Conversation
`create_file_submission` writes to the `submissions` table (what a user
uploads), but `list_submissions` delegated to `get_submissions`, which reads
`bounty_submissions` (an analyst's verdict against a bounty). Two different
tables, two different meanings. The result was that anything a user submitted
was returned by no list endpoint at all: submit a file, get a 200 and an id,
then watch it vanish from the dashboard and marketplace.
Verified against the live deployment - after submitting, gateway.submissions
held 1 row while GET /submissions returned {"submissions":[]} from
bounty_submissions.
Now returns the caller's own submissions, newest first, as a flat camelCase
array. Both details match what the client already expects:
marketplace.tsx declares useQuery<ApiSubmission[]>, and the default fetcher in
queryClient.ts does no unwrapping, so the previous envelope object arrived
where an array was required. `status` and `analysisStatus` are both emitted
because ApiSubmission reads each in different places.
Scoped to the authenticated submitter - the route is in the strict-auth group
and returning other users' uploads would leak filenames and descriptions.
analysisType/bountyAmount/priority/description are lifted out of the row's
metadata JSON, which is where create_file_submission puts them.
Rust CI has failed on main for the last four runs, so every PR inherits a red
`build` check. Both errors are `-D warnings` promotions from a newer clippy and
are unrelated to any recent change:
api-gateway/src/handlers/websocket.rs:92
useless conversion to the same type: `String` (drop `.into()`)
analysis-engine/src/analyzers/static_analyzer.rs:707
casting to the same type is unnecessary (`u32` -> `u32`) (drop the cast)
Fixed here rather than in a separate PR because they block this one from
merging; neither file is otherwise touched by this branch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Submitting a file or URL returned 200 and an id, then the item vanished from the dashboard and marketplace.
Cause:
create_file_submissionwrites tosubmissions(what a user uploads) butlist_submissionsdelegated toget_submissions, which readsbounty_submissions(an analyst's verdict on a bounty). Two different tables — user uploads were returned by no list endpoint at all.Verified against the live deployment: after submitting,
gateway.submissionsheld 1 row whileGET /submissionsreturned{"submissions":[]}.Fix: returns the caller's own submissions, newest first, as a flat camelCase array. Both details match what the client already expects —
marketplace.tsxdeclaresuseQuery<ApiSubmission[]>, andqueryClient.tsdoes no unwrapping, so the old envelope arrived where an array was required.statusandanalysisStatusare both emitted sinceApiSubmissionreads each in different places.Scoped to the authenticated submitter — the route is in the strict-auth group and returning other users' uploads would leak filenames and descriptions. A public marketplace feed should be a separate endpoint with its own field allowlist.
Compile-verified:
build-images.ymlrun 32370570962, api-gateway job success.