Repository navigation
service-messaging(http-outbox): the assertHttpRedeliverable doc comment still names the redeliver door's old caller requirement; name the sys_webhook edit check (follow-up to #27474) #27706
Description
domain:devx#1 · sunhaolin · session_017xRBcVy4VXmkQjn2MGeaWk
Filing gate: ③ a maintainer-directed task. The maintainer, in the PM session session_017xRBcVy4VXmkQjn2MGeaWk on 2026-10-29, said (verbatim): 「其他任务正常提交 issue」. This card is a non-security follow-up to PR #27474 (merged), filed as a normal card.
Business reason: a doc comment that names the wrong permission for a door misleads the next person who reads it to decide what that door allows. After #27474 the webhook redeliver door admits only a caller with edit access to sys_webhook; the comment above the redeliver refusal still says otherwise.
Reader: the dev who takes this card from the queue (a comment-only edit in packages/services/service-messaging).
Dedupe: searched the open and closed issues (GitHub issue search scoped to objectstack-ai/objectstack) for "http-outbox redeliver comment any authenticated user sys_webhook edit permission" (4 hits) and "webhooks redeliver docstring stale permission http-outbox service-messaging" (10 hits). None covers this comment; the nearest, #27607 (open), is a different stale sentence on the sys_webhook object.
What to change
Note: the file is packages/services/service-messaging/src/http-outbox.ts, not under plugin-webhooks.
At origin/main a75ddba1, packages/services/service-messaging/src/http-outbox.ts:490–491, in the doc comment of assertHttpRedeliverable, section "Why this is a security refusal and not a tidiness one", the sentence reads:
POST /api/v1/webhooks/redeliveris reachable by any authenticated user.
The current check is in packages/plugins/plugin-webhooks/src/redeliver-entitlement.ts:4–17: the door admits a caller with an object-level update admission on sys_webhook (REDELIVER_ADMINISTERED_OBJECT at :93, REDELIVER_REQUIRED_OPERATION at :96), asked through the security service before the body is read.
The ask: rewrite that sentence (and the clause after it that refers to "that user") so it names the current requirement, edit access to sys_webhook as decided by redeliver-entitlement.ts, and links that file. The refusal's own reason (a parked row carries no signature) is unchanged and stays.
The same clause appears once more, in the header comment of packages/services/service-messaging/src/http-outbox-parked-record.integration.test.ts:13–14 ("which any authenticated user can reach"). Correct it in the same edit.
Out of scope: any code or test-assertion change. This is comment-only.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 29, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: 真挡得住的权限 | none | P②
Triage: p2 ·
domain:server·area:access· 2026-10-29T19:55Z⛔ Not a claim.
service-messaging: the doc comment names the redeliver door's current admission (anupdateadmission onsys_webhook,redeliver-entitlement.ts). A security doc comment that names the wrong check misleads the next decision, so it is p2, not p3.http-outbox.ts, if one is claimed first.documentation,pm:queue.Generated by Claude Code
objectstack-fleet commentedon Oct 29, 2026
domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia
Claim: PM loop round 1 · 2026-10-29T22:25Z
Session:
session_016WV4cyh2cxBQ2LKn2VVfxq(card thread; seatsession_016WV4czuTWNgKR22fKv7jia)Account:
os-elon-muskBranch:
claude/project-thread-k1rmfw(the card thread's platform-assigned branch — the recorded platform exception; amended by the seat when the thread reported it)Worktree:
objectstack-issue-27706Domain:
domain:serverSeat:
domain:server#3File surface: comments only in
packages/services/service-messaging/src/http-outbox.ts(theassertHttpRedeliverabledoc comment) the header comment ofpackages/services/service-messaging/src/http-outbox-parked-record.integration.test.ts, and the same stale redeliver sentence inpackages/services/service-messaging/src/messaging-service.ts(the #10740 paragraph; same defect class, comment-only, folded in by the seat on the dev's report); ⛔ no code or assertion change (stop on breach; explain in the report)Container & model:
S,mode:thread,model: opus (TIER_DEFAULT; dispatch-gates --tier: no path-derived mandate),effort: mediumClause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (a stale doc comment)
Thread-read: 6506893104
Premise: holds (the "any authenticated user" sentences are on
origin/main, per the #27503 survey; the dev re-reads)Serial constraints cleared: none — no open PR or in-flight claim on
service-messaging/src/http-outbox.tsfound at claim time.objectstack-fleet commentedon Oct 29, 2026
domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia
ACCEPT → PR #27776 comment 6511006071 · 2026-10-29T23:33Z · ready + auto-merge armed through the relay.