fix: preserve pruned lookup authorization

Retain original arguments within the history byte bound and deny legacy entries without them. Inline the single-use lookup, bound, and dead-row helpers requested by review.

See #79

Author: cardmagic

docs/architecture.md

@@ -442,12 +442,17 @@ than in a separate tombstone table, which needs no second store, no second
 write, and no separate retention. `reference.find_by(idempotency_key:)` raises
 `MessagePruned` for a key the actor remembers and whose message retention
 removed, and answers `nil` for a key no caller ever sent, so a client can tell
-a lost result from a request that never arrived. An actor remembers the operation beside each key, so
-the pruned answer runs the same hook against the same operation that a lookup
+a lost result from a request that never arrived. An actor remembers the operation and original arguments beside each key, so
+the pruned answer runs the same hook against the same operation and arguments that a lookup
 of the surviving row would, and a caller the policy refuses reads `nil` whether
 the message is pruned or never existed. Gating it on `snapshot` instead would
 tell a caller who may read state, but not the operation, that the operation had
 run.
+Remembered arguments count toward the serialized memory limit and remain until
+the entry is evicted or the instance is removed. Entries from older versions
+that lack arguments return absence after pruning because their original
+authorization cannot be reproduced.
+
 `retained_idempotency_keys` bounds the memory and defaults to 64 keys for each
 actor, and `retained_idempotency_keys_bytes` bounds its serialized size at 16 KB,
 because an idempotency key has no length limit on every adapter and the memory

docs/operations.md

@@ -568,13 +568,18 @@ names survives retention. A lookup by idempotency key still tells the two cases
 apart after pruning, because the actor remembers the keys of its own last
 `retained_idempotency_keys` finished turns: it raises `MessagePruned` for a key
 the actor remembers and answers `nil` for a key no caller ever sent. The actor
-remembers the operation beside each key, so the pruned answer runs the same
+remembers the operation and original arguments beside each key, so the pruned answer runs the same
 authorization the surviving row would. Raise
 `retained_idempotency_keys` above the default of 64 when an actor finishes more
 keyed turns than that inside the window in which a caller may retry. A lookup
 by request id answers `nil` in both cases, so a caller that must tell them apart
 sends its own idempotency key.
 
+Remembered arguments count toward the serialized memory limit and remain until
+the entry is evicted or the instance is removed. Entries from older versions
+that lack arguments return absence after pruning because their original
+authorization cannot be reproduced.
+
 `retained_idempotency_keys_bytes` bounds the serialized memory as well, because
 an idempotency key has no length limit on every adapter and the memory outlives
 the message row. An actor drops its oldest keys until the list fits, so a key

docs/roadmap.md

@@ -126,7 +126,8 @@
   lookup by key raises `MessagePruned` for a message that retention removed and
   answers `nil` for a message that never existed. A lookup by request ID cannot
   make that distinction, because the runtime generates a request ID and no
-  actor remembers one
+  actor remembers one. Pruned lookups retain the original arguments for authorization
+  within the byte limit; older entries without arguments answer `nil`
 
 ## Partially implemented
 

lib/solid_objects/client.rb

@@ -110,10 +110,27 @@ def find_by(reference: nil, request_id: nil, idempotency_key: nil, authorization
         )
       end
 
-      readable_message(
-        remembered_message(reference, idempotency_key, authorization_context:),
+      instance = Instance.find_by(
+        actor_type: reference.actor_type,
+        actor_id: reference.actor_id
+      )
+      return nil unless instance
+
+      message = Message.uncached { Message.find_by(instance_id: instance.id, idempotency_key:) }
+      return readable_message(message, authorization_context:) if message
+
+      remembered = Array(instance.completed_idempotency_keys)
+        .find { |entry| entry["key"] == idempotency_key }
+      return nil unless remembered && remembered["arguments"].is_a?(Hash)
+      return nil unless authorized_to_invoke?(
+        actor_type: reference.actor_type,
+        actor_id: reference.actor_id,
+        operation: remembered["operation"],
+        arguments: remembered["arguments"],
         authorization_context:
       )
+
+      raise MessagePruned, idempotency_key
     end
 
     # @rbs (Reference, ?authorization_context: untyped) -> StateSnapshot
@@ -186,31 +203,6 @@ def enqueue_sync(reference:, operation:, arguments:, idempotency_key:, timeout:)
       )
     end
 
-    # @rbs (Reference, String, authorization_context: untyped) -> Message?
-    def remembered_message(reference, idempotency_key, authorization_context:)
-      instance = Instance.find_by(
-        actor_type: reference.actor_type,
-        actor_id: reference.actor_id
-      )
-      return nil unless instance
-
-      message = Message.uncached { Message.find_by(instance_id: instance.id, idempotency_key:) }
-      return message if message
-
-      remembered = Array(instance.completed_idempotency_keys)
-        .find { |entry| entry["key"] == idempotency_key }
-      return nil unless remembered
-      return nil unless authorized_to_invoke?(
-        actor_type: reference.actor_type,
-        actor_id: reference.actor_id,
-        operation: remembered["operation"],
-        arguments: {},
-        authorization_context:
-      )
-
-      raise MessagePruned, idempotency_key
-    end
-
     # @rbs (Message?, authorization_context: untyped) -> MessageReference?
     def readable_message(message, authorization_context:)
       return nil unless message

lib/solid_objects/dead_letter_scope.rb

@@ -30,22 +30,19 @@ def self.for_kind(kind)
     # @rbs (?authorization_context: untyped) -> Array[DeadRow]
     def all(authorization_context: nil)
       authorize!(:inspect, authorization_context:)
-      dead.includes(:instance).order(updated_at: :desc, id: :desc).map { |row| dead_row(row) }
-    end
-
-    # @rbs (untyped) -> DeadRow
-    def dead_row(row)
-      DeadRow.new(
-        id: row.public_send(identifier),
-        kind:,
-        actor_type: row.instance.actor_type,
-        actor_id: row.instance.actor_id,
-        status: row.status,
-        attempt_count: row.attempt_count,
-        available_at: row.available_at,
-        failed_at: row.updated_at,
-        error: row.error
-      )
+      dead.includes(:instance).order(updated_at: :desc, id: :desc).map do |row|
+        DeadRow.new(
+          id: row.public_send(identifier),
+          kind:,
+          actor_type: row.instance.actor_type,
+          actor_id: row.instance.actor_id,
+          status: row.status,
+          attempt_count: row.attempt_count,
+          available_at: row.available_at,
+          failed_at: row.updated_at,
+          error: row.error
+        )
+      end
     end
 
     # @rbs (String, ?authorization_context: untyped) -> untyped

lib/solid_objects/executor.rb

@@ -482,21 +482,17 @@ def remember_key(instance, message)
       instance.update!(completed_idempotency_keys: remembered_keys(instance, message))
     end
 
-    # @rbs (Instance, Message) -> Array[String]
+    # @rbs (Instance, Message) -> Array[Hash[String, untyped]]
     def remembered_keys(instance, message)
       remembered = Array(instance.completed_idempotency_keys)
       key = message.idempotency_key
       return remembered unless key
 
-      entry = { "key" => key, "operation" => message.operation }
+      entry = { "key" => key, "operation" => message.operation, "arguments" => message.arguments }
       return remembered if remembered.last == entry
 
-      bounded(remembered.reject { |value| value["key"] == key } + [ entry ])
-    end
-
-    # @rbs (Array[String]) -> Array[String]
-    def bounded(keys)
-      kept = keys.last(SolidObjects.configuration.retained_idempotency_keys)
+      kept = (remembered.reject { |value| value["key"] == key } + [ entry ])
+        .last(SolidObjects.configuration.retained_idempotency_keys)
       limit = SolidObjects.configuration.retained_idempotency_keys_bytes
       kept.shift while kept.any? && kept.to_json.bytesize > limit
       kept

sig/generated/lib/solid_objects/client.rbs

@@ -32,9 +32,6 @@ module SolidObjects
     # @rbs (reference: Reference, operation: Symbol | String, arguments: Hash[Symbol | String, untyped], idempotency_key: String?, timeout: Numeric) -> MessageReference
     def enqueue_sync: (reference: Reference, operation: Symbol | String, arguments: Hash[Symbol | String, untyped], idempotency_key: String?, timeout: Numeric) -> MessageReference
 
-    # @rbs (Reference, String, authorization_context: untyped) -> Message?
-    def remembered_message: (Reference, String, authorization_context: untyped) -> Message?
-
     # @rbs (Message?, authorization_context: untyped) -> MessageReference?
     def readable_message: (Message?, authorization_context: untyped) -> MessageReference?
 

sig/generated/lib/solid_objects/dead_letter_scope.rbs

@@ -25,9 +25,6 @@ module SolidObjects
     # @rbs (?authorization_context: untyped) -> Array[DeadRow]
     def all: (?authorization_context: untyped) -> Array[DeadRow]
 
-    # @rbs (untyped) -> DeadRow
-    def dead_row: (untyped) -> DeadRow
-
     # @rbs (String, ?authorization_context: untyped) -> untyped
     def retry: (String, ?authorization_context: untyped) -> untyped
 

sig/generated/lib/solid_objects/executor.rbs

@@ -97,11 +97,8 @@ module SolidObjects
     # @rbs (Instance, Message) -> void
     def remember_key: (Instance, Message) -> void
 
-    # @rbs (Instance, Message) -> Array[String]
-    def remembered_keys: (Instance, Message) -> Array[String]
-
-    # @rbs (Array[String]) -> Array[String]
-    def bounded: (Array[String]) -> Array[String]
+    # @rbs (Instance, Message) -> Array[Hash[String, untyped]]
+    def remembered_keys: (Instance, Message) -> Array[Hash[String, untyped]]
 
     # @rbs (Exception) -> Hash[String, untyped]
     def serialized_error: (Exception) -> Hash[String, untyped]

test/integration/result_lookup_test.rb

@@ -309,6 +309,33 @@ def reject_checkout
     assert_nil reference.find_by(idempotency_key: "checkout-7f3a")
   end
 
+  test "authorizes pruned keys with the original arguments" do
+    reference = CartActor.ref("alice")
+    reference.async(idempotency_key: "protected").checkout(order_id: 1)
+    run_actors
+    SolidObjects::Message.delete_all
+    seen = []
+    SolidObjects.configuration.authorize_message = lambda do |arguments:, **|
+      seen << arguments
+      arguments["order_id"] != 1
+    end
+
+    assert_nil reference.find_by(idempotency_key: "protected")
+    assert_equal [ { "order_id" => 1 } ], seen
+    SolidObjects.configuration.authorize_message = ->(arguments:, **) { arguments["order_id"] == 1 }
+    assert_raises(SolidObjects::MessagePruned) { reference.find_by(idempotency_key: "protected") }
+  end
+
+  test "does not disclose legacy keys without authorization arguments" do
+    reference = CartActor.ref("alice")
+    reference.async(idempotency_key: "legacy").checkout(order_id: 1)
+    run_actors
+    SolidObjects::Message.delete_all
+    SolidObjects::Instance.sole.update!(completed_idempotency_keys: [ { "key" => "legacy", "operation" => "checkout" } ])
+
+    assert_nil reference.find_by(idempotency_key: "legacy")
+  end
+
   test "remembers a key whose message was rejected" do
     reference = CartActor.ref("alice")
     reference.async(idempotency_key: "rejected-7f3a").reject_checkout
@@ -365,7 +392,7 @@ def reject_checkout
 
     remembered = SolidObjects::Instance.sole.completed_idempotency_keys
 
-    assert_equal keys.last(2), remembered.map { |entry| entry["key"] }
+    assert_equal keys.last(1), remembered.map { |entry| entry["key"] }
     assert_operator remembered.to_json.bytesize, :<=, 128
   end