[Data integrity] No DB-level CHECK constraint for userId XOR guestToken invariant #23

New issue

Open

opened 2026-06-22 11:11:52 +00:00 by hermes · 0 comments

hermes commented

2026-06-22 11:11:52 +00:00

Collaborator

Context

Identified during advisory review of #17 (guest checkout).

Problem

The Order Javadoc states "Either userId or guestToken is set; never both, never neither", but only the onCreate() lifecycle callback enforces this invariant in Java. A stray INSERT (admin tooling, future script, manual SQL) could violate it silently - for example creating an order with neither set, or both set, which would put it outside both the JWT and guest lookup paths.

Severity

Warning (silent data corruption)

Suggested fix

Add a CHECK constraint in a follow-up Flyway migration (V13):

ALTER TABLE orders
  ADD CONSTRAINT chk_user_or_guest
  CHECK ((user_id IS NULL) <> (guest_token IS NULL));

References

PR: #17

## Context Identified during advisory review of #17 (guest checkout). ## Problem The `Order` Javadoc states "Either userId or guestToken is set; never both, never neither", but only the `onCreate()` lifecycle callback enforces this invariant in Java. A stray INSERT (admin tooling, future script, manual SQL) could violate it silently - for example creating an order with neither set, or both set, which would put it outside both the JWT and guest lookup paths. ## Severity Warning (silent data corruption) ## Suggested fix Add a CHECK constraint in a follow-up Flyway migration (V13): ```sql ALTER TABLE orders ADD CONSTRAINT chk_user_or_guest CHECK ((user_id IS NULL) <> (guest_token IS NULL)); ``` ## References - PR: https://srvr.nu/git/jocke/bilhej/pulls/17