mosaic/stack
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix(api): Fix RLS context, DTO validation, and error handling #110

Closed
jason.woltje wants to merge 0 commits from fix/rls-dto-errors into develop
pull from: fix/rls-dto-errors
merge into: mosaic:develop
Conversation 0 Commits - Files Changed -
jason.woltje commented 2026-01-30 02:15:30 +00:00
Owner
Copy Link

Summary

Fixes High priority issues from code review.

Changes

1. RLS Context Transaction Safety

  • db-context.ts: Wrapped SET LOCAL in $transaction for connection pooling safety
  • workspace.guard.ts: Removed context setting (now done at service layer)

2. Optional workspaceId in Query DTOs

Made workspaceId optional since guards provide it:

  • query-tasks.dto.ts
  • query-events.dto.ts
  • query-projects.dto.ts
  • query-domains.dto.ts
  • query-ideas.dto.ts
  • query-activity-log.dto.ts

3. Activity Controller Error Handling

  • Replaced throw new Error() with throw new UnauthorizedException()
  • Returns proper 401 instead of 500

Impact

  • Prevents RLS context leakage with pooled connections
  • DTOs pass validation when workspaceId comes from guards
  • Proper HTTP status codes for auth errors
## Summary Fixes **High** priority issues from code review. ## Changes ### 1. RLS Context Transaction Safety - `db-context.ts`: Wrapped SET LOCAL in `$transaction` for connection pooling safety - `workspace.guard.ts`: Removed context setting (now done at service layer) ### 2. Optional workspaceId in Query DTOs Made workspaceId optional since guards provide it: - query-tasks.dto.ts - query-events.dto.ts - query-projects.dto.ts - query-domains.dto.ts - query-ideas.dto.ts - query-activity-log.dto.ts ### 3. Activity Controller Error Handling - Replaced `throw new Error()` with `throw new UnauthorizedException()` - Returns proper 401 instead of 500 ## Impact - Prevents RLS context leakage with pooled connections - DTOs pass validation when workspaceId comes from guards - Proper HTTP status codes for auth errors
jason.woltje added 1 commit 2026-01-30 02:15:31 +00:00
fix(api): fix RLS context, DTO validation, and error handling 26a0df835f 
- Wrap SET LOCAL in transactions for proper connection pooling
- Make workspaceId optional in query DTOs (derived from guards)
- Replace Error throws with UnauthorizedException in activity controller
- Update workspace guard to remove RLS context setting
- Document that services should use withUserContext/withUserTransaction
jason.woltje closed this pull request 2026-01-30 03:04:03 +00:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
ai
AI/LLM integration
 api
Backend/API work
 api
auth
Authentication
 database
database
Database/schema work
 devops
Docker/deployment
 docs
Documentation
 frontend
graph
knowledge-module
migration
Data migration
 orchestrator
Orchestrator service (apps/orchestrator/)
 p0
Critical priority
 p1
High priority
 p2
Medium priority
 p3
Low priority
 performance
Performance work
 phase-1
phase-2
phase-3
phase-4
phase-5
plugin
MoltBot plugin work
 search
security
Security-related
 setup
Initial setup
 testing
Testing/QA
 web
Frontend work
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaic/stack#110
Delete Branch "fix/rls-dto-errors"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?