Conversation
- Add migration 008: core_genesis.instance_id and genesis_challenge table (one-shot, 5m TTL). - Add modulr_core.genesis challenge builder/verify and GenesisChallengeService; GenesisChallengeRepository. - CoreGenesisRepository: touch, get_or_create_instance_id; validate modulr_apex_domain with dotted DNS-style rules (same as register_org), max 253 chars. - Tests for challenge issue/verify/replay/expiry and apex validation. Made-with: Cursor
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d72b93b92b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| signature_hex=signature_hex, | ||
| expected_subject_pubkey_hex=row.subject_signing_pubkey_hex, | ||
| ) | ||
| self._challenges.mark_consumed(challenge_id, consumed_at=now) |
There was a problem hiding this comment.
When two verification requests for the same challenge_id run concurrently, both can read consumed_at IS NULL, but only one UPDATE ... WHERE consumed_at IS NULL succeeds; the loser triggers RuntimeError("challenge not found or already consumed") from mark_consumed. Because verify_and_consume does not catch that exception, this race surfaces as an internal error instead of the expected domain-level rejection (challenge already consumed), which will produce flaky 500s under retries or duplicate submissions.
Useful? React with 👍 / 👎.
1 participant
Add migration 008: core_genesis.instance_id and genesis_challenge table (one-shot, 5m TTL).
Add modulr_core.genesis challenge builder/verify and GenesisChallengeService; GenesisChallengeRepository.
CoreGenesisRepository: touch, get_or_create_instance_id; validate modulr_apex_domain with dotted DNS-style rules (same as register_org), max 253 chars.
Tests for challenge issue/verify/replay/expiry and apex validation.