refactor: extract SSRF worker-URL validation into app/worker_proxy.py (CashPilot-sux) - #121
Merged
Merged
Conversation
… (CashPilot-sux) Move the self-contained SSRF/worker-URL guard (policy constants, allowlist parsing, IP classification, _validate_worker_url, _pin_url_to_ip) out of the main.py god module into a focused, independently unit-testable app/worker_proxy.py. main.py's _get_verified_worker_url composes them; it stays in main because it also needs FLEET_API_KEY + database. worker_proxy imports nothing from main, so no new import cycle is introduced. Behavior-preserving: 1172 tests green. Test seams that referenced the moved symbols via app.main (the socket-getaddrinfo patches and the strict-mode/allowlist tests mutating the policy constants) now point at app.worker_proxy; the _validate_worker_url/_pin_url_to_ip patches keep working through main's import binding. This is the architect-endorsed least-coupled extraction from bead CashPilot-sux. The benign, documented main->routers->main import cycle is intentionally left as-is (resolving it risks the ~40 app.main.* test seams for no correctness gain).
Owner
Author
|
@coderabbitai review |
|
Warning Review limit reached
Next review available in: 43 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
✅ Action performedReview finished.
|
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #121 +/- ##
=======================================
Coverage 93.89% 93.90%
=======================================
Files 33 34 +1
Lines 3901 3905 +4
=======================================
+ Hits 3663 3667 +4
Misses 238 238
🚀 New features to boost your workflow:
|
GeiserX
added a commit
that referenced
this pull request
Aug 2, 2026
…ux) (#177) [skip ci] The SSRF/worker-URL extraction this bead also called for already shipped in PR #121. What remained was the cycle, and the interesting part is how small the real coupling turned out to be. The routers reached into app.main for templates, client_ip, the auth guards, database, metrics, setup_token and the login rate limiter. Every one of those except the last was ALREADY a re-export of something in app.deps or a plain module — app.main was just a pass-through. So the routers now import their dependencies directly, and moving one module-level dict is what actually removes the cycle rather than relocating it. The rate limiter lives in app.login_rate_limit and imports nothing from the app, so it cannot be pulled back into a cycle later. A test asserts both: that no router imports main, and that the new module has no app-level imports. The seams were the risk. app.main re-exports _login_attempts BY REFERENCE, not as a copy, because a conftest fixture clears app.main._login_attempts between tests. A copy would have left that fixture clearing an object nothing reads, and every later test would silently inherit the previous one's state — flakiness that surfaces much later and is very hard to place. A test pins the identity. One seam did legitimately move: a test patched app.main._check_login_rate, which no longer intercepts anything now that the router calls the function where it lives. Patching a name in main's namespace never affected the other module. That test now patches app.login_rate_limit.check_login_rate — one explicit update, not a silent behaviour change. Two things the mechanical rename got wrong, both caught by the suite rather than by reading: * app.setup_token collides with a Form parameter also named setup_token inside do_register, so a bare import looked unused, was removed, and the other use became a NameError. Imported under an alias, with a comment saying why. * The auth router's docstring still described the old arrangement. Rewritten to say what is now true. Behaviour is unchanged and tested as such: the window, the limit, per-address counting, and the deliberate use of a plain dict rather than a defaultdict so an aged-out bucket is removed instead of leaking a permanent key for every address that ever hits /login. Verification: ruff clean, 1749 passed, coverage 94.66%.
GeiserX
added a commit
that referenced
this pull request
Aug 5, 2026
… (CashPilot-sux) (#121) Move the self-contained SSRF/worker-URL guard (policy constants, allowlist parsing, IP classification, _validate_worker_url, _pin_url_to_ip) out of the main.py god module into a focused, independently unit-testable app/worker_proxy.py. main.py's _get_verified_worker_url composes them; it stays in main because it also needs FLEET_API_KEY + database. worker_proxy imports nothing from main, so no new import cycle is introduced. Behavior-preserving: 1172 tests green. Test seams that referenced the moved symbols via app.main (the socket-getaddrinfo patches and the strict-mode/allowlist tests mutating the policy constants) now point at app.worker_proxy; the _validate_worker_url/_pin_url_to_ip patches keep working through main's import binding. This is the architect-endorsed least-coupled extraction from bead CashPilot-sux. The benign, documented main->routers->main import cycle is intentionally left as-is (resolving it risks the ~40 app.main.* test seams for no correctness gain).
GeiserX
added a commit
that referenced
this pull request
Aug 5, 2026
…ux) (#177) [skip ci] The SSRF/worker-URL extraction this bead also called for already shipped in PR #121. What remained was the cycle, and the interesting part is how small the real coupling turned out to be. The routers reached into app.main for templates, client_ip, the auth guards, database, metrics, setup_token and the login rate limiter. Every one of those except the last was ALREADY a re-export of something in app.deps or a plain module — app.main was just a pass-through. So the routers now import their dependencies directly, and moving one module-level dict is what actually removes the cycle rather than relocating it. The rate limiter lives in app.login_rate_limit and imports nothing from the app, so it cannot be pulled back into a cycle later. A test asserts both: that no router imports main, and that the new module has no app-level imports. The seams were the risk. app.main re-exports _login_attempts BY REFERENCE, not as a copy, because a conftest fixture clears app.main._login_attempts between tests. A copy would have left that fixture clearing an object nothing reads, and every later test would silently inherit the previous one's state — flakiness that surfaces much later and is very hard to place. A test pins the identity. One seam did legitimately move: a test patched app.main._check_login_rate, which no longer intercepts anything now that the router calls the function where it lives. Patching a name in main's namespace never affected the other module. That test now patches app.login_rate_limit.check_login_rate — one explicit update, not a silent behaviour change. Two things the mechanical rename got wrong, both caught by the suite rather than by reading: * app.setup_token collides with a Form parameter also named setup_token inside do_register, so a bare import looked unused, was removed, and the other use became a NameError. Imported under an alias, with a comment saying why. * The auth router's docstring still described the old arrangement. Rewritten to say what is now true. Behaviour is unchanged and tested as such: the window, the limit, per-address counting, and the deliberate use of a plain dict rather than a defaultdict so an aged-out bucket is removed instead of leaking a permanent key for every address that ever hits /login. Verification: ruff clean, 1749 passed, coverage 94.66%.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Splits a cohesive, self-contained slice out of the
main.pygod module — the architect-endorsed least-coupled candidate from beadCashPilot-sux.What moved
The SSRF/worker-URL guard → new
app/worker_proxy.py:_WORKER_URL_POLICY, metadata/loopback block sets, allowlist),_parse_worker_allowlist,_normalize_ip,_assert_ip_not_blocked,_assert_ip_strict_allowed,_validate_worker_url(DNS-rebinding-safe validation),_pin_url_to_ip.main.py's_get_verified_worker_urlcomposes them and stays in main (it also needsFLEET_API_KEY+database).worker_proxyimports nothing frommain, so no new import cycle. main.py drops ~160 lines and the SSRF policy is now isolated and unit-testable on its own.Test seams
app.main.socket.getaddrinfopatches →app.worker_proxy.socket(that's where_validate_worker_urlresolves the host).mainalias toapp.worker_proxy(where_validate_worker_urlreads them)._validate_worker_url/_pin_url_to_ippatches keep working viamain's import binding — unchanged.Verification
Behavior-preserving: 1172 tests green;
ruff check+ruff format --checkclean; verifiedworker_proxyimports nothing fromapp.main.Scope
This lands the module-extraction half of
sux. The other half — resolving themain → routers → mainimport cycle — is intentionally left as-is: it's benign and documented, and breaking it churns ~40app.main.*test seams for no correctness gain (per the architect review). The bead can close on the extraction or stay open for the cosmetic cycle cleanup — your call.Addresses bead CashPilot-sux (extraction half).