fix(misc): correctness, concurrency, and test-reliability defects #208

Merged

David merged 4 commits from fix/pms-200-misc-correctness-concurrency-test-reliability into main

2026-06-13 23:34:04 +02:00

David commented

2026-06-13 17:47:54 +02:00

Owner

Address a cluster of unrelated smaller defects (PMS-200):

infisical/client.rs: requests now retry once on a 401 (clear token, re-authenticate, replay) via a shared send_with_retry helper, instead of clearing the token and failing without recovery.
mokosh-auth-http router: add Method::PATCH to the CORS allow_methods so preflight to PATCH /v1/admin/feedback/{id} succeeds.
time_tracking stop_timer: short-circuit to the BadRequest when company_id and ticket_id are both None, instead of querying tickets by Uuid::nil() (which never matches).
mokosh-auth-storage op_sessions: add a UNIQUE index on (user_id, user_agent) NULLS NOT DISTINCT and rewrite create() as an atomic upsert, so concurrent first-login can no longer race into two rows (FOR UPDATE under READ COMMITTED could not prevent this).
mokosh-auth-storage user lockout: bind the lock-out window as a native PgInterval instead of concatenating seconds into a string and casting to INTERVAL.
mokosh-types Address::is_empty: include the country field.
pagination PaginatedResponse:🆕 clamp per_page to at least 1 so per_page == 0 no longer yields a degenerate total_pages.
tests/sla_notify.rs: add a first_response at-risk case (previously only resolution_breached was covered).
tests/auth.rs: compute the TOTP enable code immediately before send, with no awaits in the gap, so the 30s step cannot roll past the verify window.
tests/readiness.rs: yield_now() after closing the pool so the close-out is deterministic on loaded CI.
tests/scheduler.rs: pin the two pause()-based tests to the current_thread flavor the harness requires.

#PMS-200

Address a cluster of unrelated smaller defects (PMS-200): - infisical/client.rs: requests now retry once on a 401 (clear token, re-authenticate, replay) via a shared send_with_retry helper, instead of clearing the token and failing without recovery. - mokosh-auth-http router: add Method::PATCH to the CORS allow_methods so preflight to PATCH /v1/admin/feedback/{id} succeeds. - time_tracking stop_timer: short-circuit to the BadRequest when company_id and ticket_id are both None, instead of querying tickets by Uuid::nil() (which never matches). - mokosh-auth-storage op_sessions: add a UNIQUE index on (user_id, user_agent) NULLS NOT DISTINCT and rewrite create() as an atomic upsert, so concurrent first-login can no longer race into two rows (FOR UPDATE under READ COMMITTED could not prevent this). - mokosh-auth-storage user lockout: bind the lock-out window as a native PgInterval instead of concatenating seconds into a string and casting to INTERVAL. - mokosh-types Address::is_empty: include the country field. - pagination PaginatedResponse::new: clamp per_page to at least 1 so per_page == 0 no longer yields a degenerate total_pages. - tests/sla_notify.rs: add a first_response at-risk case (previously only resolution_breached was covered). - tests/auth.rs: compute the TOTP enable code immediately before send, with no awaits in the gap, so the 30s step cannot roll past the verify window. - tests/readiness.rs: yield_now() after closing the pool so the close-out is deterministic on loaded CI. - tests/scheduler.rs: pin the two pause()-based tests to the current_thread flavor the harness requires. #PMS-200

David added 1 commit

2026-06-13 17:47:54 +02:00

fix(misc): correctness, concurrency, and test-reliability defects

E2E / Playwright against staging (pull_request) Failing after 16s

Details

Check / fmt + clippy + compile + tests (pull_request) Successful in 3m15s

Details

Build OCI container / Build and push mokosh-api image (push) Successful in 4m5s

Details

92bf278f15

Address a cluster of unrelated smaller defects (PMS-200):

- infisical/client.rs: requests now retry once on a 401 (clear token, re-authenticate, replay) via a shared send_with_retry helper, instead of clearing the token and failing without recovery.
- mokosh-auth-http router: add Method::PATCH to the CORS allow_methods so preflight to PATCH /v1/admin/feedback/{id} succeeds.
- time_tracking stop_timer: short-circuit to the BadRequest when company_id and ticket_id are both None, instead of querying tickets by Uuid::nil() (which never matches).
- mokosh-auth-storage op_sessions: add a UNIQUE index on (user_id, user_agent) NULLS NOT DISTINCT and rewrite create() as an atomic upsert, so concurrent first-login can no longer race into two rows (FOR UPDATE under READ COMMITTED could not prevent this).
- mokosh-auth-storage user lockout: bind the lock-out window as a native PgInterval instead of concatenating seconds into a string and casting to INTERVAL.
- mokosh-types Address::is_empty: include the country field.
- pagination PaginatedResponse:🆕 clamp per_page to at least 1 so per_page == 0 no longer yields a degenerate total_pages.
- tests/sla_notify.rs: add a first_response at-risk case (previously only resolution_breached was covered).
- tests/auth.rs: compute the TOTP enable code immediately before send, with no awaits in the gap, so the 30s step cannot roll past the verify window.
- tests/readiness.rs: yield_now() after closing the pool so the close-out is deterministic on loaded CI.
- tests/scheduler.rs: pin the two pause()-based tests to the current_thread flavor the harness requires.

#PMS-200

David added 2 commits

2026-06-13 23:15:05 +02:00

Merge origin/main into fix/pms-200-misc-correctness-concurrency-test-reliability 5b96470f2a

Resolve conflict in src/infisical/client.rs: main migrated CoreError to
AppError after this branch was cut. Keep this branch's send_with_retry
helper (unifies single 401-retry across get/post/patch/delete) and port
it onto AppError.

#PMS-200

fix(auth): omit user profile in Google-callback mfa_required branch

Check / fmt + clippy + compile + tests (pull_request) Failing after 11s

Details

E2E / Playwright against staging (pull_request) Failing after 25s

Details

893f5d8081

main changed LoginResponse.user to Option<CurrentUser> (None until the
second factor is satisfied) after this branch was cut. The Google OAuth
callback's mfa_required branch still built it with a bare CurrentUser,
which no longer typechecks and would leak profile data pre-MFA. Set it
to None, matching the password login() mfa_required branch.

#PMS-200

David added 1 commit

2026-06-13 23:27:39 +02:00

Merge origin/main into fix/pms-200-misc-correctness-concurrency-test-reliability

E2E / Playwright against staging (pull_request) Failing after 18s

Details

Check / fmt + clippy + compile + tests (pull_request) Successful in 4m23s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

7caf796012