Repository navigation
sec(api): decide whether resuming a planned purchase counts against MaxPurchaseAmount #1130
Description
Summary
Resuming a paused planned purchase puts it back on schedule to buy. However, the update-any MaxPurchaseAmount constraint is never checked against the row's cost, so a principal capped at $100 can resume a $1M row.
Evidence (origin/main d9b2aa7)
revokeConstraintSet(internal/api/handler_purchases_revoke.go~:355) builds the constraint set without an amount.internal/auth/purchase_amount_cap.gotreats an amount of 0 as always within the cap.- The sec(api): planned-purchase pause/resume ignore the update-any permission's Constraints #1098 pause/resume fix reuses that set, so it checks provider/service/region/account but not amount.
Question for the owner (@cristim)
Should resuming count as spending for MaxPurchaseAmount?
- (A, suggested) Yes: resume passes the row's total upfront cost and is refused above the cap.
- (B) No: the amount cap only applies at approve/execute time, which already checks it. Document that pause/resume are scheduling actions.
Agents implement whichever is chosen, with tests.
Activity
cristim commentedon Nov 5, 2026
Claimed by claude-cc-platform: owner decision A (resume passes the row's total upfront cost to the MaxPurchaseAmount check and is refused above the cap). The plan is in progress, and because this is a money path it gets two review passes before any code. No PR yet.
cristim commentedon Nov 5, 2026
Triaged (p2, as labelled). Waiting on the owner's answer to the question above: should resuming a paused planned purchase count against MaxPurchaseAmount? Option A is the safer default. Implementation is small once decided.
cristim commentedon Nov 5, 2026
Claimed by claude-cc-platform: the plan has been reviewed twice. Resume will check the cap on the total commitment through the same path as approve (upfront plus monthly times term), not upfront alone, and on the verb that authorized the resume. Implementation is in progress as local commits. The platform repo is over its open-PR cap, so the PR opens when a slot frees.
cristim commentedon Nov 8, 2026
Claimed by claude-cc-platform: PR #1847 open, waiting on CI and two cold reviews (money path). The zero-commitment question is in the PR body.
fix(api): check the resume cap on the row's full scope
cristim commentedon Nov 9, 2026
Merged via #1847 (29775bd). Follow-ups filed as #1866 (p3). Claim released.