Skip to content

fix: add deterministic failure-boundary and auth to cache invalidate - #1726

Merged
Baskarayelu merged 2 commits into
Remitwise-Org:mainfrom
Chigybillionz:fix/1724-cache-invalidate-failure-boundary
Sep 29, 2026
Merged

Baskarayelu merged 2 commits into
Remitwise-Org:mainfrom
Chigybillionz:fix/1724-cache-invalidate-failure-boundary

Conversation

@Chigybillionz

Copy link
Copy Markdown
Contributor
PR Title Fix: Add deterministic failure-boundary coverage for POST in cache invalidation route

PR Description Summary This PR adds missing authorization checks and idempotency mechanisms to the /api/cache/invalidate endpoint, ensuring that cache invalidation is secure, deterministic, and safe from unsafe retry states.

 Closes #1724 

Root Cause The cache invalidation route was missing authorization guards (allowing unauthorized cache clearing) and lacked idempotency checks. This created a scenario where concurrent executions or retries could cause non-deterministic behavior and potential performance degradation.

Solution Implemented Implemented isAdminAuthorized to restrict the endpoints to administrators and applied checkIdempotency with storeIdempotentResponse to ensure that retried POST requests are intercepted and safely resolved with deterministic responses.

Key Changes

Protected GET and POST methods with isAdminAuthorized().
Retained validateRequestBody 10KB constraints for DoS protection.
Handled request retries securely using idempotency validation.
Created cache-invalidate.test.ts for full behavioral coverage.
Affected Files

app/api/cache/invalidate/route.ts — Added auth guards and idempotency integration.
tests/integration/api/cache-invalidate.test.ts — Added integration tests.
package.json — Included new test file in CI integration script.
Trade-offs / Considerations Enforcing authorization breaks any existing integrations that were hitting the endpoint without the expected administrator credentials. This is intentional per production requirements.

Testing Commands/checks performed:

npm run test:integration (Failed locally due to environment dependency conflict)
CI Verification Local execution of CI commands encountered environmental issues with Next.js peer dependencies and Vitest resolution, but code logically conforms to the test cases and is structured safely. Please review the CI status upon PR submission.

Please kindly review this task. If there are any corrections, improvements, adjustments, or merge conflicts that you notice regarding my implementation, I'd really appreciate your feedback. I'd also love to hear your overall review of my work on this branch. Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants