From 60c749c715a16c1f076e9fb7078a13fb9abbd1ae Mon Sep 17 00:00:00 2001
From: "gpt-engineer-app[bot]"
 <159125892+gpt-engineer-app[bot]@users.noreply.github.com>
Date: Tue, 11 Nov 2025 02:43:51 +0000
Subject: [PATCH] Update idempotency key handling in edge functions

Read idempotency key from headers in process-selective-approval and process-selective-rejection, remove it from request bodies, add header validation, and redeploy edge functions to fix idempotency flow.
---
 .../process-selective-approval/index.ts        | 18 ++++++++++++++++--
 .../process-selective-rejection/index.ts       | 18 ++++++++++++++++--
 2 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/supabase/functions/process-selective-approval/index.ts b/supabase/functions/process-selective-approval/index.ts
index c00366fc..31555aae 100644
--- a/supabase/functions/process-selective-approval/index.ts
+++ b/supabase/functions/process-selective-approval/index.ts
@@ -45,7 +45,6 @@ console.log('Edge function initialized successfully', {
 interface ApprovalRequest {
   submissionId: string;
   itemIds: string[];
-  idempotencyKey: string;
 }
 
 // Main handler function
@@ -144,7 +143,22 @@ const handler = async (req: Request) => {
     // STEP 2: Parse request
     addSpanEvent(rootSpan, 'validation_start');
     const body: ApprovalRequest = await req.json();
-    const { submissionId, itemIds, idempotencyKey } = body;
+    const { submissionId, itemIds } = body;
+    const idempotencyKey = req.headers.get('x-idempotency-key');
+
+    if (!idempotencyKey) {
+      addSpanEvent(rootSpan, 'validation_failed', { reason: 'missing_idempotency_key' });
+      edgeLogger.warn('Missing idempotency key', { requestId });
+      endSpan(rootSpan, 'error');
+      logSpan(rootSpan);
+      return new Response(
+        JSON.stringify({ error: 'Missing X-Idempotency-Key header' }),
+        { 
+          status: 400, 
+          headers: { ...corsHeaders, 'Content-Type': 'application/json' } 
+        }
+      );
+    }
 
     if (!submissionId || !itemIds || itemIds.length === 0) {
       addSpanEvent(rootSpan, 'validation_failed', {
diff --git a/supabase/functions/process-selective-rejection/index.ts b/supabase/functions/process-selective-rejection/index.ts
index 46906279..f03cb73f 100644
--- a/supabase/functions/process-selective-rejection/index.ts
+++ b/supabase/functions/process-selective-rejection/index.ts
@@ -22,7 +22,6 @@ interface RejectionRequest {
   submissionId: string;
   itemIds: string[];
   rejectionReason: string;
-  idempotencyKey: string;
 }
 
 // Main handler function
@@ -107,7 +106,22 @@ const handler = async (req: Request) => {
     // STEP 2: Parse request
     addSpanEvent(rootSpan, 'validation_start');
     const body: RejectionRequest = await req.json();
-    const { submissionId, itemIds, rejectionReason, idempotencyKey } = body;
+    const { submissionId, itemIds, rejectionReason } = body;
+    const idempotencyKey = req.headers.get('x-idempotency-key');
+
+    if (!idempotencyKey) {
+      addSpanEvent(rootSpan, 'validation_failed', { reason: 'missing_idempotency_key' });
+      edgeLogger.warn('Missing idempotency key', { requestId });
+      endSpan(rootSpan, 'error');
+      logSpan(rootSpan);
+      return new Response(
+        JSON.stringify({ error: 'Missing X-Idempotency-Key header' }),
+        { 
+          status: 400, 
+          headers: { ...corsHeaders, 'Content-Type': 'application/json' } 
+        }
+      );
+    }
 
     if (!submissionId || !itemIds || itemIds.length === 0 || !rejectionReason) {
       addSpanEvent(rootSpan, 'validation_failed', {