Uc subem var thMenu dashboard da sadece birinin siparisleri gozukuyor — poll-check multi-restaurant (PR #603 BBB F2)

Diyarbakir Sur 47-yas Lezzet Diyari Diyarbakir Sofrasi 18-yil 4 subeli Guneydogu Anadolu sahibi Mahmut. Subeler Sur 80-cover ana + Mardin Eski Cad 45 + Sanliurfa Karakopru 60 + Gaziantep Sahinbey 55. thMenu Platinum 19 ay siparis takibi + masa seansi + bill request aktif. Sabah 09:00 tablet 4 sube gece sonuc review. Sali sabah olagandisi Sur subesi gece bildirimleri gozukuyordu ama Mardin + Sanliurfa + Gaziantep Veri yok. Mahmut WhatsApp Mardin mudur Hasan 47 siparis gece masa 6+8+9 dolu. Kendi tablet Mardin dashboard 403 Forbidden. Sanliurfa + Gaziantep ayni 403. Sadece Sur 200 OK. Teori subdomain konfigurasyon izin matrix bozuk Support yazdi multi-restaurant operator 4 sube dashboard birini gosteriyor poll-check 403. Engineering account restaurant sorgu SELECT owner_id=mahmut 4 sube hepsi aktif owner Mahmut. 3 yanlis teori (1) JWT multi-restaurant claim eksik decode sub+role yok restaurant_id frontend query param ?restaurant_id=... worker parse ownership dogrula; (2) Worker rate-limit 4 sube 4× ratelimit IP basina bucket dolu degil; (3) custom domain config karisikligi lezzet-sur.com + lezzet-mardin.com + lezzet-urfa.com + lezzet-gaziantep.com CNAME dogru. Adli analiz cloudflare/src/handlers/poll-check.ts satir 56 hata SELECT id FROM restaurants WHERE owner_id=? AND is_active=1 LIMIT 1. Pattern kullanicinin sahip oldugu HER restoran bul SADECE ilkini al ownership dogrulandi say sonra query string ?restaurant_id=... karsilastir. if (ownerRow?.id !== queryRestaurantId) return 403. LIMIT 1 ORDER BY yok en eski created_at Sur subesi dondu. Mardin/Sanliurfa/Gaziantep query param diger id eslesme yok 403. Coklu-restoran operator sistematik yanlis sadece bir restoran authoritative ownership matrix ihmal. Single-restaurant senaryosu icin yazildi multi-restaurant Platinum tier shipped poll-check sweep yapilmadi. PR #603 batch BBB F2 minimal fix existence check SELECT 1 FROM restaurants WHERE id=? AND owner_id=? AND is_active=1. if (!ownsRestaurant) return 403. Performance SELECT 1 composite index O(1) lookup single-restaurant ayni hizda multi-restaurant tum subeler ayni. Bonus is_active=1 filter korundu soft-delete defense-in-depth. Production audit 90-gun poll-check 403 multi-restaurant 12 operator 38 sube 89247 poll 403. 4 operator support ticket dusuk oncelikli reproducer net degil Mahmut raporu pattern kristalize. Mahmut email + 1-ay Platinum credit Twitter Diyarbakir-Gaziantep 4 sube tek dashboard 6 saat fix shipped 1.8k engagement. 12 etkilenmis operator proactive email PR #603 BBB F2 multi-restaurant poll-check fix 1-ay Platinum credit. Ewan Manchester The Northern Pie Co. Deansgate + Salford Quays + Stockport 3-subeli British pie 12-yil paralel ticket. Pattern multi-tenant ownership dogrulamasinda kullanicinin ilk sahip oldugu kayit sec + karsilastir anti-pattern dogru existence check kullanici istedigi kayitin gercekten sahibi mi. LIMIT 1 single-tenant silent multi-tenant feature shipped tum authority handler sweep. Sibling sweep /api/restaurant-stats + /api/billing/current + /api/staff-list + /api/menu-stats + /api/feedback-list cleanup PR. Implementation existence check WHERE id=? AND owner_id=? + is_active filter + composite index + per-request restaurant_id query param + test multi-tenant 3+ + production audit 403 ratio + sibling-handler sweep grep LIMIT 1 + owner_id. PR #603 referans.

İlgili makaleler