peter
fe38dfbcca
The deep review of the branch raised 47 findings, 18 of which survived adversarial verification. Grouped by what they actually were: **The size ceiling inverted at its boundary.** `remaining_bytes` clamped to 0 for a user already at their storage cap, and `build_ydl_opts` reads 0 as "no limit" — so the one user over quota was the only one downloading with no ceiling at all. `check_enqueue` could not catch it: it ran while the job was queued and the user was still under the cap. The arithmetic moves into `quota.remaining_bytes` (where every other max_bytes decision lives, and where it can be tested), and the worker now fails the job outright rather than proceeding unbounded — as a non-retryable `quota_exceeded`, since retrying cannot help until space is freed. **Silent failures in the new account panel.** All three actions went through `quiet: true` endpoints, which suppress the global error dialog on the promise that the caller reports inline — with no `onError`, that promise was broken and a refusal rendered as nothing. On the broken-SMTP instance this panel exists for, an admin would read silence as "the mail went out". The co-invalidation set and the email-off predicate move to `lib/adminUsers`, shared with the pending-access queue, so the two copies of these mutations cannot drift apart again — which is how half of this was lost in the first place. **A rollback recipe that destroyed data without working.** `alembic downgrade -1` steps back one migration, but a release routinely ships several (0.80.0 shipped four): it drops the newest one's columns and leaves the schema at a revision the older image also cannot resolve, i.e. the crash loop it was meant to escape, minus the data. The dump restore is now the recommended path, and the alembic route asks the target version for its own head revision instead of counting backwards. Also: redirects named in the urlguard docstring beside the DNS-rebinding residual they share a fix with (SEC-17); a malformed port refused as `bad_port` instead of escaping as a 500; the pull cooldown extended to the sibling route spending the same QuotaAction; restore stops the app before dropping its tables; the PowerShell cleanup can no longer decide the script's verdict on 5.1, nor report the wrong exit code; the documented one-liners hardened to match the scripts; the registry's retention window stated where pinning is advertised; the two banners made mutually exclusive so neither can shadow the other; `hover:bg-hover` (a utility this project never generated) replaced by the `selectable` recipe; the clipboard helper reused; and the sync cooldown's copy swept to the two callers that discarded it. Verified: gate green (vitest 678, pytest 949), and the panel, the row hover and the reset banner UAT'd on localdev.
113 lines
5.0 KiB
Python
113 lines
5.0 KiB
Python
"""E12 · S3 — the route-level halves of SEC-12 and SEC-14.
|
|
|
|
`test_urlguard.py` pins the address judgement itself; this pins that the ENQUEUE route actually
|
|
consults it and answers in the structured `{code, reason}` shape the frontend localizes, and that a
|
|
manual sync trigger stops spending the instance-wide YouTube budget when held down.
|
|
|
|
DB-backed (the `as_user` fixture needs real rows) — skipped when no database is reachable.
|
|
"""
|
|
|
|
from app.downloads import urlguard
|
|
|
|
|
|
def test_enqueueing_a_loopback_url_is_refused_with_a_structured_detail(
|
|
db, as_user, make_user, monkeypatch
|
|
):
|
|
user = make_user()
|
|
db.commit()
|
|
monkeypatch.setattr(
|
|
urlguard.socket, "getaddrinfo", lambda *a, **kw: [(None, None, None, "", ("127.0.0.1", 0))]
|
|
)
|
|
r = as_user(user).post("/api/downloads", json={"source": "http://redis.internal:6379/x"})
|
|
assert r.status_code == 422
|
|
# The shape matters as much as the refusal: a bare English string under a bilingual UI is the
|
|
# thing the canonical-patterns table forbids.
|
|
assert r.json()["detail"] == {"code": "url_blocked", "reason": urlguard.REASON_PRIVATE}
|
|
|
|
|
|
def test_a_public_url_gets_past_the_guard(db, as_user, make_user, monkeypatch):
|
|
# Mutation check for the test above: with a public answer the request must fail LATER (or
|
|
# succeed), never with url_blocked — otherwise the guard would be refusing everything and the
|
|
# first test would still pass.
|
|
user = make_user()
|
|
db.commit()
|
|
monkeypatch.setattr(
|
|
urlguard.socket,
|
|
"getaddrinfo",
|
|
lambda *a, **kw: [(None, None, None, "", ("93.184.216.34", 0))],
|
|
)
|
|
r = as_user(user).post("/api/downloads", json={"source": "https://example.com/v"})
|
|
detail = r.json().get("detail") if r.status_code >= 400 else None
|
|
assert not (isinstance(detail, dict) and detail.get("code") == "url_blocked")
|
|
|
|
|
|
def test_youtube_sources_never_consult_the_guard(db, as_user, make_user, monkeypatch):
|
|
# A YouTube job resolves to a fixed public host from an 11-char id, so there is no
|
|
# user-controlled destination — resolving one would be pure latency on every enqueue.
|
|
def boom(*a, **kw):
|
|
raise AssertionError("the URL guard resolved DNS for a YouTube source")
|
|
|
|
user = make_user()
|
|
db.commit()
|
|
monkeypatch.setattr(urlguard.socket, "getaddrinfo", boom)
|
|
as_user(user).post("/api/downloads", json={"source": "dQw4w9WgXcQ"})
|
|
|
|
|
|
def test_manual_subscription_sync_goes_on_cooldown(db, as_user, make_user, monkeypatch):
|
|
from app.routes import sync as syncroutes
|
|
|
|
user = make_user()
|
|
db.commit()
|
|
# Neither the YouTube grant nor the import itself is under test — the limiter is.
|
|
monkeypatch.setattr(syncroutes, "has_read_scope", lambda u: True)
|
|
monkeypatch.setattr(syncroutes, "import_subscriptions", lambda d, u: {"imported": 0})
|
|
|
|
c = as_user(user)
|
|
codes = [c.post("/api/sync/subscriptions").status_code for _ in range(4)]
|
|
# 3 per 10 minutes: the first three pass, the fourth is refused.
|
|
assert codes[:3] == [200, 200, 200]
|
|
assert codes[3] == 429
|
|
assert c.post("/api/sync/subscriptions").json()["detail"] == {"code": "sync_cooldown"}
|
|
|
|
|
|
def test_the_cooldown_is_per_user_not_global(db, as_user, make_user, monkeypatch):
|
|
# Keyed by user id on purpose: the shared YouTube budget is spent per account, and one user
|
|
# exhausting their allowance must not lock everyone else out of their own sync button.
|
|
from app.routes import sync as syncroutes
|
|
|
|
a, b = make_user(), make_user()
|
|
db.commit()
|
|
monkeypatch.setattr(syncroutes, "has_read_scope", lambda u: True)
|
|
monkeypatch.setattr(syncroutes, "import_subscriptions", lambda d, u: {"imported": 0})
|
|
|
|
ca = as_user(a)
|
|
for _ in range(4):
|
|
ca.post("/api/sync/subscriptions")
|
|
assert ca.post("/api/sync/subscriptions").status_code == 429
|
|
assert as_user(b).post("/api/sync/subscriptions").status_code == 200
|
|
|
|
|
|
def test_the_single_playlist_repull_shares_the_pull_cooldown(db, as_user, make_user, monkeypatch):
|
|
# SEC-14, the sweep half: `revert-youtube` spends under the SAME QuotaAction.PLAYLISTS_PULL key
|
|
# as the bulk `sync-youtube`, so limiting only one of them left the identical drain open one
|
|
# route over. Both must draw on the one allowance.
|
|
from app.models import Playlist
|
|
from app.routes import playlists as plroutes
|
|
|
|
user = make_user()
|
|
pl = Playlist(user_id=user.id, name="Linked", kind="youtube", yt_playlist_id="PL123")
|
|
db.add(pl)
|
|
db.commit()
|
|
monkeypatch.setattr(plroutes, "has_read_scope", lambda u: True)
|
|
monkeypatch.setattr(plroutes, "repull_playlist", lambda d, u, p: {"ok": True})
|
|
monkeypatch.setattr(plroutes, "sync_user_playlists", lambda d, u: {"ok": True})
|
|
|
|
c = as_user(user)
|
|
codes = [c.post(f"/api/playlists/{pl.id}/revert-youtube").status_code for _ in range(4)]
|
|
assert codes[:3] == [200, 200, 200]
|
|
assert codes[3] == 429
|
|
# One allowance, not one each: the bulk route is now on cooldown too.
|
|
r = c.post("/api/playlists/sync-youtube")
|
|
assert r.status_code == 429
|
|
assert r.json()["detail"] == {"code": "sync_cooldown"}
|