@johnnyboy11234/esg-idea-contest 0.3.1 → 0.3.2

package/backend/internal/idea/download_integration_test.go

@@ -0,0 +1,311 @@
+//go:build integration
+
+package idea_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/api"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/idea"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/dbtest"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// created posts a valid create as p and returns the new Idea's ID and the key
+// of its stored object.
+func (e *createEnv) created(t *testing.T, p security.Principal, name string) (uuid.UUID, string) {
+	t.Helper()
+	return e.createdWith(t, p, validForm(name))
+}
+
+func (e *createEnv) createdWith(t *testing.T, p security.Principal, f form) (uuid.UUID, string) {
+	t.Helper()
+	rec := e.post(t, p, f)
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("create: %d %s", rec.Code, rec.Body)
+	}
+	var b struct{ ID uuid.UUID }
+	if err := json.Unmarshal(rec.Body.Bytes(), &b); err != nil {
+		t.Fatal(err)
+	}
+	return b.ID, e.objects.last
+}
+
+func (e *createEnv) downloadRouter() http.Handler {
+	r := chi.NewRouter()
+	r.Get("/ideas/{id}/slides", func(w http.ResponseWriter, req *http.Request) {
+		id, err := uuid.Parse(chi.URLParam(req, "id"))
+		if err != nil {
+			panic(err)
+		}
+		e.h.DownloadSlides(w, req, api.IdeaId(id))
+	})
+	return r
+}
+
+func (e *createEnv) download(t *testing.T, p security.Principal, id uuid.UUID) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodGet, "/ideas/"+id.String()+"/slides", nil)
+	req = req.WithContext(security.WithPrincipal(context.Background(), p))
+	rec := httptest.NewRecorder()
+	e.downloadRouter().ServeHTTP(rec, req)
+	return rec
+}
+
+func (e *createEnv) gets() int {
+	e.objects.mu.Lock()
+	defer e.objects.mu.Unlock()
+	return e.objects.gets
+}
+
+func TestDownloadSlides(t *testing.T) {
+	e := newCreateEnv(t)
+	leader := addUser(t, e.db, "100001", "USER")
+	other := addUser(t, e.db, "100002", "USER")
+	admin := addUser(t, e.db, "900001", "ADMIN")
+	id, key := e.created(t, leader, "Idea A")
+	successRows := func() int {
+		return e.count(t, `SELECT COUNT(*) FROM audit_log WHERE action = 'SLIDES_DOWNLOAD' AND outcome = 'SUCCESS'`)
+	}
+
+	// The audit row is committed (visible to another connection) before the
+	// object is even opened, so before the first byte.
+	rowsAtOpen := -1
+	e.objects.onGet = func() { rowsAtOpen = successRows() }
+
+	rec := e.download(t, leader, id)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("leader: %d %s", rec.Code, rec.Body)
+	}
+	if rowsAtOpen != 1 {
+		t.Errorf("SLIDES_DOWNLOAD rows when the object was opened = %d, want 1", rowsAtOpen)
+	}
+	if !bytes.Equal(rec.Body.Bytes(), e.objects.puts[key]) {
+		t.Error("body differs from the stored object")
+	}
+	want := map[string]string{
+		"Content-Type":           "application/pdf",
+		"Content-Length":         strconv.Itoa(len(e.objects.puts[key])),
+		"Content-Disposition":    idea.ContentDisposition("I_BSID_User 100001_100001_Idea A.pdf"),
+		"Cache-Control":          "no-store",
+		"X-Content-Type-Options": "nosniff",
+	}
+	for k, v := range want {
+		if got := rec.Header().Get(k); got != v {
+			t.Errorf("%s = %q, want %q", k, got, v)
+		}
+	}
+	if rec.Header().Get("Accept-Ranges") != "" {
+		t.Error("Range must not be advertised")
+	}
+	if n := e.count(t, `SELECT COUNT(*) FROM audit_log WHERE action = 'SLIDES_DOWNLOAD' AND outcome = 'SUCCESS'
+	        AND actor_role = 'USER' AND actor_emp_no = '100001' AND target_type = 'IDEA' AND target_id = ?
+	        AND method = 'GET' AND route = '/ideas/{id}/slides' AND status = 200`, id.String()); n != 1 {
+		t.Errorf("leader SUCCESS row with full fields = %d, want 1", n)
+	}
+
+	// Admin: 200 and a second SUCCESS row.
+	if rec := e.download(t, admin, id); rec.Code != http.StatusOK {
+		t.Fatalf("admin: %d %s", rec.Code, rec.Body)
+	}
+	if n := e.count(t, `SELECT COUNT(*) FROM audit_log WHERE action = 'SLIDES_DOWNLOAD' AND outcome = 'SUCCESS' AND actor_role = 'ADMIN'`); n != 1 {
+		t.Errorf("admin SUCCESS rows = %d, want 1", n)
+	}
+
+	// Hidden and missing: identical 404 (bar the request ID), both DENIED, and
+	// storage is never touched.
+	before := e.gets()
+	hidden, missing := e.download(t, other, id), e.download(t, other, uuid.New())
+	if hidden.Code != 404 || missing.Code != 404 {
+		t.Fatalf("codes %d %d", hidden.Code, missing.Code)
+	}
+	strip := func(rr *httptest.ResponseRecorder) map[string]any {
+		var m map[string]any
+		_ = json.Unmarshal(rr.Body.Bytes(), &m)
+		delete(m, "requestId")
+		return m
+	}
+	hb, mb := strip(hidden), strip(missing)
+	if len(hb) != len(mb) || hb["code"] != "NOT_FOUND" || hb["code"] != mb["code"] || hb["detail"] != mb["detail"] {
+		t.Errorf("bodies differ: %v vs %v", hb, mb)
+	}
+	for k := range hidden.Header() {
+		if hidden.Header().Get(k) != missing.Header().Get(k) {
+			t.Errorf("header %s differs", k)
+		}
+	}
+	if e.gets() != before {
+		t.Error("a 404 must not open the object")
+	}
+	if n := e.count(t, `SELECT COUNT(*) FROM audit_log WHERE action = 'SLIDES_DOWNLOAD' AND outcome = 'DENIED'
+	        AND status = 404 AND error_code = 'NOT_FOUND'`); n != 2 {
+		t.Errorf("DENIED rows = %d, want 2", n)
+	}
+	if successRows() != 2 {
+		t.Errorf("SUCCESS rows = %d, want 2", successRows())
+	}
+
+	// Not state-limited, and the name is the *current* expected filename.
+	e.setDeadline(t, "NOW(6) - INTERVAL 1 DAY")
+	if _, err := e.db.Exec(`UPDATE idea SET name = 'Renamed' WHERE id = ?`, id.String()); err != nil {
+		t.Fatal(err)
+	}
+	rec = e.download(t, leader, id)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("after deadline: %d %s", rec.Code, rec.Body)
+	}
+	if got, want := rec.Header().Get("Content-Disposition"), idea.ContentDisposition("I_BSID_User 100001_100001_Renamed.pdf"); got != want {
+		t.Errorf("Content-Disposition = %q, want %q", got, want)
+	}
+}
+
+// A non-ASCII Idea name is served exactly through filename*.
+func TestDownloadSlidesUnicodeFilename(t *testing.T) {
+	e := newCreateEnv(t)
+	leader := addUser(t, e.db, "100001", "USER")
+	id, _ := e.created(t, leader, "減碳 Idea")
+	rec := e.download(t, leader, id)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("%d %s", rec.Code, rec.Body)
+	}
+	want := `attachment; filename="I_BSID_User 100001_100001___ Idea.pdf"; ` +
+		`filename*=UTF-8''I_BSID_User%20100001_100001_%E6%B8%9B%E7%A2%B3%20Idea.pdf`
+	if got := rec.Header().Get("Content-Disposition"); got != want {
+		t.Errorf("Content-Disposition = %q, want %q", got, want)
+	}
+}
+
+// Failures before the first byte answer a problem; the audit row stays
+// (Sequence.md §6: the intent to download was real).
+func TestDownloadSlidesFailsBeforeFirstByte(t *testing.T) {
+	for _, tc := range []struct {
+		name    string
+		breakIt func(e *createEnv, id uuid.UUID, key string)
+		status  int
+		code    string
+	}{
+		{"MinIO down", func(e *createEnv, _ uuid.UUID, _ string) {
+			e.objects.getErr = web.NewError(web.CodeStorageUnavailable, "object storage is unavailable")
+		}, 503, "STORAGE_UNAVAILABLE"},
+		{"object missing", func(e *createEnv, _ uuid.UUID, key string) {
+			delete(e.objects.puts, key)
+		}, 500, "INTERNAL_ERROR"},
+		{"object length differs from the row", func(e *createEnv, id uuid.UUID, _ string) {
+			if _, err := e.db.Exec(`UPDATE idea SET slides_size = slides_size + 1 WHERE id = ?`, id.String()); err != nil {
+				panic(err)
+			}
+		}, 500, "INTERNAL_ERROR"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			e := newCreateEnv(t)
+			leader := addUser(t, e.db, "100001", "USER")
+			id, key := e.created(t, leader, "Idea A")
+			tc.breakIt(e, id, key)
+			rec := e.download(t, leader, id)
+			if rec.Code != tc.status || decodeProblem(t, rec).Code != tc.code {
+				t.Fatalf("%d %s, want %d %s", rec.Code, rec.Body, tc.status, tc.code)
+			}
+			if ct := rec.Header().Get("Content-Type"); ct != web.ProblemContentType {
+				t.Errorf("Content-Type = %q", ct)
+			}
+			if n := e.count(t, `SELECT COUNT(*) FROM audit_log WHERE action = 'SLIDES_DOWNLOAD' AND outcome = 'SUCCESS'`); n != 1 {
+				t.Errorf("SUCCESS rows = %d, want 1", n)
+			}
+		})
+	}
+}
+
+// A storage failure mid-stream aborts the connection, so the client never
+// takes a short body for the whole file. Past net/http's write buffer the 200
+// and its Content-Length are already out and the body ends early; before it,
+// the client gets no response at all.
+func TestDownloadSlidesAbortsMidStream(t *testing.T) {
+	const size = 64 << 10
+	for _, tc := range []struct {
+		name      string
+		failAfter int64
+		headers   bool // the 200 reached the client
+	}{
+		{"after the headers were sent", 32 << 10, true},
+		{"within the write buffer", 10, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			e := newCreateEnv(t)
+			leader := addUser(t, e.db, "100001", "USER")
+			f := validForm("Idea A")
+			f.file = pdf(size)
+			id, key := e.createdWith(t, leader, f)
+			total := int64(len(e.objects.puts[key]))
+			e.objects.failAfter = tc.failAfter
+			e.objects.streamErr = errors.New("minio: connection reset")
+
+			inner := e.downloadRouter()
+			srv := httptest.NewServer(web.Recover(slog.New(slog.DiscardHandler))(
+				http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+					inner.ServeHTTP(w, r.WithContext(security.WithPrincipal(r.Context(), leader)))
+				})))
+			t.Cleanup(srv.Close)
+
+			resp, err := http.Get(srv.URL + "/ideas/" + id.String() + "/slides")
+			if !tc.headers {
+				if err == nil {
+					_ = resp.Body.Close()
+					t.Fatalf("got a response (%d); want the connection aborted", resp.StatusCode)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer func() { _ = resp.Body.Close() }()
+			if resp.StatusCode != 200 || resp.ContentLength != total {
+				t.Fatalf("status %d, length %d, want 200 %d", resp.StatusCode, resp.ContentLength, total)
+			}
+			b, err := io.ReadAll(resp.Body)
+			if !errors.Is(err, io.ErrUnexpectedEOF) {
+				t.Errorf("read error = %v, want unexpected EOF", err)
+			}
+			if int64(len(b)) >= total {
+				t.Errorf("read %d of %d bytes; want a short body", len(b), total)
+			}
+		})
+	}
+}
+
+// An unknown commit outcome serves nothing: the audit row may not exist.
+func TestDownloadSlidesUnknownOutcome(t *testing.T) {
+	dsn := dbtest.Start(t)
+	d := dbtest.Open(t, dsn)
+	faulty, faults := dbtest.OpenFaulty(t, dsn)
+	e := newCreateEnvOn(t, d, faulty)
+	leader := addUser(t, d, "100001", "USER")
+	id, _ := e.created(t, leader, "Idea A")
+
+	for _, fault := range []dbtest.CommitFault{dbtest.LostAckCommitted, dbtest.LostAckNotCommitted} {
+		before := e.gets()
+		faults.FailNextCommit(fault)
+		rec := e.download(t, leader, id)
+		if rec.Code != 503 || decodeProblem(t, rec).Code != "SERVICE_UNAVAILABLE" {
+			t.Fatalf("fault %v: %d %s", fault, rec.Code, rec.Body)
+		}
+		if e.gets() != before {
+			t.Errorf("fault %v: the object must not be opened", fault)
+		}
+	}
+	if faults.Fired() != 2 {
+		t.Errorf("faults fired = %d, want 2", faults.Fired())
+	}
+}

package/backend/internal/idea/download_test.go

@@ -0,0 +1,25 @@
+package idea_test
+
+import (
+	"mime"
+	"testing"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/idea"
+)
+
+func TestContentDisposition(t *testing.T) {
+	for _, tc := range []struct{ name, want string }{
+		{"I_BSID_Amy_100001_Plan.pdf", `attachment; filename="I_BSID_Amy_100001_Plan.pdf"; filename*=UTF-8''I_BSID_Amy_100001_Plan.pdf`},
+		{"O_AAID_王小明_100002_減碳.pptx", `attachment; filename="O_AAID_____100002___.pptx"; filename*=UTF-8''O_AAID_%E7%8E%8B%E5%B0%8F%E6%98%8E_100002_%E6%B8%9B%E7%A2%B3.pptx`},
+		{`a "b"\c;d%e.pdf`, `attachment; filename="a _b__c;d%e.pdf"; filename*=UTF-8''a%20%22b%22%5Cc%3Bd%25e.pdf`},
+	} {
+		got := idea.ContentDisposition(tc.name)
+		if got != tc.want {
+			t.Errorf("%q:\n got %s\nwant %s", tc.name, got, tc.want)
+		}
+		// Go's own RFC 2231/8187 parser recovers the exact name from filename*.
+		if _, params, err := mime.ParseMediaType(got); err != nil || params["filename"] != tc.name {
+			t.Errorf("%q: parsed %q, %v", tc.name, params["filename"], err)
+		}
+	}
+}

package/backend/internal/idea/handler.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"database/sql"
 	"errors"
+	"log/slog"
 	"net/http"
 
 	"github.com/google/uuid"
@@ -51,6 +52,8 @@ type Handler struct {
 	// storage, D29).
 	ExpectedFilename func(category, org, leaderName, leaderEmpNo, ideaName string) (string, error)
 	Fail             func(w http.ResponseWriter, r *http.Request, err error)
+	// Log receives download failures the response cannot carry (nil = discard).
+	Log *slog.Logger
 }
 
 type person struct {

package/backend/internal/idea/service.go

@@ -23,7 +23,8 @@ type Idea = store.Idea
 type Service struct {
 	DB    *sql.DB
 	Audit *audit.Service
-	// Gate, Slides, Objects and Aborter are needed by Create only.
+	// Gate, Slides and Aborter are needed by Create only; Objects by Create
+	// and Download.
 	Gate    deadline.SubmissionGate
 	Slides  SlideRules
 	Objects ObjectStore

package/backend/internal/server/api.go

@@ -59,3 +59,8 @@ func (a API) CreateIdea(w http.ResponseWriter, r *http.Request, _ api.CreateIdea
 func (a API) ListIdeas(w http.ResponseWriter, r *http.Request, params api.ListIdeasParams) {
 	a.Ideas.ListIdeas(w, r, params)
 }
+
+// DownloadSlides serves GET /ideas/{id}/slides.
+func (a API) DownloadSlides(w http.ResponseWriter, r *http.Request, id api.IdeaId) {
+	a.Ideas.DownloadSlides(w, r, id)
+}

package/backend/internal/server/binding.go

@@ -18,6 +18,10 @@ func Mount(si api.ServerInterface) func(chi.Router) {
 			BaseRouter:       r,
 			ErrorHandlerFunc: BindingError,
 		})
+		// HEAD on the download must never run the GET handler, which writes an
+		// audit row (D47). chi already answers 405; the explicit route keeps
+		// the rule independent of that router default (D59).
+		r.Head(SlidesPath, web.MethodNotAllowed)
 	}
 }
 

package/backend/internal/server/server.go

@@ -6,6 +6,7 @@ import (
 	"database/sql"
 	"log/slog"
 	"net/http"
+	"strings"
 	"sync/atomic"
 	"time"
 
@@ -32,13 +33,31 @@ func NewPublic(log *slog.Logger, mount func(chi.Router), extra ...func(http.Hand
 	}
 	// The chain wraps the router instead of using r.Use: chi skips r.Use
 	// middleware (also for NotFound) while no route is registered.
-	h := web.AcceptCheck(r)
+	h := web.AcceptCheck(r, IsFileDownload)
 	for i := len(extra) - 1; i >= 0; i-- {
 		h = extra[i](h)
 	}
 	return web.RequestID(web.AccessLog(log)(web.Recover(log)(h)))
 }
 
+// SlidesPath is the slide download route under /api/v1.
+const SlidesPath = "/api/v1/ideas/{id}/slides"
+
+// IsFileDownload reports whether r targets the slide download, which serves a
+// file and therefore skips the JSON Accept check. HEAD is included so that it
+// answers 405, never 406. Errors on this route are still problem+json.
+func IsFileDownload(r *http.Request) bool {
+	if r.Method != http.MethodGet && r.Method != http.MethodHead {
+		return false
+	}
+	rest, ok := strings.CutPrefix(r.URL.Path, "/api/v1/ideas/")
+	if !ok {
+		return false
+	}
+	id, tail, ok := strings.Cut(rest, "/")
+	return ok && id != "" && tail == "slides"
+}
+
 // Check reports whether one dependency is usable; a non-nil error makes
 // readiness answer 503. Only dependencies a request cannot do without belong
 // here: the database yes, MinIO no (PRD §8.3, Architecture §12).

package/backend/internal/server/slides_test.go

@@ -0,0 +1,82 @@
+package server_test
+
+import (
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/api"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/server"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// downloadStub counts DownloadSlides calls; every other operation is 501.
+type downloadStub struct {
+	api.Unimplemented
+	calls *int
+}
+
+func (s downloadStub) DownloadSlides(w http.ResponseWriter, _ *http.Request, _ api.IdeaId) {
+	*s.calls++
+	w.Header().Set("Content-Type", "application/pdf")
+	_, _ = w.Write([]byte("%PDF-"))
+}
+
+func TestSlidesDownloadRoute(t *testing.T) {
+	const path = "/api/v1/ideas/7f0c1a52-2a51-4f0e-9a43-0d6b5f0b2a11/slides"
+	for _, tc := range []struct {
+		name, method, path, accept string
+		status                     int
+		code                       string
+		calls                      int
+	}{
+		// D47/D59: HEAD answers 405 and never runs the GET handler (which audits).
+		{"HEAD is 405", http.MethodHead, path, "", 405, "METHOD_NOT_ALLOWED", 0},
+		{"HEAD with a file Accept is still 405, not 406", http.MethodHead, path, "application/pdf", 405, "METHOD_NOT_ALLOWED", 0},
+		{"GET with a file Accept is served", http.MethodGet, path, "application/pdf", 200, "", 1},
+		{"GET with a browser Accept is served", http.MethodGet, path, "text/html,application/xhtml+xml", 200, "", 1},
+		{"GET with no Accept is served", http.MethodGet, path, "", 200, "", 1},
+		{"malformed ID is the uniform 404", http.MethodGet, "/api/v1/ideas/nope/slides", "", 404, "NOT_FOUND", 0},
+		{"other routes keep the 406", http.MethodGet, "/api/v1/ideas/7f0c1a52-2a51-4f0e-9a43-0d6b5f0b2a11", "application/pdf", 406, "NOT_ACCEPTABLE", 0},
+		{"wrong method on the download is 405", http.MethodPost, path, "", 405, "METHOD_NOT_ALLOWED", 0},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			calls := 0
+			h := server.NewPublic(slog.New(slog.DiscardHandler), server.Mount(downloadStub{calls: &calls}))
+			req := httptest.NewRequest(tc.method, tc.path, nil)
+			if tc.accept != "" {
+				req.Header.Set("Accept", tc.accept)
+			}
+			rec := httptest.NewRecorder()
+			h.ServeHTTP(rec, req)
+			if rec.Code != tc.status || calls != tc.calls {
+				t.Fatalf("status %d calls %d, want %d %d (%s)", rec.Code, calls, tc.status, tc.calls, rec.Body)
+			}
+			if tc.code != "" {
+				if ct := rec.Header().Get("Content-Type"); ct != web.ProblemContentType {
+					t.Errorf("Content-Type %q", ct)
+				}
+			}
+		})
+	}
+}
+
+func TestIsFileDownload(t *testing.T) {
+	for _, tc := range []struct {
+		method, path string
+		want         bool
+	}{
+		{http.MethodGet, "/api/v1/ideas/x/slides", true},
+		{http.MethodHead, "/api/v1/ideas/x/slides", true},
+		{http.MethodPut, "/api/v1/ideas/x/slides", false},
+		{http.MethodGet, "/api/v1/ideas//slides", false},
+		{http.MethodGet, "/api/v1/ideas/x/slides/", false},
+		{http.MethodGet, "/api/v1/ideas/x", false},
+		{http.MethodGet, "/api/v1/ideas/x/members/slides", false},
+	} {
+		if got := server.IsFileDownload(httptest.NewRequest(tc.method, tc.path, nil)); got != tc.want {
+			t.Errorf("%s %s = %v", tc.method, tc.path, got)
+		}
+	}
+}

package/backend/internal/shared/web/transport.go

@@ -20,10 +20,11 @@ func MethodNotAllowed(w http.ResponseWriter, r *http.Request) {
 
 // AcceptCheck answers 406 when the Accept header cannot be satisfied by JSON.
 // A missing header, */*, application/* and application/json (also +problem)
-// are accepted. Slide download routes opt out of this check in their PR.
-func AcceptCheck(next http.Handler) http.Handler {
+// are accepted. Requests for which exempt reports true (routes that serve a
+// file, not JSON) skip the check; exempt may be nil.
+func AcceptCheck(next http.Handler, exempt func(*http.Request) bool) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if !acceptsJSON(r.Header.Values("Accept")) {
+		if (exempt == nil || !exempt(r)) && !acceptsJSON(r.Header.Values("Accept")) {
 			WriteProblem(w, r, NewError(CodeNotAcceptable, "Only application/json is supported."))
 			return
 		}

package/backend/test/arch/arch_test.go

@@ -36,6 +36,9 @@ const (
 // may import. A module directory missing from this table fails the test, so adding a module forces
 // a conscious decision about its edges. Facts it encodes:
 //   - D29: storage has no dependency on idea; slides sits on idea + storage.
+//   - idea -> storage is allowed only for Idea delete (Sequence.md §5): idea inserts
+//     pending_file_deletion in its tx and deletes the object after commit. idea should depend on
+//     a small interface it declares itself, not on storage's concrete types (bd 1ve).
 //   - D30: account never imports auth (SessionRevoker is injected from main.go).
 //   - D53: audit is reached by business modules; audit itself imports no module.
 //   - admin holds HTTP entry points only and may call any service.
@@ -45,7 +48,7 @@ var allowedEdges = map[string][]string{
 	"account":  {"audit"},
 	"auth":     {"account", "audit"},
 	"storage":  {"audit"},
-	"idea":     {"audit", "deadline"},
+	"idea":     {"audit", "deadline", "storage"},
 	"team":     {"audit", "deadline", "idea"},
 	"slides":   {"audit", "deadline", "idea", "storage"},
 	"admin":    {"account", "audit", "auth", "deadline", "idea", "slides", "storage", "team"},
@@ -284,6 +287,7 @@ func TestChecksDetectViolations(t *testing.T) {
 
 	allowed := []imp{
 		{File: "a.go", Pkg: "slides", Target: "storage"},
+		{File: "a.go", Pkg: "idea", Target: "storage"},
 		{File: "a.go", Pkg: "idea", Target: "shared/web"},
 		{File: "a.go", Pkg: "idea", Target: "api"},
 		{File: "a.go", Pkg: "server", Target: "idea"},

package/backend/test/matrix/matrix_integration_test.go

@@ -7,6 +7,7 @@ import (
 	"context"
 	"database/sql"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"log/slog"
@@ -95,6 +96,11 @@ func (discardObjects) Put(_ context.Context, _ string, r io.Reader, _ int64, _ s
 	return err
 }
 
+// Get is never reached by the matrix rows (they download only missing Ideas).
+func (discardObjects) Get(context.Context, string) (io.ReadCloser, int64, error) {
+	return nil, 0, errors.New("matrix: no objects")
+}
+
 func (discardObjects) AbortUpload(context.Context, string, shareddb.Outcome) {}
 
 // stateDeadline is the deadline expression that puts the contest in a state.

package/docs/Architecture/Architecture.md

@@ -149,7 +149,7 @@ Next deliverables: ADR drafts for the decisions below; Flyway migration plan for
 | D26 | No `job_lease` table in v1 | Idempotent operations and `SKIP LOCKED` are enough | Decided |
 | D27 | MariaDB 10.8 LTS with native `UUID` and `INET6` | Version confirmed by the owner | **Reopened** (D45) |
 | D28 | No dedicated Spring Boot 4 compatibility spike | Owner decision; risk accepted | **Superseded: no Spring in the Go backend (OI-31 closed)** (was: Decided (OI-31)) |
-| D29 | Split `slides` into `storage` (no dependency on `idea`) and `slides` (HTTP orchestration on top of `idea` + `storage`) | Removes the `idea` ↔ `slides` cycle | Decided |
+| D29 | Split `slides` into `storage` (no dependency on `idea`) and `slides` (HTTP orchestration on top of `idea` + `storage`) | Removes the `idea` ↔ `slides` cycle. `idea → storage` is allowed (Idea delete, `Sequence.md` §5); the forbidden direction is `storage → idea` | Decided |
 | D30 | Split `auth` into `account` and `auth`; `account` defines `SessionRevoker`, `auth` implements it | Smaller modules; Vault uncertainty isolated; no cycle | Decided |
 | D31 | Repositories use `JdbcClient`, hand-written SQL owned by each module, no JPA | Locking, upserts, atomic session statement and visibility query are SQL by design | **Superseded by ADR G1 (sqlc, hand-written SQL per module; intent unchanged)** (was: Decided) |
 | D32 | `shared` depends on no business module and contains no business concept | Reusable, trivially testable kernel | Decided |

package/docs/Architecture/Backend.md

@@ -52,6 +52,7 @@ Same graph and rules as `Backend.md` §2.1. Go mechanics:
 - **`SubmissionGate`** (D34, OI-18):
   - `Precheck(ctx, actor) error` — read-only;
   - `AssertOpenInTx(ctx, tx *sql.Tx, actor) error` — the `tx` parameter makes it impossible to call outside a write transaction [ADR G9].
+- **`idea → storage`** (allowed; bd 1ve): `DELETE /ideas/{id}` (`Sequence.md` §5) inserts `pending_file_deletion` in its own transaction and deletes the object after commit, so `idea` needs `storage`. `idea` declares a small interface (for example `ObjectDeleter { Delete(ctx, key string) error }`) that `storage` implements, and `main.go` injects it. `storage` still imports no `idea` (D29), so the graph stays acyclic.
 - Allowed edges are listed once in a table inside the import-graph test (§2.4) and compared with the real graph.
 ### 2.2 Package layout inside a module **[ADR G6]**
  
@@ -323,7 +324,7 @@ Same as `Backend.md` §8. The visibility query is one sqlc query in `idea/intern
  
 Same rules as `Backend.md` §9, including the Vault sync table. Go mechanics **[Proposed]**:
  
-- Background work (Vault sync, session and throttle purge) runs as goroutines started in `main.go` with a `time.Ticker` plus random jitter; each stops when the root context is cancelled at shutdown.
+- Background work (Vault sync, session and throttle purge) runs as goroutines started in `main.go` through `shared/job.Run`: a timer re-armed after each run with the interval plus a fresh random jitter (the first run also waits a random jitter), so replicas drift apart. Each stops when the root context is cancelled at shutdown, and `main` waits for it before closing the pool. No leader is elected, so every job must be idempotent and safe on several replicas at once. The auth purge (B1b-07) runs every 5 min + up to 1 min and deletes in batches of 1000 with `DELETE … LIMIT`; a deadlock or lock-wait timeout ends that table's turn without an error.
 - Readiness waits for the first successful Vault read (`atomic.Bool` read by the readiness handler).
 - The orphan-file claim (`SELECT … FOR UPDATE SKIP LOCKED`) is generated by sqlc as written (spike case c03).
 ---

package/frontend/Dockerfile

@@ -6,6 +6,8 @@ WORKDIR /repo/frontend
 COPY frontend/package.json frontend/package-lock.json ./
 RUN npm ci
 COPY testdata /repo/testdata
+# The common-password list lives with the backend rule; the register page lazy-loads the same file.
+COPY backend/internal/account/internal/passwords/common-passwords.txt /repo/backend/internal/account/internal/passwords/
 COPY frontend/ ./
 RUN npm run build
 

package/frontend/package-lock.json

@@ -46,6 +46,7 @@
         "tailwindcss": "^4.3.5",
         "typescript": "~6.0",
         "typescript-eslint": "^8.72.1",
+        "undici": "^8.12.4",
         "vite": "^8.3.6",
         "vitest": "^5.1.0",
         "vitest-axe": "^0.1.0"

package/frontend/package.json

@@ -54,6 +54,7 @@
     "tailwindcss": "^4.3.5",
     "typescript": "~6.0",
     "typescript-eslint": "^8.72.1",
+    "undici": "^8.12.4",
     "vite": "^8.3.6",
     "vitest": "^5.1.0",
     "vitest-axe": "^0.1.0"