Rotorsoft / act-root / 36575290227

100%

push

github

fix(act): gate the events drain returns to the caller (#1683)

* fix(act): gate the events drain returns to the caller

Drain.fetched carried raw store rows — including the isolated pii
sidecar — straight back to the caller of app.drain(). On a default-deny
state, query_array returned [REDACTED] while drain returned the plaintext
email; on PG with pii_encryption the adapter had just decrypted it.
Fetch.events and Message.pii are both public typed properties, so no cast
is needed to reach it.

The handler path was never affected: build_events wraps every reaction
handler with a reader that REMOVES sensitive keys. The gate REDACTS them
instead, so gating at fetch would hand handlers "[REDACTED]" strings where
they currently see the key absent. The gate therefore belongs at the
return boundary, and a test pins both views of the same event.

Closes #1673

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* refactor(act): trim the drain gate comment

Two lines for the non-obvious part (actor-less, handlers unaffected)
instead of four restating what the code shows.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: rotorsoft <rotorsoft@outlook.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

4355 of 4355 branches covered (100.0%)

Branch coverage included in aggregate %.

3 of 3 new or added lines in 1 file covered. (100.0%)

9421 of 9421 relevant lines covered (100.0%)

1199.15 hits per line