Dependency Review

Scanned Files

No actionable comments were generated in the recent review. 🎉

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-15T01:53:24.084Z
Learning: Applies to src/synthorg/**/*.py : Use `copy.deepcopy()` at system boundaries (tool execution, LLM provider serialization, inter-agent delegation, serializing for persistence) for `dict`/`list` fields in frozen Pydantic models.

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-15T01:53:24.084Z
Learning: Applies to src/synthorg/**/*.py : Create new objects instead of mutating existing ones. For non-Pydantic internal collections (registries, `BaseTool`), use `copy.deepcopy()` at construction + `MappingProxyType` wrapping for read-only enforcement.

Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-15T01:53:24.084Z
Learning: Applies to src/synthorg/**/*.py : Use frozen Pydantic models for config/identity. Use separate mutable-via-copy models (using `model_copy(update=...)`) for runtime state that evolves. Never mix static config fields with mutable runtime fields.

sequenceDiagram
  participant Client
  participant App as "Litestar App"
  participant Handler as "Route / Exception Handler"
  participant Hook as "security_headers_hook"
  participant Response

  Client->>App: HTTP request
  App->>Handler: dispatch request
  Handler-->>App: response / exception
  App->>Hook: before_send(message, scope)
  Hook-->>App: write/overwrite security headers (choose CSP by path, add COOP for /docs)
  App-->>Response: finalize ASGI response
  Response-->>Client: HTTP response with security headers

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the application's security posture by centralizing and standardizing the application of security headers. By migrating from disparate Litestar mechanisms to a unified before_send hook, it guarantees that critical security policies, including Content-Security-Policy and various static headers, are present on all HTTP responses, regardless of whether they are successful, error-handling, or unmatched routes. This change closes a security gap where certain error responses previously lacked essential protections.

Highlights

• Unified Security Header Application: Replaced Litestar's response_headers and CSPMiddleware with a single before_send hook (security_headers_hook). This ensures all HTTP responses, including those from exception handlers (400, 500) and router-level 404/405 errors, consistently receive security headers, which was not previously the case.
• Enhanced Security Policies: Added Cross-Origin-Opener-Policy: same-origin to the static security headers and base-uri 'self' to both strict and relaxed Content-Security-Policy (CSP) definitions to prevent <base> tag injection.
• Header Overwrite Logic: Implemented header setting using headers[name] = value instead of headers.add() within the security_headers_hook to prevent duplicate headers if any middleware or handler attempts to set the same header.
• Improved Test Coverage: Introduced new comprehensive tests in TestSecurityHeadersHook to verify security headers across various HTTP response types (200, 400, 404, 405, 500) and confirmed that non-HTTP scopes (like WebSockets) are correctly skipped. CSP path boundary tests were also updated to reflect the new implementation.

Greptile Summary

This PR replaces Litestar's response_headers + the old CSPMiddleware ASGI class with a single before_send hook (security_headers_hook) that fires for every HTTP response, closing the security-header gap on exception-handler responses (400, 500) and router-level 404/405 that previously received no headers at all. It also hardens both CSP policies (object-src 'none', base-uri 'self') and adds Cross-Origin-Opener-Policy: same-origin globally with a targeted unsafe-none relaxation for /docs/ paths to accommodate Scalar UI.

Key changes:

• security_headers_hook correctly guards on both scope["type"] != ScopeType.HTTP and message["type"] != "http.response.start", is idempotent via overwrite semantics, and uses an immutable MappingProxyType for the static header set
• _DOCS_CSP and _API_CSP both now include object-src 'none' and base-uri 'self'; COOP is overridden to unsafe-none for docs paths only
• TestSecurityHeadersHook provides direct evidence that all 5 response categories (200, 400, 404, 405, 500) carry the full header set
• test_docs_path_relaxes_coop and test_api_path_keeps_strict_coop close the gap from the previous review round
• test_security_response_headers in test_app.py now derives its parametrize cases from _SECURITY_HEADERS directly, so it stays in sync automatically if the header set changes

Confidence Score: 5/5

• Safe to merge — the hook is correct, well-tested across all response categories, and all previous review findings have been fully addressed.
• The implementation is architecturally sound: before_send is the correct Litestar primitive for this problem (fires before the middleware stack for all HTTP responses), the guard conditions are correct, header overwrite semantics prevent duplicates, and the MappingProxyType prevents accidental runtime mutation of the header map. Both CSP policies have been hardened with object-src 'none' and base-uri 'self'. The COOP path-awareness for /docs/ is tested explicitly. Test coverage spans all five targeted response types (200, 400, 404, 405, 500) plus non-HTTP scope skipping and CSP path boundary cases. No new issues found beyond those addressed by previous review rounds.
• No files require special attention.

Important Files Changed

_{Last reviewed commit: 8438493}

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.67%. Comparing base (440c540) to head (8438493).
⚠️ Report is 7 commits behind head on main.
✅ All tests successful. No failed tests found.

@@            Coverage Diff             @@
##             main     #437      +/-   ##
==========================================
- Coverage   93.67%   93.67%   -0.01%     
==========================================
  Files         469      469              
  Lines       22214    22213       -1     
  Branches     2142     2144       +2     
==========================================
- Hits        20809    20808       -1     
  Misses       1094     1094              
  Partials      311      311              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.