fix: validate canvas edge output channels on API writes#4362
Merged
Conversation
Signed-off-by: Pedro F. Leao <pedroforestileao@gmail.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit a9c31e9. Configure here.
forestileao
force-pushed
the
fix/validate-output-channels
branch
from
1c3aab6 to
8cb46e6
Compare
Signed-off-by: Pedro F. Leao <pedroforestileao@gmail.com>
Collaborator
Author
|
👍 |
forestileao
commented
Apr 24, 2026
forestileao
commented
Apr 24, 2026
|
👋 Commands for maintainers:
|
WashingtonKK
pushed a commit
to WashingtonKK/superplane
that referenced
this pull request
Apr 27, 2026
…#4362) Closes: superplanehq#4318 ## Summary Reject canvas edges that reference an output channel the source node does not expose. This prevents silent workflow stalls caused by invalid channel names in CLI/API canvas definitions, and returns a `400 InvalidArgument` instead. ## Changes - Add shared canvas output-channel validation for source nodes - Validate edge channels during full canvas parsing on create/update - Validate edge channels during canvas changeset application - Support validation for: - components - triggers (`default`) - blueprints - Add a transaction-safe blueprint lookup helper for validation paths - Add tests covering invalid channel rejection in: - canvas create - canvas version update - canvas patcher changesets ## Behavior Before: - Invalid edge channels could be persisted - Downstream nodes would silently never execute After: - The API rejects invalid edge channels with `400` - Error message includes the source node and requested channel ## Testing - Ran `make format.go` - Ran `make lint` - Ran `make check.build.app` - Ran `go test -run '^$' ./pkg/grpc/actions/canvases/... ./pkg/models/...` Note: DB-backed tests in this environment could not run because the test database connection was not configured (`lookup port=: no such host`). --------- Signed-off-by: Pedro F. Leao <pedroforestileao@gmail.com> Signed-off-by: WashingtonKK <washingtonkigan@gmail.com>
re-pixel
pushed a commit
to re-pixel/superplane
that referenced
this pull request
May 4, 2026
…#4362) Closes: superplanehq#4318 ## Summary Reject canvas edges that reference an output channel the source node does not expose. This prevents silent workflow stalls caused by invalid channel names in CLI/API canvas definitions, and returns a `400 InvalidArgument` instead. ## Changes - Add shared canvas output-channel validation for source nodes - Validate edge channels during full canvas parsing on create/update - Validate edge channels during canvas changeset application - Support validation for: - components - triggers (`default`) - blueprints - Add a transaction-safe blueprint lookup helper for validation paths - Add tests covering invalid channel rejection in: - canvas create - canvas version update - canvas patcher changesets ## Behavior Before: - Invalid edge channels could be persisted - Downstream nodes would silently never execute After: - The API rejects invalid edge channels with `400` - Error message includes the source node and requested channel ## Testing - Ran `make format.go` - Ran `make lint` - Ran `make check.build.app` - Ran `go test -run '^$' ./pkg/grpc/actions/canvases/... ./pkg/models/...` Note: DB-backed tests in this environment could not run because the test database connection was not configured (`lookup port=: no such host`). --------- Signed-off-by: Pedro F. Leao <pedroforestileao@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes: #4318
Summary
Reject canvas edges that reference an output channel the source node does not expose.
This prevents silent workflow stalls caused by invalid channel names in CLI/API canvas definitions, and returns a
400 InvalidArgumentinstead.Changes
default)Behavior
Before:
After:
400Testing
make format.gomake lintmake check.build.appgo test -run '^$' ./pkg/grpc/actions/canvases/... ./pkg/models/...Note: DB-backed tests in this environment could not run because the test database connection was not configured (
lookup port=: no such host).