Skip to content

fix(security): prevent unapproved project updates from inflating banked RE - #196

Merged
0xQuerencia merged 10 commits into
mainfrom
fix/lock-previously-approved-re-during-updates
Nov 9, 2026
Merged

0xQuerencia merged 10 commits into
mainfrom
fix/lock-previously-approved-re-during-updates

Conversation

@0xQuerencia

Copy link
Copy Markdown
Collaborator

Problem

An approved project retains prior_approved_hours as banked Restoration Energy while a new update goes through review. The project edit route prevented changing level and sidequest_id only at status approved, but status needs_changes (including during approved update cycles) permitted both. lifetimeRe() weights banked old hours using those mutable fields, allowing a previously approved 20h Tier 1 project's old 250 RE to appear as 500 RE after a Tier 4 edit without approval, increasing the rate on unrelated future ships.

Review dashboard tier-setting paths were also able to regrade previously approved work during updates.

Changes

  • Centralize mustPreserveApprovedProjectTerms(status, isUpdate) in each independently built app.
  • Lock tier and Trial link when editing either an approved project or an is_update project in any review state; first-time projects can still choose tier while fixing requested changes.
  • Guard both reviewer regrade paths (verdict form and standalone tier control), including same-state checks on their writes.
  • Use precise status/is_update compare-and-set in the player's edit route so a stale edit cannot cross into a newly approved state.
  • Add tests for update review states, original hours retention, and new-submission behavior in both apps.

Intentional limitation

PIXL currently stores only a single tier and Trial link per project, including historical approved hours. Until there is a versioned per-approval model, an update must not be regraded at any stage; otherwise the prior approval's RE changes. Reviewers should use the original tier for update submissions.

Validation

Regression unit tests added to both earnedProject.test.ts files; CI pending. No production database changes. This is a preventative patch, not a claim that Eraxty's separately reported issue has an identical cause.

Copilot AI balanced review requested due to automatic review settings November 9, 2026 19:10

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

@0xQuerencia
0xQuerencia merged commit 1fc5d20 into main Nov 9, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants