fix: correct message id generation and base64 payload decoding - #697

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

Walkthrough

Generated IDs for REST annotations and messages now use URL-safe Base64. Base64 decoding now handles decoding and encoding errors without propagating them, and a test checks that encoded message data remains unchanged.

Changes

Idempotent Publishing IDs

Base64 Decoding Errors

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: ttypic

Merge Risk: ⚪ Minimal · up to e47e8

The change uses URL-safe Base64 for generated IDs and preserves payloads when decoding raises. No concrete current-head failure is established; external-service acceptance of the URL-safe alphabet remains unverified, so normal integration checks are appropriate.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to e47e8

Keeping an undecodable message available to consumers is intentional, but that message can also become the decoding base for later messages. This could disrupt delivery on channels using delta decoding; no broader access or privilege change was established.

Retained concerns

• Medium · security · inferred: A malformed Base64 message is delivered as opaque data but can also advance the realtime delta base and message ID. A following delta can therefore be processed against undecoded data rather than a successfully decoded predecessor.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{A rabbit checks the encoded stream,
URL-safe IDs hop into view.
If decoding stumbles on the way,
The data keeps its place in queue.
Soft paws review each change anew.}

_{Comment @coderabbitai help to get the list of available commands.}