Repository navigation
chore(audit): write entitlements to Upstash only in production - #2563
Merged
Merged
Conversation
saveEntitlement wrote entitlements.json before redis.set, so a read-only filesystem throw skipped Upstash, and an empty catch hid Redis errors. When Upstash is configured, write Redis only and let set failures propagate. Co-authored-by: KK <kk-agent@users.noreply.github.com>
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
github-actions
Bot
added
javascript
Contributor
|
Please add a See governance: #898 |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Outcome
Production entitlement saves reach Upstash. When Upstash credentials are set,
saveEntitlementwritesredis.setand does not touch.data/entitlements.json, so a read-only deploy filesystem cannot skip the Upstash write. A Redis write error now propagates.Findings
saveEntitlementupdated the in-memory map, awaitedwriteEntitlementToFile(mkdir+writeFileinentitlement-file-store.ts, not caught), and only then calledredis.set.rg writeEntitlementToFileon current main hitsentitlement-file-store.ts,entitlement-store.ts, andentitlement-file-store.test.ts. The file store stays for the local no-Redis path.catcharoundredis.set.billing/paywall-bypass.tsand Stripe/checkout code.Scope
apps/web/src/lib/billing/entitlement-store.tsandapps/web/src/lib/billing/__tests__/entitlement-store.test.ts.Risk
Verification
Reproduced before the code change.
npm --workspace=apps/web exec vitest run src/lib/billing/__tests__/entitlement-store.test.tsfailed both cases:mkdirthrow (EEXIST: file already exists) fromwriteEntitlementToFileabortedsaveEntitlementbeforeredis.set.redis.setrejecting, the save resolved the record. The mock recorded onesetcall and the empty catch swallowedupstash unavailable.After the change, that file passed (2 tests). The Redis client in the test is a
vi.mockof@upstash/redisso the assertion can seesetwithout a live Upstash account. The file-write failure in the reproduction was a real filesystem error.Local commands:
npm cicompletednpm --workspace=apps/web run lintpassednpm run build:webpassed, including TypeScriptnpm --workspace=apps/web test: 1562 passed, 2 failed, 1 skipped. Both failures aresrc/lib/__tests__/home-sell-surface.test.tsCI on head
d1371ccb9(https://github.com/groupthinking/EventRelay/actions/runs/41670537706):buildpassed (type-check, ESLint, web build, Studio preflight, production image)lint-frontend,guards, Python 3.11 and 3.12 tests passedtest-frontendfailed. The log showsentitlement-store.test.tspassed (2 tests). The only failures are the twohome-sell-surface.test.tscases, the same failure already on main run 41659258955. Left unchanged.Production evidence
Not applicable. No deploy was performed. The change is the entitlement write path, covered by the unit test above. CI did not call a live Upstash account.
Issue link check
The Closing keyword to open issue check failed, as expected: https://github.com/groupthinking/EventRelay/actions/runs/41670537564/job/126037389310
Related: #2328
Closes #2581