Molecule AI Dev Engineer B (MiniMax) 74bba182a5 fix(approvals#66): requester-initiated withdraw endpoint ...

Closes the long-standing gap where an agent had no way to retract an
approval it had raised but no longer needed. Issue #66 — the PM
re-dispatched this as INDEPENDENT of the RFC #2843 gate, and approved
the plan with the following guardrails (7600d2ed):

1. ADDITIVE + REVERSIBLE MIGRATION. The up migration widens
   approval_requests.status CHECK from {pending, approved, denied,
   escalated} to also include 'withdrawn'. The down migration deletes
   any 'withdrawn' rows AND narrows the CHECK back. Rollback-safe even
   if the endpoint has been exercised in the deploy window.

2. AUTHZ AGAINST CREATOR-WORKSPACE-ID, NOT PATH :id. The handler reads
   approval_requests.workspace_id (the row's creator) and compares it
   to the URL path's :id. The path :id is the GATE's workspace for
   cross-workspace approval gates (#2574, #2593) — using it as the
   authz anchor would reject legitimate creators when the gate and
   creator are different workspaces.

3. PENDING-ONLY STATE GUARD. The UPDATE has WHERE status='pending',
   and a 0-rows-affected result returns 409 Conflict (not 404) so the
   caller can distinguish 'row vanished' from 'row exists but already
   moved'. This is the same shape requests.Cancel uses for the
   analogous race.

4. DOCSTRING POINTER. The ListAll comment (which was reverted in
   bcabd207 because it inaccurately claimed a withdraw path existed)
   now points at the real endpoint instead.

NEW ENDPOINT: POST /workspaces/:id/approvals/:approvalId/withdraw
  - workspace-token auth (matches the existing approvals surface)
  - body: empty
  - 200 on success (status='withdrawn', decided_by='requester')
  - 403 if the caller's workspace != the row's creator workspace
  - 404 if the approval doesn't exist (or UUID is malformed)
  - 409 if the approval is no longer 'pending'
  - 500 on DB error
  - broadcasts APPROVAL_WITHDRAWN on the row's creator workspace_id
    (matches Decide's broadcast convention)

NEW FILES:
- migrations/20260614010000_approval_withdrawn_status.up.sql — widen CHECK
- migrations/20260614010000_approval_withdrawn_status.down.sql — narrow + purge

MODIFIED:
- internal/handlers/approvals.go — new Withdraw method + ListAll comment
- internal/handlers/approvals_test.go — 5 new tests:
  - TestApprovals_Withdraw_Success (happy path)
  - TestApprovals_Withdraw_NotPendingReturns409 (state guard)
  - TestApprovals_Withdraw_NotFound (404)
  - TestApprovals_Withdraw_CrossWorkspaceAuthzReject (the load-bearing
    cross-workspace authz test — verifies the authz check short-
    circuits before UPDATE; uses sqlmock.ExpectationsWereMet to
    confirm no UPDATE was issued)
  - TestApprovals_Withdraw_CrossWorkspaceGateOK (the #2574 / #2593
    scenario where the row's creator workspace matches the path's :id
    and withdraw proceeds normally)
- internal/router/router.go — wire the route (wsAuth)
- docs/api-reference.md, docs/api-protocol/platform-api.md — table entries

LOCAL VALIDATION:
- go test ./internal/handlers/  -> clean (26.4s, all 5 new + all existing)
- go test ./internal/provisioner/ -> clean (0.08s, no regressions from earlier)
- go vet ./...                 -> clean
- go build ./...               -> clean

Refs #66. PM-approved plan: 7600d2ed.

2026-06-14 12:43:50 +00:00

..

a2a-protocol.md

tech-debt: rename molecule-monorepo-net -> molecule-core-net

2026-05-09 20:51:48 +00:00

communication-rules.md

initial commit — Molecule AI platform

2026-04-13 11:55:37 -07:00

memory-plugin-v1.yaml

Memory v2 fixup C1: backfill idempotency via MemoryWrite.id

2026-05-04 08:54:13 -07:00

platform-api.md

fix(approvals#66): requester-initiated withdraw endpoint

2026-06-14 12:43:50 +00:00

registry-and-heartbeat.md

chore: open-source restructure — rename dirs, remove internal files, scrub secrets

2026-04-18 00:24:44 -07:00

websocket-events.md

initial commit — Molecule AI platform

2026-04-13 11:55:37 -07:00