fix: enforce idempotency TTL store conformance by kang-heewon · Pull Request #1385 · croco-dev/framework

kang-heewon · 2026-07-12T22:17:34Z

Fixes #1370.

Summary

Enforces invalid TTL rejection before reserve, commit, and fail state changes in the portable idempotency store conformance suite.
Covers zero, negative, NaN, infinity, fractional, and Date-overflow TTLs on every transition.
Locks omitted TTLs as the explicit non-expiring behavior across reserve, commit, and fail.
Preserves the runtime validation, public Problem API, generated docs, registry, and snapshots already merged to trunk by fix: reject invalid idempotency TTLs and secure generated apps #1449 instead of reintroducing a competing implementation.

Verification

pnpm --filter=@croco/idempotency-core test — 68/68 tests passed.
pnpm typecheck --filter=@croco/idempotency-core — 4/4 tasks passed.
pnpm lint --filter=@croco/idempotency-core — 2/2 tasks passed.
pnpm static-misuse:check — all rules passed.
pnpm check — repository profile passed 21/22 gates, with one non-applicable gate.
Pre-push gates for the current head — tests 226/226 and typecheck 225/225 passed.
Full Oxfmt check across 2,681 files and git diff --check — passed.

Self-review gates

Correctness and regression: PASS. Every invalid numeric class rejects before reserve creation or commit/fail mutation, while omitted TTLs remain non-expiring on all transitions.
API, security, compatibility, and release: PASS. The rebase keeps fix: reject invalid idempotency TTLs and secure generated apps #1449's current public API and generated contracts unchanged; the remaining package behavior has a patch changeset.
Maintainability and minimality: PASS. The rebased diff is limited to the conformance suite, its case registry test, package guidance, the required static-misuse locator updates, and one changeset.

Rebase accounting

The original PR commit db7c526 was rebased onto b65ed66. Its runtime/API/generated-artifact changes were already represented on trunk by 62885fe (#1449); the PR-only conformance and README changes were retained as 9153ff2. Repository policy support is in e83fa0b, and the review-requested invalid TTL matrix is in 94f6639.

Residual risk

No known validation gap remains for the numeric TTL classes defined by the contract.

coderabbitai · 2026-07-12T22:17:42Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

idempotency store conformance suite가 reserve, commit, fail의 잘못된 TTL과 생략된 TTL 동작을 검증하도록 확장되었습니다. README와 changeset에는 TTL 유효성 및 InvalidIdempotencyTtlProblem이 문서화되었습니다.

Changes

Idempotency TTL conformance

Layer / File(s)	Summary
TTL 콘포먼스 검증 및 계약 문서 `packages/idempotency-core/src/libs/conformance.ts`, `packages/idempotency-core/src/tests/IdempotencyConformance.spec.ts`, `packages/idempotency-core/README.md`, `.changeset/9c4317b7.md`	reserve, commit, fail에서 잘못된 TTL을 `InvalidIdempotencyTtlProblem`으로 거부하고 기존 reservation을 유지하는 케이스를 추가했습니다. 생략된 TTL의 `expiresAt: null` 동작과 관련 공개 문서 및 patch changeset도 추가했습니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	비정상 TTL 거부, reserve/commit/fail의 동일한 검증, omitted TTL의 비만료 동작이 요구사항과 일치합니다.
Out of Scope Changes check	✅ Passed	변경은 문서, conformance 테스트, 변경기록에 한정되어 있어 링크된 요구사항 범위를 벗어난 항목이 보이지 않습니다.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목이 idempotency TTL 검증과 스토어 conformance 강제를 정확히 요약하며 변경 내용과 잘 맞습니다.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/1370-validate-idempotency-ttl

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-12T22:31:17Z

📊 Benchmark Results

✅ All benchmarks passed

Benchmark	p75	Threshold	Baseline	vs Baseline	Status	Notes
CrocoApp constructor	9.0μs	30.0ms	8.2μs	+10.1%	✅	-
CrocoApp lambdaHandler (10 controllers)	283.6μs	50.0ms	258.4μs	+9.7%	✅	-
Lambda cold-start simulation	428.1μs	80.0ms	418.1μs	+2.4%	✅	-
Lambda cold-start with headers	401.5μs	80.0ms	369.7μs	+8.6%	✅	-
Lambda cold-start with binary body	380.2μs	80.0ms	339.1μs	+12.1%	✅	-
Lambda cold-start with query params	316.6μs	80.0ms	301.3μs	+5.1%	✅	-
Lambda cold-start with authorizer context	318.3μs	80.0ms	299.8μs	+6.2%	✅	-
Lambda cold-start realistic scenario	319.7μs	80.0ms	299.2μs	+6.9%	✅	-
EventBusConfig.start (10 handlers)	1.9μs	10.0ms	1.4μs	+32.4%	❌	-
EventPublisher.publishNow single event	2.0μs	2.0ms	1.7μs	+17.9%	✅	-
DefaultHandlerResolver.resolve × 10	0.1μs	5.0ms	0.1μs	-16.2%	✅	-
Container.get singleton (cold)	71.5μs	5.0ms	70.3μs	+1.7%	✅	-
Container.register × 50 components	3.6ms	10.0ms	3.2ms	+11.4%	✅	-
Container.validate (50 components)	4.1ms	20.0ms	3.4ms	+21.7%	❌	-
Container.get singleton (warm)	1.9μs	500.0μs	1.6μs	+15.9%	✅	-
TelemetryRuntime.init (lambda preset)	2.4μs	200.0ms	1.1ms	-99.8%	✅	-
lambdaPreset config creation	1.6μs	2.0ms	1.4μs	+10.9%	✅	-

_{Updated: 2026-07-24T12:42:41.206Z · Commit: f7ab85f}

kang-heewon · 2026-07-13T06:23:40Z

@coderabbitai review

coderabbitai · 2026-07-13T06:23:45Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

kang-heewon · 2026-07-13T07:23:46Z

@coderabbitai review

coderabbitai · 2026-07-13T07:23:52Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

kang-heewon · 2026-07-13T08:23:28Z

@coderabbitai review

coderabbitai · 2026-07-13T08:23:34Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

kang-heewon · 2026-07-13T10:06:26Z

@coderabbitai review

coderabbitai · 2026-07-13T10:06:33Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/idempotency-core/src/libs/conformance.ts`:
- Around line 158-259: Expand the TTL validation conformance cases around the
existing reserve, commit, and fail tests to cover representative invalid values
beyond zero, including negative, NaN/non-finite, fractional, and out-of-range
TTLs. Use separate createConformanceKey values and preserve the current
assertions that invalid inputs reject before changing reservation state.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: d19f54cc-f232-43ac-a079-9a700da010d9

📥 Commits

Reviewing files that changed from the base of the PR and between 08cb6f1 and fe45159.

⛔ Files ignored due to path filters (1)

packages/problems-core/src/generated/problem-code-registry.ts is excluded by !**/generated/**

📒 Files selected for processing (17)

.changeset/valid-idempotency-ttl.md
docs/problem-code-registry.json
packages/docs/src/content/docs/api/idempotency-core/src/classes/InvalidIdempotencyTtlProblem.md
packages/docs/src/content/docs/api/idempotency-core/src/type-aliases/IdempotencyTtlOperation.md
packages/docs/src/content/docs/api/idempotency-core/src/type-aliases/InvalidIdempotencyTtlReason.md
packages/docs/src/content/docs/api/idempotency-core/src/variables/IDEMPOTENCY_DIAGNOSTIC_CODES.md
packages/docs/src/content/docs/en/reference/problem-recovery-cookbook.md
packages/idempotency-core/README.md
packages/idempotency-core/src/index.ts
packages/idempotency-core/src/libs/InMemoryIdempotencyStore.ts
packages/idempotency-core/src/libs/conformance.ts
packages/idempotency-core/src/libs/problems/IdempotencyProblems.ts
packages/idempotency-core/src/tests/IdempotencyConformance.spec.ts
packages/idempotency-core/src/tests/InMemoryIdempotencyStore.spec.ts
public-api-surface.snapshot.json
scripts/static-misuse-raw-error-allowlist.json
tsconfig/contract-strict.baseline.json

coderabbitai

♻️ Duplicate comments (1)

packages/idempotency-core/src/libs/conformance.ts (1)
158-225: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

기존 TTL 대표값 확장 지적이 여전히 유효합니다.

현재 세 transition은 ttlMs: 0만 검증합니다. 계약에 명시된 음수, NaN/무한대, 소수, Date 범위 초과 값도 reserve·commit·fail마다 검증해야 서드파티 저장소가 전체 invalid TTL 계약을 우회하지 못합니다. 추가한 case 이름에 맞춰 IdempotencyConformance.spec.ts의 기대 목록도 함께 갱신하세요.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/idempotency-core/src/libs/conformance.ts` around lines 158 - 225,
Expand the invalid-TTL conformance cases for reserve, commit, and fail beyond
zero to cover negative, NaN/infinite, fractional, and Date-range-overflow
values. Ensure each case asserts rejection with InvalidIdempotencyTtlProblem
before any state change, preserving reservation state for commit and fail.
Update the expected case-name list in IdempotencyConformance.spec.ts to include
all newly added cases.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In `@packages/idempotency-core/src/libs/conformance.ts`:
- Around line 158-225: Expand the invalid-TTL conformance cases for reserve,
commit, and fail beyond zero to cover negative, NaN/infinite, fractional, and
Date-range-overflow values. Ensure each case asserts rejection with
InvalidIdempotencyTtlProblem before any state change, preserving reservation
state for commit and fail. Update the expected case-name list in
IdempotencyConformance.spec.ts to include all newly added cases.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ce76b105-c874-4fb6-a0bf-8e88285b7e10

📥 Commits

Reviewing files that changed from the base of the PR and between fe45159 and 05ccd9b.

📒 Files selected for processing (4)

.changeset/9c4317b7.md
packages/idempotency-core/README.md
packages/idempotency-core/src/libs/conformance.ts
packages/idempotency-core/src/tests/IdempotencyConformance.spec.ts

kang-heewon force-pushed the fix/1370-validate-idempotency-ttl branch 2 times, most recently from 10784fd to bfbbd9e Compare July 13, 2026 05:34

coderabbitai Bot approved these changes Jul 13, 2026

View reviewed changes

kang-heewon force-pushed the fix/1370-validate-idempotency-ttl branch from bfbbd9e to 7871103 Compare July 13, 2026 06:44

kang-heewon force-pushed the fix/1370-validate-idempotency-ttl branch from 7871103 to 9920b76 Compare July 13, 2026 07:47

kang-heewon force-pushed the fix/1370-validate-idempotency-ttl branch from 9920b76 to 08cb6f1 Compare July 13, 2026 08:32

kang-heewon force-pushed the fix/1370-validate-idempotency-ttl branch 2 times, most recently from bfa53f0 to fe45159 Compare July 13, 2026 11:13

coderabbitai Bot requested changes Jul 13, 2026

View reviewed changes

Comment thread packages/idempotency-core/src/libs/conformance.ts

kang-heewon force-pushed the fix/1370-validate-idempotency-ttl branch from fe45159 to db7c526 Compare July 13, 2026 12:10

coderabbitai Bot approved these changes Jul 24, 2026

View reviewed changes

fix: reject invalid idempotency TTL values

9153ff2

kang-heewon force-pushed the fix/1370-validate-idempotency-ttl branch from db7c526 to 05ccd9b Compare July 24, 2026 12:22

kang-heewon changed the title ~~fix: reject invalid idempotency TTL values~~ fix: enforce idempotency TTL store conformance Jul 24, 2026

kang-heewon force-pushed the fix/1370-validate-idempotency-ttl branch from 05ccd9b to a9b56c3 Compare July 24, 2026 12:23

coderabbitai Bot reviewed Jul 24, 2026

View reviewed changes

chore: publish idempotency TTL conformance contract

e83fa0b

kang-heewon force-pushed the fix/1370-validate-idempotency-ttl branch from a9b56c3 to e83fa0b Compare July 24, 2026 12:34

fix: enforce all invalid TTL classes in store conformance

94f6639

kang-heewon merged commit 0aa0bf1 into trunk Jul 24, 2026
9 checks passed

kang-heewon deleted the fix/1370-validate-idempotency-ttl branch July 24, 2026 13:30

Uh oh!

Conversation

kang-heewon commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Self-review gates

Rebase accounting

Residual risk

Uh oh!

coderabbitai Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📊 Benchmark Results

Uh oh!

kang-heewon commented Jul 13, 2026

Uh oh!

coderabbitai Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kang-heewon commented Jul 13, 2026

Uh oh!

coderabbitai Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kang-heewon commented Jul 13, 2026

Uh oh!

coderabbitai Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kang-heewon commented Jul 13, 2026

Uh oh!

coderabbitai Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

kang-heewon commented Jul 12, 2026 •

edited

Loading

coderabbitai Bot commented Jul 12, 2026 •

edited

Loading

github-actions Bot commented Jul 12, 2026 •

edited

Loading

coderabbitai Bot commented Jul 13, 2026 •

edited

Loading

coderabbitai Bot commented Jul 13, 2026 •

edited

Loading

coderabbitai Bot commented Jul 13, 2026 •

edited

Loading

coderabbitai Bot commented Jul 13, 2026 •

edited

Loading