delete session security fix #560
Conversation
Codecov ReportAll modified and coverable lines are covered by tests ✅ ✅ All tests successful. No failed tests found. 📢 Thoughts on this report? Let us know! |
Codecov ReportAll modified and coverable lines are covered by tests ✅
✅ All tests successful. No failed tests found. Additional details and impacted files@@ Coverage Diff @@
## main #560 +/- ##
=======================================
Coverage 91.32% 91.33%
=======================================
Files 599 599
Lines 15940 15951 +11
=======================================
+ Hits 14558 14569 +11
Misses 1382 1382
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
Codecov ReportAll modified and coverable lines are covered by tests ✅
✅ All tests successful. No failed tests found @@ Coverage Diff @@
## main #560 +/- ##
=======================================
Coverage 91.32% 91.33%
=======================================
Files 599 599
Lines 15940 15951 +11
=======================================
+ Hits 14558 14569 +11
Misses 1382 1382
Flags with carried forward coverage won't be shown. Click here to find out more.
|
| @@ -1,13 +1,15 @@ | |||
| import logging | |||
There was a problem hiding this comment.
Entire file is ruff and mypy changes
Codecov ReportAll modified and coverable lines are covered by tests ✅
✅ All tests successful. No failed tests found. Additional details and impacted files@@ Coverage Diff @@
## main #560 +/- ##
=====================================
Coverage 95.82 95.82
=====================================
Files 777 777
Lines 17258 17269 +11
=====================================
+ Hits 16537 16548 +11
Misses 721 721
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
| if not self.current_user.is_authenticated: | ||
| raise Unauthenticated() | ||
|
|
||
| @sync_to_async | ||
| def execute(self, sessionid: int): | ||
| def execute(self, sessionid: int) -> None: |
There was a problem hiding this comment.
I thought there was a mypy rule that makes "return as none" implicit if no type is presented?
I could see it either way tho, related thread here: python/mypy#7511
There was a problem hiding this comment.
Yeah we added the warn_no_return to the tests, I think we shouldn't have that for these files. Its not always obvious a function returns None or not, unlike test functions.
There was a problem hiding this comment.
Yeah fair enough, Im good to keep as is
| from codecov_auth.views.okta import auth as okta_basic_auth | ||
| from codecov_auth.views.okta import validate_id_token |
There was a problem hiding this comment.
how come we split this to a separate line?
There was a problem hiding this comment.
Uh ruff did that..
github-merge-queue
bot
removed this pull request from the merge queue due to failed status checks
Signed-off-by: JerrySentry <jerry.feng@sentry.io>
Signed-off-by: JerrySentry <jerry.feng@sentry.io>
Signed-off-by: JerrySentry <jerry.feng@sentry.io>
Signed-off-by: JerrySentry <jerry.feng@sentry.io>
Signed-off-by: JerrySentry <jerry.feng@sentry.io>
Signed-off-by: JerrySentry <jerry.feng@sentry.io>
* adding logs for debugging * change log level from debug to info * make token slice safer * remove troubleshooting logs Signed-off-by: JerrySentry <jerry.feng@sentry.io>
* fix scheduled details key w/ stripe version upgrade * add other test case * remove print Signed-off-by: JerrySentry <jerry.feng@sentry.io>
Pull request was closed
fixes: https://github.com/codecov/internal-issues/issues/469
Only allow sessions to be deleted if they are belonging to the authenticated user.
Legal Boilerplate
Look, I get it. The entity doing business as "Sentry" was incorporated in the State of Delaware in 2015 as Functional Software, Inc. In 2022 this entity acquired Codecov and as result Sentry is going to need some rights from me in order to utilize my contributions in this PR. So here's the deal: I retain all rights, title and interest in and to my contributions, and by keeping this boilerplate intact I confirm that Sentry can use, modify, copy, and redistribute my contributions, under Sentry's choice of terms.