feat(api): scope-aware SQL totals for the History summary cards by IAmJSD · Pull Request #1200 · LeanerCloud/cloud-commitments-platform

IAmJSD · 2026-10-20T13:06:43Z

Root cause

getHistory built summary with summarizePurchaseHistory(all), which only sees the page: at most limit purchase_history rows, 100 terminal executions and 1000 actionable ones. With more rows than a cap, the cards under-report, and truncated only says so.

Fix

One store method. HistorySummaryAggregate (internal/config/store_postgres_history_summary.go) runs one grouped COUNT/SUM per source and returns groups, not totals:
- purchase_history, grouped by (account_id, cloud_account_id, provider, revoked). Upfront is NULL when any row in the group has an unknown cost, the same way sumKnownCosts handles it.
- purchase_executions, grouped by (status, cloud_account_id, created_by_user_id, ordered [provider, cloud_account_id] of each recommendation).
- There's one group per account/provider/status combination, so the result size doesn't grow with row count.
Shared SQL predicates.
- purchaseHistoryFilterWhere is now the only WHERE builder for both GetPurchaseHistoryFiltered and the aggregate.
- historyExecutionsPredicate is shared with GetExecutionsByStatuses.
- On the handler side, historyFilters.purchaseHistoryFilter() builds the store filter for both the row fetch and the aggregate.
Same scope check, same code. The row path applies the account scope in Go: allowed.Allows(accountID, historyRowAccountName(...)), plus the ambient-row ownership gate. That logic now lives in historyScope.allows. It is resolved once per request and applied to the listed rows and to every aggregate group.
- Execution groups are rebuilt into a PurchaseExecution and passed through the same matchesExecutionProviderAndAccount and executionToHistoryRow the list uses.
- Group totals are only added up after the scope check, so a scoped user never gets counts from another tenant. Nothing is returned for groups outside the scope.
- I did not rewrite the scope check in SQL. That would be a second copy that could drift from the Go one.
Same bucketing rules. summarizePurchaseHistory now loops over addHistoryRowToSummary(row, n), and the aggregate calls that same function for each group. Its rules are unchanged:
- revoked rows have no dollars
- audit-gap and partially completed rows count as completed, with no dollars
- canceled rows count only toward total_purchases
- pending/notified/scheduled count as pending
- approved/running/paused count as in progress
Concurrency.
- Both aggregate queries run in one REPEATABLE READ, READ ONLY transaction. Without it, a purchase moving from a running execution to a purchase_history row mid-read gets counted 0 or 2 times; there's a race test for this.
- The stale-approval sweep is now deferred. On Lambda it used to run synchronously before the summary, so the cards would have counted as expired the rows the list still showed as pending.
Response. HistoryResponse.summary_complete (also in openapi.yaml) is true when the summary covers every matching row. If the aggregate query fails, the summary falls back to the page with a warning log and summary_complete: false, instead of failing the whole History load. The openapi HistorySummary schema also lists the per-bucket counters it was missing.
Cost. One grouped scan per table. The default date window is unchanged and there is no new index. An unfiltered view scans all of purchase_history, which is bounded by the number of purchases ever made.
Interface. Implemented in internal/mocks/stores.go, internal/analytics/collector_test.go and internal/server/test_helpers_test.go. With no expectation set, the shared mock returns ErrHistorySummaryAggregateNotStubbed, so older handler tests keep checking the page summary through the fallback.

Closes #675

Verification

All on macOS against real Postgres via testcontainers (local integration evidence). Tests ran with AWS_CONFIG_FILE=/dev/null AWS_SHARED_CREDENTIALS_FILE=/dev/null because this machine's default AWS profile is broken. There's no real-cloud or deployed-stack coverage; the change is DB and handler only.

Fail before, pass after. I ran TestIntegration_HistorySummary_TotalsCoverAllInScopeRows against a git archive origin/main copy with only the new test file added.

Seed: two tenants. Each has 11 purchases (2 revoked, 3 legacy rows with no cloud_account_id), 105 canceled executions (over the 100 terminal cap), and pending/notified/scheduled, approved/running/paused, failed, expired, audit-gap completed, partially_completed, clean-completed (excluded), canceled and web-bulk rows. There are also ambient executions owned by the scoped user and by another user. The request uses limit=5.
On main:
- scoped user total_purchases expected 130, got 61
- admin expected 260, got 120
- total_completed, upfront and savings also wrong
- summary_complete missing
On this branch it passes. The scoped user gets exactly the manual sum over tenant-A rows plus their own ambient row, the admin gets the sum over all rows, and a scoped user filtering on tenant B gets zero.

Drift guards.

TestIntegration_HistorySummary_MatchesListedRowsUnderTheCap (api): with every in-window row listed, summary == summarizePurchaseHistory(listed rows) for scoped and admin viewers across date, provider aws/azure, account A/B and legacy account_id filters, including rows exactly on and 1µs outside the date edges.
TestIntegration_HistorySummaryAggregate_MatchesRowFetch (config): aggregate groups == uncapped GetPurchaseHistoryFiltered / GetExecutionsByStatuses rows grouped in Go, across 7 filter combinations.
TestIntegration_HistorySummaryAggregate_DateBoundsInclusive: the SQL date bound is inclusive at both ends, the same as the Go check, and JSON-null recommendations project to an empty list.
TestIntegration_HistorySummaryAggregate_SnapshotUnderConcurrentCompletion: a writer moves one purchase between a running execution and a purchase_history row while 1500 aggregates run, and each must count it exactly once.
Unit (mock):
- the aggregate gets the scope applied
- the aggregate's purchase filter equals the row fetch's filter
- the summary falls back when the aggregate fails
- on Lambda the sweep runs after the aggregate
- no listed execution status can add dollars, which is why rebuilt execution groups are safe
- a group of n rows equals n single rows

Mutation probes. Each one was applied by hand, run, and reverted.

Removing SET TRANSACTION ... REPEATABLE READ: race test fails ("counted 0 times").
Skipping the scope check on execution groups: 3 tests fail.
Shifting the SQL date bound by a day: 3 tests fail.
Dropping the purchase_history WHERE from the aggregate: 3 tests fail.

go build ./...
go vet ./internal/api/ ./internal/config/ ./internal/mocks/ ./internal/analytics/ ./internal/server/
go vet -tags integration ./internal/api/ ./internal/config/
go test ./internal/api/ ./internal/config/ ./internal/mocks/ ./internal/analytics/ ./internal/server/ -count=1
go test -tags integration ./internal/config/ -run 'TestIntegration_HistorySummaryAggregate|TestIntegration_GetExecutionsByStatuses|History|PurchaseHistory' -count=1
go test -tags integration ./internal/api/ -run 'TestIntegration_HistorySummary_|History' -count=1
golangci-lint v2.10.1 run --allow-parallel-runners --build-tags integration ./internal/{api,config,mocks,analytics,server}/...   # 0 issues
gocyclo -over 10 -ignore "_test\.go" <changed non-test files>   # silent
bash scripts/gosec-hook.sh <changed files>                       # exit 0
git-secrets --scan (fresh temp repo, isolated HOME, repo patterns) # clean; scripts/test-git-secrets-allowlist.sh 42 PASS

Out of scope / notes

Pre-existing scope behavior, kept as is. For purchase_history rows the Go scope check compares the row's external account_id to the scope entries, so a scope that lists only an account UUID matches those rows only through the unique-display-name path. The aggregate copies this behavior instead of changing it. Open PR fix(auth): bind group account scope entries to account IDs #1116 (bind group scope entries to account IDs) is the place to change it.
fix(history): pending approvals can fall off the first page because filters are applied after the executions cap; add paging and push provider/account/date filters into the executions SQL #632 is not done here. It covers pushing the provider/account/scope predicates into the executions row SQL, and paging. The executions row fetch still filters in Go after the cap.
Separate reads. The row list and the aggregate are still two reads. A row committed between them, or a sweep fired by a concurrent request, can make the cards differ from the list by that row until the next load.
JSON keys. The execution grouping reads the lowercase JSON keys provider / cloud_account_id, which is what json.Marshal writes for RecommendationRecord. encoding/json matches keys case-insensitively, so hand-written JSONB with other casing would match the list but not the aggregate.

Frontend follow-up for the UI owner

No change under frontend/ in this PR. The cards already read summary.*, so they show the full totals with no UI change. Suggested follow-up in frontend/src/history.ts renderTruncationNotices and frontend/src/types.ts:

Add summary_complete?: boolean to HistoryResponse.
When truncated && summary_complete, change the banner to say only that older rows aren't listed, and that the summary cards still cover all matching purchases. Drop "and totals may be incomplete".
Keep the current wording when summary_complete is false.

Maintainers: please mirror the issue's triage labels on this PR: priority/p2, severity/medium, urgency/this-quarter, impact/many, effort/m, type/feat, triaged.

🤖 Generated with Claude Code

The History summary was summed over the capped, filtered page, so the cards under-reported once a fetch hit its row cap. Add one store method, HistorySummaryAggregate, that returns counts and dollar sums over every matching purchase_history and purchase_executions row, grouped by the columns the handler's provider, account and account-scope checks read. The purchase_history WHERE clause now comes from one builder (purchaseHistoryFilterWhere) shared with GetPurchaseHistoryFiltered, and the executions predicate is one constant shared with GetExecutionsByStatuses. The handler applies the same Go checks it runs on listed rows (matchesExecutionProviderAndAccount, executionToHistoryRow and the account scope) to each group, and both the list and the totals bucket rows through addHistoryRowToSummary, so the scope predicate and the summary rules cannot drift. Both halves are read in one REPEATABLE READ snapshot, and the stale-approval sweep is deferred until after the aggregate. HistoryResponse gains summary_complete, false only when the aggregate fails and the summary falls back to the page. Closes LeanerCloud#675 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

coderabbitai · 2026-10-20T13:06:51Z

Caution

Review failed

The pull request is closed.

Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

cristim · 2026-10-21T01:37:12Z

Independent review 2 (claude-fleet, cold): APPROVE abec6cd

Findings (none blocking):

[non-blocking, pre-existing] frontend/src/history.ts:270 and frontend/src/api/history.ts:22 vs internal/api/handler_history.go:739 (parseHistoryFilters) - plan_id is sent but never parsed, so "View plan history" lists every purchase.
- Before this PR, the plan view's cards summed only the page. Now they show tenant-wide all-time totals, which makes the bug more visible.
- This is not this PR's bug, but it is worth a known-issues entry or a follow-up issue.
[non-blocking, test gap] internal/config/store_postgres_history_summary.go:85 - The NULL-upfront rule (CASE WHEN COUNT(upfront_cost)=COUNT(*)) is pinned only by the config test. The api-level integration seed has no unknown-cost rows, so probe P2b survives there.
[non-blocking] internal/config/store_postgres.go:2116 vs store_postgres_history_summary.go:96-101 - If one execution row's recommendations JSON will not decode, GetExecutionsByStatuses errors and the handler drops that whole class from the list.
- The aggregate still counts the row and reports summary_complete=true.
- The same holds whenever a class listing fails. This is an edge case, and the handler logs it.
[nit] store_postgres_history_summary.go:132-137 - Begin followed by SET TRANSACTION ... works, and the race probe shows the snapshot holds. BeginTx(pgx.TxOptions{IsoLevel: RepeatableRead, AccessMode: ReadOnly}) would do it in one call, if s.db exposes it.
[non-blocking] The cost claim holds for the UI only, because the frontend sends a 7-day window by default (history.ts:228).
- A no-date API call runs the jsonb projection over every purchase_executions row in the listed statuses.
- The purchase_history half was already a full scan.

Against #675: the summary now comes from grouped SQL, and the groups go through the same code the list uses: historyScope.allows, matchesExecutionProviderAndAccount, executionToHistoryRow and addHistoryRowToSummary.

The group keys cover every field those functions read.
- historyRowAccountName reads CloudAccountID, AccountID and Provider.
- accountMatchesFilters and executionProvider read exec.CloudAccountID and the rec provider/cloud_account_id.
- The ambient gate reads CreatedByUserID.
Execution groups can never add dollars. Completed and partially_completed set IsAuditGap, and every other status lands in a non-dollar bucket.
The JSON nil, "" and absent cloud_account_id cases are equivalent through collapseRecommendationAccount.
The legacy account_id is folded into AccountIDs before purchaseHistoryFilter(), so the no-filter fast path matches too (GetAllPurchaseHistory has no WHERE).

Attacked:

Deferred sweep: staleExecs is bound when the defer is set, and the error paths behave as before.
Blast radius:
- All 4 StoreInterface implementers are updated: mocks, server, the analytics test mocks and postgres.
- filterPurchaseHistoryByAllowedAccounts is also called by handler_inventory.go:48,191, and its behaviour there is unchanged.
Mutation probes on a scratch copy, each restored and confirmed identical with cmp:
- P1, scope skipped on execution groups: FAILS (scoped 249 vs 130; tenant-B filter 118 vs 0).
- P2, the NULL-upfront CASE dropped: the config test FAILS. P2b at the api level survives (the gap above).
- P3, <= changed to < on the end bound: FAILS.
- P4, the sweep not deferred: FAILS (the Lambda ordering unit test).
- P5, purchaseGroupRow CloudAccountID=nil: survives. This is effectively an equivalent mutant, because name resolution falls back to provider plus external ID.
- P6, the execution date bound dropped: FAILS.
- P7, READ ONLY without REPEATABLE READ: FAILS ("counted 0 times").
- P8, scope skipped on purchase groups: FAILS.
Merge: git merge-tree --write-tree origin/main <head> is clean.
- Main changed interfaces.go, the mocks and the test mocks (RI exchange direct-exec methods), plus unrelated text in types.go and openapi.yaml.
- handler_history.go and store_postgres.go are unchanged on main.
- Built and tested on a merged export.

Verified locally, on head and merged exports with no cloud credentials, under the heavy lock, using the repo's testcontainers harness:

Build and static checks:
- go build ./...: OK.
- go vet on api, config, mocks, analytics and server, plus -tags integration on api and config: OK.
- gofmt -l on the 12 changed files: clean.
Unit tests: go test -count=1 on the 5 packages: ok.
Integration tests:
- config -run 'TestIntegration_HistorySummaryAggregate|TestIntegration_GetExecutionsByStatuses|PurchaseHistory': PASS.
- api -run 'TestIntegration_HistorySummary_|History': PASS.
Fail-before: the new api integration test on base FAILS as the PR says: scoped total_purchases 130 vs 61, admin 260 vs 120, and summary_complete is missing.
No migration and no frontend changes.

Reviewed by an independent agent with no author context (second reviewer). Review only: nothing was pushed, and the GitHub review state is unchanged.

cristim · 2026-10-25T10:30:47Z

VERDICT: APPROVE abec6cd

Reviewed against origin/main f5ad8c6. git merge-tree is clean (tree e9f2c22e). The merged tree builds, and go vet passes with and without -tags integration, on Go 1.26.10.

Findings

medium (pre-existing, not introduced) internal/api/handler_history.go:739 (main :729) - parseHistoryFilters never reads plan_id, and historyFilters has no plan field. The frontend still sends it: frontend/src/api/history.ts:22, and viewPlanHistory (frontend/src/history.ts:282, :294) passes { planId }. Failure scenario: "View plan history" lists every in-scope purchase, not just the plan's, and has no date bound. With this PR the cards on that view now total every in-scope purchase ever made and report summary_complete: true, where before they summed one capped page. The list and the totals are wrong in the same way, so they stay consistent with each other. This needs a follow-up issue. It does not block this PR.
nit (pre-existing, sec(money): currency is dropped at every layer boundary, so USD-denominated caps are compared against non-USD amounts [platform part] #361) internal/config/store_postgres_history_summary.go:85-86 - upfront_cost and estimated_savings are summed with no currency, as the old page summary did. purchase_history has no currency column, so mixed-currency rows still produce one unlabeled number, now over every matching row.
nit (test gap) internal/api/handler_history_summary.go:164 - mutation M3 sets the group CloudAccountID to nil, and no unit or integration test fails. The scope-name lookup then falls back to (provider, account_id). That only differs when a row's cloud_account_id and its external id point at different accounts. Add one fixture for that case.
nit (process) - the single commit is 1656 changed lines, over the 400-line cap.

Checked and found correct

Scope: historyScope.allows (handler_history_summary.go:63-72) is the same code for listed rows and for aggregate groups. Execution groups go through matchesExecutionProviderAndAccount and executionToHistoryRow before the scope check (:121-136). The groups carry every field those functions read: status, cloud_account_id, created_by_user_id and the provider/cloud_account_id of each rec.
Filters: purchaseHistoryFilterWhere and historyExecutionsPredicate are shared with the row SQL. The SQL date bound is inclusive and matches the Go check. An empty filter is equivalent to GetAllPurchaseHistory.
Unknown upfront: a group with any NULL upfront_cost gets a NULL sum, which sumKnownCosts treats as unknown, the same as a single unknown row.
Execution dollars: every listed execution status is either a non-dollar bucket or an IsAuditGap row, so rebuilt groups never add dollars.

Tests (merged tree)

Unit: go test ./internal/{api,config,mocks,analytics,server}/: 5763 passed.
Integration (testcontainers Postgres): go test -tags integration ./internal/config/ -run 'TestIntegration_HistorySummaryAggregate|TestIntegration_GetExecutionsByStatuses|History|PurchaseHistory' ok. ./internal/api/ -run 'TestIntegration_HistorySummary_|History' ok.

Attacked (mutation probes, each in a scratch copy and reverted)

M1: skip the scope check on purchase groups. FAIL TestGetHistory_SummaryComesFromScopedAggregate (caught).
M2: skip the scope check on execution groups. FAIL, same test (caught).
M3: drop the group CloudAccountID. Unit and integration tests both pass (survived, see the test-gap nit).
M4: make the stale sweep run before the aggregate instead of deferred. FAIL TestGetHistory_LambdaSweepRunsAfterSummaryAggregate (caught).
M5: replace the NULL-upfront CASE with a plain SUM. FAIL TestIntegration_HistorySummaryAggregate_MatchesRowFetch (caught).
Also read: the snapshot transaction (REPEATABLE READ, READ ONLY, begun before any query), the stale-sweep defer on error paths, API-key sessions (UserID is never empty, so the ownership gate holds), and the mock fallback.

cristim · 2026-10-25T11:02:52Z

Local verification at abec6cdc96e68901aaae657a706cc6445f275764 merged onto current main (00a3f408; merge-tree 05693d46; macOS):

go build ./..., go vet -tags integration ./... and go test -race -short ./... pass (full suite).
Nothing was applied to any cloud.

cristim · 2026-10-25T11:18:36Z

Local verification at abec6cdc96e68901aaae657a706cc6445f275764 merged onto current main (00a3f408; merge-tree 05693d46; macOS):

go build ./..., go vet -tags integration ./... and go test -race -short ./... pass (full suite).
Nothing was applied to any cloud.

cristim · 2026-10-25T11:31:13Z

Marked ready and merged by the owner's agent after 2 independent reviews and local verification (see the review and verification comments above, all at abec6cdc96e68901aaae657a706cc6445f275764).

Bring the branch up to date with main (7cde88e), which includes LeanerCloud#1200's HistorySummaryAggregate mock. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

LeanerCloud#1200 added HistorySummaryAggregate with the old panic on a mistyped .Return, which ends the whole test binary. Route it through wrongReturnType like the other sites so a registered test fails under the method's name instead. Refs LeanerCloud#353 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The history-summary integration tests from LeanerCloud#1200 scoped their user with the tenant's display name. This branch binds allowed_accounts entries to account IDs and makes a bare name entry match nothing (LeanerCloud#1034), so the scoped user saw no tenant A rows and the totals and listed-rows checks failed. Grant the scope by tenant A's account ID, the form group writes now store. The assertions are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Bring the branch up to date with main. Conflicted files: - internal/api/handler_history.go: main (LeanerCloud#1200) moved the per-row summary bucketing out of summarizePurchaseHistory into addHistoryRowToSummary and addNonCompletedRowToSummary so the SQL aggregate and the row list share one set of rules. The branch had dropped config.LegacyStatusCanceled from the canceled case in the old inline switch. Kept main's refactor and applied the branch's change to addNonCompletedRowToSummary: only config.StatusCanceled is matched, since 000144 makes the legacy spelling unstorable and the branch removes the constant. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…ry test The test came in from main (LeanerCloud#1200) and seeds executions with LegacyStatusCanceled and queries it as an execution status. This branch removes that constant, and migration 000144 rejects the 'cancelled' status, so the seed would fail the narrowed CHECK. Seed and query only the canonical spelling. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Bring the branch up to date with main. Conflicted files: - internal/api/handler_history.go: main (LeanerCloud#1200) replaced summarizePurchaseHistory(all) in the getHistory response with the scope-aware SQL summary plus SummaryComplete; the branch added ActionableExecutionsLimit to the same literal. Kept both: main's Summary/SummaryComplete and the branch's ActionableExecutionsLimit. - internal/api/types.go: both sides rewrote the Truncated doc comment. Combined them: main's note that Summary still counts rows beyond the caps while SummaryComplete is true, and the branch's note that a failed execution class listing also sets Truncated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

This branch is stacked on fix/issue-686 (LeanerCloud#1276). That branch was brought up to date with origin/main in ee67abd, so merging it here brings in main and the LeanerCloud#686 conflict resolutions in one step. Conflicted files: - internal/api/main_nonet_test.go, internal/api/main_integration_test.go: both sides added a teardown hook list for the shared Postgres server (this branch: afterAllTests; main LeanerCloud#1400: afterTests). Took main's files unchanged; this branch only needed the hook, which main now provides. - internal/api/handler_history.go, getHistory: main (LeanerCloud#1200) loads the account scope once (loadHistoryScope), filters rows with scope.filter, defers the stale-approval sweep until after the summary aggregate, and returns the scope-aware SQL summary with SummaryComplete. This branch pages the stream (fetchHistoryPage) and lists the actionable class only on the first page. Combined: the page is fetched first, the scope is loaded once and applied to the actionable rows, staleExecs is declared outside the Cursor == nil branch so the sweep stays deferred (and does not run on cursor pages), and the response carries main's Summary/SummaryComplete plus this branch's paging fields. The summary is now whole-scope on every page. - internal/api/handler_history.go, fetchPurchaseHistory: main replaced the GetAllPurchaseHistory/GetPurchaseHistoryFiltered split with the shared historyFilters.purchaseHistoryFilter; this branch reads one keyset batch through ListPurchaseHistoryPage. Kept both: purchaseHistoryFilter is kept (the summary uses it) and the batch read now starts from it with Limit set to the batch size. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Main (LeanerCloud#1200) made purchaseHistoryFilterWhere the one purchase_history predicate builder and historyExecutionsPredicate the one executions predicate, shared by the History row fetch and the summary aggregate so the totals count exactly the rows the list can show. This branch's page queries carried their own copies (purchaseHistoryPageConds and an inline status/clean-completed predicate). Use the shared ones instead, so the paged list and the whole-scope summary cannot drift apart. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Main (LeanerCloud#1200) added purchaseHistoryRowStatus so listed purchase_history rows and the summary's aggregate groups get the same Status. The paged stream set the literal "completed"; use the constant. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The History summary tests came in from main (LeanerCloud#1200) and mock the old purchase_history reads (GetAllPurchaseHistory, GetPurchaseHistoryFiltered). This branch reads purchases through ListPurchaseHistoryPage, so the filter-equality test panicked on a nil row filter. Mock the paged read instead; the assertions are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Bring the branch up to date with main. Conflicted files: - internal/analytics/collector_test.go: main kept adding stubs to the hand-rolled analytics mockConfigStore (HistorySummaryAggregate from LeanerCloud#1200, ClaimCollectionInvocation from LeanerCloud#1099, the ReplaceRecommendations removal from LeanerCloud#1209, and the pgx import they need). This branch replaces that hand-rolled mock with one that embeds mocks.MockConfigStore, which already carries all of those methods on main. Kept the branch's version; main's stub edits are covered by the shared mock and drop out. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Bring the route-coverage guard and spec backfill up to date with main. Conflicted files: - internal/api/openapi.yaml, GET /api/recommendations parameters: keep this branch's account_ids, min_savings_usd and min_savings_pct and main's limit and cursor (LeanerCloud#974). The AccountID ($ref account_id) entry main still carried stays dropped, since the handler never reads account_id. - internal/api/openapi.yaml, GET /api/recommendations 400: keep main's detailed description (LeanerCloud#974), which already covers the filters this branch documents. - internal/api/openapi.yaml, HistorySummary: keep main's schema-level description from LeanerCloud#1200 (audit-gap and canceled rows), add a sentence on revoked rows, and keep this branch's per-field descriptions for total_pending, total_in_progress and total_revoked, which match addHistoryRowToSummary on main. - internal/api/openapi_403_test.go: main (LeanerCloud#1403) replaced the per-route file scan with one permissionGatedHandlers index built by scanHandlerFileForPermission. Keep main's structure and move this branch's whole-line comment skip into scanHandlerFileForPermission, so a requirePermission mention in a comment still doesn't mark a handler as gated. The branch's first-match specPathsForRoute and the route table length check merged cleanly on top. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…nd e2e findings (#1270) * chore(test): fix the 2026-07-28 review's mock, CI-doc, known-issues and e2e findings - internal/mocks: a mistyped .Return value no longer panics when the test registered itself with the mock's Test method; it fails that test (Errorf + FailNow) under the method's name. 82 of the 83 type-assertion sites in MockConfigStore, MockAuthStore and the Secrets Manager, SES and SNS mocks go through testReporter (GetPendingExecutionsTx is left alone: open PR #1217 deletes it). Without a registered test the mock still panics, now naming the method. - frontend-build.yml: drop the paths filter so `Build frontend` reports on every PR (a path-filtered required check blocks every PR outside its paths); a fail-closed first step skips the build when nothing under frontend/ changed. docs/ci-required-checks.md explains why. - known-issues.md: the #731 entry named a role the ARM template does not define and a stale branch; correct the name and move it to Resolved, pointing re-deploys at the #1545 revoke-first steps. - tests/e2e: TestVersionEndpoint asserts version, git_sha and build_time instead of any non-empty JSON object. Refs #353 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(mocks): fail the test on a mistyped HistorySummaryAggregate return #1200 added HistorySummaryAggregate with the old panic on a mistyped .Return, which ends the whole test binary. Route it through wrongReturnType like the other sites so a registered test fails under the method's name instead. Refs #353 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…_cursor) (#1277) * fix(history): flag a failed execution class listing as truncated and expose the actionable cap fetchExecutionsByClass logged a listing error and skipped the class, so a failed actionable query hid every pending approval while the response kept truncated=false. The class fetch now reports failure and fetchExecutionsAsHistory raises the incomplete-results signal (including on the no-executions early return). HistoryResponse gains actionable_executions_limit (config.MaxListLimit) next to executions_limit (terminal cap, DefaultListLimit), so the UI banner can quote the cap that was actually hit instead of always quoting the terminal cap. The banner text itself lives in frontend/ and is left to the UI owner. Refs #686 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(api): page the History view with a keyset cursor (has_more, next_cursor) GET /api/history listed at most `limit` purchase_history rows and 100 terminal executions, and rows past those caps could not be reached: there was no way to ask for the next page. Completed purchases and terminal executions are now one stream, newest first, ordered by (timestamp DESC, source DESC, row id DESC), which is unique. Each response lists `limit` rows of it and, when more rows the caller may see follow, sets has_more and next_cursor; passing next_cursor back as `cursor` returns the next page. The cursor is a keyset position, not an offset: the account scope and the execution filters run in Go after the SQL read, so an offset would count rows the caller never sees, and every row written ahead of it would shift the page. With the keyset, a later page resumes strictly after the last row shown, so rows written between page loads never repeat or skip a row, and a page costs the same at any depth. `offset` is rejected with 400 instead of ignored, so a client written against an offset API cannot loop on the first page. Actionable executions (pending approvals, in-flight purchases) are not paged: the first page lists the whole class as before, and cursor pages leave it out, so paging can never push a pending approval off the first page. The #686 signals are kept: a failed execution listing or a full actionable class still sets truncated. has_more is judged on rows the caller may see, so other tenants' rows never set it, and the cursor only ever names a row the caller was shown. The scope is applied again on every page. Store: ListPurchaseHistoryPage (GetPurchaseHistoryFiltered's predicate plus the keyset, returning each row's id) and ListHistoryExecutionsPage (the terminal statuses, clean completed rows excluded, scheduled_date bounds pushed into SQL). No migration: the existing timestamp and scheduled_date indexes serve both. Closes #674 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(config): build the History page queries from the shared predicates Main (#1200) made purchaseHistoryFilterWhere the one purchase_history predicate builder and historyExecutionsPredicate the one executions predicate, shared by the History row fetch and the summary aggregate so the totals count exactly the rows the list can show. This branch's page queries carried their own copies (purchaseHistoryPageConds and an inline status/clean-completed predicate). Use the shared ones instead, so the paged list and the whole-scope summary cannot drift apart. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(api): give paged purchase rows the shared History row status Main (#1200) added purchaseHistoryRowStatus so listed purchase_history rows and the summary's aggregate groups get the same Status. The paged stream set the literal "completed"; use the constant. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(api): mock the paged purchase read in the History summary tests The History summary tests came in from main (#1200) and mock the old purchase_history reads (GetAllPurchaseHistory, GetPurchaseHistoryFiltered). This branch reads purchases through ListPurchaseHistoryPage, so the filter-equality test panicked on a nil row filter. Mock the paged read instead; the assertions are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

SavePurchaseHistory now fills cloud_account_id from the registered account with the same (provider, external_id). The History summary (LeanerCloud#1200) and History page (LeanerCloud#1277) fixtures seed "legacy" rows by saving with a nil CloudAccountID next to a registered account, so after the merge those rows came back linked and the drift guards no longer exercised the unlinked, external-id-only shape they were written for. Clear the column after the save so the fixtures still seed legacy rows, and require that exactly one row was cleared. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…1244) * fix(history): set cloud_account_id on every purchase_history insert The direct-execute, ambient (host-account) and legacy single-account paths reach SavePurchaseHistory with no CloudAccountID, so their rows were stored with cloud_account_id NULL even after the 000139 backfill. SavePurchaseHistory now resolves a missing cloud_account_id in the INSERT from (provider, account_id) with the backfill's rules: lower-cased provider, exact account id, never an empty id. The lookup locks the account FOR KEY SHARE so a concurrent account delete makes the row NULL instead of failing the insert on the foreign key. A row that matches no registered account is still stored (dropping it would be an audit gap, #621) and logged as a warning. The function moves to its own file out of store_postgres.go. The marketplace constraint test's "missing account" rows now clear the resolved account to keep a legacy unlinked row, and a new case covers a host-account row the save links to its registered account. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(history): cover cloud_account_id resolution and account-delete races Real-Postgres tests for #1235: rows shaped like each write path get their account, an explicit id wins, rows that match nothing are kept with NULL, the dedupe path does not rewrite a row, and a save racing an account delete stores NULL instead of failing on the foreign key. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(history): keep legacy History fixture rows unlinked SavePurchaseHistory now fills cloud_account_id from the registered account with the same (provider, external_id). The History summary (#1200) and History page (#1277) fixtures seed "legacy" rows by saving with a nil CloudAccountID next to a registered account, so after the merge those rows came back linked and the drift guards no longer exercised the unlinked, external-id-only shape they were written for. Clear the column after the save so the fixtures still seed legacy rows, and require that exactly one row was cleared. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* fix(auth): bind group account scope entries to account IDs A group's allowed_accounts could hold an account's display name. The name was not bound to any account, so once that account was deleted or renamed the entry matched whichever account was later created or renamed to the same name. #1032 limited name matching to unique names, which does not help here: the newcomer is the only account carrying the name. Scope entries now match by account identifier only: - AccountScope.Allows never compares an entry with a display name. A caller that knows an account only by name (legacy rows keyed by external ID) still resolves through WithRegisteredAccounts to the one account carrying that name, and that account's ID must be in the scope. - Group create/update bind allowed_accounts at grant time: "*", account IDs and external IDs are kept; a name exactly one registered account carries, inside the actor's own scope, is stored as that account's ID; anything else is a 400. A failed account or scope load refuses the write. - Migration 000135 rewrites existing name entries to IDs when exactly one account carries the name and it predates the group's last write. Other entries are left in place and no longer grant access. Down is a no-op. - The name-only MatchesAccount and AuthContext.CanAccessAccount helpers, which had no production callers, are removed. Closes #1034 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(api): scope the history-summary fixture by account ID The history-summary integration tests from #1200 scoped their user with the tenant's display name. This branch binds allowed_accounts entries to account IDs and makes a bare name entry match nothing (#1034), so the scoped user saw no tenant A rows and the totals and listed-rows checks failed. Grant the scope by tenant A's account ID, the form group writes now store. The assertions are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore(db): renumber the group scope binding migration to 000149 main now ships migrations up to 000139, so 000135 would sit below versions a deployed database has already applied and golang-migrate would never run it. Open PRs hold 000140-000148, so this takes 000149 and must merge after that chain. The SQL is unchanged; only the file names, header comments, test version and test fixture IDs move. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore(db): renumber bind_group_account_names_to_ids migration 000149 -> 000145 golang-migrate only applies versions above the database's current one, so PRs must merge in migration-number order. 000140-000144 had been taken by PRs that are now held on owner decisions (#1239, #1241, #1253). The ready PRs move to 000140-000145 so they can merge ahead of them, and the held ones will take the next free numbers when decided. Rename only: the SQL statements are unchanged, and the test version constants and the comments naming the migration follow the new number. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(api): register the wire-format group account for grant-time binding TestUserGroupWrites_WireFormat came in from main (#1261) and builds a Handler with no config store. Since #1034, group writes bind every allowed_accounts entry to a registered account and refuse the write when the account list cannot be loaded, so POST /api/groups answered 500. The test now registers its account ID in a store mock, as the binding tests do; the wire format it pins is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(api): scope the History paging user by account ID, not name TestIntegration_HistoryPaging_ScopedUserNeverPagesIntoAnotherTenant came in from main (#1277) and grants the scoped user tenant A by its display name. Since #1034 an allowed_accounts entry matches by cloud account ID only, so that user saw none of tenant A's rows and the walk returned only its own unscoped execution. The grant now names tenant A's ID, as the other scope tests on this branch do; what the test asserts is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(analytics): scope account_ids fixtures by account ID The account_ids analytics tests that arrived with the main merge (#1448) grant scope by account name ("a", "b", "c"). This branch binds group scope entries to account IDs and no longer matches an entry against a display name (#1034), so those name entries authorize nothing and the scoped cases got 404. List the account IDs in the scope instead, as the other analytics scope tests on this branch already do. The assertions are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(analytics): scope the account_ids DB test by account ID TestAnalyticsAccountIDs_SumsSelectedAccountsOnly_DB (from #1448) grants the scoped user ["a", "b"], which are account names. Scope entries are account IDs on this branch (#1034), so the name entries allowed nothing and the in-scope query returned 404. Use the created accounts' IDs. The foreign-id refusal assertion is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(history): scope the plan_id filter DB test by account ID TestIntegration_HistoryPlanFilter_CrossTenant (from #1445) grants the scoped user tenant A by account name. Scope entries are account IDs on this branch (#1034), so the name allowed nothing and tenant A's own plan came back empty. Grant tenant A's ID, as the other history integration tests on this branch do. The cross-tenant assertions are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(api): scope #1464's actionable History tests by account ID #1464 landed on main with tests that scope the user by the display name "dev" and with an executionScope case built on WithRegisteredNames. This branch (#1034) makes name entries grant nothing and replaces that constructor, so after merging main those tests no longer compiled or no longer exercised the scoped path. Scope them by the account's ID, which is what a group stores now, and pin that a name entry contributes only its literal value to the SQL scope. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(auth,api): bind account names to the identifier in scope checks Review (rE7) found that an ID-scoped user could pass the purchase gate for an account outside their scope. resolveAccountNamesByID keyed names by both account ID and the free-text external ID in one map, so an editor of in-scope account Z who set Z's external ID to victim Y's ID got Z's name back for Y. AccountScope.Allows then resolved that name to Z, which is in scope, and allowed a purchase in Y. The same map fed the dashboard, ladder and RI reshape filters. Decide those gates on the record's cloud_account_id itself, the ID the purchase resolves its credentials from, and delete the dual-keyed map. Bind the name path in Allows as well, so a name only identifies an account through that account's own external ID and never through a value that is some registered account's ID. Callers that pass a name for an external ID already resolve it within the record's provider or require exactly one owner. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…HECKs, write only canceled_by (#1253) * fix(db): contract the canceled rename: normalize, narrow the status CHECKs, stop using cancelled_by Migration 000144 is the contract half of 000089. Under a table lock it normalizes every legacy 'cancelled' status in purchase_executions and ri_exchange_history, drains legacy-only actors into canceled_by, and narrows both status CHECKs to the 000089 lists minus 'cancelled'. The code stops reading and writing purchase_executions.cancelled_by: reads project canceled_by, the cancel transition and SetCancelledBy write only canceled_by, and SavePurchaseExecution writes canceled_by, keeping an actor already on the row (the value reads saw before). The LegacyStatusCanceled constant and every dual-spelling branch are gone. The cancelled_by column is kept. The previous build still reads COALESCE(canceled_by, cancelled_by) and writes cancelled_by, and it keeps serving during a rolling deploy and after a code-only rollback, so dropping the column in the same release would break every execution read on it. A trigger mirrors any legacy-only actor write into canceled_by until a follow-up migration drops the trigger and column. Refs #47 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(config): drop the legacy canceled spelling from the history summary test The test came in from main (#1200) and seeds executions with LegacyStatusCanceled and queries it as an execution status. This branch removes that constant, and migration 000144 rejects the 'cancelled' status, so the seed would fail the narrowed CHECK. Seed and query only the canonical spelling. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(deps): bump golang.org/x/net to v0.62.0 (GO-2026-6860, GO-2026-6866) govulncheck in the Docker image build now fails on these two advisories, both fixed in x/net v0.62.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(migrations): target renumbered canceled spelling migration * fix(db): renumber the canceled contract migration to 000158 000153 now belongs to marketplace_listing_settlements on main (000154-000157 are in flight in #1239 and #1241). Pure renames of the up, down and test files, plus the identifier and comment number fixes. Refs #47 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(db): slim the 000158 canceled contract Only normalize 'cancelled' to 'canceled' on purchase_executions and ri_exchange_history and narrow both status CHECKs. The mirror trigger, the cancelled_by drain and the down backfill are cut: this release keeps reading COALESCE(canceled_by, cancelled_by), so nothing reads canceled_by alone yet. The row-level updated_at triggers (000128 and 000009) are disabled around the normalization so the plan-health and retention clock is not restamped. The down only re-widens the CHECKs. The old test is removed; the new 000158 test follows. Refs #47 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(db): cover the 000158 canceled contract migration Seeds legacy 'cancelled' rows in both tables with a 90-day-old updated_at, then asserts the normalization, that updated_at is unchanged on each table (each assertion fails without its trigger disable), that both triggers are enabled again, the narrowed CHECKs (23514 on the legacy spelling), and that the down restores the widened CHECK text exactly. Also runs the write statements of the build live today (the SavePurchaseExecutionTx upsert, SetCancelledBy, the transitionExecutionStatus dual write and CancelAllPendingExchanges) against the narrowed schema: no 23514, and the actor reads back via COALESCE(canceled_by, cancelled_by). Written relative to the version below 158, so it follows the tree as 154-157 land. Refs #47 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(config): keep tolerant canceled reads The PR removed every tolerant read of the legacy spelling, which is only safe once 000158 has run and no older build can be rolled back to. Keep them until the follow-up: LegacyStatusCanceled and the lists and switches that use it, COALESCE(canceled_by, cancelled_by) in every execution projection, and status IN ('cancelled', 'canceled') in the cleanup SQL. Their tests (the legacy-spelling fixtures) are restored. The PR's write changes stay: SavePurchaseExecution writes canceled_by = COALESCE(purchase_executions.canceled_by, $17) and no longer writes cancelled_by, and the cancel transition and SetCancelledBy write canceled_by only. Refs #47 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(config): pin cancel actor reads and writes with pgxmock Two tests. The projections test asserts all ten purchase_executions projections read COALESCE(canceled_by, cancelled_by), so a legacy actor on cancelled_by still scans back. The writes test rejects any INSERT or UPDATE that names the legacy column in its write part (RETURNING reads are exempt) and pins SavePurchaseExecution's COALESCE(purchase_executions.canceled_by, $17), so a stale-copy save cannot erase an existing actor. Refs #47 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(config): run the new code against the pre-contract schema Migrates to the version below 000158 and seeds what an older build wrote: the legacy status spelling and an actor only in cancelled_by. Covers GetExecutionByID, the History page and summary, CountLiveExecutionsForAccount, holdsCapacity, the ramp-step occupied check, SavePurchaseExecution on a legacy-actor row (the actor is carried into canceled_by and a stale save cannot erase it), CleanupOldExecutions, and the handler's cancel-race recovery (cancelOrRecoverExecution). The build and the migration roll out in either order, so both orders must read correctly. Against the original #1253 strict reads the config test fails on the actor scan, the live count, holdsCapacity, the save and the cleanup, and the api test fails with a 409. Refs #47 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: drop legacy-spelling rows from DB-backed fixtures, fix lint On a fully migrated schema 000158 forbids the legacy status spelling, so integration fixtures that INSERT it cannot run. Revert the DB-backed fixtures to the PR's versions (history summary, ladder resolve, ramp baseline, ramp step, ladder reconcile, submit dedupe, the db retention test, the retention writers case), and have the account-delete tests iterate TerminalExecutionStatuses minus the legacy spelling. The unit tests keep their legacy fixtures, and the legacy rows are covered at the pre-000158 schema by the new integration tests. Also reword comments and mark the SQL constants that name the legacy column so the misspell linter passes, and drop a stray blank line. Refs #47 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(known-issues): record the two ramp reads without the legacy cancel actor ListPlanCommittedTx and ListExecutionsForPlanStepTx select canceled_by alone. Pre-existing and decision-neutral (both callers branch on status); the drain in #1747 fixes the rows at the source. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(db): renumber the canceled contract migration to 000159 #1762 took 000158. Rename the up, down and test files and update the test names, identifiers and comments that name this migration. The tests still resolve the version just below it dynamically. Refs #47 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(db): renumber the canceled contract migration to 000155 Migration numbers are assigned at merge time: main's highest is now 000154 (first_dispatch_at). Rename the up, down and test files and update the test names, identifiers and comments naming this migration. Refs #47 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test: derive the pre-contract cutoff from the migration file The config and api legacy-canceled tests hardcoded the migration number as the cutoff for "the schema just below the contract". Read it from the file ending _contract_canceled_spelling.up.sql instead and fail loudly if it is missing, so a renumber needs no test edit. Checked in a scratch copy with the migration renamed to 000170 and a 000169 present: derived 169, where the old hardcoded cutoff would have picked 154. Refs #47 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(config): update the pgxmock Save arity after #1762 #1762 added first_dispatch_at as the 30th SavePurchaseExecutionTx argument. The Save SQL on the merged tree still has canceled_by = COALESCE(purchase_executions.canceled_by, $17), and #1762 added no cancelled_by writer or bare reader. Refs #47 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(config): pin that a stale save cannot replace the stored cancel actor A stale copy carrying a different non-nil actor B must not replace the actor A already in canceled_by. Swapping the save to COALESCE($17, purchase_executions.canceled_by) in a scratch copy now fails with expected concurrent@example.com, actual stale-copy@example.com. Refs #47 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(known-issues): use the CONTRIBUTING audit line format Add the resolved count to the audit status of the cancel-actor entry. Refs #47 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(db): renumber the canceled contract migration to 000157 after #1241 #1241 took 000155 and 000156. Rename the up, down and test files and update the test names, identifiers and comments naming this migration. Refs #47 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Buddy <buddy@users.noreply.github.com> Co-authored-by: Cristian Magherusan-Stanciu <cristi.magherusan@gmail.com>

IAmJSD added priority/p2 Backlog-worthy severity/medium Moderate harm triaged Item has been triaged urgency/this-quarter Within the quarter impact/many Affects most users effort/m Days type/feat New capability labels Oct 20, 2026

cristim mentioned this pull request Oct 25, 2026

fix(history): apply the plan_id filter the plan-history view sends #1404

Closed

cristim marked this pull request as ready for review October 25, 2026 11:33

cristim merged commit 503eb2e into LeanerCloud:main Oct 25, 2026
24 of 25 checks passed

This was referenced Oct 25, 2026

fix(auth): bind group account scope entries to account IDs #1116

Merged

fix(db): contract the canceled rename: normalize, narrow the status CHECKs, write only canceled_by #1253

Merged

IAmJSD mentioned this pull request Oct 25, 2026

fix(history): flag a failed execution class listing as truncated and expose the actionable cap #1276

Merged

IAmJSD mentioned this pull request Oct 25, 2026

test(analytics): fold the hand-rolled ConfigStore mock onto mocks.MockConfigStore #1254

Merged

IAmJSD mentioned this pull request Oct 26, 2026

feat(frontend): Load more on the History view, Approval Queue from all loaded pages #676

Closed

cristim mentioned this pull request Oct 26, 2026

fix(history): apply the plan_id filter the plan-history view sends #1445

Merged

IAmJSD mentioned this pull request Oct 26, 2026

fix(history): push filters and account scope into the actionable executions read #1464

Merged

Navigation Menu

Repository navigation

feat(api): scope-aware SQL totals for the History summary cards - #1200

feat(api): scope-aware SQL totals for the History summary cards#1200
cristim merged 1 commit into
LeanerCloud:mainfrom
IAmJSD:fix/issue-675

IAmJSD commented Oct 20, 2026

Uh oh!

coderabbitai Bot commented Oct 20, 2026 •

edited

Loading

Review failed

Uh oh!

cristim commented Oct 21, 2026

Uh oh!

cristim commented Oct 25, 2026

Uh oh!

cristim commented Oct 25, 2026

Uh oh!

cristim commented Oct 25, 2026

Uh oh!

cristim commented Oct 25, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

IAmJSD commented Oct 20, 2026

Root cause

Fix

Verification

Out of scope / notes

Frontend follow-up for the UI owner

Uh oh!

coderabbitai Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Uh oh!

cristim commented Oct 21, 2026

Uh oh!

cristim commented Oct 25, 2026

Uh oh!

cristim commented Oct 25, 2026

Uh oh!

cristim commented Oct 25, 2026

Uh oh!

cristim commented Oct 25, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Oct 20, 2026 •

edited

Loading