# MentorApprovalOwners class

> Which SignalR connection raised each pending HITL confirmation (BUG-058).

- URL: https://docs.mentoragent.net/api/novior-mentoragent-server-hubs/mentorapprovalowners
- Verified with: MentorAgent 1.2.0
- Last updated: 2026-10-27
- Packages: Novior.MentorAgent.Server

`MentorApprovalStore` in the core is keyed by `Guid` alone, which is right for it — the core has no notion of a connection. But `POST /mentor/approve` then had nothing to check a caller against, so anyone who learned an action id could approve a gated, destructive action its owner had not answered, or deny one they wanted. The action id shares the connection id's weakness: the documented client sends it in a query string, so it reaches access logs, proxy logs and browser history on the way back.

This map lives in the **Server** package, not the core, precisely because the thing it knows is transport-shaped. With the connection in hand the endpoint reuses the same ownership check `/mentor/session` uses, against the principal that opened it.

An action id that is **not** here has no owner to check: an SSE client's confirmation never passes through a hub connection, and neither does an in-process Blazor Server one. Those keep today's behaviour rather than failing closed, which would break HITL for every such host.

## Definition

Namespace: `Novior.MentorAgent.Server.Hubs`. Package: `Novior.MentorAgent.Server`.

`public sealed class MentorApprovalOwners`

```shell
dotnet add package Novior.MentorAgent.Server
```

## Constructors

`public MentorApprovalOwners()`

## Methods

### `ConnectionFor`

`public string? ConnectionFor(Guid actionId)`

The connection that raised it, or `null` when nothing recorded one.

### `Forget`

`public void Forget(Guid actionId)`

Forgets one entry once it has been answered.

### `ForgetConnection`

`public void ForgetConnection(string connectionId)`

Forgets everything a dropped connection had pending. Without this the map grows for the life of the process — a confirmation that is never answered would otherwise leak an entry per abandoned turn.

### `Record`

`public void Record(Guid actionId, string connectionId)`

Records that `connectionId` raised `actionId`.

---

- Previous: [HubStateServiceDecorator class](https://docs.mentoragent.net/api/novior-mentoragent-server-hubs/hubstateservicedecorator.md)
- Next: [MentorHub class](https://docs.mentoragent.net/api/novior-mentoragent-server-hubs/mentorhub.md)