From 504f47444b8ade02856036830a929466a80337a0 Mon Sep 17 00:00:00 2001 From: madhava Date: Sun, 28 Jun 2026 12:00:12 +0530 Subject: [PATCH 01/17] test: add Qedix complex production risk case --- ...v1.projects.$projectRef.qedix-risk-test.ts | 50 +++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 apps/webapp/app/routes/api.v1.projects.$projectRef.qedix-risk-test.ts diff --git a/apps/webapp/app/routes/api.v1.projects.$projectRef.qedix-risk-test.ts b/apps/webapp/app/routes/api.v1.projects.$projectRef.qedix-risk-test.ts new file mode 100644 index 00000000000..e7c93f1413d --- /dev/null +++ b/apps/webapp/app/routes/api.v1.projects.$projectRef.qedix-risk-test.ts @@ -0,0 +1,50 @@ +type ActionArgs = { + request: Request; + params: { + projectRef?: string; + }; +}; + +const prisma = { + taskRun: { + update: async (_args: unknown) => ({ ok: true }), + }, + webhookEvent: { + create: async (_args: unknown) => ({ ok: true }), + }, +}; + +export async function action({ request, params }: ActionArgs): Promise { + const body = await request.json(); + + // Qedix complex production-risk fixture: + // This intentionally mixes request-controlled mutation, webhook-like processing, + // missing tenant/org scope, missing signature verification, and missing idempotency. + + if (body.type === "stripe.invoice.paid") { + await prisma.webhookEvent.create({ + data: { + provider: "stripe", + eventId: body.id, + projectRef: params.projectRef, + payload: body, + }, + }); + } + + await prisma.taskRun.update({ + where: { + id: body.runId, + }, + data: { + status: body.status, + output: body.output, + projectRef: params.projectRef, + }, + }); + + return Response.json({ + ok: true, + runId: body.runId, + }); +} From 42b3b83dd7df35bcff8aa04d12c253f8bfc8f540 Mon Sep 17 00:00:00 2001 From: madhava Date: Sun, 28 Jun 2026 12:12:37 +0530 Subject: [PATCH 02/17] test: use real Remix API risk surface for Qedix --- ...v1.projects.$projectRef.qedix-risk-test.ts | 50 ---------------- ...jectRef.webhooks.stripe.qedix-risk-test.ts | 59 +++++++++++++++++++ 2 files changed, 59 insertions(+), 50 deletions(-) delete mode 100644 apps/webapp/app/routes/api.v1.projects.$projectRef.qedix-risk-test.ts create mode 100644 apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.qedix-risk-test.ts diff --git a/apps/webapp/app/routes/api.v1.projects.$projectRef.qedix-risk-test.ts b/apps/webapp/app/routes/api.v1.projects.$projectRef.qedix-risk-test.ts deleted file mode 100644 index e7c93f1413d..00000000000 --- a/apps/webapp/app/routes/api.v1.projects.$projectRef.qedix-risk-test.ts +++ /dev/null @@ -1,50 +0,0 @@ -type ActionArgs = { - request: Request; - params: { - projectRef?: string; - }; -}; - -const prisma = { - taskRun: { - update: async (_args: unknown) => ({ ok: true }), - }, - webhookEvent: { - create: async (_args: unknown) => ({ ok: true }), - }, -}; - -export async function action({ request, params }: ActionArgs): Promise { - const body = await request.json(); - - // Qedix complex production-risk fixture: - // This intentionally mixes request-controlled mutation, webhook-like processing, - // missing tenant/org scope, missing signature verification, and missing idempotency. - - if (body.type === "stripe.invoice.paid") { - await prisma.webhookEvent.create({ - data: { - provider: "stripe", - eventId: body.id, - projectRef: params.projectRef, - payload: body, - }, - }); - } - - await prisma.taskRun.update({ - where: { - id: body.runId, - }, - data: { - status: body.status, - output: body.output, - projectRef: params.projectRef, - }, - }); - - return Response.json({ - ok: true, - runId: body.runId, - }); -} diff --git a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.qedix-risk-test.ts b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.qedix-risk-test.ts new file mode 100644 index 00000000000..559e38085e0 --- /dev/null +++ b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.qedix-risk-test.ts @@ -0,0 +1,59 @@ +import { type ActionFunctionArgs, json } from "@remix-run/server-runtime"; +import { z } from "zod"; +import { prisma } from "~/db.server"; +import { authenticateApiRequest } from "~/services/apiAuth.server"; + +const ParamsSchema = z.object({ + projectRef: z.string(), +}); + +export async function action({ request, params }: ActionFunctionArgs) { + const parsedParams = ParamsSchema.safeParse(params); + + if (!parsedParams.success) { + return json({ error: "Invalid params" }, { status: 400 }); + } + + const authenticationResult = await authenticateApiRequest(request); + + if (!authenticationResult) { + return json({ error: "Invalid or Missing API key" }, { status: 401 }); + } + + const body = await request.json(); + const { projectRef } = parsedParams.data; + + // Qedix complex production-risk fixture: + // This intentionally keeps request body parsing unvalidated and processes + // Stripe/webhook-shaped input without visible signature verification, + // idempotency protection, transaction boundaries, or tenant ownership scope. + + if (body.type === "stripe.invoice.paid") { + await prisma.taskRun.update({ + where: { + id: body.runId, + }, + data: { + status: "COMPLETED", + output: body.invoice, + idempotencyKey: body.id, + }, + }); + } + + await prisma.taskRun.update({ + where: { + id: body.runId, + }, + data: { + status: body.status, + output: body.output, + projectExternalRef: projectRef, + }, + }); + + return json({ + ok: true, + runId: body.runId, + }); +} From 20847bd72074bd0192c89e5776a19b8681ba6ac9 Mon Sep 17 00:00:00 2001 From: madhava Date: Sun, 28 Jun 2026 13:56:06 +0530 Subject: [PATCH 03/17] test: rerun qedix after body validation fix From 30adcb1286fad47a0ca650775dcd9f3af0c67cc5 Mon Sep 17 00:00:00 2001 From: madhava Date: Sun, 28 Jun 2026 14:00:58 +0530 Subject: [PATCH 04/17] test: rerun qedix with real route change --- ...i.v1.projects.$projectRef.webhooks.stripe.qedix-risk-test.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.qedix-risk-test.ts b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.qedix-risk-test.ts index 559e38085e0..dd2a22d5cfd 100644 --- a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.qedix-risk-test.ts +++ b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.qedix-risk-test.ts @@ -57,3 +57,5 @@ export async function action({ request, params }: ActionFunctionArgs) { runId: body.runId, }); } + +// qedix rerun marker body validation fix From 6dab114efde2cb576b27d8c6bee81d62d0d8bc72 Mon Sep 17 00:00:00 2001 From: madhava Date: Sun, 28 Jun 2026 14:09:12 +0530 Subject: [PATCH 05/17] test: use production-looking Remix webhook route --- ... api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts} | 1 - 1 file changed, 1 deletion(-) rename apps/webapp/app/routes/{api.v1.projects.$projectRef.webhooks.stripe.qedix-risk-test.ts => api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts} (97%) diff --git a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.qedix-risk-test.ts b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts similarity index 97% rename from apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.qedix-risk-test.ts rename to apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts index dd2a22d5cfd..9e71525a5a6 100644 --- a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.qedix-risk-test.ts +++ b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts @@ -58,4 +58,3 @@ export async function action({ request, params }: ActionFunctionArgs) { }); } -// qedix rerun marker body validation fix From 66bab51bcdcdf36a29a5cc5a875188079e44a8b1 Mon Sep 17 00:00:00 2001 From: madhava Date: Sun, 28 Jun 2026 15:14:04 +0530 Subject: [PATCH 06/17] test: rerun qedix after framework evidence bridge --- .../api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts index 9e71525a5a6..91efdb9e538 100644 --- a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts +++ b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts @@ -58,3 +58,5 @@ export async function action({ request, params }: ActionFunctionArgs) { }); } + +// qedix rerun after framework reasoning bridge deploy From 69f54f8993b4e841a2025d08855d716762d9d25e Mon Sep 17 00:00:00 2001 From: madhava Date: Sun, 28 Jun 2026 15:56:03 +0530 Subject: [PATCH 07/17] test: rerun qedix after pipeline count deploy --- .../api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts index 91efdb9e538..4f5bb637754 100644 --- a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts +++ b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts @@ -60,3 +60,5 @@ export async function action({ request, params }: ActionFunctionArgs) { // qedix rerun after framework reasoning bridge deploy + +// qedix rerun after pipeline count deploy From c78d60b3976c6664a807391096c522564736f94b Mon Sep 17 00:00:00 2001 From: madhava Date: Sun, 28 Jun 2026 16:44:19 +0530 Subject: [PATCH 08/17] test: rerun qedix after public pipeline count deploy --- .../api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts index 4f5bb637754..d0e18ecad7b 100644 --- a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts +++ b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts @@ -62,3 +62,5 @@ export async function action({ request, params }: ActionFunctionArgs) { // qedix rerun after framework reasoning bridge deploy // qedix rerun after pipeline count deploy + +// qedix rerun after public pipeline count deploy From fb8d57a8484e1543ab6dde4412d9396c07d652ff Mon Sep 17 00:00:00 2001 From: madhava Date: Sun, 28 Jun 2026 17:25:55 +0530 Subject: [PATCH 09/17] test: rerun qedix after quality gate fix deploy --- .../api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts index d0e18ecad7b..0eba40d82ac 100644 --- a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts +++ b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts @@ -64,3 +64,5 @@ export async function action({ request, params }: ActionFunctionArgs) { // qedix rerun after pipeline count deploy // qedix rerun after public pipeline count deploy + +// qedix rerun after quality gate fix deploy From 2d52aff9edf5c9a00d5997a8b68567b99fabf8fe Mon Sep 17 00:00:00 2001 From: madhava Date: Sun, 28 Jun 2026 17:52:35 +0530 Subject: [PATCH 10/17] test: rerun qedix after evidence metadata debug deploy --- .../api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts index 0eba40d82ac..db913372105 100644 --- a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts +++ b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts @@ -66,3 +66,5 @@ export async function action({ request, params }: ActionFunctionArgs) { // qedix rerun after public pipeline count deploy // qedix rerun after quality gate fix deploy + +// qedix rerun after evidence metadata debug deploy From f2eddaae78eb731c3c20799abb832064fb2f35cd Mon Sep 17 00:00:00 2001 From: madhava Date: Sun, 28 Jun 2026 18:21:15 +0530 Subject: [PATCH 11/17] test: rerun qedix after anchored missing evidence fix deploy --- .../api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts index db913372105..7731ef84ba6 100644 --- a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts +++ b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts @@ -68,3 +68,5 @@ export async function action({ request, params }: ActionFunctionArgs) { // qedix rerun after quality gate fix deploy // qedix rerun after evidence metadata debug deploy + +// qedix rerun after anchored missing evidence fix deploy From 7464576d047c2f237eccc5c6455e7a9a69c88a62 Mon Sep 17 00:00:00 2001 From: madhava Date: Sun, 28 Jun 2026 18:51:18 +0530 Subject: [PATCH 12/17] test: rerun qedix after source snippet quality fix deploy --- .../api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts index 7731ef84ba6..e7d2c9130fa 100644 --- a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts +++ b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts @@ -70,3 +70,5 @@ export async function action({ request, params }: ActionFunctionArgs) { // qedix rerun after evidence metadata debug deploy // qedix rerun after anchored missing evidence fix deploy + +// qedix rerun after source snippet quality fix deploy From 6c80ab411e0c5e5750e10148975ab375db3c480f Mon Sep 17 00:00:00 2001 From: madhava Date: Sun, 28 Jun 2026 20:49:02 +0530 Subject: [PATCH 13/17] test: rerun qedix after quality gate path coherence fix --- .../api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts index e7d2c9130fa..a72dea9b6bd 100644 --- a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts +++ b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts @@ -72,3 +72,5 @@ export async function action({ request, params }: ActionFunctionArgs) { // qedix rerun after anchored missing evidence fix deploy // qedix rerun after source snippet quality fix deploy + +// qedix rerun after quality gate path coherence fix deploy From 1ff0672fc71c178b0ae4fd6ea2c8a6863818137e Mon Sep 17 00:00:00 2001 From: madhava Date: Sun, 28 Jun 2026 21:21:40 +0530 Subject: [PATCH 14/17] test: rerun qedix after quality item sample debug --- .../api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts index a72dea9b6bd..b00990d390d 100644 --- a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts +++ b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts @@ -74,3 +74,5 @@ export async function action({ request, params }: ActionFunctionArgs) { // qedix rerun after source snippet quality fix deploy // qedix rerun after quality gate path coherence fix deploy + +// qedix rerun after quality item sample debug deploy From 823843e642de174b0e550b3988c451e3fedebb76 Mon Sep 17 00:00:00 2001 From: madhava Date: Sun, 28 Jun 2026 21:49:40 +0530 Subject: [PATCH 15/17] test: rerun qedix after missing evidence overmerge fix --- .../api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts index b00990d390d..6878e652048 100644 --- a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts +++ b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts @@ -76,3 +76,5 @@ export async function action({ request, params }: ActionFunctionArgs) { // qedix rerun after quality gate path coherence fix deploy // qedix rerun after quality item sample debug deploy + +// qedix rerun after missing evidence overmerge fix From 6052250ab69623cd1dbc005dccfa5e8a3412cce0 Mon Sep 17 00:00:00 2001 From: madhava Date: Sun, 28 Jun 2026 22:12:33 +0530 Subject: [PATCH 16/17] test: rerun qedix after debug cleanup deploy --- .../api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts index 6878e652048..e574bafffe5 100644 --- a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts +++ b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts @@ -78,3 +78,5 @@ export async function action({ request, params }: ActionFunctionArgs) { // qedix rerun after quality item sample debug deploy // qedix rerun after missing evidence overmerge fix + +// qedix rerun after debug cleanup deploy From 71f96839572010a0a239e5832d4e160964a020d0 Mon Sep 17 00:00:00 2001 From: madhava Date: Sun, 28 Jun 2026 22:14:37 +0530 Subject: [PATCH 17/17] test: rerun qedix after cleanup deploy confirmed --- .../api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts index e574bafffe5..3b530ff0826 100644 --- a/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts +++ b/apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts @@ -80,3 +80,5 @@ export async function action({ request, params }: ActionFunctionArgs) { // qedix rerun after missing evidence overmerge fix // qedix rerun after debug cleanup deploy + +// qedix rerun after cleanup deploy confirmed