feat/one-api

listContractPublicIdsByOrgId returns soft-deleted utility contracts — no deletedAt IS NULL filter

domains/utility/src/site-utility-contract/site-utility-contract.queries.ts:231

Pre-existing gap carried from old two-hop path. Add isNull(utilityContracts.deletedAt) to the WHERE clause.

get_user_org_ids() evaluates current_setting('request.jwt.claims') twice — CTE would eliminate double parse

packages/database/drizzle/0075_machine_claim_hardening.sql:41

Functionally correct (STABLE); the duplicate expression risks drift if one occurrence is edited without the other. A WITH clause would make the value appear once.

Auth handler profile-insert deviation confirmed resolved — canonical-form note removal is accurate

apps/platform/src/api/handlers/auth.handler.ts:257

Handler now calls ProfileFCIS.ensureProfileForAuthShell(). Stale deviation note correctly retired.

Main v1 mount rate-limiter still uses spoofable x-forwarded-for[0] — fix applied only to OAuth token route

apps/platform/src/app/api/v1/[...ts-rest]/route.ts:91

x-real-ip preference correctly applied to oauth/token/route.ts. The main mount's rateLimitBucket() for unauthenticated requests still reads x-forwarded-for[0]. Apply the same x-real-ip ?? x-forwarded-for[0] precedence.

Non-empty invalid JSON in request.jwt.claims GUC raises unhandled exception in get_user_org_ids() (pre-existing, 0075 inherits gap)

packages/database/drizzle/0075_machine_claim_hardening.sql:38

nullif handles empty string → NULL, but any non-empty non-JSON value causes the ::json cast to raise, crashing all 88 RLS policies for that request. Not directly attacker-controllable from the public API. Inherited from 0069.

Machine-claim identity gate (0075) verified correct — auth.uid() IS NULL makes human and machine branches mutually exclusive

packages/database/drizzle/0075_machine_claim_hardening.sql:1

Fix is correct. CI ratchet on custom_access_token_hook definition text provides defense-in-depth.

No new IDOR risk in listContractPublicIdsByOrgId — orgId sourced from verified token, not caller input

packages/api/src/auth/accessible-contracts.ts:71

Permission boundary unchanged; query consolidation only.

Orphaned docblock misattributes 'List contract public_ids for a set of sites' to listContractPublicIdsByOrgId

domains/utility/src/site-utility-contract/site-utility-contract.queries.ts:214

New function inserted between existing JSDoc for listContractPublicIdsBySiteIds and that function. listContractPublicIdsByOrgId now has two docblocks (wrong + right); listContractPublicIdsBySiteIds has zero. Move the first docblock down.

Second docblock on listContractPublicIdsByOrgId leads with SQL mechanics (WHAT) rather than WHY

domains/utility/src/site-utility-contract/site-utility-contract.queries.ts:218

Trim 'One-query org→contract resolution: SELECT DISTINCT…'; keep the performance reasoning and DISTINCT justification.

shipToTinybird tests: vi.fn() call history accumulates across tests — not.toHaveBeenCalled() fails after test 1

apps/platform/src/api/utils/__tests__/public-v1-telemetry.test.ts:350

tinybird.appendEvents is a vi.hoisted() vi.fn(). vi.restoreAllMocks() does not clear call counts. Test 2 asserts not.toHaveBeenCalled() but call count is 1 after test 1. Add mockClear() in beforeEach or clearMocks:true in vitest config.

Auth hook 'cleanliness' check fragile — any comment mentioning batu_org_id in hook body fails CI as false alarm

apps/platform/src/__tests__/integration/rls-machine-claim.test.ts:162

pg_get_functiondef returns verbatim body including SQL comments. A future defensive comment would trigger a misleading security-alarm failure. Strip comment lines before the substring check.

Source-level after() boundary guard coupled to specific comment string '// Not in a request scope'

apps/platform/src/api/utils/__tests__/public-v1-telemetry.test.ts:267

Editing that comment silently breaks the slice boundary. Existing start>-1 + end>start guards prevent vacuous pass — risk is a confusing failure, not a silent miss.

fetchRow replacement correctly pins that recordApiRequest is synchronously awaited

apps/platform/src/__tests__/integration/api-telemetry-persistence.test.ts:49

Poll loop would have stayed green on deferred-write regression. Direct select is the right enforcement.

0075: nullif(current_setting(...))::json evaluated twice — lateral or CTE would parse once

packages/database/drizzle/0075_machine_claim_hardening.sql:41

STABLE within a statement so functionally safe. Worth a cleanup on next migration touch.

withEnv helper doesn't cover TINYBIRD_BRANCH_TOKEN — env can be left deleted on test failure

apps/platform/src/api/utils/__tests__/public-v1-telemetry.test.ts:350

Extend withEnv to cover both tokens, or use vi.stubEnv for guaranteed cleanup.

setTimeout(r,0) microtask flush may not settle dynamic import() in all environments

apps/platform/src/api/utils/__tests__/public-v1-telemetry.test.ts:324

Works reliably in current Vitest+Node; worth noting if test environment changes.