fix: exact maintainer status check with negative-cache lockdown (#871) - #876
Conversation
|
@ionfwsrijan is attempting to deploy a commit to the codersogs-3057's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
Hey @ionfwsrijan You have 4 open PRs right now. The limit is 3 at a time. Please get your existing PRs merged or closed before opening new ones:
This PR will remain open but won't be reviewed until you're under the limit. See our Contributing Guidelines for details. |
|
@jakharmonika364 @Soumya-codr Please review this |
jakharmonika364
left a comment
There was a problem hiding this comment.
The core .eq(..., null) -> should-be .is(..., null) bug is a one-line fix but is severe: as written, this PR would make isUserMaintainer return false for 100% of users in production, a total maintainer-detection outage. Everything else in the diff (cacheDel cleanups) is correct and can stay as-is once that line is fixed.
Problem
isUserMaintainerfetched only 20 installation users (.limit(20)) then filtered client-side, so a maintainer beyond the first 20 could be misclassified as a non-maintainer. Worse, a transient failure when the service client was missing cached a permanent "denied" answer, locking legitimate maintainers out.Fix
src/lib/maintainer/detect.ts: the DB query now uses an exact EXISTS filter (.eq('github_installations.uninstalled_at', null).limit(1)); the client-side.some()truncation is gone.cacheDel) during maintainer discovery and when an installation event (re)creates an install.Files changed
src/lib/maintainer/detect.tssrc/inngest/functions/maintainer-discover.tssrc/inngest/functions/process-installation-event.tsdetect.test.tsTesting
Closes #871