gitea-admin/gh-christianlouis-docuelevate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,959 Commits 28 Branches 0 Tags
ea2dad0c088ca4f447abeefe0c7a59d59ff09912
Commit Graph

9 Commits

Author SHA1 Message Date
google-labs-jules[bot] d22175310a 🛡️ Sentinel: [HIGH] Fix Server-Side Request Forgery in IMAP connections 
🚨 Severity: HIGH
💡 Vulnerability: User-provided IMAP `host` in `_test_imap_connection` and `pull_inbox` was not validated against private IPs, creating an SSRF risk.
🎯 Impact: Attackers could abuse the endpoints to port-scan or interact with internal/private network services.
🔧 Fix: Integrated `is_private_ip` from `app.utils.network` to block connections resolving to private, loopback, link-local, or reserved IPs.
✅ Verification: Ran `test_imap_tasks.py` and `test_api_imap_accounts.py` successfully. Checked `ruff` output and diffs. Removed all scratch files from the commit.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-03-23 14:45:22 +00:00
copilot-swe-agent[bot] 93629ff440 fix: update test assertions and lint fixes for Starlette 1.0 TemplateResponse API 
Update test mocks to check kwargs["context"] instead of positional
args[1] for tests that verify auth.py and base.py wrapper behavior.
Fix B026 lint error by avoiding star-arg after keyword argument.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/DocuElevate/sessions/7b5f7e0d-89ad-43be-b68d-a9c0c5407a7e
 2026-03-23 13:14:25 +00:00
copilot-swe-agent[bot] 3aa5364e0c fix(auth): return 401 for API paths in require_login to prevent wrong post-login redirect 
The common.js fetch('/api/auth/whoami') probe on every page load was
overwriting the redirect_after_login session key with the API endpoint URL.
After login, users were sent to the JSON endpoint instead of the original page.

Fix: require_login now returns HTTP 401 for any /api/* path, consistent
with REST conventions, and never stores API URLs as the post-login redirect.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-03-08 09:51:23 +00:00
copilot-swe-agent[bot] 97f85ce74e feat(auth): auto-create admin user profiles with highest tier and complimentary flag 
- Add `is_complimentary` column to UserProfile model (migration 019)
- Update `_ensure_user_profile` to accept `is_admin` param; admins get
  highest subscription tier, is_complimentary=True, onboarding skipped
- Call `_ensure_user_profile` from all login paths (OAuth, local user, admin creds)
- Add `is_complimentary` to UserProfileUpsert schema, response helpers,
  list_users, get_user, upsert_user_profile in admin API
- Add complimentary toggle to admin users UI with gift badge in table
- Write 18 new tests covering complimentary plan and admin auto-creation
- Update SubscriptionTiers.md documentation

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-03-07 20:14:34 +00:00
copilot-swe-agent[bot] b1ce28f804 fix: resolve merge conflict with main, fix test failures 
- Merge main (pipelines feature) into branch, resolving conflicts in
  app/api/__init__.py and app/views/__init__.py by keeping all routers
  (onboarding + billing from our branch, pipelines from main)
- Fix migration 018 down_revision to depend on both 017_add_onboarding_fields
  and 017_add_pipelines (Alembic multi-head merge pattern)
- Fix test_auth_module.py: add multi_user_enabled=False to three admin-auth
  tests that call auth() directly without FastAPI DI
- Add missing SETTING_METADATA entries for allow_local_signup and all five
  Stripe config keys (fixes test_all_config_settings_have_metadata)

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-03-07 15:02:43 +00:00
copilot-swe-agent[bot] 6f197e69fc fix(tests): set multi_user_enabled=False in auth module tests that call auth() directly 2026-03-07 14:47:35 +00:00
copilot-swe-agent[bot] 43bc58770d refactor: consolidate linting tools into Ruff 
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-02-13 09:10:52 +00:00
copilot-swe-agent[bot] 604facf36f fix(test): fix task __wrapped__ calls, auth imports, mock chains, async markers, and rate limit mock 
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-02-12 13:03:26 +00:00
copilot-swe-agent[bot] 8e8a64969f feat: add comprehensive unit tests for tasks and auth modules 
- Add test_extract_metadata_gpt.py with 16 tests (7 passing)
- Add test_convert_pdf.py with 13 tests achieving 90.56% coverage
- Add test_embed_pdf_metadata.py with 10 tests achieving 46.81% coverage
- Add test_finalize_storage.py with 9 tests
- Add test_auth_module.py with 14 tests achieving 43.48% coverage

Coverage improvements:
- convert_to_pdf: 10% → 90.56%
- embed_metadata_into_pdf: 14.89% → 46.81%
- extract_metadata_with_gpt: 21.84% → 36.78%
- auth.py: 27.83% → 43.48%

43 tests passing, working on fixing remaining tests for full coverage

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
 2026-02-12 04:00:05 +00:00