Parent bounty: #743
Mirrors #6463 because the original report is not owned by this account.
Summary
The createJob service spreads the client payload after the server-generated id and status fields, allowing the client to override them. This permits callers to set arbitrary id values and bypass the initial open status.
Expected behavior
Server-generated fields (id, status) should not be overridable by the client payload.
Scope
Fix apps/api/src/services/jobService.js by placing ...payload before id and status so server-generated values take priority. Add a focused service test confirming client-supplied id and status are ignored while normal payload fields are preserved.
This issue is limited only to the creator of this issue. This means that only the issue author can attempt to solve this issue. If you would like to work on it, please create another issue with the same contents and refer to issue #743 for more information.
Parent bounty: #743
Mirrors #6463 because the original report is not owned by this account.
Summary
The
createJobservice spreads the client payload after the server-generatedidandstatusfields, allowing the client to override them. This permits callers to set arbitraryidvalues and bypass the initialopenstatus.Expected behavior
Server-generated fields (
id,status) should not be overridable by the client payload.Scope
Fix
apps/api/src/services/jobService.jsby placing...payloadbeforeidandstatusso server-generated values take priority. Add a focused service test confirming client-suppliedidandstatusare ignored while normal payload fields are preserved.This issue is limited only to the creator of this issue. This means that only the issue author can attempt to solve this issue. If you would like to work on it, please create another issue with the same contents and refer to issue #743 for more information.