Skip to content

Pre-existing dead query keys on Update-PfbArrayConnection and Update-PfbAsyncLog (unfiltered-PATCH risk on the former) #64

Description

Summary

Found during #31's live-testing sweep and whole-branch wire-key audit. Neither cmdlet was
touched by #31 — these are pre-existing conditions, not introduced by that work. Splitting this
out of the general #31 follow-up scope issue because of the unintended-blast-radius risk below.

Update-PfbArrayConnection — higher risk, recommend prompt attention

Sends a names query parameter, but PATCH /array-connections documents only ids,
remote_ids, remote_names (plus context_names from spec 2.17 onward) — never a plain
names, in any cached spec version. -Name is Mandatory in the cmdlet's default parameter set
(ByNameIndividual), so the most natural invocation of this cmdlet may silently issue an
unfiltered PATCH affecting every array connection rather than the one intended.

This was live-tested only via -Id (which uses a working ids key) during the #31 session —
the -Name path was never live-verified.

Recommend:

  • Live-verify what -Name actually does against a real array before relying on it further.
  • Consider whether -Name should be removed, replaced with a working filter, or guarded with an
    explicit warning, given the silent-no-op / unintended-scope risk.

Update-PfbAsyncLog — lower risk

Sends names/ids query parameters, but PATCH /logs-async documents no query parameters at
all in any of the 29 cached spec versions (2.4–2.28). These parameters cannot ever have worked —
worth removing or reworking, but there's no evidence of an unintended-blast-radius risk like the
Update-PfbArrayConnection case.

Priority

Update-PfbArrayConnection warrants prompt attention given the risk of an unfiltered write
affecting resources beyond the one the caller intended. Update-PfbAsyncLog is lower-urgency
cleanup and can ride along with this issue rather than needing its own.

References

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions