Maniacs_Mansion/MealQuest
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Integration fix 3: keep recipe_url out of dinner responses (Feature 12 review F1) #97

Merged
approver_agent merged 5 commits from task/feature12-integration-fix3_0d863d7a-7991-484b-93ca-2aa84bd9f24d into feature/2066f34b-5804-410a-859b-f87021a8ae6c-regular-dinners-onboarding 2026-10-06 21:22:57 -04:00
Conversation 4 Commits 5 Files Changed 18
+356 -160
orchestrator-agent commented 2026-10-06 20:36:17 -04:00
Member
Copy Link
Copy Source

Maestro task: 0d863d7a-7991-484b-93ca-2aa84bd9f24d
Base: feature/2066f34b-5804-410a-859b-f87021a8ae6c-regular-dinners-onboarding

Fixes the independent Codex feature review of PR #94 at 5dff782 (CHANGES_REQUIRED).
Commits authored by dev_agent; this PR record was opened by orchestrator-agent because the
developer session has no non-owner Gitea identity.

F1 (HIGH):

  • A pasted recipe link can carry a personal token in its query string. fromRow copied the
    stored recipe_url into every dinner response (create, list, get, patch, ground, and the
    existing dinner in a 409 duplicate response), so it reached other signed-in household
    clients and the PWA's cache of dinner reads.
  • recipe_url is removed from the public dinners.Dinner struct, so every response path is
    fixed by one mechanism with no per-handler omission logic. The link stays in the database and
    grounding, repair and duplicate checks continue to read it from there.
  • Tests: TestCreateDinnerByURL and TestCreateDinnerByName now assert the field is absent;
    new TestDinnerResponsesHideRecipeURL posts
    https://c.example/recipes/stew?access_token=personal-token-abc123 and asserts neither the
    create nor the list response contains the link, host, token or key, while the stored link is
    kept. All three fail at 5dff782.
  • The PWA never read recipe_url from a response; web mock fixtures were updated to match the
    API (test-only).

Done-condition: recipe_url is absent from every public dinner response while still driving
grounding.

Checks: gofmt clean, go vet, go test -race -count=1 ./..., CGO_ENABLED=0 go build ./...,
make sqlc-check, web typecheck/test (533)/build - all passing.

Maestro task: `0d863d7a-7991-484b-93ca-2aa84bd9f24d` Base: `feature/2066f34b-5804-410a-859b-f87021a8ae6c-regular-dinners-onboarding` Fixes the independent Codex feature review of PR #94 at `5dff782` (CHANGES_REQUIRED). Commits authored by dev_agent; this PR record was opened by orchestrator-agent because the developer session has no non-owner Gitea identity. F1 (HIGH): - A pasted recipe link can carry a personal token in its query string. `fromRow` copied the stored `recipe_url` into every dinner response (create, list, get, patch, ground, and the `existing` dinner in a 409 duplicate response), so it reached other signed-in household clients and the PWA's cache of dinner reads. - `recipe_url` is removed from the public `dinners.Dinner` struct, so every response path is fixed by one mechanism with no per-handler omission logic. The link stays in the database and grounding, repair and duplicate checks continue to read it from there. - Tests: `TestCreateDinnerByURL` and `TestCreateDinnerByName` now assert the field is absent; new `TestDinnerResponsesHideRecipeURL` posts `https://c.example/recipes/stew?access_token=personal-token-abc123` and asserts neither the create nor the list response contains the link, host, token or key, while the stored link is kept. All three fail at `5dff782`. - The PWA never read `recipe_url` from a response; web mock fixtures were updated to match the API (test-only). Done-condition: `recipe_url` is absent from every public dinner response while still driving grounding. Checks: gofmt clean, `go vet`, `go test -race -count=1 ./...`, `CGO_ENABLED=0 go build ./...`, `make sqlc-check`, web typecheck/test (533)/build - all passing.
orchestrator-agent added 1 commit 2026-10-06 20:36:18 -04:00
Keep recipe_url out of dinner responses (Feature 12 review F1)
CI / ci (push) Successful in 2m36s
Details
CI / ci (pull_request) Successful in 2m23s
Details
c15c8ec284 
A pasted recipe link may carry a personal token in its query, and the
dinners API returned it from create, list, get, patch and ground, where
other household clients and the PWA's cache of dinner reads could keep
it. Drop recipe_url from the public Dinner shape so it stays in the
database for grounding and dedupe only.

TestCreateDinnerByURL and TestCreateDinnerByName now assert the field is
absent; TestDinnerResponsesHideRecipeURL creates a Regular from a
token-bearing link and checks neither the create nor the list response
holds the link, host or token while the stored link remains.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
review_agent requested changes 2026-10-06 20:42:24 -04:00
Dismissed
review_agent left a comment
Member
Copy Link
Copy Source

Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.

Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.
overseer added 1 commit 2026-10-06 20:45:39 -04:00
Drop cached dinner responses and keep link tokens out of names (PR #97 review F1, F2)
CI / ci (push) Successful in 2m37s
Details
CI / ci (pull_request) Successful in 2m40s
Details
903a332375 
F1: bump the service worker cache version to v2 so activate deletes the
v1 API cache, whose dinner responses still carried the pasted recipe_url
and could be served offline.

F2: nameFromURL now drops words holding a digit and ends the name at the
first credential word (token, access, secret, ...), so a token in the
link's last path segment never reaches the public dinner name.
/recipes/beef-stew is still "Beef stew".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
overseer added 1 commit 2026-10-06 20:48:06 -04:00
Name dinners from links with letter-only words (PR #97 review F2)
CI / ci (push) Successful in 2m25s
Details
CI / ci (pull_request) Successful in 2m24s
Details
4e0c31b7d6 
Keep only words of at most 20 letters from the link's last path segment,
so punctuated or long token text such as /stew-t=abcdef never reaches
the dinner name, and stop at combined credential words like accesstoken.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
review_agent requested changes 2026-10-06 20:57:56 -04:00
Dismissed
review_agent left a comment
Member
Copy Link
Copy Source

Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.

Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.
overseer added 1 commit 2026-10-06 21:02:20 -04:00
Retire only the API cache when its version changes (PR #97 review F2, F3)
CI / ci (push) Successful in 2m36s
Details
CI / ci (pull_request) Successful in 2m24s
Details
9574d1920e 
F2: one shared cache version renamed every cache, so the v2 bump that
drops the v1 API cache (dinner responses with the pasted recipe_url) also
deleted saved photos, fonts and the precache. Each cache now carries its
own version in cacheVersions; only api is v2, so activate deletes
mealquest-api-v1 and keeps mealquest-precache-v1, -media-v1 and -fonts-v1.

F3: replace the source-text activation test with src/sw.test.ts, which
loads the worker with the Workbox precache and router stubbed, dispatches
activate against mocked Cache Storage, and asserts caches.delete is called
for mealquest-api-v1 only. tsconfig.sw.json type-checks the test with the
worker's types.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
review_agent requested changes 2026-10-06 21:10:02 -04:00
Dismissed
review_agent left a comment
Member
Copy Link
Copy Source

Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.

Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.
overseer added 1 commit 2026-10-06 21:16:19 -04:00
Require the household's name for a Regular added from a link (PR #97 review R4-F1)
CI / ci (push) Successful in 2m38s
Details
CI / ci (pull_request) Successful in 2m25s
Details
51bae14b7b 
A pasted link may carry a personal token anywhere in its path, so no part
of it can safely name a dinner: the slug heuristic always let some plain
words through. POST /api/v1/dinners now takes {name} or {name, recipe_url};
a link without a name is 400 invalid_dinner, and nameFromURL is gone. The
link is still kept only for grounding and for the recipe-link duplicate
rule. Name-created Regulars, grounding, and the rename rules are unchanged.

On the Regulars screen, pasting a link shows a "Dinner name" field, and
Add stays disabled until it is filled. The optimistic row shows that name,
never the link.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
review_agent left a comment
Member
Copy Link
Copy Source

Independent Codex gpt-6-sol review: APPROVED for this exact commit.

Independent Codex gpt-6-sol review: APPROVED for this exact commit.
approver_agent merged commit f85e09ae07 into feature/2066f34b-5804-410a-859b-f87021a8ae6c-regular-dinners-onboarding 2026-10-06 21:22:57 -04:00
Sign in to join this conversation.
Reviewers
No Reviewers
review_agent
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
approver_agent (The Approver) chatgpt claude-ai Claude-Code codex (Codex) dev_agent grok opencode orchestrator-agent overseer (Joshua) review_agent (The Reviewer)
No Assignees
3 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Maniacs_Mansion/MealQuest#97