[IAmJSD]

Summary

909626172446 is the AWS account ID of the CUDly host account, not a placeholder. It was still in two frontend jest files:

• frontend/src/__tests__/approval-details.test.ts: 7 occurrences, in the host-account argument to renderApprovalDetailsBody, the CUDly host (...) cell assertion and the formatAccountLabel assertion.
• frontend/src/__tests__/settings-accounts.test.ts: 2 occurrences, in the account fixture and the matching Service overrides for CUDly host (...) aria-label selector.

This PR replaces each one with 444444444444. That ID is in the .gitallowed placeholder set and neither file used it before, so the two-account fixtures still have distinct IDs (the other account is 123456789012). The PR only changes test data: no production code or selector logic changes.

Remaining occurrences (kept on purpose)

After this change, git grep 909626172446 finds the ID in just three files. All three are in the ci-cd-permissions Terraform state bucket name:

• terraform/environments/aws/ci-cd-permissions/main.tf
• terraform/environments/aws/ci-cd-permissions/backend.hcl.example
• terraform/environments/aws/ci-cd-permissions/README.md

Owner decision D20 (recorded on #43) keeps these. The ID is already public in git history, an account ID on its own isn't a credential, and a partial backend config would make the manual bootstrap harder for no real gain. #1292 already replaced the copy in the UX review doc. With this PR, every item in the issue is either fixed or kept by D20, so the PR closes it.

Closes #43

Verification

Unit/fixture evidence only. This PR changes only test data, so there is no behavior to show failing before the fix. The regression check is the grep, and a mutation probe confirms the swapped fixtures still discriminate.

# before (main @ 7b86e386): 9 frontend hits plus 4 Terraform hits
git grep -n 909626172446
# after: only the 4 lines in the 3 Terraform files kept by D20
git grep -n 909626172446
terraform/environments/aws/ci-cd-permissions/README.md:52:BUCKET="cudly-terraform-state-909626172446"
terraform/environments/aws/ci-cd-permissions/backend.hcl.example:13:bucket = "cudly-terraform-state-909626172446"
terraform/environments/aws/ci-cd-permissions/backend.hcl.example:23:#   aws s3api get-bucket-location --bucket cudly-terraform-state-909626172446 --output text
terraform/environments/aws/ci-cd-permissions/main.tf:15:    bucket       = "cudly-terraform-state-909626172446"

cd frontend && npm ci
npx jest src/__tests__/approval-details.test.ts src/__tests__/settings-accounts.test.ts
# Test Suites: 2 passed, 2 total / Tests: 121 passed, 121 total

npx eslint src/__tests__/approval-details.test.ts src/__tests__/settings-accounts.test.ts
# clean

Mutation probe: I changed only the settings-accounts fixture's external_id to 555555555555 and left the aria-label selector at 444444444444. switching accounts swaps the modal title then failed (1 failed), which shows the fixture and selector are still coupled after the swap. I reverted the probe before committing.

Combined-tree verification. This branch was tested together with the other queued branches on a local, never-pushed tree: queue/platform @ 400d256b = origin/main 7b86e386 plus these heads, merged in this order:

Branch	Tested head
fix/issue-243-rest	007c163
fix/issue-1206	312072f
fix/issue-111-email	6d422e2
fix/issue-111-fail-closed	3817e29
fix/issue-712-age-cap	a91120b
fix/issue-712-fargate	aeaf0d4
fix/issue-613-legacy-ids	350e837
fix/issue-120-guards	6f38ebc
fix/issue-120-shared-predicate	cb25735
fix/issue-151-account-update-keep	d20cf01
fix/issue-713-upcoming-filter	e73fdfb
fix/issue-263-bastion-opts	7861f32
fix/issue-43-fixture-ids	8cee203
fix/issue-177-makefile-walk	365a9d6
fix/issue-27-seller-not-registered	d845f66
fix/issue-313-user-columns	6d759dd
fix/issue-353-mock-panics	aac2edf
fix/issue-8-config-stamps	b548ae5
fix/issue-30-monthly-totals	f637921

Linux, Go 1.26.9, AWS_CONFIG_FILE=/dev/null AWS_SHARED_CREDENTIALS_FILE=/dev/null AWS_EC2_METADATA_DISABLED=true; Docker Postgres via testcontainers. The full suite ran on f7c48020, which differs from this tree only by test-only commits on fix/issue-30, fix/issue-713 and fix/issue-263 that replace placeholder account-number literals with named constants:

• Passed: go build ./..., go vet ./..., go vet -tags integration ./... and the full go test -race -short -count=1 ./....
• Static checks: golangci-lint v2.10.1 found 0 issues on every changed package, with and without --build-tags integration. gocyclo -over 10 is silent on the changed non-test files.
• Integration tests, every changed package that has them, one package at a time (-tags integration -count=1): internal/analytics, internal/api, internal/auth, internal/config, internal/database/postgres/migrations, internal/purchase, internal/scheduler and internal/server all pass. Migrations 000149, 000150 and 000151 apply in order on this tree.
• Frontend: the changed jest files (approval-details, settings-accounts, api) pass (221 tests).
• Secrets: the first run flagged 9 new fixture lines (placeholder account numbers next to an account key); fixed with named constants. Re-run on this tree: git-secrets, using the repo's scripts/setup-git-secrets.sh patterns in a fresh repo with an isolated HOME, found nothing in the changed files, and a planted fake key was flagged. scripts/test-git-secrets-allowlist.sh: 183 PASS, 0 FAIL.
• Terraform .tftest.hcl files were not run locally (CI runs them). Nothing was applied to any cloud.

Out of scope

• The Terraform state bucket name in the three ci-cd-permissions files, which D20 keeps.

Maintainer: please mirror the issue's triage labels onto this PR: effort/s, impact/internal, priority/p2, severity/medium, triaged, type/security, urgency/this-quarter.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: LeanerCloud/cloud-commitments-platform
• Branch: main
• File: .coderabbit.yaml
• Commit: 7b86e38
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3a270e10-5501-4a07-b1ff-3aa3a5968da1

Commits

Reviewing files that changed from the base of the PR and between 7b86e38 and 14ddde2.

Files ignored due to path filters: 1

• go.sum is excluded by !**/*.sum

Files selected for processing: 3

• frontend/src/__tests__/approval-details.test.ts
• frontend/src/__tests__/settings-accounts.test.ts
• go.mod

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE 8cee2036a0c457668446d260c85d7a1bb1def3d7

Blocking:

• none

Non-blocking:

• The issue suggested 210987654321; 444444444444 is just as good. It's in the .gitallowed placeholder set, it's distinct from the 123456789012 second account, and neither file used it before. The changed lines are not account_id: '...' lines, so that allowlist entry doesn't need to cover them, and the scanner doesn't flag them anyway (see below).
• During the jest run, jest printed "A worker process has failed to exit gracefully". This is a pre-existing teardown leak in these suites, not something this PR introduced.

Attacked:

• git grep -n 909626172446 on the head finds only the 4 Terraform state-bucket lines in terraform/environments/aws/ci-cd-permissions/ (main.tf, backend.hcl.example x2, README.md). These are exactly what D20 on Second non-placeholder AWS account ID 909626172446 (CUDly host) in tracked test fixtures and docs #43 keeps. The known_issues/23_ux_review_2026_04_22.md copy named in the issue is already gone (sec(docs): replace the CUDly host account ID in the UX review with a placeholder #1292). So every item in Second non-placeholder AWS account ID 909626172446 (CUDly host) in tracked test fixtures and docs #43 is either fixed or kept by an owner decision, and Closes #43 is right.
• Checked that each fixture and its assertion or aria-label selector were swapped together, so no test now passes vacuously. Ran npm ci && npx jest src/__tests__/approval-details.test.ts src/__tests__/settings-accounts.test.ts: 2 suites, 121 tests passed.
• Ran secrets-scan.sh on the 2 changed files: "clean; planted key flagged". scripts/test-git-secrets-allowlist.sh: 183 PASS, 0 FAIL.
• There's no fail-before to prove: the PR changes test data only, with no production code.

Body-stale: none

_{Reviewer: rG4. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE 14ddde2b00f02c31ef96c8d68d78a636ce4e11a1

Blocking:

• none

Non-blocking:

• Unchanged from my earlier review of 8cee2036 on this PR. See that comment for the full findings.

Attacked: The head moved from 8cee2036 to 14ddde2b after my earlier review. The only new commit is fix(deps): bump golang.org/x/net to v0.62.0. Its diff (go.mod/go.sum, 3+/3-) is byte-identical to #1564's and to the same commit on #1548, #1560 and #1556, and the PR's own changes are untouched. Re-checked on 14ddde2b: go mod verify (all modules verified) and go build ./....

Body-stale: the body doesn't mention the x/net bump (non-blocking).

_{Reviewer: rG4. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE 14ddde2b00f02c31ef96c8d68d78a636ce4e11a1

Blocking:

• none

Non-blocking:

• none

Attacked:

• git grep 909626172446 on the head now finds only the 4 lines in the 3 ci-cd-permissions Terraform files that owner decision D20 on Second non-placeholder AWS account ID 909626172446 (CUDly host) in tracked test fixtures and docs #43 keeps. The known_issues/23 doc copy is already gone on main (sec(docs): replace the CUDly host account ID in the UX review with a placeholder #1292). The replacement 444444444444 matches the placeholder alternation in .gitallowed:71, and neither file used it before, so the two-account fixture still has distinct IDs. Only test data changes. The other commit is the x/net bump, identical to fix(deps): bump golang.org/x/net to v0.62.0 (GO-2026-6860, GO-2026-6866) #1564.
• In the worktree's frontend/ after npm ci: npx jest on approval-details and settings-accounts gives 121/121 pass, and eslint on both files is clean. Mutation probe: changing only the settings-accounts fixture's external_id to 555555555555 fails 1 test (the aria-label selector), so fixture and selector are still coupled. Reverted afterwards.
• Secrets: secrets-scan.sh on the changed files printed "clean; planted key flagged", and scripts/test-git-secrets-allowlist.sh gave 183 PASS, 0 FAIL. No fail-before is applicable: this is a fixture-data change, not a behaviour fix.
• Closes #43 is right: the issue's three listed locations are fixed (two here, one by sec(docs): replace the CUDly host account ID in the UX review with a placeholder #1292), and D20 covers the Terraform copies, which the issue didn't list.

Body-stale:

• none

_{Reviewer: rH1. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

[IAmJSD]

Local verification at 14ddde2b00f02c31ef96c8d68d78a636ce4e11a1 merged onto main (b85e42a0), together with #1461, #1557, #1563 in that order (combined tree 4d91ad42, Linux, Go 1.26.10): go build ./..., go vet with and without -tags integration, the full go test -race -short -count=1 ./..., and go test -race -tags integration -count=1 on every changed package, against Docker Postgres. All pass. CI Success and pre-commit are green on this head, with 2 approving independent review(s) on it. Nothing was run against any cloud.

[IAmJSD]

Merged by IAmJSD's agent at IAmJSD's request (IAmJSD is acting owner while the maintainers are away), under the bar IAmJSD set: 2 approving independent review(s) on 14ddde2b (two required: money, auth or security path), green CI, and the combined-tree verification above. Squash-merged at exactly 14ddde2b00f02c31ef96c8d68d78a636ce4e11a1.