Solution architect, 16 years in software, last 3 on AI automation. I write about making automated work verifiable: evaluation harnesses, audit trails, and results published even when the answer is no.
The service-side recheck can still be bypassed by a cached serialized history response. If the endpoint is cacheable, the cache key has to include tenant plus entitlement version, or revocation must purge it; otherwise the request never reaches _require_copilot_read. A negative test that warms the cache before revocation and replays after would cover the read path the mocked database test cannot see.
Right, and the mocked test can't see it by construction.
Where it stands: the history routes don't set an explicit Cache-Control, so "nothing caches this" is an assumption about whatever sits in front of the service, not a property of the service. That's the same argument I made against trusting the gateway, so I don't get to wave it away here. Cache-Control: no-store on the history routes is the cheap fix that makes the guarantee local, and your warm-then-revoke-then-replay test is the one that proves it end to end.
It got sharper since the post, too: the gateway in front is gone and the service has its own public edge, so the in-service check is now the only check
For further actions, you may consider blocking this person and/or reporting abuse
We're a place where coders share, stay up-to-date and grow their careers.
The service-side recheck can still be bypassed by a cached serialized history response. If the endpoint is cacheable, the cache key has to include tenant plus entitlement version, or revocation must purge it; otherwise the request never reaches
_require_copilot_read. A negative test that warms the cache before revocation and replays after would cover the read path the mocked database test cannot see.Right, and the mocked test can't see it by construction.
Where it stands: the history routes don't set an explicit Cache-Control, so "nothing caches this" is an assumption about whatever sits in front of the service, not a property of the service. That's the same argument I made against trusting the gateway, so I don't get to wave it away here.
Cache-Control: no-storeon the history routes is the cheap fix that makes the guarantee local, and your warm-then-revoke-then-replay test is the one that proves it end to end.It got sharper since the post, too: the gateway in front is gone and the service has its own public edge, so the in-service check is now the only check