fix: reject invalid readiness user payload (#77)

src/main.py

@@ -43,6 +43,8 @@ async def readiness():
         user = await asyncio.wait_for(
             current_user(), timeout=READINESS_TIMEOUT_SECONDS
         )
+        if not isinstance(user, dict) or not user.get("login"):
+            raise ValueError("Gitea current-user response did not include a login")
     except Exception as exc:
         timed_out = isinstance(exc, TimeoutError)
         error_message = (

tests/test_health.py

@@ -42,6 +42,23 @@ async def test_readiness_endpoint_returns_503_when_gitea_is_unavailable(monkeypa
     assert b'"error":"connection refused"' in response.body
 
 
+@pytest.mark.anyio
+async def test_readiness_endpoint_returns_503_for_null_current_user_payload(monkeypatch):
+    async def null_user():
+        return None
+
+    monkeypatch.setattr(main, "current_user", null_user)
+
+    response = await main.readiness()
+
+    assert response.status_code == 503
+    assert json.loads(response.body) == {
+        "status": "not_ready",
+        "service": "stackchain-dashboard",
+        "error": "Gitea current-user response did not include a login",
+    }
+
+
 @pytest.mark.anyio
 async def test_readiness_endpoint_times_out_and_cancels_stalled_gitea_check(monkeypatch):
     cancelled = asyncio.Event()