fix: 5 security/reliability bugs from Codex audit round 4

P2:
- Export endpoint requires admin auth (was leaking YAML to tenants)
- Version history listing no longer auto-creates production version
- Idempotency key UNIQUE constraint now composite with tenant_id
- Sync run wraps execute in try/except (prevents RUNNING stuck state)

P3:
- useSSE resets events array on path change (no more mixed run data)

Author: Tomas Pflanzer

dashboard/src/hooks/useSSE.ts

@@ -24,6 +24,10 @@ export function useSSE(path: string | null) {
   useEffect(() => {
     if (!path) return;
 
+    // Reset events when path changes so old events from a previous
+    // run/stream don't mix with new ones.
+    setEvents([]);
+
     const controller = new AbortController();
     abortRef.current = controller;
 

src/sandcastle/api/routes.py

@@ -2295,6 +2295,7 @@ async def export_workflow(name: str, request: Request) -> ApiResponse:
 
     Removes environment variable references and sensitive data.
     """
+    _require_admin(request)
     async with async_session() as session:
         result = await session.execute(
             select(WorkflowVersion)
@@ -4420,14 +4421,28 @@ async def run_workflow_sync(request: WorkflowRunRequest, req: Request) -> ApiRes
             ).model_dump(),
         )
 
-    result = await execute_workflow(
-        workflow=workflow,
-        plan=plan,
-        input_data=request.input,
-        run_id=run_id,
-        storage=storage,
-        max_cost_usd=budget,
-    )
+    try:
+        result = await execute_workflow(
+            workflow=workflow,
+            plan=plan,
+            input_data=request.input,
+            run_id=run_id,
+            storage=storage,
+            max_cost_usd=budget,
+        )
+    except Exception as exc:
+        # Mark the run as FAILED so it doesn't stay stuck in RUNNING.
+        try:
+            async with async_session() as session:
+                db_run = await session.get(Run, uuid.UUID(run_id))
+                if db_run:
+                    db_run.status = RunStatus.FAILED
+                    db_run.error = f"Engine error: {exc}"
+                    db_run.completed_at = datetime.now(timezone.utc)
+                    await session.commit()
+        except Exception:
+            logger.error("Failed to mark run %s as FAILED after engine error", run_id, exc_info=True)
+        raise
 
     # Map result status to RunStatus
     status_map = {
@@ -8445,23 +8460,17 @@ async def list_workflow_versions(
         versions = result.scalars().all()
 
     if not versions and total == 0:
-        # Try auto-import from disk
-        try:
-            yaml_content = _load_workflow_yaml(name)
-            await _auto_import_workflow(name, yaml_content)
-            # Re-query
-            async with async_session() as session:
-                total = 1
-                stmt = select(WorkflowVersion).where(WorkflowVersion.workflow_name == name)
-                result = await session.execute(stmt)
-                versions = result.scalars().all()
-        except FileNotFoundError:
-            raise HTTPException(
-                status_code=404,
-                detail=ApiResponse(
-                    error=ErrorResponse(code="NOT_FOUND", message=f"Workflow '{name}' not found")
-                ).model_dump(),
-            )
+        # Return empty list instead of auto-importing (read-only endpoint
+        # should not create production versions as a side effect).
+        return ApiResponse(
+            data={
+                "versions": [],
+                "total": 0,
+                "production_version": None,
+                "staging_version": None,
+                "draft_version": None,
+            }
+        )
 
     prod_ver = None
     staging_ver = None

src/sandcastle/models/db.py

@@ -80,6 +80,7 @@ class Run(Base):
         Index("ix_runs_api_key_id", "api_key_id"),
         CheckConstraint("total_cost_usd >= 0", name="ck_runs_total_cost_non_negative"),
         CheckConstraint("depth >= 0", name="ck_runs_depth_non_negative"),
+        UniqueConstraint("tenant_id", "idempotency_key", name="uq_tenant_idempotency_key"),
     )
 
     id: Mapped[uuid.UUID] = mapped_column(
@@ -97,7 +98,7 @@ class Run(Base):
     error: Mapped[str | None] = mapped_column(Text, nullable=True)
     callback_url: Mapped[str | None] = mapped_column(String(2048), nullable=True)
     tenant_id: Mapped[str | None] = mapped_column(String(255), nullable=True)
-    idempotency_key: Mapped[str | None] = mapped_column(String(255), nullable=True, unique=True)
+    idempotency_key: Mapped[str | None] = mapped_column(String(255), nullable=True)
     max_cost_usd: Mapped[float | None] = mapped_column(Float, nullable=True)
     parent_run_id: Mapped[uuid.UUID | None] = mapped_column(
         Uuid, ForeignKey("runs.id", ondelete="SET NULL"), nullable=True

tests/test_api_full_coverage.py

@@ -1377,7 +1377,11 @@ class TestWorkflowVersions:
 
     def test_list_versions_nonexistent_workflow(self):
         response = client.get("/api/workflows/nonexistent-wf/versions")
-        assert response.status_code == 404
+        # Returns 200 with empty list (read-only endpoint, no auto-import)
+        assert response.status_code == 200
+        data = response.json()["data"]
+        assert data["versions"] == []
+        assert data["total"] == 0
 
     def test_get_version_nonexistent(self):
         response = client.get("/api/workflows/nonexistent-wf/versions/1")

tests/test_concurrency_wave9.py

@@ -234,14 +234,19 @@ async def add_cost(amount: float):
 
     @pytest.mark.asyncio
     async def test_idempotency_key_concurrent_inserts(self):
-        """Two concurrent inserts with same idempotency_key - one must fail."""
+        """Two concurrent inserts with same tenant + idempotency_key - one must fail.
+
+        The unique constraint is composite (tenant_id, idempotency_key) so the
+        same key can coexist across different tenants but not within one.
+        """
         from sqlalchemy.exc import IntegrityError
 
         from sandcastle.models.db import Run, RunStatus
 
         eng, sf = await _setup_test_db()
         try:
             idem_key = "unique-request-123"
+            tenant = "tenant-idem-test"
             results = []
 
             async def insert_with_idem(idx: int):
@@ -253,6 +258,7 @@ async def insert_with_idem(idx: int):
                             status=RunStatus.QUEUED,
                             input_data={},
                             idempotency_key=idem_key,
+                            tenant_id=tenant,
                         )
                         session.add(run)
                         await session.commit()