mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-10 13:22:14 +00:00
Marc-André Bombeck
de088febe6
The route used the enforceBudget + recordSpend read-then-write pair and passed no cap, so every call measured against the operator ceiling — a self-hoster on their own key was rationed by the operator's bill while paying for their own usage. It also left the TOCTOU window the rest of the codebase closed: concurrent calls could each read a sub-cap total and all proceed. Move the gate after the chain resolves and reserve atomically against resolveDailyCap(chain), matching runStatusCompletion and the document paths. Reconcile on every exit: the provider's reported count on a completed call, a full refund when nothing was generated.