refactor: break the main -> routers -> main import cycle (CashPilot-sux) - #177
Conversation
The SSRF/worker-URL extraction this bead also called for already shipped in PR #121. What remained was the cycle, and the interesting part is how small the real coupling turned out to be. The routers reached into app.main for templates, client_ip, the auth guards, database, metrics, setup_token and the login rate limiter. Every one of those except the last was ALREADY a re-export of something in app.deps or a plain module — app.main was just a pass-through. So the routers now import their dependencies directly, and moving one module-level dict is what actually removes the cycle rather than relocating it. The rate limiter lives in app.login_rate_limit and imports nothing from the app, so it cannot be pulled back into a cycle later. A test asserts both: that no router imports main, and that the new module has no app-level imports. The seams were the risk. app.main re-exports _login_attempts BY REFERENCE, not as a copy, because a conftest fixture clears app.main._login_attempts between tests. A copy would have left that fixture clearing an object nothing reads, and every later test would silently inherit the previous one's state — flakiness that surfaces much later and is very hard to place. A test pins the identity. One seam did legitimately move: a test patched app.main._check_login_rate, which no longer intercepts anything now that the router calls the function where it lives. Patching a name in main's namespace never affected the other module. That test now patches app.login_rate_limit.check_login_rate — one explicit update, not a silent behaviour change. Two things the mechanical rename got wrong, both caught by the suite rather than by reading: * app.setup_token collides with a Form parameter also named setup_token inside do_register, so a bare import looked unused, was removed, and the other use became a NameError. Imported under an alias, with a comment saying why. * The auth router's docstring still described the old arrangement. Rewritten to say what is now true. Behaviour is unchanged and tested as such: the window, the limit, per-address counting, and the deliberate use of a plain dict rather than a defaultdict so an aged-out bucket is removed instead of leaking a permanent key for every address that ever hits /login. Verification: ruff clean, 1749 passed, coverage 94.66%.
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
Warning Review limit reached
Next review available in: 25 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (7)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #177 +/- ##
==========================================
+ Coverage 94.64% 94.65% +0.01%
==========================================
Files 40 41 +1
Lines 5004 5017 +13
==========================================
+ Hits 4736 4749 +13
Misses 268 268
🚀 New features to boost your workflow:
|
…ux) (#177) [skip ci] The SSRF/worker-URL extraction this bead also called for already shipped in PR #121. What remained was the cycle, and the interesting part is how small the real coupling turned out to be. The routers reached into app.main for templates, client_ip, the auth guards, database, metrics, setup_token and the login rate limiter. Every one of those except the last was ALREADY a re-export of something in app.deps or a plain module — app.main was just a pass-through. So the routers now import their dependencies directly, and moving one module-level dict is what actually removes the cycle rather than relocating it. The rate limiter lives in app.login_rate_limit and imports nothing from the app, so it cannot be pulled back into a cycle later. A test asserts both: that no router imports main, and that the new module has no app-level imports. The seams were the risk. app.main re-exports _login_attempts BY REFERENCE, not as a copy, because a conftest fixture clears app.main._login_attempts between tests. A copy would have left that fixture clearing an object nothing reads, and every later test would silently inherit the previous one's state — flakiness that surfaces much later and is very hard to place. A test pins the identity. One seam did legitimately move: a test patched app.main._check_login_rate, which no longer intercepts anything now that the router calls the function where it lives. Patching a name in main's namespace never affected the other module. That test now patches app.login_rate_limit.check_login_rate — one explicit update, not a silent behaviour change. Two things the mechanical rename got wrong, both caught by the suite rather than by reading: * app.setup_token collides with a Form parameter also named setup_token inside do_register, so a bare import looked unused, was removed, and the other use became a NameError. Imported under an alias, with a comment saying why. * The auth router's docstring still described the old arrangement. Rewritten to say what is now true. Behaviour is unchanged and tested as such: the window, the limit, per-address counting, and the deliberate use of a plain dict rather than a defaultdict so an aged-out bucket is removed instead of leaking a permanent key for every address that ever hits /login. Verification: ruff clean, 1749 passed, coverage 94.66%.
1 participant
The SSRF/worker-URL extraction this bead also called for [already shipped in #121]. What remained was the cycle — and the interesting part is how small the real coupling turned out to be.
The routers reached into
app.mainfortemplates,client_ip, the auth guards,database,metrics,setup_tokenand the login rate limiter. Every one except the last was already a re-export of something inapp.depsor a plain module —app.mainwas just a pass-through.So the routers now import their dependencies directly, and moving one module-level dict is what actually removes the cycle rather than relocating it.
app.login_rate_limitimports nothing from the app, so it can't be pulled back into a cycle later. Tests assert both: no router importsmain, and the new module has no app-level imports.The seams were the real risk
app.mainre-exports_login_attemptsby reference, not as a copy — a conftest fixture clearsapp.main._login_attemptsbetween tests. A copy would have left that fixture clearing an object nothing reads, and every later test would silently inherit the previous one's state. That's flakiness which surfaces much later and is very hard to place. A test pins the identity.One seam did legitimately move. A test patched
app.main._check_login_rate, which no longer intercepts anything now that the router calls the function where it lives — patching a name inmain's namespace never affected the other module. That test now patchesapp.login_rate_limit.check_login_rate: one explicit update, not a silent behaviour change.Two things the mechanical rename got wrong
Both caught by the suite rather than by reading:
app.setup_tokencollides with aFormparameter of the same name insidedo_register, so the bare import looked unused, was auto-removed, and the other use became aNameError. Now imported under an alias, with a comment saying why.Behaviour unchanged
Tested as such: the window, the limit, per-address counting, and the deliberate plain dict (not a
defaultdict) so an aged-out bucket is removed rather than leaking a permanent key for every address that ever hits/login.Verification
ruff check .+ruff format --check .cleanpytest --cov=app --cov-fail-under=90→ 1749 passed, coverage 94.66%