fix(data-access): allow rejecting new suggestions and refresh integration setup

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: AndreeaGGhita

package-lock.json

@@ -1,3 +1,9 @@
+## [@adobe/spacecat-shared-data-access-v4.40.1](https://github.com/adobe/spacecat-shared/compare/@adobe/spacecat-shared-data-access-v4.40.0...@adobe/spacecat-shared-data-access-v4.40.1) (2026-10-08)
+
+### Bug Fixes
+
+* **suggestions:** allow NEW -> REJECTED transition ([#1970](https://github.com/adobe/spacecat-shared/issues/1970)) ([8281605](https://github.com/adobe/spacecat-shared/commit/8281605431096155fc11b0a3f488978f89492865))
+
 ## [@adobe/spacecat-shared-data-access-v4.40.0](https://github.com/adobe/spacecat-shared/compare/@adobe/spacecat-shared-data-access-v4.39.1...@adobe/spacecat-shared-data-access-v4.40.0) (2026-10-02)
 
 ### Features

packages/spacecat-shared-data-access/CHANGELOG.md

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/spacecat-shared-data-access",
-  "version": "4.40.0",
+  "version": "4.40.1",
   "description": "Shared modules of the Spacecat Services - Data Access",
   "type": "module",
   "engines": {

packages/spacecat-shared-data-access/package.json

@@ -42,15 +42,16 @@ export const SUGGESTION_CREATE = Symbol('SUGGESTION_CREATE');
  * drowning real flows in false warnings. The warn logs from the rollout period
  * inform which entries to tighten before flipping to enforce.
  *
- * The one hard rule already enforced by api-service is preserved exactly:
- * REJECTED is only reachable from PENDING_VALIDATION (suggestions.js).
+ * The hard rule enforced by api-service (SITES-53247): REJECTED is only
+ * reachable from NEW or PENDING_VALIDATION (suggestions.js).
  */
 export const SUGGESTION_TRANSITIONS = {
-  // audit-worker creates as NEW (non-paid) or PENDING_VALIDATION (paid); OUTDATED at audit time.
+  // SITES-53247: audit-worker now always creates as NEW; OUTDATED at audit time.
+  // PENDING_VALIDATION retained for historical rows and V2.
   [SUGGESTION_CREATE]: [S.NEW, S.PENDING_VALIDATION, S.OUTDATED],
-  // ESE/TBYB review (-> NEW), mystique (-> IN_PROGRESS), bubble-up, UI skip, re-audit.
-  [S.NEW]: [S.APPROVED, S.IN_PROGRESS, S.FIXED, S.ERROR, S.SKIPPED, S.OUTDATED],
-  // paid-review gate: approve -> NEW, decline -> REJECTED (the one hard rule), or skip/outdate.
+  // ESE review (-> REJECTED, SITES-53247), mystique (-> IN_PROGRESS), bubble-up, UI skip, re-audit.
+  [S.NEW]: [S.APPROVED, S.IN_PROGRESS, S.FIXED, S.ERROR, S.SKIPPED, S.OUTDATED, S.REJECTED],
+  // paid-review gate: approve -> NEW, decline -> REJECTED (the hard rule), or skip/outdate.
   // IN_PROGRESS: api-service autofixSuggestions accepts PENDING_VALIDATION and sets IN_PROGRESS.
   [S.PENDING_VALIDATION]: [S.NEW, S.IN_PROGRESS, S.REJECTED, S.SKIPPED, S.OUTDATED],
   [S.APPROVED]: [S.IN_PROGRESS, S.FIXED, S.ERROR, S.SKIPPED, S.NEW, S.OUTDATED],

packages/spacecat-shared-data-access/src/models/suggestion/suggestion.transitions.js

@@ -86,6 +86,9 @@ const EXPECTED_INVOCATION_ERROR_PATTERNS = [
   'invalid input value for enum',
   'not configured',
   'schema cache',
+  // Write-protected collections (e.g. AbvOnboardingClaim) revoke direct table
+  // access and only expose RPC functions, so generic reads legitimately 403.
+  'permission denied for table',
 ];
 
 const isMutatingMethod = (methodName) => MUTATING_METHOD_PREFIXES

packages/spacecat-shared-data-access/test/it/postgrest/all-collections-methods-coverage.test.js

@@ -38,17 +38,17 @@ services:
     # the oldest still-available tag (v5.104.0) since both are far past v5.80.0 and
     # pinning to the tip buys the most runway before the next forced bump.
     # v5.137.0 (2026-09-25): v5.115.0 aged out of ECR; also carries the semantic-index schema.
-    # v5.156.0 (2026-10-07): v5.137.0 was deleted from ECR.
+    # v5.157.0 (2026-10-08): v5.137.0 aged out of ECR; bumped to current tip.
     #
     # To obtain or refresh the digest:
     #   aws ecr describe-images \
     #     --profile <your-profile> --region us-east-1 \
     #     --repository-name mysticat-data-service \
-    #     --image-ids imageTag=v5.156.0 \
+    #     --image-ids imageTag=v5.157.0 \
     #     --query 'imageDetails[0].imageDigest' --output text
     # Then export MYSTICAT_DATA_SERVICE_DIGEST=sha256:<the-digest> before npm run test:it,
     # or set it in the .env file consumed by docker compose. Leave unset for local dev.
-    image: ${MYSTICAT_DATA_SERVICE_REPOSITORY:-682033462621.dkr.ecr.us-east-1.amazonaws.com/mysticat-data-service}:${MYSTICAT_DATA_SERVICE_TAG:-v5.156.0}${MYSTICAT_DATA_SERVICE_DIGEST:+@${MYSTICAT_DATA_SERVICE_DIGEST}}
+    image: ${MYSTICAT_DATA_SERVICE_REPOSITORY:-682033462621.dkr.ecr.us-east-1.amazonaws.com/mysticat-data-service}:${MYSTICAT_DATA_SERVICE_TAG:-v5.157.0}${MYSTICAT_DATA_SERVICE_DIGEST:+@${MYSTICAT_DATA_SERVICE_DIGEST}}
     depends_on:
       db:
         condition: service_healthy

packages/spacecat-shared-data-access/test/it/postgrest/docker-compose.yml

@@ -693,23 +693,30 @@ describe('SuggestionModel', () => {
 
     it('warns but still applies an illegal transition in warn mode (default)', () => {
       delete process.env.STATUS_TRANSITION_ENFORCEMENT;
-      const { model, mockLogger } = createElectroMocks(Suggestion, { ...mockRecord, status: 'NEW' });
+      const { model, mockLogger } = createElectroMocks(Suggestion, { ...mockRecord, status: 'APPROVED' });
       mockLogger.warn.resetHistory(); // ignore construction-time warnings
-      model.setStatus('REJECTED'); // REJECTED only legal from PENDING_VALIDATION
+      model.setStatus('REJECTED'); // REJECTED only legal from NEW or PENDING_VALIDATION (SITES-53247)
       expect(model.record.status).to.equal('REJECTED');
       expect(mockLogger.warn).to.have.been.calledOnce;
     });
 
-    it('allows REJECTED only from PENDING_VALIDATION in enforce mode', () => {
+    it('allows REJECTED from PENDING_VALIDATION in enforce mode', () => {
       process.env.STATUS_TRANSITION_ENFORCEMENT = 'enforce';
       const { model } = createElectroMocks(Suggestion, { ...mockRecord, status: 'PENDING_VALIDATION' });
       expect(() => model.setStatus('REJECTED')).to.not.throw();
       expect(model.record.status).to.equal('REJECTED');
     });
 
-    it('throws on an illegal transition (NEW -> REJECTED) in enforce mode', () => {
+    it('allows REJECTED from NEW in enforce mode (SITES-53247: pre-validation gate retired)', () => {
       process.env.STATUS_TRANSITION_ENFORCEMENT = 'enforce';
       const { model } = createElectroMocks(Suggestion, { ...mockRecord, status: 'NEW' });
+      expect(() => model.setStatus('REJECTED')).to.not.throw();
+      expect(model.record.status).to.equal('REJECTED');
+    });
+
+    it('throws on an illegal transition (APPROVED -> REJECTED) in enforce mode', () => {
+      process.env.STATUS_TRANSITION_ENFORCEMENT = 'enforce';
+      const { model } = createElectroMocks(Suggestion, { ...mockRecord, status: 'APPROVED' });
       expect(() => model.setStatus('REJECTED')).to.throw('Suggestion');
     });
   });

packages/spacecat-shared-data-access/test/unit/models/suggestion/suggestion.model.test.js

@@ -28,7 +28,8 @@ describe('Suggestion transitions', () => {
     ['NEW', 'ERROR'],
     ['PENDING_VALIDATION', 'NEW'],
     ['PENDING_VALIDATION', 'IN_PROGRESS'], // api-service autofixSuggestions path
-    ['PENDING_VALIDATION', 'REJECTED'], // the one hard rule preserved from api-service
+    ['PENDING_VALIDATION', 'REJECTED'], // the hard rule: NEW or PENDING_VALIDATION only
+    ['NEW', 'REJECTED'], // SITES-53247: ESE can reject directly from NEW now the gate is retired
     ['IN_PROGRESS', 'FIXED'],
     ['IN_PROGRESS', 'NEW'], // bubble-up: all issues NEUTRAL
     ['FIXED', 'NEW'], // re-detection reopens
@@ -40,7 +41,7 @@ describe('Suggestion transitions', () => {
   ];
 
   const illegal = [
-    ['NEW', 'REJECTED'], // REJECTED only from PENDING_VALIDATION
+    ['APPROVED', 'REJECTED'], // REJECTED only from NEW or PENDING_VALIDATION
     ['FIXED', 'REJECTED'],
     ['REJECTED', 'FIXED'], // reopen only to NEW, not straight to a terminal outcome
     ['SKIPPED', 'FIXED'],