MemberJunction / MemberJunction/MJ

BizApps actions report SUCCESS without doing the work (Twitter delete guard dead code; Instagram schedule no-op)

Open
#3,790 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TSQL
Stars
29
Forks
6
Avg merge
2d 1h
Merged PRs (30d)
323

Description

## Summary

Several BizApps provider actions report `ResultCode = 'SUCCESS'` without actually performing the operation — either because a guard is dead code or because the action is an unimplemented stub that fabricates a success payload. Surfaced during the review of #3542 and pinned in the new provider tests (they assert the current behavior so a fix flips them), not fixed there.

## Confirmed cases

**Twitter — delete-tweet ownership guard is dead code.** The ownership check is swallowed by the detail-retrieval `catch`, so a non-owned tweet is deleted anyway.
`packages/Actions/BizApps/Social/src/__tests__/twitter.provider.test.ts:371` — *"deletes a non-owned tweet anyway — the ownership guard is dead code (swallowed by the detail-retrieval catch)"*.

**Instagram — schedule-post is a no-op that returns SUCCESS.** It persists nothing and calls no API, yet returns `SUCCESS` with a fabricated `schedulingId`.
`packages/Actions/BizApps/Social/src/__tests__/instagram.provider.test.ts:385-399` — asserts `ResultCode === 'SUCCESS'`, `http.instance.request` never called, and a truthy `schedulingId`.

More broadly, the review noted several BizApps "integrations" that no-op with `SUCCESS`; these two are the confirmed, test-pinned examples and are likely representative.

## Impact

- The Twitter guard gives false assurance that a delete is authorized; ownership is not actually enforced.
- A caller (or agent) that schedules an Instagram post is told it succeeded while nothing was scheduled — silent data loss of the scheduled post.
- Any downstream logic keying off `SUCCESS` treats a no-op as a completed operation.

## Suggested fix

- Twitter delete: move the ownership check out of the `try` that the retrieval `catch` swallows, or re-raise so a non-owned delete fails with a clear error.
- Instagram schedule (and similar stubs): either implement the operation, or return a non-`SUCCESS` result code (e.g. a "not implemented" / "not supported" outcome) so callers don't treat it as done.
- Audit the other BizApps actions for the same `SUCCESS`-without-effect pattern and give unimplemented ones an honest result code.

## References
- PR #3542 (review finding #4)

Contributor guide

Open the contributing guide

Research direction

Start with the pinned cases in packages/Actions/BizApps/Social/src/__tests__/twitter.provider.test.ts:371 and packages/Actions/BizApps/Social/src/__tests__/instagram.provider.test.ts:385-399, then locate the corresponding provider actions. Confirm the ownership failure and fabricated scheduling success behavior before checking other BizApps actions for the same pattern. Done means affected actions either perform their work or return a non-SUCCESS result, with tests covering the corrected outcomes.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.