feat(api): retrieve authorized exports via loopback GET - #411
Conversation
GAP-003A unique slice: AnalysisRunLiveService mints a metric-free
export_id on naruon POST /v1/exports and serves GET /v1/exports/{id}.
NaruonLiveService stays POST-only. Persistence remains GAP-003B.
|
Warning Review limit reachedNext included review available in 10 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (16)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
ADR 0053 is already live on #409 (Pareto candidate-K vs main). Rename this stack's decision identity rather than collide.
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
🔍 Mandatory coverage evidence is absent
The verification list omits the complete suite and 100% line and branch coverage gates required for production changes.
Was this helpful? React with 👍 or 👎 to provide feedback.
| "export_id": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": ".*\\S.*" }, | ||
| "artifact_id": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": ".*\\S.*" }, |
There was a problem hiding this comment.
🟡 Schema-valid identities fail Rust parsing
The schema accepts control-bearing export_id and artifact_id values that ExportRetrieval::from_json rejects. Schema-valid receipts can therefore fail Rust consumers.
Prompt for agents
Align schemas/export_retrieval_v1.json with ExportRetrieval::validate in crates/tepp_api/src/export_http.rs. Add JSON Schema constraints that reject Unicode control characters for export_id, artifact_id, decision_code, and idempotency_key while preserving the existing nonempty and length rules. Add contract tests proving representative control-bearing strings fail both schema validation and Rust parsing.
Was this helpful? React with 👍 or 👎 to provide feedback.
| if self.export_id.len() > EXPORT_RETRIEVAL_ID_MAX_LEN | ||
| || self.artifact_id.len() > EXPORT_RETRIEVAL_ID_MAX_LEN | ||
| || self.idempotency_key.len() > EXPORT_RETRIEVAL_ID_MAX_LEN |
There was a problem hiding this comment.
🟡 Unicode identifiers violate published limit
Schema-valid non-ASCII identifiers can exceed ExportRetrieval::validate's byte limit. The live POST then returns 413 for payloads clients correctly accepted.
Prompt for agents
Align crates/tepp_api/src/export_http.rs and schemas/export_retrieval_v1.json on one length unit. Rust currently uses UTF-8 byte length for export_id, artifact_id, and idempotency_key, while JSON Schema maxLength counts Unicode characters. Either validate character counts in ExportRetrieval::validate and the path/exchange helpers, or express and enforce a byte-oriented schema constraint so schema-valid inputs receive the same result from the live POST and DTO parser. Add non-ASCII boundary tests.
Was this helpful? React with 👍 or 👎 to provide feedback.
| let encoded_id = encode_path_segment(export_id); | ||
| let target_path = format!("{NARUON_EXPORT_PATH}/{encoded_id}"); | ||
| let target_url = compose_https_target(origin, &target_path)?; |
There was a problem hiding this comment.
📝 Info: Slash asymmetry does not affect minted IDs
naruon_export_retrieval_exchange encodes slashes while the server rejects them. Server-minted UUID v7 identifiers contain no slashes, so supported retrieval remains unaffected.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Folded into #417
Closed as
superseded_by_fold, not discarded. #417's current head contains this PR as its direct ancestor and has been retargeted to protectedmain, preserving the export retrieval GET implementation/tests and this review history while reducing queue WIP. Export collection/stored-request/idempotency-lookup vehicles #444/#459/#466 also retain this ancestry.Canonical retrieval landing vehicle: #417 (
feat(api): consolidate export retrieval GET and CLI).Do not reopen unless a surviving folded head demonstrably loses unique behavior or evidence.