fix: fail close account-deletion Cloud Tasks dispatch#9768
Merged
Conversation
Persist opaque wipe jobs before dispatch, require production Cloud Tasks configuration, and reconcile undispatched intents.\n\nVerification: serialized backend/test.sh (603 files), backend pre-deploy checks (69 tests), make preflight, and PR preflight.
Git-on-my-level
force-pushed
the
codex/account-deletion-fail-closed
branch
from
July 14, 2026 23:14
26ba460 to
644730e
Compare
Close the OIDC audience mirror hole so new-audience tasks cannot resolve legacy uid payloads, and cover pre-job-id reconcile backfill hermetically. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #9760.
Root cause and recurrence
The deletion workflow previously relied on inline execution as a reachable deployment mode and accepted a payload that could identify a user directly. A crash or configuration drift between the delete request and its side effects could therefore leave a deletion incomplete without a durable, safely replayable dispatch contract.
This follows the same dispatch/reliability failure class addressed in #5088, #6750, #7640, #8405, #9117, and #9632. The durable guard is now the persisted wipe-job identity plus production-only Cloud Tasks configuration validation, queue payload minimization, dedicated OIDC audience verification, and reconciliation through the same dispatcher.
Verification
cd backend && ENCRYPTION_SECRET=local-test-secret BACKEND_PYTEST_WORKERS=1 bash test.sh— passed all 603 isolated unit-test files.cd backend && PATH="/tmp/omi-predeploy-9760/bin:$PATH" bash scripts/pre-deploy-check.sh— passed (69 tests); validates dev/prod runtime and deploy contracts.make preflight— passed.test_persisted_wipe_recovers_after_enqueue_crash_and_handler_runs_once.No live Cloud Task was dispatched because this PR does not authorize a deployment mutation.
Review
Sol review completed before opening. It identified an OIDC audience-isolation issue; the fix uses
ACCOUNT_DELETION_TASKS_OIDC_AUDIENCE(defaulting only to the dedicated deletion handler URL) for both task creation and verification. A second independent Sol review after rebasing identified the deploy-order compatibility path for queued legacy UID tasks; the resolved branch accepts the former sync audience only for those legacy payloads and drops job-ID payloads before resolution or mutation.