Repository navigation
Let the API manage domains in SES; report pg-boss errors as errors - #340
Merged
Merged
Conversation
pg-boss emits some errors as plain copies ({ ...error, message, stack }), which Sentry's console
capture can't recognize, so during the database restart on 2026-11-03 they arrived as
"[jobs] pg-boss error: [object Object]". They are errors again before they are logged.
Fixes WORKER-8
POST /v1/domains runs the same SesIdentityProvider as the dashboard, but the API's IAM policy only allowed sending, so in production every domain that needed a new SES tenant or identity failed with AccessDenied and customers got a 502. The API now shares the dashboard's domain statements (tenants, associations, identities, still limited by the prefix and the coss_managed tag). A test keeps the two equal and lists what the provider calls. Takes effect once ses:bootstrap has updated the live policy. Refs API-2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes for the two Sentry issues that weren't noise. The rest have been resolved or ignored in Sentry with a note on each.
API-2:
POST /v1/domainsfails in production (AccessDenied)/v1/domainsruns the sameSesIdentityProvideras the dashboard, butcossPolicies().apionly allowedses:SendEmail. So in production, adding a domain through the API that needs a new SES tenant or identity is denied by IAM, and the customer gets a 502provider_error. Since 2026-11-01, 31 attempts from one organization (org_01m69gamf9fr5v3r3rnnvesjfp, one API key) have all failed. Verifying and deleting domains through the API need the same permissions too.The API now shares the dashboard's domain statements (
manageDomains): tenants limited to thecoss-*prefix, identities created and changed only with thecoss_managedtag. It gets nothing for dedicated IPs or inbound simulation. A test keeps the API's and the dashboard's SES statements equal and lists the actions the provider calls.After merge: the live
coss/coss-apipolicy changes only whenses:bootstrapruns (from the worker image of the merge commit, see README "Deploying to AWS"). Until then, API-2 keeps happening, which is why the commit saysRefs API-2rather thanFixes.WORKER-8:
[jobs] pg-boss error: [object Object]pg-boss emits some errors as plain copies (
{ ...error, message, stack }). Sentry's console capture only recognizesErrorinstances, so these arrived without their message.logPgBossErrorturns them back into errors (keeping message, stack andcode). It is used by bothjobs.tsandmigrate.ts.Checks
bun run --cwd packages/db testandbun run --cwd apps/worker test: pass (on a fresh test database)turbo run typecheck --affected: passOpen in [code]smith · Need help on this PR? Tag
@codesmith-botwith what you need.