Logan Cusano
8fbfe7d6de
Two unrelated-looking problems with the same shape: a dangerous state that
looked fine from the outside.
DEPLOY (server-26#21). The Deploy job failed on fifteen consecutive pushes
between 2026-08-18 and 08-20 and nobody noticed for two days, because the
build job was green and a red run is only visible to someone who opens Gitea.
Production served 08-18 code the whole time -- including the entire frontend
redesign, chunks 2 through 8. Three changes:
* The health check now asserts WHICH build answered, not just that something
did. CI bakes the commit into the image (Dockerfile ARG/ENV GIT_SHA) and
/health reports it, so a deploy that "succeeds" while the previous
container keeps running now fails. Liveness alone could never have caught
this.
* The image pull retries once after a prune. The actual failure was
containerd unable to extract a layer -- "failed to Lchown ... no such file
or directory" -- a corrupted entry in the snapshot store, which a prune
clears. A second failure after pruning is a real problem (check the VM's
disk) and still stops the deploy.
* A notify-failure job POSTs to DEPLOY_ALERT_WEBHOOK when anything in the
workflow fails. Unset means skip quietly, not fail.
CORS (server-26#20). allow_origins=["*"] with allow_credentials=True is not
the permissive-but-harmless setting it reads as. Starlette does not reject the
pair -- it reflects the caller's Origin back and still sends
Access-Control-Allow-Credentials: true, so the effective policy is "any
origin, WITH credentials", the opposite of what a wildcard normally means.
Rather than trust every deployment to remember CORS_ORIGINS, the pair is now
unrepresentable: a wildcard forces allow_credentials off and logs an ERROR
naming the variable to set. Correctly configured deployments that name their
origins are unaffected and keep credentialed requests.
Severity honestly: low today. c2-core is bearer-auth, and browsers do not
attach bearer tokens cross-origin the way they attach cookies. This is a
misconfiguration waiting for the day something starts trusting a cookie.
Also adds firebase_admin.auth.UserRecord and the list/update/create/delete_user
names to the conftest stub. routers/users.py annotates with UserRecord at
import time, so without it importing app.main failed at collection -- which is
why nothing had ever tested anything wired at app level, CORS included.
Tests: 5 new in test_cors_policy.py, covering the pure policy function, the
middleware actually mounted on the app (so re-hardcoding allow_credentials=True
fails here), and the presence of the build stamp.
Closes logan/server-26#20
Closes logan/server-26#21
71 lines
3.0 KiB
Python
71 lines
3.0 KiB
Python
# All C2 core settings have defaults — no env setup needed.
|
|
#
|
|
# firebase-admin and google-cloud-firestore are runtime-only dependencies: they
|
|
# are installed in the container but not in the local dev venv, and
|
|
# app/internal/firestore.py calls _init_firebase() at import time. Without the
|
|
# stubs below, importing ANY module that reaches Firestore fails at collection
|
|
# time, which is why test_mqtt_handler and test_node_sweeper could not be run
|
|
# outside the container.
|
|
#
|
|
# The stubs are installed only when the real packages are absent, so the
|
|
# container's real SDK is never shadowed.
|
|
import sys
|
|
from types import ModuleType
|
|
from unittest.mock import MagicMock
|
|
|
|
try: # pragma: no cover - exercised only by which packages are installed
|
|
import firebase_admin # noqa: F401
|
|
except ModuleNotFoundError:
|
|
_firebase = ModuleType("firebase_admin")
|
|
# Falsy so _init_firebase() takes the initialize_app() branch rather than the
|
|
# already-initialised branch, which is itself broken (see DEFERRED.md).
|
|
_firebase._apps = {}
|
|
_firebase.initialize_app = MagicMock()
|
|
_firebase.credentials = MagicMock()
|
|
_firebase.firestore = MagicMock()
|
|
|
|
_credentials = ModuleType("firebase_admin.credentials")
|
|
_credentials.Certificate = MagicMock()
|
|
_credentials.ApplicationDefault = MagicMock()
|
|
|
|
_fs = ModuleType("firebase_admin.firestore")
|
|
_fs.client = MagicMock()
|
|
# A distinct sentinel rather than a MagicMock: production code writes this
|
|
# into dicts that tests compare against, and a MagicMock compares unequal
|
|
# to itself across attribute accesses.
|
|
_fs.SERVER_TIMESTAMP = "__SERVER_TIMESTAMP__"
|
|
|
|
_auth = ModuleType("firebase_admin.auth")
|
|
_auth.verify_id_token = MagicMock()
|
|
_auth.set_custom_user_claims = MagicMock()
|
|
_auth.get_user_by_email = MagicMock()
|
|
_auth.get_user = MagicMock()
|
|
# Type used in annotations at import time by routers/users.py, so it has to
|
|
# exist as a name even though nothing here ever instantiates it. Without it,
|
|
# importing app.main -- and therefore testing anything wired at app level,
|
|
# like the CORS policy -- fails at collection.
|
|
_auth.UserRecord = MagicMock()
|
|
_auth.list_users = MagicMock()
|
|
_auth.update_user = MagicMock()
|
|
_auth.create_user = MagicMock()
|
|
_auth.delete_user = MagicMock()
|
|
|
|
_firebase.auth = _auth
|
|
_firebase.credentials = _credentials
|
|
_firebase.firestore = _fs
|
|
|
|
sys.modules["firebase_admin"] = _firebase
|
|
sys.modules["firebase_admin.credentials"] = _credentials
|
|
sys.modules["firebase_admin.firestore"] = _fs
|
|
sys.modules["firebase_admin.auth"] = _auth
|
|
|
|
try: # pragma: no cover
|
|
from google.cloud.firestore_v1.base_query import FieldFilter # noqa: F401
|
|
except ModuleNotFoundError:
|
|
for _name in (
|
|
"google", "google.cloud", "google.cloud.firestore_v1",
|
|
"google.cloud.firestore_v1.base_query",
|
|
):
|
|
sys.modules.setdefault(_name, ModuleType(_name))
|
|
sys.modules["google.cloud.firestore_v1.base_query"].FieldFilter = MagicMock()
|