mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-08-06 03:15:28 +00:00
a51a1fc4fc
/api/auth/settings is auth-exempt (the frontend + the pre-login page read it for keybinds/TTS prefs), so non-admin and unauthenticated callers get a scrubbed copy. The previous scrub only blanked TOP-LEVEL string values whose key matched a short suffix list — so a secret nested under a non-secret parent key, or stored under a key outside the list, would leak. A real exposure when the app is reachable over a Cloudflare tunnel / reverse proxy. - src/settings_scrub.py: NEW stdlib-only module with the scrub helpers (deep/ recursive; broadened secret-key patterns). Kept separate from auth_routes so it imports + unit-tests WITHOUT pulling the FastAPI / auth / database chain (addresses review: the test no longer fails at collection on the DB import). - routes/auth_routes.py: import scrub_settings from the module. - tests/test_settings_scrub.py: import the tiny module directly. Ran: pytest tests/test_settings_scrub.py (8 passed); verified the test pulls no db/auth modules into sys.modules; py_compile routes/auth_routes.py. Co-authored-by: Kanaru92 <107661007+Kanaru92@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| bombadil-spec.ts | ||
| conftest.py | ||
| test_action_intents.py | ||
| test_agent_loop.py | ||
| test_app.py | ||
| test_auth_regressions.py | ||
| test_calendar_recurrence.py | ||
| test_chat_stream_scope.py | ||
| test_chroma_client.py | ||
| test_compare_js.py | ||
| test_context_compactor.py | ||
| test_cookbook_helpers.py | ||
| test_deep_research_extraction_controls.py | ||
| test_endpoint_resolver.py | ||
| test_gallery_image_privileges.py | ||
| test_hwfit_macos.py | ||
| test_llm_core_ollama.py | ||
| test_model_context.py | ||
| test_model_routes.py | ||
| test_null_owner_gates.py | ||
| test_pdf_runtime.py | ||
| test_personal_docs_pdf_index.py | ||
| test_personal_upload_isolation.py | ||
| test_rate_limiter.py | ||
| test_reply_recipients_js.py | ||
| test_research_utils.py | ||
| test_review_regressions.py | ||
| test_search_query.py | ||
| test_search_ranking.py | ||
| test_security_regressions.py | ||
| test_session_mode_helpers.py | ||
| test_settings_scrub.py | ||
| test_setup_admin_user.py | ||
| test_shell_routes.py | ||
| test_task_scheduler_session_delivery.py | ||
| test_vision_model_detection.py | ||
| test_visual_report.py | ||