fix(compliance-api,compliance-web): guard ir_progress writes (COMP-910) - #880
Open
tolkamps1 wants to merge 1 commit into
Open
fix(compliance-api,compliance-web): guard ir_progress writes (COMP-910)#880tolkamps1 wants to merge 1 commit into
tolkamps1 wants to merge 1 commit into
Conversation
ir_progress was exposed through the generic single-field PATCH endpoint, letting callers overwrite an inspection record's workflow stage without the matching approval record ever changing. Remove it from the allowed fields so every transition goes through a service that keeps the two in step. Replace the three independent, unawaited mutations behind the reopen modal with a single atomic reopen endpoint, so the stage can no longer regress without the approval being deactivated (or vice versa) when one call fails or races. Move the stepper's "Continue with Preliminary IR" option onto its own endpoint that validates the record is at an approved preliminary stage before sending it back to drafting. Stop approval date edits from unconditionally re-stamping HOLDER_PRELIMINARY_REVIEW. Recording the send date still advances a freshly approved preliminary IR, but a later correction no longer drags a record backwards from a stage it has already passed. The action_required_by_rp rebuild is decoupled so it still runs regardless of stage. Ref COMP-910
tolkamps1
requested review from
Ckoelewyn,
danieltruong,
marklise and
tom0827
as code owners
July 29, 2026 20:21
Ckoelewyn
approved these changes
Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ir_progress was exposed through the generic single-field PATCH endpoint, letting callers overwrite an inspection record's workflow stage without the matching approval record ever changing. Remove it from the allowed fields so every transition goes through a service that keeps the two in step.
Replace the three independent, unawaited mutations behind the reopen modal with a single atomic reopen endpoint, so the stage can no longer regress without the approval being deactivated (or vice versa) when one call fails or races.
Move the stepper's "Continue with Preliminary IR" option onto its own endpoint that validates the record is at an approved preliminary stage before sending it back to drafting.
Stop approval date edits from unconditionally re-stamping HOLDER_PRELIMINARY_REVIEW. Recording the send date still advances a freshly approved preliminary IR, but a later correction no longer drags a record backwards from a stage it has already passed. The action_required_by_rp rebuild is decoupled so it still runs regardless of stage.
Ref COMP-910