bug(server): when creating invalid control, an empty control is created in DB

[lan17]

Summary

When creating a control with malformed payload, the server returned 422, but a control still got created with empty data in the database.

Motivation

This causes UI issues because empty controls are later loaded and fail validation.

Current behavior

Empty controls can still get created.

Expected behavior

A 422 from a write endpoint should not result in any write.

Reproduction (if bug)

1. send a create-with-definition request
2. the request returns 422
3. a control is still present in the database with empty data

Verified root cause

For a create-with-definition flow, the client did:

1. PUT /api/v1/controls with just name
2. the server inserted an empty shell control
3. PUT /api/v1/controls/{id}/data with the definition
4. if step 3 returned 422, the empty shell from step 2 was still in the DB

That is the actual server-side bug. The association between agent and empty control was caller-flow dependent, but the root problem was that invalid create requests were not atomic.

Proposed solution (optional)

Validate the definition before inserting anything, so failed create requests do not persist shell controls.

Additional context

Fixed by PR #139.

[lan17]

Verified locally on March 19, 2026.

Additional detail on the failure mode:

• the bug was not just a validation error; it was a non-atomic create flow
• the create path allowed a shell control row to be inserted first, and the later data-validation step could then fail with 422
• that meant invalid create requests could still leave a persisted control with empty {} data
• the direct agent association mentioned in the issue was flow-dependent on the caller; the root server-side bug was the persisted shell control after invalid data

Resolution shipped in PR #139:

• PUT /api/v1/controls now requires data
• the server validates data before inserting anything
• invalid payloads return 422 and write nothing
• SDK/UI/generated API clients were updated to use the single-request create flow
• compatibility coverage for legacy empty rows remains in tests, but the public create endpoint no longer creates new unconfigured controls

[galileo-automation]

🎉 This issue has been resolved in version 2.1.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀