Node.js Moderation Debug: Missing Pending State Makes Banned Content Visible

A page saying “restricted media reached the delivery cache” means the system published too early. The least complex fix is a quarantine namespace plus an explicit moderation state: accept each uploaded logistics promo clip as pending, keep its bytes and derivatives unreachable from public delivery, and promote them only after an allow decision commits. Never treat a missing state, a timeout, or a cache miss as approval.

TL;DR: the public read path must require approved, rather than merely rejecting banned. That distinction closes the brief exposure window because unknown and pending records fail closed. It also gives the on-call engineer a useful early signal: count attempted public reads by moderation state, and alert on blocked promotion attempts before a viewer can fetch anything.

The page is the end of the story. Work backward.

How does a missing pending state make banned content briefly visible?

Suppose a dispatcher creates a short promo video from a prompt for a same-day freight campaign. A moderation worker later classifies the upload as banned, yet the delivery cache already holds the original clip or a thumbnail. The urgent symptoms are not “moderation is slow” and not “the classifier made an error.” They are a state transition and an object-copy operation that occurred in the wrong order.

The page should identify the affected asset, current review state, attempted transition, destination namespace, and whether a public cache key was created. It should not include the prompt or media bytes; those can carry sensitive customer material. One alert should answer a narrow question: did any operation try to move a non-approved asset into a public location? If the trace shows an upload write followed immediately by cache population, before any decision commit, the optimistic publish path is the defect; if the cache was populated only after approval but later served after revocation, invalidation is the separate defect. Those two timelines need different owners and different remediation, even though a viewer reports the same symptom.

Start with a service-level objective that expresses the invariant directly: no successful public fetch for an asset whose durable state is anything other than approved. A latency SLO for moderation matters, but it cannot substitute for this safety property. A slow pending clip is inconvenient. A banned clip briefly served is a publication failure.

This suggests two signals with different urgency. A promotion-denied counter is an early warning and can be investigated during working hours if the delivery path stayed closed. A successful public response for a non-approved asset is page-worthy because the control failed. Do not combine them into a generic moderation error rate; aggregation erases the difference between a guard doing its job and the guard being bypassed.

Make approval a capability, not the absence of a ban

The fragile model has two values: banned and not banned. A newly inserted row has no decision, so application code, a nullable column, or a stale cache can interpret it as not banned. Optimistic publication then becomes the accidental default.

Use a closed state machine instead:

There is no unknown -> public edge. Unknown is denial.

No approval, no delivery.

Store incoming bytes under a private, non-delivery key such as a generated asset identifier in a quarantine namespace. Generate thumbnails there too. A public URL must not be derivable from the upload filename, and the upload handler must not enqueue a public-cache warmup. The moderation decision and the durable state transition belong together; copying approved derivatives into the public namespace happens afterward as an idempotent promotion job.

That last ordering is deliberate. Trying to make a database update, object copy, and cache fill one atomic transaction usually creates an imaginary guarantee across systems. A durable outbox or equivalent committed work record makes the boundary visible: commit approved and a promotion request together, then let a retryable worker perform the copy. The read path still checks approval, so a duplicate job is tolerable and a delayed job affects availability rather than safety.

Storage cost now becomes legible. Quarantine holds the original plus review derivatives; public storage holds only approved delivery variants; the cache holds only requested approved variants. Retention for rejected material should be a policy decision, not an unnoticed consequence of failed cleanup. Capacity planning should therefore separate bytes by moderation state and derivative class instead of reporting one total-media number.

Instrument the gate where publication actually happens

Instrumentation at the classifier alone cannot prove that delivery remained closed. Put the decisive metric and structured event at the promotion boundary, then add a check on the public read path. The following Go example models the important rule without tying it to a storage or queue product:

package moderation

import (
    "context"
    "errors"
)

type State string

const (
    Pending  State = "pending"
    Approved State = "approved"
    Rejected State = "rejected"
    Revoked  State = "revoked"
)

var ErrNotApproved = errors.New("asset is not approved for publication")

type Asset struct {
    ID    string
    State State
}

type Repository interface {
    Asset(ctx context.Context, id string) (Asset, error)
    CommitApprovalAndPromotion(ctx context.Context, id string) error
}

type Publisher interface {
    Promote(ctx context.Context, assetID string) error
}

func Publish(ctx context.Context, repo Repository, dst Publisher, id string) error {
    asset, err := repo.Asset(ctx, id)
    if err != nil {
        return err // Missing records and lookup failures never grant access.
    }
    if asset.State != Approved {
        return ErrNotApproved
    }
    return dst.Promote(ctx, asset.ID)
}

The interface is intentionally small. The promotion worker needs an asset identifier and an affirmative decision; it does not need the original prompt, reviewer notes, or a loosely typed metadata bag. Narrow inputs reduce the number of ways an absent field can silently become permission. The limitation is extra read pressure when every delivery request checks durable state, while a cached authorization decision lowers that pressure at the cost of a revocation window. A team unable to bound and observe that window should keep the durable check; a team with much higher read volume can cache approval only if revocation actively purges both the authorization entry and every delivery variant.

Emit a structured event for every denied promotion with fields for asset ID, observed state, caller, job ID, and destination class. Record a separate counter when the delivery handler denies a read. Trace the chain from upload acceptance through review commit, outbox consumption, object promotion, and cache fill using the same opaque asset ID. Then an on-call engineer can establish ordering without searching customer content.

Do not attach moderation state only at request time and assume every cache will honor it. The cache key and stored object are both part of the authorization boundary. If a public cache can answer without consulting the gate, only approved bytes may enter that cache.

Reproduce the race before changing the threshold

A useful regression test controls ordering. Pause the review worker, upload a representative clip, and attempt the public read while the record is pending. It must be denied. Resume review with a rejection and repeat; it must still be denied, and no public object or cache entry should exist. Run the approval path last and verify that promotion is the first operation capable of creating public delivery state.

Test missing rows and lookup errors too. They are not exotic edge cases: they are precisely the conditions under which permissive fallback code turns uncertainty into exposure. The assertion should examine both the HTTP outcome and the side effects in storage and cache, because a denied response followed by a queued warmup still leaves a delayed failure.

For media validation, inspect the decoded format rather than trusting a filename extension. Image formats differ in capabilities and browser support, as MDN’s format guide documents; validation and derivative generation should use an explicitly supported allowlist. This is input hygiene, though, not a moderation decision. A technically valid thumbnail remains private until its asset is approved.

Short tests catch the obvious branch. A concurrency test should also run review completion and publication attempts in competing orders, then assert the invariant after every schedule. The target is not a lucky final state. It is the absence of any interval in which a non-approved asset is publicly readable.

Buy or build the surrounding control plane?

The gating invariant must survive either choice. The useful comparison is operational ownership, especially because video originals and derivatives amplify storage and cache volume.

I would reject a comparison based only on request price. It misses retained rejected bytes, duplicate derivatives, cache churn, review backlogs, and the engineering time required to prove that revocation completed. Model monthly capacity from 6 explicit inputs: arrival rate, average original size, derivatives per approved asset, approval ratio, retention by state, and cache residency. Keep each input visible. A single blended cost per video hides the lever that will hurt first.

The acceptance test for any component is blunt: can it preserve quarantine, emit an auditable affirmative decision, retry promotion idempotently, and prevent a cache from serving before that decision? If the answer depends on every caller remembering a convention, the platform does not have a gate. It has a suggestion.

Tune alerts without teaching the system to fail open

Thresholds deserve skepticism. Paging on every blocked pending read creates noise during normal processing, and sustained noise trains responders to ignore the exact signal meant to protect publication. Aggregate denied attempts by caller and state, alert on a meaningful rate or an unexpected caller, and keep the hard page for evidence that public delivery succeeded without approval.

The false-positive cost is real: interrupted on-call time, hurried changes to a safety control, and eventual alert suppression. Yet the remedy is better classification of signals, not a grace period in which pending media can be served. Measure moderation latency separately and set its threshold from the product’s promised publishing time and observed queue behavior. This design is a poor fit for a workflow that intentionally requires immediate public preview; such a workflow needs a private, access-controlled preview audience rather than weakening the publication gate. That is a product trade-off, not an alert threshold.

Safety stays binary.

For the logistics promo workflow, the final operating rule is compact: uploads enter quarantine, affirmative approval creates durable promotion work, public storage and caches receive only approved derivatives, and every other state is denied. That rule is easy to explain during an incident and cheap to test on every deployment. More important, it makes a missing pending state visible as a schema or ingestion defect instead of allowing absence to masquerade as permission.

Further reading

• MDN: Image file type and format guide