From e2eea55b6eee2d6d08dddf1940c99a20d25492fe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Fri, 7 Aug 2026 10:25:52 +0200 Subject: [PATCH] chore: drop two exports nothing reaches The dead-code gate has been red on this branch since the sharing refusal contracts landed. Neither name is new and neither was noticed, because knip is not in the local gate. consentRequiredResponse lost its last caller when every delegable route started sharing one 403 description through recordRefusal(); the AI consent sentence it wrapped is still used and stays, with a note at the constant saying why there is no response object beside it any more. mutateThenRestore was written with the sharing security fixtures and has never been called. No ignore entries: an export with no consumer is the thing the gate is for. --- src/lib/openapi/routes/shared.ts | 13 ++++++------- tests/fixtures/v137/security-principals.ts | 16 ---------------- 2 files changed, 6 insertions(+), 23 deletions(-) diff --git a/src/lib/openapi/routes/shared.ts b/src/lib/openapi/routes/shared.ts index c88764d41..3c5530c43 100644 --- a/src/lib/openapi/routes/shared.ts +++ b/src/lib/openapi/routes/shared.ts @@ -244,16 +244,15 @@ export function recordRefusal(...alsoRefusesFor: string[]): RefusalResponse { // grant-consent notice and call POST /api/consent/ai (or, on web, POST // /api/consent/ai/web) to mint the receipt. BYOK / local / ChatGPT-OAuth // chains are the user's own egress and never trip this gate. +// +// There is no `consentRequiredResponse` beside this description any more, and +// the absence is deliberate. Every route that could answer it is also a route +// the sharing fence can refuse, and OpenAPI allows one response per status, so +// the two 403s share a single description built by `recordRefusal(...)`. A +// second exported 403 body would be a second way to write the same operation. export const AI_CONSENT_REQUIRED_DESCRIPTION = "AI consent required: no active ConsentReceipt for the server-managed provider. `meta.errorCode` = `consent.ai.required`. Mint a receipt via POST /api/consent/ai before retrying."; -export const consentRequiredResponse = { - "403": { - description: AI_CONSENT_REQUIRED_DESCRIPTION, - content: { "application/json": { schema: errorEnvelope } }, - }, -}; - // ── Module-disabled gate (v1.18.0) ─────────────────────────────────── // Every module-scoped route runs `requireModuleEnabled(userId, key)`, // which returns a 403 when the account has the module turned off — even diff --git a/tests/fixtures/v137/security-principals.ts b/tests/fixtures/v137/security-principals.ts index 121b722f1..400b2355c 100644 --- a/tests/fixtures/v137/security-principals.ts +++ b/tests/fixtures/v137/security-principals.ts @@ -60,19 +60,3 @@ export const SECURITY_PRINCIPALS = { job: { id: "job-owner-idempotency", origin: "owner-request" }, }, } as const satisfies Record; - -export async function mutateThenRestore( - mutate: () => Promise, - restore: (result: T) => Promise, -): Promise { - let result: T | undefined; - let completed = false; - - try { - result = await mutate(); - completed = true; - return result; - } finally { - if (completed) await restore(result as T); - } -}