Keep feedback attribution tied to the editor

src/admin.ts

@@ -1,6 +1,5 @@
 import { readBatches } from "./read-batches.js";
 import { readPages } from "./read-pages.js";
-import { createHash } from "node:crypto";
 import type { Express, Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { env } from "./config.js";
@@ -72,56 +71,6 @@ async function loadRelatedCounts(table: "players" | "sessions" | "actions", key:
 }
 
 export function registerAdminRoutes(app: Express) {
-  // Temporary one-time repair endpoint. Remove after the production attribution repair.
-  const feedbackAuthorId = "474bbc30-5535-4c06-8010-6d59d01949c0";
-  async function feedbackAuthorSnapshot() {
-    const notes = await readPages(async (from, to) => {
-      const { data, error } = await supabaseAdmin.from("annotations_notes").select("action_id")
-        .order("action_id").order("note").range(from, to);
-      if (error) throw new Error(`Unable to list feedback notes: ${error.message}`);
-      return data ?? [];
-    });
-    const ids = [...new Set(notes.map((note) => note.action_id))];
-    const rows: { action_id: string; user_id: string | null }[] = [];
-    for (let index = 0; index < ids.length; index += 100) {
-      const { data, error } = await supabaseAdmin.from("annotations").select("action_id,user_id")
-        .in("action_id", ids.slice(index, index + 100));
-      if (error) throw new Error(`Unable to list feedback authors: ${error.message}`);
-      rows.push(...(data ?? []));
-    }
-    if (rows.length !== ids.length) throw new Error("Feedback author snapshot is incomplete.");
-    rows.sort((a, b) => a.action_id.localeCompare(b.action_id));
-    const fingerprint = createHash("sha256").update(JSON.stringify(rows)).digest("hex");
-    return { rows, noteCount: notes.length, fingerprint };
-  }
-  app.get("/api/admin/repair-feedback-authors", asyncRoute(async (req, res) => {
-    if (!await admin(req, res)) return;
-    const { data: author, error } = await supabaseAdmin.from("users").select("fname,lname")
-      .eq("user_id", feedbackAuthorId).maybeSingle();
-    if (error || author?.fname !== "Ahmed" || author?.lname !== "Gad") throw new Error("Target feedback author could not be verified.");
-    const snapshot = await feedbackAuthorSnapshot();
-    return res.json({ ...snapshot, targetUserId: feedbackAuthorId });
-  }));
-  app.post("/api/admin/repair-feedback-authors", asyncRoute(async (req, res) => {
-    if (!await admin(req, res)) return;
-    const input = z.object({ fingerprint: z.string().regex(/^[a-f0-9]{64}$/) }).strict().safeParse(req.body);
-    if (!input.success) return fail(res, 400, "A current feedback snapshot is required.");
-    const { data: author, error } = await supabaseAdmin.from("users").select("fname,lname")
-      .eq("user_id", feedbackAuthorId).maybeSingle();
-    if (error || author?.fname !== "Ahmed" || author?.lname !== "Gad") throw new Error("Target feedback author could not be verified.");
-    const snapshot = await feedbackAuthorSnapshot();
-    if (snapshot.fingerprint !== input.data.fingerprint) return fail(res, 409, "Feedback authors changed. Refresh the snapshot.");
-    const ids = snapshot.rows.filter((row) => row.user_id !== feedbackAuthorId).map((row) => row.action_id);
-    for (let index = 0; index < ids.length; index += 100) {
-      const { error: updateError } = await supabaseAdmin.from("annotations")
-        .update({ user_id: feedbackAuthorId }).in("action_id", ids.slice(index, index + 100));
-      if (updateError) throw new Error(`Unable to update feedback authors: ${updateError.message}`);
-    }
-    const verified = await feedbackAuthorSnapshot();
-    if (verified.rows.some((row) => row.user_id !== feedbackAuthorId)) throw new Error("Feedback author verification failed.");
-    return res.json({ updatedAnnotations: ids.length, totalAnnotations: verified.rows.length,
-      noteCount: verified.noteCount, targetUserId: feedbackAuthorId, fingerprint: verified.fingerprint });
-  }));
   app.get("/api/admin/users", asyncRoute(async (req, res) => {
     if (!await admin(req, res)) return;
     const search = String(req.query.search ?? "").replace(/[^\p{L}\p{N}@._ -]/gu, "").trim().slice(0, 100);

tests/admin-review-author.test.ts

@@ -0,0 +1,80 @@
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { once } from "node:events";
+import { createServer } from "node:http";
+import type { AddressInfo } from "node:net";
+import { test } from "node:test";
+
+test("admin action edits attribute changed feedback to the editor", { timeout: 30_000 }, async () => {
+  const adminId = "11111111-1111-4111-8111-111111111111";
+  const ownerId = "22222222-2222-4222-8222-222222222222";
+  const sessionId = "33333333-3333-4333-8333-333333333333";
+  const actionId = "44444444-4444-4444-8444-444444444444";
+  const user = { id: adminId, email: "admin@example.com", email_confirmed_at: new Date().toISOString(), user_metadata: {} };
+  const savedReviews: Array<Record<string, unknown>> = [];
+  let oldNotes = ["Original feedback"];
+  const upstream = createServer(async (req, res) => {
+    const url = new URL(req.url!, "http://stub");
+    res.setHeader("Content-Type", "application/json");
+    if (url.pathname === "/auth/v1/user") return res.end(JSON.stringify(user));
+    if (url.pathname === "/rest/v1/users") return res.end(JSON.stringify({ user_id: adminId, account_role: "admin" }));
+    if (url.pathname === "/rest/v1/sessions") return res.end(JSON.stringify({ status: "completed" }));
+    if (url.pathname === "/rest/v1/annotations" && req.method === "GET") {
+      return res.end(JSON.stringify({ user_id: ownerId, score: 5, annotations_notes: oldNotes.map((note) => ({ note })) }));
+    }
+    if (url.pathname === "/rest/v1/rpc/save_action_review") {
+      const chunks: Buffer[] = [];
+      for await (const chunk of req) chunks.push(Buffer.from(chunk));
+      const body = JSON.parse(Buffer.concat(chunks).toString()) as Record<string, unknown>;
+      savedReviews.push(body);
+      oldNotes = body.p_notes as string[];
+      return res.end("null");
+    }
+    if (url.pathname === `/api/sessions/${sessionId}/actions/${actionId}` && req.method === "PATCH") return res.end("{}");
+    res.statusCode = 404;
+    return res.end(JSON.stringify({ error: "Unexpected mock request", path: url.pathname }));
+  });
+  upstream.listen(0, "127.0.0.1");
+  await once(upstream, "listening");
+  const portProbe = createServer();
+  portProbe.listen(0, "127.0.0.1");
+  await once(portProbe, "listening");
+  const port = (portProbe.address() as AddressInfo).port;
+  await new Promise<void>((resolve) => portProbe.close(() => resolve()));
+  const origin = `http://127.0.0.1:${port}`;
+  const upstreamOrigin = `http://127.0.0.1:${(upstream.address() as AddressInfo).port}`;
+  const child = spawn(process.execPath, ["--import", "tsx", "src/server.ts"], {
+    env: { ...process.env, NODE_ENV: "test", PORT: String(port), FRONTEND_URL: origin, BACKEND_URL: origin,
+      ANALYSIS_API_URL: upstreamOrigin, SUPABASE_URL: upstreamOrigin,
+      SUPABASE_ANON_KEY: "test-anon", SUPABASE_SERVICE_ROLE_KEY: "test-service", ANALYSIS_PROXY_SECRET: "x".repeat(32) },
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  try {
+    await new Promise<void>((resolve, reject) => {
+      child.stdout.on("data", (data) => { if (String(data).includes("API listening")) resolve(); });
+      child.once("exit", (code) => reject(new Error(`API exited: ${code}`)));
+      child.once("error", reject);
+    });
+    const save = (notes: string[]) => fetch(`${origin}/api/admin/sessions/${sessionId}/actions/${actionId}`, {
+      method: "PATCH", signal: AbortSignal.timeout(10000),
+      headers: { Cookie: "sp_access=access", Origin: origin, "Content-Type": "application/json" },
+      body: JSON.stringify({ startFrame: 0, endFrame: 10, type: "Shoot", score: 5, notes }),
+    });
+    assert.equal((await save(["Original feedback"])).status, 200);
+    assert.equal(savedReviews.length, 0, "an action-only edit must preserve the previous feedback author");
+    assert.equal((await save(["Updated feedback"])).status, 200);
+    assert.equal(savedReviews.length, 1);
+    assert.equal(savedReviews[0].p_user_id, adminId);
+    assert.deepEqual(savedReviews[0].p_notes, ["Updated feedback"]);
+    assert.equal(savedReviews[0].p_session_id, sessionId);
+    assert.equal(savedReviews[0].p_action_id, actionId);
+  } finally {
+    if (child.exitCode === null && child.signalCode === null) {
+      const exited = once(child, "exit");
+      child.kill();
+      await exited;
+    }
+    upstream.closeAllConnections();
+    await new Promise<void>((resolve) => upstream.close(() => resolve()));
+  }
+});