rick/LEDMatrix
1
0
Fork 0
mirror of https://github.com/ChuckBuilds/LEDMatrix.git synced 2026-10-18 12:59:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(api-v3): address CodeRabbit findings on the blueprint split

Browse Source 
- _redact_credentials: blank scalar descendants of objects reached
  through a credential-owned list (e.g. tokens: [{"value": "secret"}])
  regardless of field name -- the existing name-based walk only
  protected direct dict values under a credential key, not list items.
- wifi.py: reject enabled/force/auto_enable_ap_mode values
  _parse_bool_ish can't recognize (400) instead of silently treating
  them as False, which could disable Wi-Fi or the radio itself.
- Starlark manifest locking: lock a stable manifest.json.lock sidecar
  instead of manifest.json itself, in both the standalone route path
  (_starlark_manifest_lock) and the plugin path
  (StarlarkAppsPlugin._save_manifest / _update_manifest_safe).
  manifest.json is replaced by an atomic rename on every write, which
  swaps in a fresh inode; a lock held on the old inode does not
  exclude a second locker that opens the path afresh right after the
  rename and gets the new inode, so two writers could race despite
  each holding "a lock". A sidecar that no write ever touches always
  resolves to the same inode for every locker.

Skipped as stale: the "serialize the complete manifest
read-modify-write" finding at api_v3/__init__.py -- every standalone
handler that calls _write_starlark_manifest is already wrapped in
_starlark_manifest_lock() on this branch.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Claude
2026-09-11 10:35:27 +00:00
parent 6e06b60615
commit 7c3e4b8a38
7 changed files with 192 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/test_config_main_redacts_secrets.py
+11
View File
@@ -125,6 +125,17 @@ def test_a_list_nested_inside_a_credential_named_container_is_also_blanked():
assert out["auth"]["note"] == "keep"
def test_objects_inside_a_credential_named_list_are_blanked_regardless_of_field_names():
"""A list item has no field name of its own to test against
`_CREDENTIAL_NAME_PARTS`, so an object reached through a credential-owned
list must be blanked outright rather than walked by field name -- unlike
the dict-directly-under-a-credential-key case in the test above.
"""
config = {"tokens": [{"value": "secret", "kind": "bearer"}]}
out = _redact_credentials(config)
assert out["tokens"] == [{"value": "", "kind": ""}]
def test_credential_shaped_container_with_named_fields_still_only_blanks_those():
"""Unchanged behaviour for the case the container test above already
covers: a dict whose sub-keys are semantically named fields is walked