Two critical issues from the post-phase code review:
- PATCH /api/route53/zones/[zoneId]/records/[recordId] never verified the
request body's name/type/setIdentifier matched the record identified by
the URL. A mismatch would silently UPSERT a brand-new AWS recordset
(leaving the original live and untouched) while corrupting the mirror's
record_key invariant. Now rejects with 400 if any of those three fields
differ from the existing record — renaming/retyping is delete-plus-create,
not an update.
- route53-sync-service.ts's syncZones()/syncRecords() tombstone queries used
"id <> ALL(seenIds)" style queries with no empty-array guard — a
successful-but-empty AWS response would soft-delete every previously
synced zone/record in one shot. Same bug class already fixed in
pax8-sync-service.ts; now guarded the same way here.
Two smaller fixes:
- checkRoute53()'s AWS auth probe had no timeout, unlike every other
integration's liveCheck() (8s AbortController). Added the same bound via
the SDK's abortSignal option.
- buildRecordKey() relied on every caller to pre-normalize name/type case
before calling it. Now normalizes internally (lowercase name, uppercase
type) so the record_key invariant holds regardless of caller discipline.
Full REVIEW.md findings in 24-REVIEW.md. Two remaining Warnings (alias
records un-editable/undeletable, no admin-UI surface for route53_audit_log)
deliberately left as backlog items for a follow-up phase — out of scope for
a post-execution fix pass.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
lorentz
e057255f4f