fix(api): query raw DbGateway in admin_test_gateway to avoid decode_auth crash on masked auth_value#3544
Merged
crivetimihai merged 3 commits intoIBM:mainfrom Mar 9, 2026
Conversation
…uth crash on masked auth_value Signed-off-by: Oriol Morros Vilaseca <OM368@student.aru.ac.uk>
…nch in admin_test_gateway Cover the three new code paths introduced by the decode_auth fix: - dict auth_value (raw DbGateway JSON) → headers.update directly - str auth_value → decode_auth fallback - auth_type=None gateway → no auth headers added Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
a9ef4ff to
4065954
Compare
Member
Maintainer changesRebased onto 1.
|
4065954 to
d7a7b59
Compare
crivetimihai
previously approved these changes
Mar 9, 2026
Address Codex review findings: - Restore DbGateway.enabled filter that was dropped when replacing get_first_gateway_by_url() with a direct query, preventing disabled gateways from being matched for credential injection. - Add test for header merge behavior: caller-supplied headers are preserved and stored gateway auth takes precedence. - Add test verifying the enabled filter is present in the compiled query. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
d7a7b59 to
62831e0
Compare
MohanLaksh
pushed a commit
that referenced
this pull request
Mar 12, 2026
…uth crash on masked auth_value (#3544) * fix(api): query raw DbGateway in admin_test_gateway to avoid decode_auth crash on masked auth_value Signed-off-by: Oriol Morros Vilaseca <OM368@student.aru.ac.uk> * test: add differential coverage for basic/bearer/authheaders auth branch in admin_test_gateway Cover the three new code paths introduced by the decode_auth fix: - dict auth_value (raw DbGateway JSON) → headers.update directly - str auth_value → decode_auth fallback - auth_type=None gateway → no auth headers added Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix: restore enabled filter in gateway lookup and add regression tests Address Codex review findings: - Restore DbGateway.enabled filter that was dropped when replacing get_first_gateway_by_url() with a direct query, preventing disabled gateways from being matched for credential injection. - Add test for header merge behavior: caller-supplied headers are preserved and stored gateway auth takes precedence. - Add test verifying the enabled filter is present in the compiled query. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> --------- Signed-off-by: Oriol Morros Vilaseca <OM368@student.aru.ac.uk> Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> Co-authored-by: Mihai Criveti <crivetimihai@gmail.com>
Yosiefeyob
pushed a commit
that referenced
this pull request
Mar 13, 2026
…uth crash on masked auth_value (#3544) * fix(api): query raw DbGateway in admin_test_gateway to avoid decode_auth crash on masked auth_value Signed-off-by: Oriol Morros Vilaseca <OM368@student.aru.ac.uk> * test: add differential coverage for basic/bearer/authheaders auth branch in admin_test_gateway Cover the three new code paths introduced by the decode_auth fix: - dict auth_value (raw DbGateway JSON) → headers.update directly - str auth_value → decode_auth fallback - auth_type=None gateway → no auth headers added Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix: restore enabled filter in gateway lookup and add regression tests Address Codex review findings: - Restore DbGateway.enabled filter that was dropped when replacing get_first_gateway_by_url() with a direct query, preventing disabled gateways from being matched for credential injection. - Add test for header merge behavior: caller-supplied headers are preserved and stored gateway auth takes precedence. - Add test verifying the enabled filter is present in the compiled query. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> --------- Signed-off-by: Oriol Morros Vilaseca <OM368@student.aru.ac.uk> Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> Co-authored-by: Mihai Criveti <crivetimihai@gmail.com> Signed-off-by: Yosief Eyob <yosiefogbazion@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔗 Related Issue Closes #3539
📝 Summary
admin_test_gatewaycrashed withValueError: Nonce must be between 8 and 128 bytesbecause it calleddecode_auth()on a masked
auth_value("*****") returned byget_first_gateway_by_url(). This PR queries the rawDbGatewayORMobject directly and guards the
decode_authcall with an explicitauth_typecheck, fixing the crash for allgateways (with and without auth).
🏷️ Type of Change
🧪 Verification
make lintmake testmake coverage✅ Checklist
make black isort pre-commit)📓 Notes (optional)
Root cause:
get_first_gateway_by_url()returns aGatewayRead.masked()whereauth_value="*****". Passing thatto
decode_auth()base64-decodes it to a 3-byte payload, then AES-GCM fails extracting a 12-byte nonce.Fix:
gateway_service.get_first_gateway_by_url()with a directselect(DbGateway)query to get the unmaskedauth value
elsewithelif gateway.auth_type in ("basic", "bearer", "authheaders")so gateways with noauth skip decryption entirely
dictandstrauth_valueformats from the raw DB objectThe 4
TestPaginationSwapStylefailures are pre-existing on upstream main and unrelated to this change.