From f90324c5a62e3ead0bc67c9880fb1023b49db137 Mon Sep 17 00:00:00 2001 From: jay Date: Mon, 8 Jun 2026 13:52:19 -0400 Subject: [PATCH] Feedback admin: check rowcount before commit (tidy 404 path) Per Codex note: raise the 404 before commit so a no-match read/delete commits nothing. get_conn only closes (no auto-commit), so this is clean. Co-Authored-By: Claude Opus 4.8 (1M context) --- goodnews/api.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/goodnews/api.py b/goodnews/api.py index 4bf8d30..c40ebc6 100644 --- a/goodnews/api.py +++ b/goodnews/api.py @@ -798,9 +798,9 @@ def create_app() -> FastAPI: _require_admin(conn, request) ts = "CURRENT_TIMESTAMP" if body.read else "NULL" cur = conn.execute(f"UPDATE feedback SET read_at = {ts} WHERE id = ?", (fid,)) - conn.commit() if cur.rowcount == 0: raise HTTPException(status_code=404, detail="feedback not found") + conn.commit() return {"ok": True, "read": body.read} @app.delete("/api/admin/feedback/{fid}") @@ -808,9 +808,9 @@ def create_app() -> FastAPI: with get_conn() as conn: _require_admin(conn, request) cur = conn.execute("DELETE FROM feedback WHERE id = ?", (fid,)) - conn.commit() if cur.rowcount == 0: raise HTTPException(status_code=404, detail="feedback not found") + conn.commit() return {"ok": True} @app.get("/api/admin/stats")