mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
HaytandWill Pfleger
71b932708a
Two follow-ups to the idempotency fix from the kalvin-agent security review. The requestId-preservation tests exercised only admin_reopen_report, so the resolve call-site — the enforcement path — could regress to the stale-intent bug with no test going red (verified: unconditionally resetting the resolve requestId left the 35-test admin jsdom suite green). Add resolve lost-response and definitive-4xx tests, mutation-verified against the resolve catch block. preserveRequestIdOnError decided from HTTP status alone, so a truncated 4xx (status read, body lost mid-stream) was treated as a definitive pre-commit rejection and cleared the key even though no authoritative body arrived. Add a bodyComplete discriminator to AdminMutationError, set true only when the full response body is read (authoritative) and false for a redirect, over-cap, or mid-stream read failure (partial). The UI resets a non-409 4xx only when the body was complete; a truncated 4xx now preserves the key. Message strings are unchanged. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>