fix: harden notify pipeline — edit truncation, timing-safe auth, stable assertions#131
fix: harden notify pipeline — edit truncation, timing-safe auth, stable assertions#131
Conversation
…le assertions - Add _truncate_notify_data() to truncate data["new_text"] (edit path), not just data["message"]["text"] (new_message path), preventing silent pg_notify failures on long edit payloads exceeding PostgreSQL 8KB limit - Switch /internal/push bearer token comparison to secrets.compare_digest() for timing-safe auth, consistent with the rest of the auth layer - Use stmt.text instead of str(stmt) for SQLAlchemy text() assertions, avoiding reliance on undocumented __str__ behavior - Add 3 new tests for edit notification truncation (55 total realtime tests) - Bump to v7.6.3 with CHANGELOG entry
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 19 minutes and 59 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (6)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #131 +/- ##
=======================================
Coverage 94.45% 94.46%
=======================================
Files 21 21
Lines 5931 5941 +10
=======================================
+ Hits 5602 5612 +10
Misses 329 329
🚀 New features to boost your workflow:
|
|
🐳 Dev images published!
The dev/test instance will pick up these changes automatically (Portainer GitOps). To test locally: docker pull drumsergio/telegram-archive:dev
docker pull drumsergio/telegram-archive-viewer:dev |
Summary
Follow-up to #123 (pg_notify bound parameters by @tondeaf). Addresses all findings from the 11-agent review swarm:
data["message"]["text"](new_message path), leavingdata["new_text"](edit path) unprotected. A 4096-char emoji edit could produce a ~16KB payload exceeding PostgreSQL's 8KB NOTIFY limit. Both paths now truncated via shared_truncate_notify_data()helper./internal/pushendpoint used!=for bearer token comparison; switched tosecrets.compare_digest()consistent with the rest of the auth layer.TextClause.textattribute — Replacedstr(stmt)withstmt.textfor SQLAlchemy SQL assertions, avoiding reliance on undocumented__str__behavior.Test plan