Building thoughtful software with AI.Notes from the systems behind the work.
Two name matchers in my ordering system let a product claim a different one whose name started the same way, and both of their tests asserted it as correct. Now names have to be equal, and the tests put the lookalike right next to the real thing.
Read moreThe SDK middleware turned every failed token check into a redirect to sign-in, so an outage on my side would have looked like a mass logout. I split the answer into yes, no and couldn't-check, and made the middleware answer an outage with a 503. In the same commit the browser client went the other way and now throws away good tokens when the server is unreachable.
The lookup that decided whether an organization already had a payment customer searched by an email my code sometimes guessed or generated, and could hand one org's billing record to another. I moved identity onto the identity provider's org ID and tied retries to it, but the same commit left an ignored retry flag, a delete check that reads error wording, a gutted seat counter, and no tests.
The way my admin app links a code-host install to a tenant got a rewrite. It checks that an installation exists, not that it belongs to you, and when the webhook arrives first, nothing ever finishes the setup.
Workspace creation waited for a later webhook so invited people wouldn't get a spare one, and self-serve people could log in before it fired. Now the creation handler asks the identity provider for memberships on the spot, a later event repairs misses, and the session lookup retries, but the comment that justifies it contradicts the one it replaced and nothing tests which is right.
The first version of my second login path decoded signed tokens and trusted whatever user ID was inside; now it checks the signature and issuer, but the audience, the pinned issuer and a test with a real untrusted key are still open.
An auth step I put in front of my agent-event collector decoded the bearer token instead of verifying it, so the caller's own claims picked the user, the organization, a default role and the author of every stored event.