feat(visibility): demote-on-downgrade + /verify-brand use resolver (#4159 Stage 1.2) - #4301
Merged
Merged
Conversation
…4159 Stage 1.2) Migrates two more read sites: - agent-visibility-enforcement.ts: drop primary_brand_domain from the FOR-UPDATE SELECT, read via resolver after commit. The brand.json manifest cleanup still runs against the resolved domain — no behavior change. - member-profiles.ts /verify-brand: replace profile.primary_brand_domain with getBrandPrimaryDomain. Profile read still validates existence (404 path); brand-domain check moves to the resolver. Same lock-release reasoning as Stage 1.1 (PR #4300): the FOR UPDATE on member_profiles is load-bearing for the agents JSONB read; brand-primary ownership is enforced at write time elsewhere. Unit tests for visibility-enforcement updated to mock the resolver. 60 tests pass across visibility-enforcement (10), visibility-e2e (14), member-agents-api (25), brand-domain-resolver (11). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Comment in /verify-brand explaining why the existence check is still separate from brand-primary lookup (404 vs 400 distinction). - TODO in agent-visibility-enforcement referencing #4159 Stage 3: when setPrimaryDomain writer lands, it should own old-primary-manifest cleanup rather than depending on a tier-downgrade race. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stage 1.2 of #4159. Two more read sites migrated to
getBrandPrimaryDomain(orgId):demotePublicAgentsOnTierDowngrade(server/src/services/agent-visibility-enforcement.ts) — the visibility-demote path that fires when an org's tier loses API access. Dropsprimary_brand_domainfrom the FOR-UPDATE SELECT; brand.json manifest cleanup now reads the brand-primary via the resolver after commit./verify-brand(server/src/routes/member-profiles.ts) — the brand-claim verifier endpoint. Same swap.Lock-release reasoning (same as Stage 1.1)
The FOR UPDATE on
member_profilesis load-bearing for the agents JSONB read/write. Brand-primary ownership is enforced at write time elsewhere (member self-service PUT verifies membership; brand-claim verify proves DNS control). A concurrentsetPrimaryDomain(Stage 3) racing this read lands old-or-new — both states the org legitimately controls.Tests
agent-visibility-enforcement.test.tsupdated to mock the resolver. Tests that depend on a brand domain set the mock per-case.What's left
member-profiles.tsGET-resolution paths (lines ~695, ~748, ~1995)http.tsservices/brand-property-parse.tsservices/brand-identity.tsservices/announcement-drafter.tsroutes/brand-feeds.tsNext PR will likely target dashboard reads in
http.ts(good fit for the batched resolver shipped in PR #4299).🤖 Generated with Claude Code