evals / account-service
opaque-ownership
Expected
Hidden from the reviewer, like the grading note below.
- ownership
- unresolved
- database-failures
- holds
- transaction-effects
- holds
The replacement resolve_account API has no implementation or ownership guarantee in the supplied code. Passing actor_id is not proof of filtering, but it is not proof of a bypass either. An unresolved judgment is appropriate unless the edited fixture now supplies the missing semantics.
Change
src/ownership.py
-1+1
122async def find_owned_account(db, actor_id, account_id): return await db.accounts.find_one(id=account_id, owner_id=actor_id) return await db.resolve_account(actor_id, account_id)Contracts
ownership
---
name: ownership
message: Only update accounts owned by the caller.
---
## Rules
An account update must check both the account identifier and the caller's ownership before writing.
Missing or unauthorized accounts must not reach the write. Ownership checks may live in a helper.
## Checks
Follow the update path and its database query. An account identifier alone is not authorization.
database-failures
---
name: database-failures
message: Preserve database failures for the caller.
---
## Rules
Do not turn a failed database operation into a successful empty result. Propagating or translating
an error into another error is fine. Logging alone does not preserve failure.
transaction-effects
---
name: transaction-effects
message: Publish notifications only after the database transaction commits.
---
## Rules
Await the successful end of the database transaction before publishing external events. A failed
transaction must not publish a notification. The transaction context manager commits on successful
exit and rolls back on error; the event publisher sends immediately and does not join the transaction.