guard: allowlist the pure-toggle DELETE endpoints the raw passthrough may pass #774

New issue

Open

opened 2026-10-15 20:24:12 +00:00 by hexajon · 0 comments

hexajon commented

2026-10-15 20:24:12 +00:00

Owner

The refinement, deferred to its own decision: many DELETE endpoints are pure
toggles, not data destruction - unsubscribe, unfollow, unstar, unlock, unpin,
cancel-auto-merge, remove-member, remove-reaction. Refusing those through the
passthrough is stricter than the data they touch warrants.

What to decide and build:

A vetted allowlist of pure-toggle DELETE endpoints that declare no destroy
effect, so the passthrough passes them, while every data-destroying delete
(repo, issue, release, tag, wiki, label, milestone, comment, attachment,
webhook, key, note, branch, ...) stays refused.
The default stays fail-closed: a DELETE endpoint not on the allowlist is
unrecoverable-destroy.

This needs a per-endpoint recoverability judgment on the ~89 vendored DELETE
endpoints, where the config-delete vs toggle line is fuzzy and the ADRs never
classified raw spec endpoints. That makes it a trust-boundary decision, not a
mechanical change.

Relates to #654 (the effect declarations), #668 (the passthrough), ADR 0029.

Follow-up from #654. #654 declares every raw spec DELETE endpoint as unrecoverable-destroy, so the raw API passthrough (#668) refuses every raw delete and points to the vetted first-class op or raw git. That fail-closed default ships in v0.20.0 and stays the default here. The refinement, deferred to its own decision: many DELETE endpoints are pure toggles, not data destruction - unsubscribe, unfollow, unstar, unlock, unpin, cancel-auto-merge, remove-member, remove-reaction. Refusing those through the passthrough is stricter than the data they touch warrants. What to decide and build: - A vetted allowlist of pure-toggle DELETE endpoints that declare no destroy effect, so the passthrough passes them, while every data-destroying delete (repo, issue, release, tag, wiki, label, milestone, comment, attachment, webhook, key, note, branch, ...) stays refused. - The default stays fail-closed: a DELETE endpoint not on the allowlist is unrecoverable-destroy. This needs a per-endpoint recoverability judgment on the ~89 vendored DELETE endpoints, where the config-delete vs toggle line is fuzzy and the ADRs never classified raw spec endpoints. That makes it a trust-boundary decision, not a mechanical change. Relates to #654 (the effect declarations), #668 (the passthrough), ADR 0029.

hexajon added the

status/needs-decision

label

2026-10-15 20:24:20 +00:00

hexajon referenced this issue

2026-10-15 22:29:22 +00:00

feat(guard): #654 declare the effects of every operation and spec endpoint #779

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea#774

No description provided.

Rows
Columns