Consolidate Extensions domain ownership in API - #186
Conversation
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
api | 8de90f7 | Commit Preview URL Branch Preview URL |
Aug 05 2026, 12:18 PM |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 26 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
There was a problem hiding this comment.
All reported issues were addressed across 17 files (changes from recent commits).
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
There was a problem hiding this comment.
0 issues found across 1 file (changes from recent commits).
Requires human review: Adds D1 schema migrations (0000 bootstrap, 0019 tombstone) and moves DB ownership across repos, plus auth/authorization and API-contract changes (active-account enforcement, identity-sync endpoint, new public unclaimed field). These data and security tradeoffs need human sign-off.
Re-trigger cubic
There was a problem hiding this comment.
2 issues found across 8 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="src/services/extensions/v2/interfaces.ts">
<violation number="1" location="src/services/extensions/v2/interfaces.ts:141">
P2: A pending legacy submission can still publish the reserved `mine` id and make that extension unreachable through the public detail route, because this guard is bypassed when stored submissions are approved. Applying the reservation check during approval (and covering pending rows in the rollout preflight) would preserve the route contract.</violation>
</file>
<file name="src/services/extensions/v2/index.ts">
<violation number="1" location="src/services/extensions/v2/index.ts:129">
P3: This comment directs readers to "The deployment preflight in README.md" / "rollout preflight", but those rollout/preflight details were removed from README.md in commit 8de90f77 ("Trim rollout details from README") — grep shows README.md no longer mentions the reserved `mine`/`me` ids or any preflight. The comment now points to documentation that doesn't exist, so the operational safeguard (rejecting pre-existing rows with reserved ids before enabling the routes) is only recorded in code comments. Reconcile the two: either restore the preflight guidance to README.md or reword the comment to not cite it.</violation>
</file>
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
| }) | ||
| .strict() | ||
| .superRefine((payload, ctx) => { | ||
| if (RESERVED_EXTENSION_IDS.has(payload.extension.id)) { |
There was a problem hiding this comment.
P2: A pending legacy submission can still publish the reserved mine id and make that extension unreachable through the public detail route, because this guard is bypassed when stored submissions are approved. Applying the reservation check during approval (and covering pending rows in the rollout preflight) would preserve the route contract.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/services/extensions/v2/interfaces.ts, line 141:
<comment>A pending legacy submission can still publish the reserved `mine` id and make that extension unreachable through the public detail route, because this guard is bypassed when stored submissions are approved. Applying the reservation check during approval (and covering pending rows in the rollout preflight) would preserve the route contract.</comment>
<file context>
@@ -131,6 +138,13 @@ export const SubmissionPayloadSchema = z
})
.strict()
.superRefine((payload, ctx) => {
+ if (RESERVED_EXTENSION_IDS.has(payload.extension.id)) {
+ ctx.addIssue({
+ code: z.ZodIssueCode.custom,
</file context>
|
|
||
| // Register the static owner route before the public parameter route | ||
| // (/extensions/{id}) so the reserved "mine" segment is handled as the | ||
| // owner collection. The deployment preflight in README.md must reject any |
There was a problem hiding this comment.
P3: This comment directs readers to "The deployment preflight in README.md" / "rollout preflight", but those rollout/preflight details were removed from README.md in commit 8de90f7 ("Trim rollout details from README") — grep shows README.md no longer mentions the reserved mine/me ids or any preflight. The comment now points to documentation that doesn't exist, so the operational safeguard (rejecting pre-existing rows with reserved ids before enabling the routes) is only recorded in code comments. Reconcile the two: either restore the preflight guidance to README.md or reword the comment to not cite it.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/services/extensions/v2/index.ts, line 129:
<comment>This comment directs readers to "The deployment preflight in README.md" / "rollout preflight", but those rollout/preflight details were removed from README.md in commit 8de90f77 ("Trim rollout details from README") — grep shows README.md no longer mentions the reserved `mine`/`me` ids or any preflight. The comment now points to documentation that doesn't exist, so the operational safeguard (rejecting pre-existing rows with reserved ids before enabling the routes) is only recorded in code comments. Reconcile the two: either restore the preflight guidance to README.md or reword the comment to not cite it.</comment>
<file context>
@@ -125,7 +125,9 @@ const dependencies: RouteDependencies = {
// Register the static owner route before the public parameter route
-// (/extensions/{id}) so "mine" is never interpreted as an extension id.
+// (/extensions/{id}) so the reserved "mine" segment is handled as the
+// owner collection. The deployment preflight in README.md must reject any
+// pre-existing extension with that id before this route is enabled.
registerOwnerExtensionsRoutes(extensionsV2, dependencies);
</file context>
1 participant
Summary
Consolidates the Extensions domain under the API Worker, including the users projection and the complete D1 migration chain.
Changes
deleted_attombstone migration.unclaimeddeveloper field publicly.DB_EXTENSIONSbinding.