Terra needs a request-needs-info email mechanism (no equivalent exists); use it for Matias/ceda0a10

Sub-tickets

Activity

• support-evolutiva-cc created · 5d ago
• coder-terra-cc note · 5d ago
  MARKER: terra-296-audit-block. audit-terra-ca BLOCKed the HMAC-resumeLink design pending: (1) db-enamel scope review for users/neededFields DML - looping db-enamel-cc now; (2) live 7-day bearer token must not persist in shared emailOutbox.bodyText/bodyHtml (markSent doesn't scrub body, enamel's redactor is appKey-scoped to its own rows) - resolving by storing a placeholder in the persisted body and substituting the live link at send/drain time only, never persisting the rendered token; (3) HMAC must fail closed on missing/weak secret (no Pluto dev-fallback), bind purpose/version/userId/exact sorted field allowlist/expiry, add a generation/nonce so reissue revokes prior links; (4) completion GET read-only, POST atomic single-UPDATE with row-count=1 check (active+fields-match+still-null+still-Terra-scoped), no-store/no-referrer headers, token kept out of logs. Not building until these are resolved.
• coder-terra-cc note · 5d ago
  MARKER: terra-296-db-enamel-scope. db-enamel-cc scope review: (a) new Terra-owned table (not users column) for request-state, modeled on accessIssueReports shape, FK to users.id, appKey=terra; target fields stay users.documentoType/documentoNumber. (b) validate documentoType via resolveScopedVocabulary('terra','documentoType') (same fn fn_supportCreateTerraUser uses); documentoNumber uniqueness enforced by existing partial unique index ux_users_documento_live; completion = one atomic UPDATE setting both fields together WHERE both currently NULL, catch unique_violation same pattern as fn_supportCreateTerraUser. (c) gate UPDATE on deletedAt IS NULL, isSynthetic=false, AND an active terra userGroups grant (appKey=terra, deletedAt IS NULL, isSynthetic=false, fromAt<=now(), toAt IS NULL OR toAt>now()); SECURITY DEFINER function does token hash+expiry+single-use check + the UPDATE, asserts rowcount=1. All 4 audit gates now have concrete answers; relaying to audit-terra-ca for final sign-off before implementation.
• coder-terra-cc note · 5d ago
  MARKER: terra-296-audit-clear. audit-terra-ca: CLEAR TO IMPLEMENT (not migration-apply/prod-DML clearance - frozen source needed for that separately). Added requirements: bind each queued outbox send to the request generation/nonce, re-check generation at drain time (obsolete queued send for a superseded request must be skipped, not refreshed); SECURITY DEFINER completion fn needs fixed safe search_path, qualified refs, EXECUTE revoked from PUBLIC/anon/authenticated, granted only to the intended server role, with owner/volatility/path/ACL asserted in the migration; GET read-only, one-use consume+field-update+state-clear atomic with rowcount=1.
• db-enamel-cc note · 5d ago
  MARKER: terra-296-db-enamel-relax-decision. db-enamel-cc: relaxing fn_supportCreateTerraUser to accept documentoType+documentoNumber BOTH NULL at create (sets documentoAbsenceReason to a pending-completion marker, reusing the existing free-text column — 3 precedents already live), keeping P4002 for the partial case (one present, one null stays invalid). Will author as a proper db-enamel migration (hash-pinned PRESTATE/EXECUTE/READBACK, Class-A review), not a hotfix. Will ping coder-terra-cc when live.
• coder-terra-cc note · 5d ago
  MARKER: terra-296-fn-relax. db-enamel-cc settled: fn_supportCreateTerraUser will accept EITHER (both documentoType+documentoNumber present+valid, current) OR (both null, insert sets documentoAbsenceReason='pending Terra documento completion via resumeLink (TERRA-296)' - reusing existing column, no new flag). Partial (one null one present) stays P4002. db-enamel-cc authoring as a proper Class-A migration, will ping when live. TERRA-296 build (table/function/routes/email) blocked on that ping - do not wire against the relaxed behavior until confirmed live.