[antosubash]

Tech-debt batch 28: the lower-priority checklist from the 2026-10-28 scan.

Closes #698

What changed

• auth.deps.require_permission is deprecated. remove_in="0.1.0", listed in test_deprecation_expiry. It meant "any of", bypassed on the literal role name "admin", and skipped RequiresPermission's demoted-mid-request check; no shipped code used it. The auth README now recommends RequiresPermission.
• Behaviour change: menus follow permissions. The Files and Branding menu items were gated on role names, so ordinary users on single-tenant installs could use /files/ but never saw it, and holders of branding.manage saw no Branding entry. Both now use their pages' permissions.
• Feature-flag tenant overrides leave every worker on TenantDeleted. This was the remaining part of tenant deletion leaves tenant-scope settings/branding rows and in-memory flag overrides #639: the durable handler deleted the rows, but each worker's in-memory registry kept the deleted tenant's overrides.
• Bulk invite no longer shows raw exception text. For database errors that text includes the SQL and its parameters. Known errors still map to their messages; anything else shows a generic one, and the log keeps the detail.
• Behaviour change: audit-log list filters match the export. GET /api/audit_log/ now resolves user_id through the actor search and treats to_date as end-of-day, like the browse screen and CSV export.
• Leases on Postgres lock before reading the clock. DbLeaseBackend read the time before taking the slot's row lock, and Postgres computes an UPDATE's new values before waiting on a lock. A lock wait longer than the TTL could therefore grant, or "refresh", a lease that had already expired.
  • Acquire now inserts an expired placeholder when the slot is missing, SELECT … FOR UPDATEs the row, then reads the clock.
  • Refresh and release lock their rows the same way.
  • SQLite is unchanged, since it already holds the database write lock.

Verification

• make lint ✓ · make test-js ✓ · make test-py ✓ (6443 passed, 41 skipped)
• Lease, on real Postgres:
  • test_db_lease_lock_wait.py holds a row lock for 1.5 s while acquiring or refreshing a 1 s lease; it fails on the old code and passes with the fix.
  • The existing lease suites pass on Postgres and SQLite.
  • Codex's first version shipped tests that broke on Postgres; it was replaced, and an attempt to compute expiry in SQL with clock_timestamp() was measured not to work.
• Code review: clean on the non-lease items; the lease code was reworked and tested by hand as above.
• No browser QA: menu permissions, bulk-invite errors and audit filters are covered by new tests.

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-30T08:30:52.263978Z	effd662	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cloudflare-workers-and-pages]

Deploying simple-module-python with    Cloudflare Pages

Latest commit:	d207151
Status:	✅  Deploy successful!
Preview URL:	https://c8af7a37.simple-module-python.pages.dev
Branch Preview URL:	https://tech-debt-b28-low-priority-c.simple-module-python.pages.dev

View logs