zeekay 4bf07ef07f client: spell out org-scoping requirements for Threshold.Cancel ...

Cancel was documented as "cancels a pending session belonging to the
caller's org" but the contract did not name HOW the implementation
enforces that. A loose implementation could:

  - read session, transition state, then check org_id (TOCTOU window)
  - distinguish "not yours" from "not found" in the error message
    (enumeration oracle leaks the existence of cross-org sessions)
  - skip the org predicate when a concurrent legitimate caller also
    has the row open (race condition lets the wrong-org call win)

Tightened doc names the three required behaviors:
  - orgID derived from ctx Claims, not caller-supplied
  - SELECT-FOR-UPDATE + WHERE org_id = ctx.OrgID; mismatch returns
    ErrSessionNotFound (same opaque response as unknown id)
  - row-level CAS with the org predicate in WHERE, so two callers
    cannot race the state transition
  - idempotency on already-cancelled scoped to the SAME org

go.work bumped to 1.26.3 to satisfy the per-module go directive.

2026-05-13 02:47:05 -07:00

..

threshold.go

client: spell out org-scoping requirements for Threshold.Cancel

2026-05-13 02:47:05 -07:00