active broker nor audited as revoked. The fix is gated on the provider sunset flow, so confirm with maintainers before starting.

索引モデルが issue の本文から書いたものです。

説明

Two brokered_connections reads in server/src/plugins/store.ts carry no provider predicate, where the other 11 selects in that file all filter on the active broker:

  • retireConnectionsFor — the offboarding sweep
  • brokeredConnectionsFor — the settings-page read

Both are keyed (holder = 'person', userId) only.

Why it matters

retireConnectionsFor finds a person's connections and then calls the active broker's revoke() for each row it found. On a deployment holding rows from both providers, that is a revocation requested at the wrong vendor — which would not recognise the connection — while the audit row records vendorRevocationRequested about access that was never removed. A departed employee keeps live access and the record says otherwise.

brokeredConnectionsFor is milder: rows are resolved at the active provider's canonical URL, so another provider's connections are silently dropped from the settings page.

Why it is not urgent

Unreachable today. The startup activation refusal (assertActivatable, called from server/src/index.ts) refuses to boot when the configured provider differs from the provider on the existing rows, so a mixed deployment cannot start and neither read can see a foreign row.

Both sites were already unfiltered before the Arcade provider work began (base 7b1c20a) — this is pre-existing, not a regression.

Why it needs an issue rather than a fix now

The provider sunset flow is exactly the change that relaxes assertActivatable's refusal, and it turns both sites live. Whoever builds it must add the brokerProvider predicate to both reads. Both call sites now carry comments saying so and naming assertActivatable, but a comment is not a work item.

Also to correct

The design spec's inventory of provider-filtered sites lists the offboarding sweep among them. It is not one — the sweep has no provider filter at all. That line should be corrected when the sunset flow is specced.

Acceptance
  • Both reads filter on the active broker provider.
  • A test drives the offboarding sweep on a deployment holding a foreign-provider row and asserts it is not revoked through the active broker and not audited as revoked.

Context: filed from the Arcade provider PR (#770), which does not change either read.

主要言語
TypeScript
スター
6.6k
フォーク
914
平均マージ
17時間 52分
マージ済み PR（30日）
155

環境構築

  • Dockerfile または Docker Compose ファイルあり
  • プルリクエストのテンプレートあり
  • コントリビューションガイドなし

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

CopilotKit/OpenBot のほかの issue

CopilotKit/OpenBot の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。