fix(automation): bound backup approval fingerprints

apps/api/src/services/backup_restore_alertmanager_ingress.py

@@ -39,6 +39,7 @@ logger = get_logger("awoooi.backup_restore_alertmanager_ingress")
 BACKUP_RESTORE_AGENT99_ROUTE_ID = "agent99:backup_health:BackupCheck"
 BACKUP_RESTORE_DISPATCH_OWNER = "alertmanager_raw_signal"
 BACKUP_RESTORE_OWNER_SCHEMA_VERSION = "backup_restore_ingress_owner_v1"
+APPROVAL_FINGERPRINT_MAX_LENGTH = 64
 BACKUP_RESTORE_PROHIBITED_ACTIONS = (
     "run_backup",
     "run_restore",
@@ -55,6 +56,15 @@ def _stable_digest(*parts: object) -> str:
     return hashlib.sha256(value.encode("utf-8")).hexdigest()
 
 
+def _approval_storage_fingerprint(source_fingerprint: str) -> str:
+    """Fit a source identity into approval_records.fingerprint VARCHAR(64)."""
+
+    normalized = str(source_fingerprint or "").strip()
+    if len(normalized) <= APPROVAL_FINGERPRINT_MAX_LENGTH:
+        return normalized
+    return hashlib.sha256(normalized.encode("utf-8")).hexdigest()
+
+
 def build_backup_restore_ingress_owner(
     *,
     project_id: str,
@@ -233,6 +243,9 @@ async def process_backup_restore_alertmanager_signal(
         source_event_fingerprint=source_event_fingerprint,
         source_started_at=source_started_at,
     )
+    approval_storage_fingerprint = _approval_storage_fingerprint(
+        source_fingerprint
+    )
     approval_service = get_approval_service()
     owner_approval_id = UUID(str(owner["approval_id"]))
     approval = await approval_service.get_approval(owner_approval_id)
@@ -240,7 +253,7 @@ async def process_backup_restore_alertmanager_signal(
     legacy_incident_id = ""
     if approval is None:
         recent = await approval_service.find_by_fingerprint(
-            fingerprint=source_fingerprint,
+            fingerprint=approval_storage_fingerprint,
             debounce_minutes=30,
         )
         legacy_incident_id = _value(getattr(recent, "incident_id", ""))
@@ -253,7 +266,7 @@ async def process_backup_restore_alertmanager_signal(
         try:
             approval = await approval_service.create_approval_with_fingerprint(
                 request=request,
-                fingerprint=source_fingerprint,
+                fingerprint=approval_storage_fingerprint,
             )
         except Exception:
             # A concurrent producer may have inserted the deterministic owner.