Skip to content

fix(api): match history rows to scoped accounts by provider and external id - #593

Merged
cristim merged 2 commits into
mainfrom
fix/history-scope-provider-qualified-account-id
Oct 6, 2026
Merged

cristim merged 2 commits into
mainfrom
fix/history-scope-provider-qualified-account-id

Conversation

@cristim

@cristim cristim commented Oct 6, 2026 •

Copy link
Copy Markdown
Member

Closes #550

History scope filtering keyed account names by external id alone. With the same external id on two providers, a name-scoped user saw or lost rows depending on account list order. The name now comes from CloudAccountID when set, otherwise from provider plus external id (reusing accountNameByExternalID). A legacy row without a provider matches only when one account across providers has that external id. Ambiguous ids resolve to no name.

Tests: handler_history_scope_provider_test.go drives GET /api/history through HandleRequest in both account list orders; 5 of 6 subtests in SameExternalIDAcrossProviders failed on main and pass now.

Not changed: other resolveAccountNamesByID callers. Rows with the account UUID in AccountID and no CloudAccountID are matched by UUID first.

…nal id

The History scope filter keyed account names by external id alone, so two accounts on different providers sharing an external id made the visible rows depend on list order. Resolve the name from CloudAccountID when set, else from provider plus external id, and skip names that are ambiguous.

Closes #550
@cristim cristim added priority/p2 Backlog-worthy severity/medium Moderate harm triaged Item has been triaged urgency/this-quarter Within the quarter impact/few Limited audience effort/s Hours type/security Security finding labels Oct 6, 2026
@coderabbitai

coderabbitai Bot commented Oct 6, 2026 •

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

  • Run on-demand review

This review includes 2 billable files and costs up to $0.50.

  • Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 35 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 64 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Configuration used: Repository: LeanerCloud/cloud-commitments-platform/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Essentials
  • Run ID: e0a3ccab-a609-411d-a455-cb84358199f1
📥 Commits

Reviewing files that changed from the base of the PR and between 165039d and eaefd3f.

📒 Files selected for processing (2)
  • internal/api/handler_history.go
  • internal/api/handler_history_scope_provider_test.go
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

In-flight history rows store the account UUID in AccountID with no CloudAccountID, so provider plus external id lookup hid them from name-scoped users. Try the UUID first. Add tests for UUID rows and for same-provider external id ambiguity.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

effort/s Hours impact/few Limited audience priority/p2 Backlog-worthy severity/medium Moderate harm triaged Item has been triaged type/security Security finding urgency/this-quarter Within the quarter

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(history): history scope matching uses the external account id without the provider (cross-provider collision)

1 participant