From b442ef4102f64307ad5613c4a9d3d0e636b2d58b Mon Sep 17 00:00:00 2001 From: Vantz Stockwell Date: Thu, 11 Jun 2026 12:49:53 -0400 Subject: [PATCH] fix(api): consumer rejects malformed heartbeats with no host block (no phantom hosts) Co-Authored-By: Claude Fable 5 --- backend-nest/src/services/host-agent-consumer.service.ts | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/backend-nest/src/services/host-agent-consumer.service.ts b/backend-nest/src/services/host-agent-consumer.service.ts index 080e655..1248581 100644 --- a/backend-nest/src/services/host-agent-consumer.service.ts +++ b/backend-nest/src/services/host-agent-consumer.service.ts @@ -88,6 +88,12 @@ export class HostAgentConsumerService implements OnApplicationBootstrap { private async onHeartbeat(licenseId: string, payload: HeartbeatPayload): Promise { if (!(await this.isValidTenant(licenseId))) return; + // A well-formed v2 heartbeat always carries a host block. Reject malformed + // payloads so a stray/empty publish can't create a phantom host row. + if (!payload || typeof payload.host !== 'object' || payload.host === null) { + this.logger.warn(`ignoring malformed heartbeat for license ${licenseId} (no host block)`); + return; + } const now = new Date(); await this.updateLegacyConnection(licenseId, now);