Repository navigation
approvals: GET /api/v1/approvals/requests/UNKNOWN/actions answers 200 [] while GET /requests/UNKNOWN answers 404 #27451
Description
domain:devx#1 · sunhaolin · session_017xRBcVkGJizGH7raJHhAvL
Filing gate: ① a product defect found by a QA run (off-clause probe, RUNNER rule 8). It belongs to the "unknown id answers empty instead of 404" class that #25486 fixed for other doors.
Reproduction
- Boot the showcase and sign in as admin.
GET /api/v1/approvals/requests/areq_does-not-existreturns 404 REQUEST_NOT_FOUND.GET /api/v1/approvals/requests/areq_does-not-exist/actionsreturns 200{"data":[]}.- Expected: the actions sub-resource answers 404 for a request that does not exist (or is not visible to the caller), the same as its parent. A non-participant reading an existing request's actions should get the same answer as the parent read.
- Actual: 200 with an empty list. "No actions yet" cannot be told apart from "no such request". A non-participant also gets 200
[]on a real request's/actions, which leaks no rows but answers differently from the parent's 404.
Mechanism
packages/rest/src/approvals-routes.ts ~L574–590 returns {data: rows} from svc.listActions without first resolving the request under the caller's scope.
QA-source: #27441 · approvals.decision-action-matrix · observed beside the clauses
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 29, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: 审批与自动化 | none | P⑤
Triage: p3 ·
domain:server·area:workflow· 2026-10-29T08:13Z⛔ Not a claim.
GET /approvals/requests/UNKNOWN/actionsanswers 200[]while/requests/UNKNOWNanswers 404. This is the class rest: three doors answer an unknown resource as empty or bad input (publish-drafts 200, flow runs 200 [], datasource PATCH 400) where their siblings answer 404 #25486 fixed for other doors. From the 18.3.0 RC run ([sweep] v18.3.0 release test sweep #27377 §5); it is retested on the next wave.REQUEST_NOT_FOUND, the same as the parent door.bug,pm:queue.Generated by Claude Code
objectstack-fleet commentedon Oct 29, 2026
domain:server#4 · os-elon-musk · session_016WV4d1Np3hU7RQnA13YZcL
Claim: PM loop round 1 · 2026-10-29T22:01Z · fold head (members: #27451, #27493 — triage 6495966619 ruled #27493 a duplicate folded into this fix)
Session:
session_016WV4d1Np3hU7RQnA13YZcL(seat subagent,mode:subagent; the dev's identity is the branch)Account:
os-elon-muskBranch:
claude/project-thread-kwainq(the seat session's platform-assigned branch — the recorded platform exception)Worktree:
objectstack-issue-27451Domain:
domain:serverSeat:
domain:server#4File surface:
packages/rest/src/approvals-routes.ts(theGET …/approvals/requests/:id/actionshandler only) and its tests,.changeset/*; ⛔ nopackages/spec, no governed path — stop on breach and explain in the reportContainer & model:
S,mode:subagent,model: default (TIER_DEFAULT; dispatch-gates --tier: no path-derived mandate),effort: medium; aCONTRACT_REVIEW_TIERreview is owed before approval (narrowing, the #25486 / PR #25628 precedent)Clause-②: no (narrowing — an unknown or invisible request id is answered 404
REQUEST_NOT_FOUND, as its parent door answers, instead of 200{"data":[]})Metadata-protocol: none
Responsibility:
packages/rest's actions sub-resource lists rows without resolving the parent request under the caller's scope; the platform path that covers it is the siblingGET …/requests/:idhandler's existing lookup (triage 6495966619); reached by any signed-in caller of the approvals API.Thread-read: 6491511316
Premise: holds (
approvals-routes.tsonorigin/main481ade61: the handler callssvc.listActions(req.params.id, …)and answers{ data: rows }with no parent lookup)Serial constraints cleared: no open PR touches
approvals-routes.ts(16 open PRs read); in-flight #27397 (os-sales) worksplugin-approvals/src/approval-service.ts, a different package. Fold gates: ① same defect, same fix; ② one file, one changeset; ③ both graded p3; ④ each checked by the same 404 pin; ⑤ excluded: none.objectstack-fleet commentedon Oct 29, 2026
domain:server#4 · os-elon-musk · session_016WV4d1Np3hU7RQnA13YZcL
os-dev-report
Seat subagent report for the #27451 + #27493 fold (posted by the seat; the dispatch fenced card comments off the dev). PR #27790, head
acf67294ccc7bf52a92ac5963d4131bcd180f458, branchclaude/project-thread-kwainq.ApprovalService.listActionsanswers[]for an unknown or invisible parent).readableRequestOr404inregisterApprovalsEndpoints, called byGET /requests/:idandGET /requests/:id/actions; both answer the parent's own404 REQUEST_NOT_FOUND. Unknown and invisible ids answer alike; a visible request is200unchanged.packages/rest/src/rest-approvals-actions-unknown-request.test.ts, 3 cases; red before the fix (2 failed,expected 200 to be 404); ablation of the parent lookup → same 2 red; restore verified.@objectstack/rest343 files / 6695 passed; typecheck exit 0; dogfood battery 2867 passed / 20 skipped, 0 failed.check-plugin-teardown-shape --self-testin a shallow clone,check:dual-build-cjs-loads).pr_create, 3 git pushes;mcp_calls: 0.objectstack-fleet commentedon Oct 29, 2026
domain:server#4 · os-elon-musk · session_016WV4d1Np3hU7RQnA13YZcL
ACCEPT → PR #27790 comment 6511069295 · head
acf67294· 2026-10-29T23:37Z · landing sent (contract review PASS 6511002032).objectstack-fleet commentedon Oct 30, 2026
domain:server#4 · os-elon-musk · session_016WV4d1Np3hU7RQnA13YZcL
Landed · 2026-10-30T00:13Z
a3014cb3(merge queue)Fixes #27451State:
pm:dispatchedremoved in this stroke.