Two read-only routes still write: stale character creations and the legacy lore image move #1206

New issue

Closed

opened 2026-10-17 06:27:18 +00:00 by claude-bot · 1 comment

claude-bot commented

2026-10-17 06:27:18 +00:00

Collaborator

Follow-up to #1178 (4.6.0). Two GET handlers stay on the allow-list in tests/test_get_routes_do_not_write.py, each with its real reason:

list_creations: sheet_creation.waiting calls clear_stale, which deletes character creations untouched for 30 days on a GET. The #1178 scan had filed it under ensure_builtin. Move the deletion to a Beat task, or filter stale rows out on read and delete them elsewhere.
download_lore_image: moves a legacy file from the public media path into the private store and rewrites image_url. A migration can't move files, so this needs a one-off startup sweep. Then the GET becomes a pure read.

When both are done, the allow-list holds only the two auth callbacks and the content-pack exports (where the audit row is the point).

Follow-up to #1178 (4.6.0). Two GET handlers stay on the allow-list in `tests/test_get_routes_do_not_write.py`, each with its real reason: - **`list_creations`:** `sheet_creation.waiting` calls `clear_stale`, which **deletes** character creations untouched for 30 days on a GET. The #1178 scan had filed it under `ensure_builtin`. Move the deletion to a Beat task, or filter stale rows out on read and delete them elsewhere. - **`download_lore_image`:** moves a legacy file from the public media path into the private store and rewrites `image_url`. A migration can't move files, so this needs a one-off startup sweep. Then the GET becomes a pure read. When both are done, the allow-list holds only the two auth callbacks and the content-pack exports (where the audit row is the point).

claude-bot referenced this issue

2026-10-17 09:35:29 +00:00

Read-only routes that still write: the ones the scan found #1178

claude-bot added this to the v4.7.0 - Browse the Rules milestone

2026-10-27 17:38:54 +00:00

claude-bot commented

2026-10-30 19:23:01 +00:00

Author

Collaborator

Picked up for v4.7.0 (2026-10-30), on branch fix/1206-read-routes-write. list_creations will filter stale creations on read, with the deletion moved to a daily Beat task. download_lore_image will only read, with the legacy move done by an idempotent daily sweep. The allow-list in test_get_routes_do_not_write.py shrinks to the auth callbacks and the pack exports.

Picked up for v4.7.0 (2026-10-30), on branch `fix/1206-read-routes-write`. `list_creations` will filter stale creations on read, with the deletion moved to a daily Beat task. `download_lore_image` will only read, with the legacy move done by an idempotent daily sweep. The allow-list in `test_get_routes_do_not_write.py` shrinks to the auth callbacks and the pack exports.