# 0027 — Api — Module Triage

**Milestone:** M3
**Owner:** TBD
**Status:** planning

## Goal

Consolidates 35 legacy issues from the
`MetaDrivenPlatform4AI` repo that share the same module / area label,
so they can be triaged together by the corresponding domain IC.

Module label scope: `module/api`.

## Acceptance criteria

- [ ] All `ported` children below have a Story or Bug filed in pingcap-pack
- [ ] All filed Stories / Bugs have a linked test (existing or to-write task with scaffold)
- [ ] Engineering review confirms which children are still applicable under the new project's design

## Stories / Bugs (filed as GitHub issues)

35 children classified `ported`. Phase 3/4 will file each as
a Story (capability) or Bug (defect) in this repo and back-reference the
legacy issue. Initial child list:

- [ ] #TBD — legacy MetaDrivenPlatform4AI#1229 — P2: Wrap Recall mutations in RunInTransaction for atomicity
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1230 — P2: Fix indentation in approval_handler.go case Approve block
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1242 — Validate RecordTypeId on record creation endpoint
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1243 — Add cache invalidation for ObjectInfo record type data
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1258 — Add aggregate function allowlist for ORDER BY clause (defense-in-depth)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1259 — Extract shared ORDER BY function-call parser to reduce duplication
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1261 — Parameterize table name constant in discover_tables.go SQL query
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1264 — Subquery SELECT does not parse function call syntax
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1265 — Extend function allowlist validation to WHERE clause expressions
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1267 — Add max-depth guard for nested parentheses in SOQL function parsing
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1268 — Inconsistent error types in SOQL subquery parser vs main parser
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1269 — Parameterize ORDER BY column/direction in query builder to prevent SQL injection
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1270 — Add DISTANCE and GEOLOCATION to SOQL function allowlist
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1271 — Surface DB errors from GetRecordTypes instead of returning empty slice
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1272 — Hoist validatePolymorphicLookups outside BulkInsert loop to fix N+1 queries
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1273 — parseFunctionCall does not validate nested function names against allowlist
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1274 — Add depth guard to parseCallExpression in WHERE clause function parsing
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1278 — TestRecordRepository_Integration fails: Unknown column 'IsCustomized'
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1281 — Contract tests fail: Unknown column 'CreatedDate' in Notification table
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1282 — Add GetAllAutoNumbers stub to test mocks for MetadataRepository
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1285 — Add UNIQUE(DefinitionId; VersionNumber) constraint to prevent duplicate flow versions
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1286 — Add GetMaxVersionNumber repo method to avoid full-row fetch for version auto-increment
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1293 — Non-deterministic SQL column ordering in query builder ON DUPLICATE KEY UPDATE
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1294 — Replace LOWER() wrapping with case-insensitive collation on ObjectApiName columns
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1301 — DescribeObject demotes Master default before filtering inactive record types
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1314 — escapeSoqlValue() does not escape SOQL LIKE wildcard characters (% and _)
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1317 — Case-insensitive table name lookup missing in reconcileDiscoveredTableColumns
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1320 — Add chunking for Composite API 25-subrequest limit in permission updates
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1321 — Missing encodeURIComponent on record Id in Composite API URL path
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1324 — Fix boolean type switch in schema_validator.go to handle int/int64 inputs
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1326 — coerceForFormulaEval mutates caller's record map in-place
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1327 — regexp.MatchString recompiles regex on every call in validation_service.go
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1329 — Add server-side enum validation for ProcessNode RejectBehavior field
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1332 — Fix ProcessNode delete block: silent skip on query error and unchecked type assertion in metadata_deploy_handler.go
- [ ] #TBD — legacy MetaDrivenPlatform4AI#1341 — searchSingleObject missing try/catch — inconsistent error contract with sibling methods

## Non-goals

- Re-port legacy fixes that are no longer relevant under the new project's
  pure-platform design — engineering identifies these case-by-case
- Layer-belonging classification (L0 / L1 / L2) — engineering's job

## History

- 2026-05-03 — created during Phase 2 from clustered orphan issues.

## Stories (filed in Phase 3)

_Pending Phase 3 synthesis._