WealthLedger/backend
5
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

[Bug] Переводить permanent invalid-token error на всех online entrypoints #59

New Issue
Closed
opened 2026-10-11 21:43:36 +03:00 by codex-bot · 0 comments
codex-bot commented 2026-10-11 21:43:36 +03:00
Owner
Copy Link
Copy Source

Problem

Первый upstream UNAUTHENTICATED/PERMISSION_DENIED становится Error→500 в online search/detail/ticker/company/screener. Stored invalid flag защищает другую ветвь. Frontend GET считает 500 transient и делает до трёх attempts.

Expected Behavior

Permanent broker auth refusal → safe 400/INVALID_TBANK_TOKEN; temporary outage остаётся 503 с bounded retry.

Evidence

Audit date 2026-10-11; 06, 07. IDs BE-005, FLOW-004, RISK-006, TA-F13. Revision 0ad84ff4f0b4712abc7e69dc299856f14af6eadd; Confidence High; Verification status static.
Affected code: tbank-token.service.ts:26–35; catalog-discovery.service.ts:149–165,227–249,295–317; catalog-enrichment.service.ts:241–267; stock-screener.service.ts:65–81; filter:19–31. Consumer frontend/client.ts:127–193 at c8821200ce699dab1ce65360d1968d5877a2e78b.

Scope

In scope

Все direct online callers existing translator, configured HTTP matrix и consumer retry proof.

Out of scope

Global plain Error rewrite, новая token state machine, invalidation новой connection поздним old-token response.

Proposed Approach

Reuse translateInvalidToken на existing application/access boundary. Durable source catches и attempt-aware invalidation не менять.

Acceptance Criteria

  • Search/detail/ticker/company/screener upstream auth refusal возвращает 400/INVALID_TBANK_TOKEN без raw error/credentials.
  • Actual frontend GET transport не повторяет permanent response; transient unavailable остаётся retryable.
  • Durable failed+invalid-token handling и current-revision isolation прежние; financial snapshots не изменяются online failure.

Verification

Existing stocks/bonds configured HTTP suites и tbank.client.spec.ts; frontend client.test.ts/MSW при consumer proof. Полные relevant gates на конечном diff; unit RPC mapping один HTTP outcome не доказывает.

Dependencies

Нет.

Traceability

Campaign WealthLedger/main#23 . Findings BE-005, FLOW-004, RISK-006, TA-F13. Repository WealthLedger/backend; T06.

<!-- wealthledger-audit:2026-10-11:online-token-translation --> ## Problem Первый upstream UNAUTHENTICATED/PERMISSION_DENIED становится Error→500 в online search/detail/ticker/company/screener. Stored invalid flag защищает другую ветвь. Frontend GET считает 500 transient и делает до трёх attempts. ## Expected Behavior Permanent broker auth refusal → safe 400/INVALID_TBANK_TOKEN; temporary outage остаётся 503 с bounded retry. ## Evidence Audit date `2026-10-11`; [06](https://git.personal.ksv741.ru/WealthLedger/main/src/commit/d07fbfabb1295780952a554185989d2d5b5c8349/audits/2026-10-11/reports/06-backend-architecture-report.md), [07](https://git.personal.ksv741.ru/WealthLedger/main/src/commit/d07fbfabb1295780952a554185989d2d5b5c8349/audits/2026-10-11/reports/07-api-and-data-flow-efficiency-report.md). IDs BE-005, FLOW-004, RISK-006, TA-F13. Revision `0ad84ff4f0b4712abc7e69dc299856f14af6eadd`; Confidence High; Verification status static. Affected code: [tbank-token.service.ts:26–35](https://git.personal.ksv741.ru/WealthLedger/backend/src/commit/0ad84ff4f0b4712abc7e69dc299856f14af6eadd/src/integrations/tbank/tbank-token.service.ts#L26-L35); catalog-discovery.service.ts:149–165,227–249,295–317; catalog-enrichment.service.ts:241–267; stock-screener.service.ts:65–81; filter:19–31. Consumer frontend/client.ts:127–193 at `c8821200ce699dab1ce65360d1968d5877a2e78b`. ## Scope ### In scope Все direct online callers existing translator, configured HTTP matrix и consumer retry proof. ### Out of scope Global plain Error rewrite, новая token state machine, invalidation новой connection поздним old-token response. ## Proposed Approach Reuse translateInvalidToken на existing application/access boundary. Durable source catches и attempt-aware invalidation не менять. ## Acceptance Criteria - [ ] Search/detail/ticker/company/screener upstream auth refusal возвращает 400/INVALID_TBANK_TOKEN без raw error/credentials. - [ ] Actual frontend GET transport не повторяет permanent response; transient unavailable остаётся retryable. - [ ] Durable failed+invalid-token handling и current-revision isolation прежние; financial snapshots не изменяются online failure. ## Verification Existing stocks/bonds configured HTTP suites и tbank.client.spec.ts; frontend client.test.ts/MSW при consumer proof. Полные relevant gates на конечном diff; unit RPC mapping один HTTP outcome не доказывает. ## Dependencies Нет. ## Traceability Campaign https://git.personal.ksv741.ru/WealthLedger/main/issues/23 . Findings BE-005, FLOW-004, RISK-006, TA-F13. Repository WealthLedger/backend; T06.
codex-bot added this to the Technical Audit Remediation — 2026-10-11 milestone 2026-10-11 21:43:36 +03:00
codex-bot added the Kind/Bug
Priority
Medium
3
audit/2026-10-11 labels 2026-10-11 21:43:36 +03:00
codex-bot was assigned by hermes-agent 2026-10-12 00:04:24 +03:00
hermes-agent added this to the WealthLedger — Delivery Board project 2026-10-12 00:04:24 +03:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Kind/Dependencies
Dependency update or dependency-management work
 Kind/Investigation
Research or decision required before implementation
 Kind/Process
Developer workflow, CI/CD, tooling, or process improvement
 Kind/Refactor
Internal code or configuration restructuring without new product behavior
 audit/2026-10-11
Technical Audit Remediation — 2026-10-11
 kind/investigation
Нужна проверка evidence до решения; runtime-дефект не утверждается
Compat/Breaking
Breaking change that won't be backward compatible
 Kind/Bug
Something is not working
 Kind/Documentation
Documentation changes
 Kind/Enhancement
Improve existing functionality
 Kind/Feature
New functionality
 Kind/Security
This is security issue
 Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Medium
3
The priority is medium
Priority
Low
4
The priority is low
Reviewed
Confirmed
1
Issue has been confirmed
Reviewed
Duplicate
2
This issue or pull request already exists
Reviewed
Invalid
3
Invalid issue
Reviewed
Won't Fix
3
This issue won't be fixed
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
Status
Abandoned
3
Somebody has started to work on this but abandoned work
No labels audit/2026-10-11 Kind/Bug
Priority
Medium
3
Milestone
No items
No Milestone Technical Audit Remediation — 2026-10-11
Projects
Clear projects
No projects
WealthLedger — Delivery Board
Бэклог
Assignees
Clear assignees
codex-bot hermes-agent ksv741 publisher-bot renovate-bot
No Assignees codex-bot
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: WealthLedger/backend#59