Conversation
chore(deps): update github-actions Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
chore(deps): update actions/setup-node action to v7 Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…r import cycle (#511) * fix(api): keep exception text out of response bodies; break the logger cycle - sweep all 171 sites where str(e)/f-string exception text reached a JSON response (17 api modules, the FastAPI catch-all included): responses carry stable public messages, the detail stays in logger.error (14 log lines added, 2 upgraded to exc_info) - ConfigError carries a curated .message (position-only YAML errors via problem_mark; no parser or OS text) and the handler reads the attribute, never the exception object - error/status codes byte-identical across the sweep (312 values verified) - move create_bar into logger.py (its dominant consumer) with a helper re-export: kills the logger<->helper import cycle and the lazy-import workaround that papered over it Closes code-scanning alerts 294 (stack-trace exposure) and 273 (cyclic import). * test: raise the leak-marker error from a real accessor, not __getattr__ Special methods should honor their contract (CodeQL 296); an explicit get_poster_stats stub also can't be swallowed by attribute-probing paths. * test: route the leak marker through the real stats accessor The previous stub method was never called (the route reads db.stats), making the marker assertion vacuous; bite re-proven against a deliberately leaky handler. * fix(api): review round — close the ConfigError class, confine deletes, sanitize passthroughs - ConfigError now re-raises to the shared CONFIG_INVALID contract from every api handler (50 sites across two rounds; a transitive checker proves zero swallowing trys remain, with two documented exceptions). A malformed config can no longer 200 as empty roots, a false "no secret configured" wiring panel, or silently-missing styles - worker failure results pass through worker_error(): stable public message, detail logged (the worker's own strings can embed exception text) - upstream Plex bodies stay out of responses (_PlexFetchError grows a server-only detail); validation 422s drop echoed input values and mask sensitive fields via the existing SENSITIVE_FIELD_NAMES - GDrive folder deletion re-asserts the resolved target immediately before rmtree; poster file deletion realpaths and requires configured-root membership before os.remove (poisoned rows can no longer point deletes outside the roots), and file_deleted reports the real outcome * test: record-and-raise AttributeError in the webhook tripwire Special methods keep their contract (CodeQL 298) and the touch list survives even if a handler swallows the exception; bite re-proven via exit codes with the guard genuinely removed. * fix(api): close the sentinel-assignment ConfigError shape delete_poster loads config before the destructive row delete (a malformed config can no longer 200 after an irreversible deletion); the directory guards' inner config=None fallbacks re-raise instead of impersonating PATH_NOT_ALLOWED; webhook trusted-proxy resolution fails closed either way. * fix(api): webhook secret dependency uses the shared ConfigError contract The deliberate 503 predates the campaign's uniform CONFIG_INVALID handling and its retryability rationale doesn't hold (failed webhook events aren't re-queued on any 5xx). ConfigError now propagates from the dependency; tests assert the shared 500 CONFIG_INVALID with zero enqueues.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
@coderabbitai ignore
develophas drifted behindmain(releases, fixes, dependency bumps). Do not merge this PR — it reports the drift, it does not fix it.developrequires branches be up to date, andhead:maincan never satisfy that without pulling develop's extension files into main, which the branch invariant forbids. Squash or rebase would also leavemainunreachable fromdevelop, so this workflow would just open another PR next push.Sync locally instead:
Then verify
git diff main developis added extension files plusdeploy/docker/Dockerfileonly. GitHub marks this PR merged on its own once develop contains main's tip. Opened by the sync-develop workflow.