Consent token files lack restrictive file permissions (+1 more)#90
Merged
Conversation
Add os.chmod(token_file, 0o600) after writing consent tokens. Also re-permission existing files on verify and list access. Closes #79
Use tempfile.NamedTemporaryFile(dir=user_data_dir) so decrypted DB files are in ~/.local/share/openeraseme/ rather than /tmp. Reduces exposure on shared systems when SIGKILL prevents cleanup. Closes #80
danieljustus
changed the title
- Add .pre-commit-config.yaml with detect-private-key hook - Add secrets-scan CI job using TruffleHog - Document pre-commit setup in README Closes #81
- Add command that checks: - Python version (>= 3.11) - Required dependencies installed - Config directory writable - Database accessible - Registry loadable - Environment variables set Closes #82
Improve error messages across the CLI to tell users what to do next: - 'Not found' errors now suggest the list command to discover valid IDs - Generic wrapped errors include context-specific next steps - Missing dependency errors include install instructions - Missing token/profile errors suggest the command to create them Files changed: - services/broker.py, reply.py, auto_confirm.py, manual_task.py - services/web_form.py, inbox.py, consent.py, captcha.py, scheduler.py - core/identity.py, adapters/web/confirmation_clicker.py Closes #83
Add --dry-run to commands that modify state: - run-web-form: Show form steps without executing - solve-captcha: Show captcha parameters without solving - schedule install: Show scheduler configs without installing - grant: Show token details without creating it Closes #84
- Create core/datetime_utils.py with unified format list - Replace _parse_dt in deadlines.py, _parse_ts in projection.py, _parse_date in himalaya.py with shared utility - Unify ISO 8601 and RFC 2822 email date formats Closes #85
Replace per-file mtime stat() calls (1,200+ per lookup) with a single directory mtime check. Directory mtime changes on add/remove/rename, covering the main registry update scenario. Closes #86
Replace full rebuild with incremental approach: - Find requests with events newer than their last projected event - Only rebuild state for those requests - Skip rebuild entirely when no new events exist Closes #87
Add _BROKER_FILE_CACHE keyed by (file_path, mtime) to avoid re-validating unchanged broker YAMLs on cache misses. Reduces cold-start validation from 1,200+ to only changed files. Closes #88
Add --batch-size parameter to limit tick processing per run: - run_tick() accepts optional batch_size LIMIT - CLI tick command gets --batch-size option - Prevents memory spikes on large campaigns Closes #89
- Fix 7 broker YAMLs with invalid email endpoints (notes moved to notes field) - Fix ruff lint errors: unused imports, extraneous f-string, long line - Fix E402 import-not-at-top-of-file in deadlines.py - Fix orchestrator to skip web_form-only brokers in plan_campaign - Filter eligible email brokers before applying max_brokers limit Refs PR #90
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bundles fixes for multiple open issues. The list below grows as commits land; every linked issue will close automatically on merge.
Milestone: v0.1.2