Skip to content

fix(storyboards): push_notification_config uses schemes array (#2770) - #2780

Merged
bokelley merged 2 commits into
mainfrom
bokelley/pr-2770
Apr 22, 2026
Merged

fix(storyboards): push_notification_config uses schemes array (#2770)#2780
bokelley merged 2 commits into
mainfrom
bokelley/pr-2770

Conversation

@bokelley

@bokelley bokelley commented Apr 22, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Fix push_notification_config.authentication shape in three storyboards (one base + two specialisms) to use schemes (array) + credentials per PushNotificationConfigSchema. The fixtures had the deprecated singular scheme field, which @adcp/client 5.9.0+ rejects at client-side zod validation.
    • static/compliance/source/protocols/media-buy/index.yaml (base media_buy_seller)
    • static/compliance/source/specialisms/sales-guaranteed/index.yaml
    • static/compliance/source/specialisms/creative-generative/generative-seller.yaml
  • Drop the three grandfathered entries from tests/storyboard-sample-request-schema-allowlist.json now that the drift is fixed (surfaces via the lint added in feat(storyboards): lint sample_request against schema_ref with ratchet allowlist #2768).
  • Use storyboard-scoped placeholder credentials (per the sales-broadcast-tv pattern) instead of a generic string.

sales-broadcast-tv/index.yaml was already correct and served as the reference shape.

Closes #2770.

Follow-ups (out of scope)

  • Storyboards currently teach the deprecated legacy HMAC path; baseline should be the RFC 9421 profile (schema comment: authentication is a "switch, not a fallback"). Worth a narrative pass or adding a no-authentication example variant.
  • No runtime test exercises storyboard sample_request payloads through @adcp/client zod schemas — only static AJV lint. Closing that gap would catch AJV↔zod drift.
  • Other allowlist entries look like analogous field-name drift (e.g. additionalProperties@/:account across five fixtures); triage suggested.

Test plan

  • npm run test:storyboard-sample-request-schema passes (previously failed on stale allowlist entries)
  • npm run test:unit + npm run typecheck (precommit) green on both commits
  • CI green on first commit (build, changeset, CodeQL, schema validation, storyboards legacy+framework, semgrep, GitGuardian)
  • Downstream compliance audit re-run against media_buy_seller, sales_guaranteed, and creative_generative/seller with @adcp/client 5.9.0+

🤖 Generated with Claude Code

bokelley and others added 2 commits April 21, 2026 21:08
Align sales-guaranteed and creative-generative/seller storyboards with
the PushNotificationConfig spec schema, which requires `schemes` (array)
and `credentials` — not the singular `scheme` the fixtures had.
@adcp/client 5.9.0+ rejects the malformed shape at client-side zod
validation, breaking 3 sales_guaranteed and 2 creative_generative/seller
compliance runs. sales-broadcast-tv was already correct.

Drop the two grandfathered entries from the sample-request schema
allowlist now that the drift is fixed.

Closes #2770.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…placeholders

Expert review flagged that the same singular `scheme` bug was already
grandfathered in the base `protocols/media-buy/index.yaml` storyboard
(higher-traffic than the specialisms). Same class of drift, same fix.

Also rename the two specialism placeholder credentials from the generic
`placeholder-webhook-secret-token` to storyboard-scoped values matching
the `sales-broadcast-tv` pattern — reduces the chance of copy-paste
collisions across fixtures and makes the origin of a leaked placeholder
traceable.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@bokelley
bokelley merged commit 1fa6b9d into main Apr 22, 2026
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Storyboards: push_notification_config.authentication uses singular scheme instead of spec array schemes

1 participant