Missing or another owner's conversation → 404 conversation not found
Revisions (surfaceId set) keep previous behavior
Without this check a direct API caller could create a project-less surface and skip the project lifecycle gate on actions.
Why: an empty conversationId produced surfaces with no project ownership.
Evidence: agent-exec unit backend-surface-submit-conversation-required (pi, authorized rerun, terminal=success); go test ./internal/server/ ./internal/surfacesvc/ OK.
Impact: HTTP create-surface validation only.
Refs: Dev task fix/svc-superadmin-envfile-surface-conv.
Require a caller's own conversationId when creating a surface via POST /api/surfaces.
- Empty conversationId → 400 `conversationId required`
- Missing or another owner's conversation → 404 `conversation not found`
- Revisions (surfaceId set) keep previous behavior
Without this check a direct API caller could create a project-less surface and skip the project lifecycle gate on actions.
Why: an empty conversationId produced surfaces with no project ownership.
Evidence: agent-exec unit `backend-surface-submit-conversation-required` (pi, authorized rerun, terminal=success); `go test ./internal/server/ ./internal/surfacesvc/` OK.
Impact: HTTP create-surface validation only.
Refs: Dev task `fix/svc-superadmin-envfile-surface-conv`.
POST /api/surfaces with an empty surfaceId now requires a conversationId
that belongs to the caller: empty returns 400, missing or another owner's
conversation returns 404. Revisions keep the previous behavior. Without
this check a direct API caller could create a project-less surface and
skip the project lifecycle gate on actions.
Why: an empty conversationId produced surfaces with no project ownership.
Evidence: agent-exec unit backend-surface-submit-conversation-required (pi, attempt 1 after authorized rerun, terminal=success); go test ./internal/server/... ./internal/surfacesvc/... .
Impact: HTTP create-surface validation only.
Refs: Dev task fix/svc-superadmin-envfile-surface-conv.
Co-authored-by: Cursor <cursoragent@cursor.com>
weichen
merged commit 528e3a4c1f into main2026-10-21 15:05:04 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Require a caller's own conversationId when creating a surface via POST /api/surfaces.
conversationId requiredconversation not foundWithout this check a direct API caller could create a project-less surface and skip the project lifecycle gate on actions.
Why: an empty conversationId produced surfaces with no project ownership.
Evidence: agent-exec unit
backend-surface-submit-conversation-required(pi, authorized rerun, terminal=success);go test ./internal/server/ ./internal/surfacesvc/OK.Impact: HTTP create-surface validation only.
Refs: Dev task
fix/svc-superadmin-envfile-surface-conv.