8b84378fe1
Elevate MiroFish/CrowdSight from single-container dev to a SaaS foundation: - Local memory backend (Zep-compatible): memory services/models, local graph builder + updater, AgentActivity seam, import-boundary isolation; Zep stays default, local is opt-in behind MEMORY_BACKEND. Semantic parity not yet proven. - Durable product persistence: projects/simulations/reports schema (migration 0007) + tenant/owner-scoped ProductRepository + dual-write + scoped_project read-first + ArtifactStore abstraction; durable JobQueue + worker.py. - SaaS hardening: durable RateLimiter (wired to login), UsageService (LLM accounting), redacted AuditService, idempotency, CORS allowlist, safe API errors, single-use PasswordResetService + endpoints (covers invite-pending). - Exactly 3 roles (super_admin/admin/user) with tenant authz policy. - Admin UI: GET/POST/PATCH /api/admin/users + GET/PUT /api/admin/settings (super-admin only, encrypted/masked); AdminView.vue + SettingsView.vue with admin/super-admin route guards, th/en i18n. - Production deploy topology: multi-stage Dockerfile (frontend build + gunicorn wsgi + nginx SPA-proxy + supervisord worker), backend/wsgi.py, gunicorn dep. Backend 197 passed; frontend 10 tests + build green. ruff unavailable (gap). No commit of credentials; secrets handled via env/.env.example. Deferred: Zep semantic A/B parity, object storage cutover, mobile QA, EasyPanel container build of deploy topology.
37 lines
1.0 KiB
Python
37 lines
1.0 KiB
Python
from pathlib import Path
|
|
import re
|
|
|
|
|
|
API_DIR = Path(__file__).parents[1] / "app" / "api"
|
|
|
|
|
|
UNSAFE_PATTERNS = (
|
|
re.compile(r"[\"']traceback[\"']\s*:\s*traceback\.format_exc\(\)"),
|
|
re.compile(r"[\"']error[\"']\s*:\s*str\((?:e|exc)\)"),
|
|
re.compile(r"t\([^\n]*error\s*=\s*str\((?:e|exc)\)"),
|
|
re.compile(r"(?:project|state)\.error\s*=\s*str\((?:e|exc)\)"),
|
|
re.compile(r"fail_task\([^\n]*str\((?:e|exc)\)"),
|
|
)
|
|
|
|
|
|
TARGET_FILES = (
|
|
"simulation.py",
|
|
"graph.py",
|
|
"report.py",
|
|
"agent_group.py",
|
|
"template.py",
|
|
)
|
|
|
|
|
|
def test_api_does_not_expose_or_persist_raw_exception_details():
|
|
findings = []
|
|
for filename in TARGET_FILES:
|
|
path = API_DIR / filename
|
|
source = path.read_text(encoding="utf-8")
|
|
for pattern in UNSAFE_PATTERNS:
|
|
for match in pattern.finditer(source):
|
|
line = source.count("\n", 0, match.start()) + 1
|
|
findings.append(f"{filename}:{line}:{match.group(0)}")
|
|
|
|
assert findings == [], "unsafe exception details found:\n" + "\n".join(findings)
|