[PetrefiedThunder]

Suppliers could set their own late CTE threshold through PUT /v1/supplier/facilities/{facility_id}/agreed-sending-hours. This moves the write to the tenant.

Changes

• Supplier PUT removed. New PUT /v1/supplier/admin/facilities/{facility_id}/agreed-sending-hours, gated by TenantAdminChecker, which reuses the tenant settings Owner or Admin membership check (admin: PATCH /tenants/{id}/settings allows any Member to overwrite billing/retention/mfa/sso/webhook config #1386). Facility lookup is scoped to the caller's tenant only, so a facility in another tenant returns 404.
• Supplier dashboard: SendingHoursEditor removed. The agreed time shows read only with "Set by your customer".
• api-client points at the admin path. Route security manifest: path and operation updated, required_permissions now tenant.admin. Counts unchanged (one removed, one added, same classification).

Tests (data free, runtime ids): tenant admin sets and clears for any facility in tenant; supplier roles (no membership, Member, Viewer, supplier) get 403 even on their own facility; old path is gone; admin of another tenant gets 404; validation and missing tenant cases. Frontend test asserts the read only view has no edit controls.

Local: admin supplier pytest pass, supplier-data-quality vitest 14/14, tsc only the existing instrumentation.ts error, copy gate exit 0. Manifest generator could not run locally (typesafe_sdk not installed); the manifest was edited by hand to match, CI --check will confirm.

Merge order: lands on claude/supplier-data-quality (#3574), after #3575 (already squashed in as 61bb729).

---

Note

Medium Risk
Authorization and API surface change for a compliance-related setting: suppliers lose write access and tenant admins gain cross-facility write within a tenant, which is correct but affects integrations using the old path.

Overview
Agreed sending hours (the late CTE threshold) can no longer be changed by suppliers. The write API moves from PUT /v1/supplier/facilities/{facility_id}/agreed-sending-hours to PUT /v1/supplier/admin/facilities/{facility_id}/agreed-sending-hours, gated by TenantAdminChecker (tenant.admin — tenant Owner or Admin). Facility updates are resolved by tenant id only (any facility in the tenant), not supplier ownership; cross-tenant facilities return 404.

On the supplier dashboard, the editable SendingHoursEditor is removed in favor of a read-only note (“Set by your customer”); onSendingHoursSaved / reload wiring is dropped. api-client targets the new admin path. The route security manifest reflects the new operation and permission.

Tests are updated for admin set/clear, 403 for non-admin roles (including facility owners), removal of the old path, cross-tenant 404, and an integration-style TenantAdminChecker membership check.

^{Reviewed by Cursor Bugbot for commit 361138c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
regengine	Ignored	Preview	Oct 25, 2026 4:02am UTC

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review: 1

• main

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: regengine/RegEngine
• Branch: claude/tenant-locked-sending-hours
• File: .coderabbit.yaml
• Commit: 361138c
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 5606a5be-e8da-4323-a3c0-ac83b2ba0fb1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T03:58:20.436782Z	0e6854d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[PetrefiedThunder]

REVIEW: FAIL deepseek 0e6854d

Reviewed by hand: Mac load was 28.7–29.9, over the 28 limit, so DeepSeek was not run. Delta is 61bb729..0e6854d, 8 files.

What's right:

• No supplier write path is left. The old PUT /v1/supplier/facilities/{id}/agreed-sending-hours is gone from the routes and from docs/security/route-security-manifest.json. The only remaining writer of agreed_sending_hours is services/admin/app/supplier_compliance_routes.py:403. The only frontend caller is frontend/src/lib/api-client.ts:896, which now points at the admin path. The supplier UI is read-only ("Set by your customer", frontend/src/app/dashboard/suppliers/data-quality.tsx:85), and page.tsx no longer passes onSendingHoursSaved.
• The admin check is right. TenantAdminChecker (:360-375) calls tenant_settings_routes._get_user_role_name (:47-67), which requires user_id, the bound tenant_id and is_active=True, and the role must be in _ADMIN_ROLE_NAMES (Owner/Admin, :25). No sysadmin bypass. Missing tenant context returns 403.
• Input validation: :211 is Field(..., strict=True, gt=0, le=2**31-1). Null clears the value, bools and strings are rejected, and the DB CHECK > 0 backs it up.
• Real data: no fixtures or synthetic values in prod code, copy or the manifest. The tests are data-free.

Blocking:

1. services/admin/app/supplier_compliance_routes.py:399-400: tenant scoping is checked after the fetch, not in the query. db.get(SupplierFacilityModel, id) loads the row by primary key alone (with no RLS it reads across tenants), and only then compares facility.tenant_id != tenant_id. The result is 404 today, but the request asked for the filter in the query. Fix: db.execute(select(SupplierFacilityModel).where(SupplierFacilityModel.id == scoped_facility_id, SupplierFacilityModel.tenant_id == tenant_id)).scalar_one_or_none() (ideally .with_for_update()), then 404 on None.
2. services/admin/tests/test_supplier_data_quality_routes.py:99 monkeypatches _get_user_role_name for every test, so the real membership query (active flag, tenant match, role lookup) is never exercised. Please add data-free tests that drive the real _get_user_role_name through the FakeSession: an inactive Owner membership gives 403, an Owner membership in another tenant only gives 403, and an Owner in the bound tenant gives 200. Also, test_admin_of_another_tenant_gets_404 actually tests "admin of the bound tenant, facility in another tenant". The name is fine, but please assert that the lookup is tenant-filtered (after fix 1), not just the status code.
3. The manifest was edited by hand and has not been checked yet. backend-ci.yml:821 runs generate_route_security_manifest.py --check, but no backend CI job ran on this PR (base is claude/supplier-data-quality), and I could not run it locally under the load limit. Please run python scripts/generate_route_security_manifest.py --check and post the output, or get backend CI to run. Confirm that it extracts tenant.admin from TenantAdminChecker.required_permission, and that enabled_operation_count stays 258 (tests/security/test_route_security_manifest.py:78), which fits one route removed and one added.

Not blocking: there is no route where a caller from another tenant gets 403 instead of 404 for an existing facility. Missing or wrong-role callers get 403 before any lookup, so a 403 doesn't reveal whether a facility exists.

CI at this head: Copy gate, Security path changes and others are still pending. Head SHA Check Guard and PR Blocker Checklist failed (review gates).

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0e6854d. Configure here.}

[cursor]

Tenant page cannot edit sending hours

High Severity

SendingHoursNote makes agreed sending hours read-only with Set by your customer on the tenant Supplier Management page. Owner and Admin users are now the only roles that can write agreed_sending_hours, but they have no in-app editor, so the late CTE threshold cannot be set or cleared from the product.

Additional Locations (1)

• frontend/src/app/dashboard/suppliers/page.tsx#L905-L913

 

^{Reviewed by Cursor Bugbot for commit 0e6854d. Configure here.}

[PetrefiedThunder]

REVIEW: PASS deepseek 361138c

Delta review against my FAIL at 0e6854d (2 files). The Mac's load was 18.7–24.2, so I ran the tests and the manifest check myself in a scratch venv (/tmp/dsre84v, Python 3.12.13, pip install --require-hashes -r requirements.lock, typesafe-sdk 0.7.4). The findings below were checked by hand.

1. Fixed. services/admin/app/supplier_compliance_routes.py:399-406: the facility is selected with id == scoped_facility_id AND tenant_id == tenant_id in one SELECT, and 404 is returned on None. A facility in another tenant is never loaded. FakeSession.execute (tests :84-88) now matches only on the bound id and tenant values, so the existing 404 test for another tenant's facility exercises the SQL filter.
2. Fixed. test_tenant_admin_checker_uses_real_membership (tests :359-428) builds the real Tenant/User/Role/Membership/SupplierFacility tables in in-memory SQLite. Nothing on the checker's path is stubbed: _get_user_role_name, the membership/role SELECTs, _ADMIN_ROLE_NAMES and the facility query are all real. The only overrides are the tenant binding (:405), current user (:409) and session (:408), which are the request inputs. The 3 cases all assert both the status and the stored value: owner of the tenant gets 200 and the value is set, inactive owner gets 403 and nothing changes, owner of another tenant gets 403 and nothing changes.
3. Verified. python scripts/generate_route_security_manifest.py --check gives "Route security manifest verified: 258 enabled operations; 180 omitted operations returned exact 404." The manifest entry requires tenant.admin.

• Ran pytest services/admin/tests/test_supplier_data_quality_routes.py: 38 passed.
• Real data: all ids, names and addresses are runtime uuid4() values. There are no seeded or fixed records. Not blocking: tests :383-384 build emails as {uuid4()}@example.com. That's runtime-generated, but it's a fixed placeholder domain. If the fleet rule is read strictly, a uuid-only local value would avoid it.
• CI: no backend CI runs on this base (it isn't main). Copy and the security gates follow the usual pattern. The manifest --check must still go green on the PR to main.

[github-actions]

PR Blocker Checklist

Head SHA: 361138c776a6209ba1b615d71ad783d557c27888

Status: Blocked (1 open blocker)

Review Threads (1 unresolved)

• frontend/src/app/dashboard/suppliers/data-quality.tsx by @cursor: "### Tenant page cannot edit sending hours High Severity <!-- DESCRIPTION STA..."

Changes Requested (0)

• No reviews requesting changes

Blocked Engines (0)

• No blocked review engines