From 571851faf5d6d18ee10bd4f364c19601d299fc7d Mon Sep 17 00:00:00 2001
From: Dotta <bippadotta@protonmail.com>
Date: Sat, 1 Aug 2026 22:56:08 +0000
Subject: [PATCH] fix: make break-glass evidence atomic

Write the owner-visible system notice and issue.break_glass_read audit entry in one transaction so an emergency read cannot persist only half of its evidence.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 server/src/routes/issues.ts | 61 +++++++++++++++++++------------------
 1 file changed, 32 insertions(+), 29 deletions(-)

diff --git a/server/src/routes/issues.ts b/server/src/routes/issues.ts
index 2b4b824b7c0..478e6e2ef83 100644
--- a/server/src/routes/issues.ts
+++ b/server/src/routes/issues.ts
@@ -3507,37 +3507,40 @@ export function issueRoutes(
   ) {
     const actor = getActorInfo(req);
     const occurredAt = new Date().toISOString();
-    await svc.addComment(
-      issue.id,
-      `A company administrator used audited break-glass access to read this private task at ${occurredAt}.`,
-      {},
-      {
-        authorType: "system",
-        presentation: {
-          kind: "system_notice",
-          tone: "warning",
-          title: "Break-glass access used",
-          detailsDefaultOpen: false,
-          density: "compact",
+    await db.transaction(async (tx) => {
+      const txDb = tx as unknown as Db;
+      await issueService(txDb).addComment(
+        issue.id,
+        `A company administrator used audited break-glass access to read this private task at ${occurredAt}.`,
+        {},
+        {
+          authorType: "system",
+          presentation: {
+            kind: "system_notice",
+            tone: "warning",
+            title: "Break-glass access used",
+            detailsDefaultOpen: false,
+            density: "compact",
+          },
         },
-      },
-    );
-    await logActivity(db, {
-      companyId: issue.companyId,
-      actorType: "user",
-      actorId: actor.actorId,
-      agentId: null,
-      runId: actor.runId,
-      agentApiKeyId: actor.agentApiKeyId,
-      action: "issue.break_glass_read",
-      entityType: "issue",
-      entityId: issue.id,
-      issueId: issue.id,
-      details: {
+      );
+      await logActivity(txDb, {
+        companyId: issue.companyId,
+        actorType: "user",
+        actorId: actor.actorId,
+        agentId: null,
+        runId: actor.runId,
+        agentApiKeyId: actor.agentApiKeyId,
+        action: "issue.break_glass_read",
+        entityType: "issue",
+        entityId: issue.id,
         issueId: issue.id,
-        occurredAt,
-        acknowledgement: "breakGlass=true",
-      },
+        details: {
+          issueId: issue.id,
+          occurredAt,
+          acknowledgement: "breakGlass=true",
+        },
+      });
     });
   }