From 090a059c17345d5c137685215682ba3d501e3630 Mon Sep 17 00:00:00 2001 From: timmy Date: Thu, 6 Aug 2026 05:47:38 +0000 Subject: [PATCH] fix: reject invalid readiness user payload (#77) --- src/main.py | 2 ++ tests/test_health.py | 17 +++++++++++++++++ 2 files changed, 19 insertions(+) diff --git a/src/main.py b/src/main.py index 047d5f0..3128139 100644 --- a/src/main.py +++ b/src/main.py @@ -43,6 +43,8 @@ async def readiness(): user = await asyncio.wait_for( current_user(), timeout=READINESS_TIMEOUT_SECONDS ) + if not isinstance(user, dict) or not user.get("login"): + raise ValueError("Gitea current-user response did not include a login") except Exception as exc: timed_out = isinstance(exc, TimeoutError) error_message = ( diff --git a/tests/test_health.py b/tests/test_health.py index 0ac3564..db465d8 100644 --- a/tests/test_health.py +++ b/tests/test_health.py @@ -42,6 +42,23 @@ async def test_readiness_endpoint_returns_503_when_gitea_is_unavailable(monkeypa assert b'"error":"connection refused"' in response.body +@pytest.mark.anyio +async def test_readiness_endpoint_returns_503_for_null_current_user_payload(monkeypatch): + async def null_user(): + return None + + monkeypatch.setattr(main, "current_user", null_user) + + response = await main.readiness() + + assert response.status_code == 503 + assert json.loads(response.body) == { + "status": "not_ready", + "service": "stackchain-dashboard", + "error": "Gitea current-user response did not include a login", + } + + @pytest.mark.anyio async def test_readiness_endpoint_times_out_and_cancels_stalled_gitea_check(monkeypatch): cancelled = asyncio.Event() -- 2.43.0