Solo dev discovers rollback API silently ignored user-specified deployment version
A developer building Staxa, a solo multi-tenant deployment platform, found that the POST rollback endpoint accepted a deployment ID in the URL but never actually read it. Instead of rolling back to the requested version, the system always restored the most recent successful deployment, regardless of what the user specified. The bug returned a 202 Accepted response and logged a successful rollback every time, leaving no visible errors to alert users or developers. The issue was discovered during a manual audit of API documentation against actual handler code, revealing the handler never called chi.URLParam to extract the deployment ID. The fix, merged via pull request, also exposed a second underlying schema bug where the is_current flag was scoped to the entire tenant rather than to individual services.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Discussion (0)
Log in to join the discussion and vote.
Log in