Conversation
…-ai-only PM-5203 approval phase ai only
…-submitters PM-5226 - hide score for submitters
…er-platform/review-api-v6 into allow-to-edit-scores
Allow to edit scores
Hide final score
Fix visibility for reviewer and MM for submissionId and score
Fixes for score visibility in MMs and challenges
Return run details
Sync master into dev
do not remove submission id
Persist cancelled job
Retry failed virus scans
What was broken Review API only allowed create:submission scoped M2M tokens to call the clean validation-upload endpoint used by Marathon Match scorer validation. The Marathon Match API service token used in dev was rejected by Review API, so Work app test submission uploads failed before the ECS scorer task could be queued. Root cause The first PM-5231 implementation added the clean validation-upload endpoint but scoped it as a generic submission creation route. This missed the deployed Marathon Match service credentials, which authorize Marathon Match operations rather than Review API submission creation. What was changed Added Review API Marathon Match update/all scopes and allowed them on POST /submissions/validation-upload while keeping the existing create:submission access. Updated the validation-upload documentation comment and Swagger description to match the accepted scopes. Any added/updated tests Added a SubmissionController metadata test that verifies validation-upload accepts create:submission, update:marathon-match, and all:marathon-match scopes.
PM-5231: Allow Marathon validation upload scopes
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces several enhancements and fixes across the AI workflow, review, and submission modules. Key improvements include stricter controls and auditability for manual AI workflow score edits, new support for Marathon Match validation submission uploads with fine-grained scope controls, and codebase simplification for score calculations. Additionally, new database fields and permissions are added to support these features.
AI Workflow Score Editing & Auditability
Review & Score Calculation Improvements
Submission & Marathon Match Validation Upload
POST /validation-uploadtoSubmissionControllerfor Marathon Match validation submissions. This endpoint is protected by new scopes (update:marathon-match,all:marathon-match) and allows Admin/service accounts to upload clean validation submissions without side effects. Includes a test to ensure correct scope enforcement. [1] [2] [3] [4]Permissions & Roles
Global Providers
SubmissionVirusScanRetryServiceas a global provider, making it available for dependency injection throughout the application. [1] [2]