admin-valentin/ceo-api
1
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

fix(decisions): wrap mutations in db.transaction() for audit atomicity

Browse source
This commit is contained in:
admin-valentin 2026-07-31 10:48:37 +00:00
parent 880c2a7018
commit 3b1b14e380
1 changed files with 41 additions and 37 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

78
src/decisions/decisions.service.ts
View file

@ -26,49 +26,53 @@ export class DecisionsService {
}
async create(session: AuthenticatedSession, dto: CreateDecisionDto) {
const [row] = await db
.insert(decisions)
.values({
return db.transaction(async (tx) => {
const [row] = await tx
.insert(decisions)
.values({
tenantId: session.tenantId,
ownerUserId: session.userId,
context: dto.context,
options: (dto.options ?? []) as unknown[],
assumptions: (dto.assumptions ?? []) as unknown[],
evidence: (dto.evidence ?? []) as unknown[],
reviewDueAt: dto.reviewDueAt ? new Date(dto.reviewDueAt) : undefined,
})
.returning();
await this.audit.record(tx, {
tenantId: session.tenantId,
ownerUserId: session.userId,
context: dto.context,
options: (dto.options ?? []) as unknown[],
assumptions: (dto.assumptions ?? []) as unknown[],
evidence: (dto.evidence ?? []) as unknown[],
reviewDueAt: dto.reviewDueAt ? new Date(dto.reviewDueAt) : undefined,
})
.returning();
await this.audit.record(null, {
tenantId: session.tenantId,
actorId: session.userId,
action: 'decision.created',
resource: `decision:${row.id}`,
actorId: session.userId,
action: 'decision.created',
resource: `decision:${row.id}`,
});
return row;
});
return row;
}
async update(session: AuthenticatedSession, id: string, dto: UpdateDecisionDto) {
await this.getById(session, id);
const [row] = await db
.update(decisions)
.set({
...(dto.context !== undefined ? { context: dto.context } : {}),
...(dto.options !== undefined ? { options: dto.options as unknown[] } : {}),
...(dto.assumptions !== undefined ? { assumptions: dto.assumptions as unknown[] } : {}),
...(dto.evidence !== undefined ? { evidence: dto.evidence as unknown[] } : {}),
...(dto.selectedOption !== undefined ? { selectedOption: dto.selectedOption } : {}),
...(dto.outcomeReview !== undefined ? { outcomeReview: dto.outcomeReview } : {}),
...(dto.reviewDueAt !== undefined ? { reviewDueAt: new Date(dto.reviewDueAt) } : {}),
updatedAt: new Date(),
})
.where(and(eq(decisions.id, id), eq(decisions.tenantId, session.tenantId)))
.returning();
await this.audit.record(null, {
tenantId: session.tenantId,
actorId: session.userId,
action: dto.selectedOption !== undefined ? 'decision.option_selected' : 'decision.updated',
resource: `decision:${id}`,
return db.transaction(async (tx) => {
const [row] = await tx
.update(decisions)
.set({
...(dto.context !== undefined ? { context: dto.context } : {}),
...(dto.options !== undefined ? { options: dto.options as unknown[] } : {}),
...(dto.assumptions !== undefined ? { assumptions: dto.assumptions as unknown[] } : {}),
...(dto.evidence !== undefined ? { evidence: dto.evidence as unknown[] } : {}),
...(dto.selectedOption !== undefined ? { selectedOption: dto.selectedOption } : {}),
...(dto.outcomeReview !== undefined ? { outcomeReview: dto.outcomeReview } : {}),
...(dto.reviewDueAt !== undefined ? { reviewDueAt: new Date(dto.reviewDueAt) } : {}),
updatedAt: new Date(),
})
.where(and(eq(decisions.id, id), eq(decisions.tenantId, session.tenantId)))
.returning();
await this.audit.record(tx, {
tenantId: session.tenantId,
actorId: session.userId,
action: dto.selectedOption !== undefined ? 'decision.option_selected' : 'decision.updated',
resource: `decision:${id}`,
});
return row;
});
return row;
}
}