izteamslots 1.5.0 → 1.5.2

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [1.5.2](https://github.com/izzzzzi/izTeamSlots/compare/v1.5.1...v1.5.2) (2026-03-06)
+
+
+### Bug Fixes
+
+* security and thread-safety improvements from code review ([6356bfd](https://github.com/izzzzzi/izTeamSlots/commit/6356bfd9eded9379fe1424b20f954cec8e847c8b))
+
+## [1.5.1](https://github.com/izzzzzi/izTeamSlots/compare/v1.5.0...v1.5.1) (2026-03-06)
+
+
+### Bug Fixes
+
+* use self.password_prefix in boomlify generate() instead of hardcoded string ([de0098a](https://github.com/izzzzzi/izTeamSlots/commit/de0098ad620ee3010c359155b726f097b15fb13f))
+
 # [1.5.0](https://github.com/izzzzzi/izTeamSlots/compare/v1.4.0...v1.5.0) (2026-03-06)
 
 

package/backend/account_store.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import json
 import shutil
+import threading
 import uuid
 from dataclasses import dataclass
 from datetime import datetime, timezone
@@ -46,6 +47,7 @@ class AccountStore:
         self.base_dir = base_dir
         self.admin_dir = base_dir / "admin"
         self.worker_dir = base_dir / "worker"
+        self._lock = threading.Lock()
         self.admin_dir.mkdir(parents=True, exist_ok=True)
         self.worker_dir.mkdir(parents=True, exist_ok=True)
 
@@ -113,49 +115,52 @@ class AccountStore:
         )
 
     def add_admin(self, email: str, password: str) -> AdminAccount:
-        index = self._read_index(self.admin_dir)
-        if email in index:
-            raise ValueError(f"Админ {email} уже существует")
-        account_id = uuid.uuid4().hex
-        now = datetime.now(timezone.utc).isoformat()
-        index[email] = {"id": account_id, "created_at": now}
-        self._write_index(self.admin_dir, index)
-        account_dir = self.admin_dir / account_id
-        self._write_meta(account_dir, {"email": email, "password": password})
-        return AdminAccount(id=account_id, email=email, password=password, created_at=now)
+        with self._lock:
+            index = self._read_index(self.admin_dir)
+            if email in index:
+                raise ValueError(f"Админ {email} уже существует")
+            account_id = uuid.uuid4().hex
+            now = datetime.now(timezone.utc).isoformat()
+            index[email] = {"id": account_id, "created_at": now}
+            self._write_index(self.admin_dir, index)
+            account_dir = self.admin_dir / account_id
+            self._write_meta(account_dir, {"email": email, "password": password})
+            return AdminAccount(id=account_id, email=email, password=password, created_at=now)
 
     def update_admin(self, account: AdminAccount) -> None:
-        index = self._read_index(self.admin_dir)
-        if account.email not in index:
-            raise ValueError(f"Админ {account.email} не найден")
-        info = index[account.email]
-        if account.last_login:
-            info["last_login"] = account.last_login
-        self._write_index(self.admin_dir, index)
-        account_dir = self.admin_dir / info["id"]
-        meta: dict[str, Any] = {
-            "email": account.email,
-            "password": account.password,
-        }
-        if account.access_token is not None:
-            meta["access_token"] = account.access_token
-        if account.workspace_id is not None:
-            meta["workspace_id"] = account.workspace_id
-        if account.account_id is not None:
-            meta["account_id"] = account.account_id
-        if account.workspaces is not None:
-            meta["workspaces"] = account.workspaces
-        self._write_meta(account_dir, meta)
+        with self._lock:
+            index = self._read_index(self.admin_dir)
+            if account.email not in index:
+                raise ValueError(f"Админ {account.email} не найден")
+            info = index[account.email]
+            if account.last_login:
+                info["last_login"] = account.last_login
+            self._write_index(self.admin_dir, index)
+            account_dir = self.admin_dir / info["id"]
+            meta: dict[str, Any] = {
+                "email": account.email,
+                "password": account.password,
+            }
+            if account.access_token is not None:
+                meta["access_token"] = account.access_token
+            if account.workspace_id is not None:
+                meta["workspace_id"] = account.workspace_id
+            if account.account_id is not None:
+                meta["account_id"] = account.account_id
+            if account.workspaces is not None:
+                meta["workspaces"] = account.workspaces
+            self._write_meta(account_dir, meta)
 
     def delete_admin(self, email: str) -> None:
-        index = self._read_index(self.admin_dir)
-        info = index.pop(email, None)
-        if not info:
-            return
-        self._write_index(self.admin_dir, index)
-        account_dir = self.admin_dir / info["id"]
-        if account_dir.exists():
-            shutil.rmtree(account_dir)
+        with self._lock:
+            index = self._read_index(self.admin_dir)
+            info = index.pop(email, None)
+            if not info:
+                return
+            self._write_index(self.admin_dir, index)
+            account_dir = self.admin_dir / info["id"]
+            if account_dir.exists():
+                shutil.rmtree(account_dir)
 
     def get_admin_profile_dir(self, account: AdminAccount) -> Path:
         profile_dir = self.admin_dir / account.id / "browser_profile"
@@ -203,63 +208,66 @@ class AccountStore:
         )
 
     def add_worker(self, email: str, password: str, admin_email: str) -> WorkerAccount:
-        index = self._read_index(self.worker_dir)
-        if email in index:
-            raise ValueError(f"Worker {email} уже существует")
-        worker_id = uuid.uuid4().hex
-        now = datetime.now(timezone.utc).isoformat()
-        index[email] = {
-            "id": worker_id,
-            "status": "created",
-            "admin_email": admin_email,
-            "created_at": now,
-        }
-        self._write_index(self.worker_dir, index)
-        account_dir = self.worker_dir / worker_id
-        self._write_meta(account_dir, {
-            "email": email,
-            "password": password,
-            "status": "created",
-        })
-        return WorkerAccount(
-            id=worker_id, email=email, password=password,
-            admin_email=admin_email, created_at=now,
-        )
+        with self._lock:
+            index = self._read_index(self.worker_dir)
+            if email in index:
+                raise ValueError(f"Worker {email} уже существует")
+            worker_id = uuid.uuid4().hex
+            now = datetime.now(timezone.utc).isoformat()
+            index[email] = {
+                "id": worker_id,
+                "status": "created",
+                "admin_email": admin_email,
+                "created_at": now,
+            }
+            self._write_index(self.worker_dir, index)
+            account_dir = self.worker_dir / worker_id
+            self._write_meta(account_dir, {
+                "email": email,
+                "password": password,
+                "status": "created",
+            })
+            return WorkerAccount(
+                id=worker_id, email=email, password=password,
+                admin_email=admin_email, created_at=now,
+            )
 
     def update_worker(self, account: WorkerAccount) -> None:
-        index = self._read_index(self.worker_dir)
-        if account.email not in index:
-            raise ValueError(f"Worker {account.email} не найден")
-        info = index[account.email]
-        info["status"] = account.status
-        if account.admin_email is not None:
-            info["admin_email"] = account.admin_email
-        else:
-            info.pop("admin_email", None)
-        self._write_index(self.worker_dir, index)
-        account_dir = self.worker_dir / info["id"]
-        meta: dict[str, Any] = {
-            "email": account.email,
-            "password": account.password,
-            "status": account.status,
-        }
-        if account.openai_password is not None:
-            meta["openai_password"] = account.openai_password
-        if account.access_token is not None:
-            meta["access_token"] = account.access_token
-        if account.workspace_id is not None:
-            meta["workspace_id"] = account.workspace_id
-        self._write_meta(account_dir, meta)
+        with self._lock:
+            index = self._read_index(self.worker_dir)
+            if account.email not in index:
+                raise ValueError(f"Worker {account.email} не найден")
+            info = index[account.email]
+            info["status"] = account.status
+            if account.admin_email is not None:
+                info["admin_email"] = account.admin_email
+            else:
+                info.pop("admin_email", None)
+            self._write_index(self.worker_dir, index)
+            account_dir = self.worker_dir / info["id"]
+            meta: dict[str, Any] = {
+                "email": account.email,
+                "password": account.password,
+                "status": account.status,
+            }
+            if account.openai_password is not None:
+                meta["openai_password"] = account.openai_password
+            if account.access_token is not None:
+                meta["access_token"] = account.access_token
+            if account.workspace_id is not None:
+                meta["workspace_id"] = account.workspace_id
+            self._write_meta(account_dir, meta)
 
     def delete_worker(self, email: str) -> None:
-        index = self._read_index(self.worker_dir)
-        info = index.pop(email, None)
-        if not info:
-            return
-        self._write_index(self.worker_dir, index)
-        account_dir = self.worker_dir / info["id"]
-        if account_dir.exists():
-            shutil.rmtree(account_dir)
+        with self._lock:
+            index = self._read_index(self.worker_dir)
+            info = index.pop(email, None)
+            if not info:
+                return
+            self._write_index(self.worker_dir, index)
+            account_dir = self.worker_dir / info["id"]
+            if account_dir.exists():
+                shutil.rmtree(account_dir)
 
     def get_worker_profile_dir(self, account: WorkerAccount) -> Path:
         profile_dir = self.worker_dir / account.id / "browser_profile"

package/backend/jobs.py

@@ -67,7 +67,6 @@ class JobManager:
                     {
                         "job_id": job_id,
                         "error": message,
-                        "traceback": tb,
                         "log_path": job_logger.rel_path,
                     },
                 )

package/backend/mail/boomlify.py

@@ -133,7 +133,7 @@ class BoomlifyProvider(MailProvider):
         if not email or not email_id:
             raise MailError(f"Unexpected Boomlify create response: {raw}")
 
-        return Mailbox(email=email, password=f"boomlify:{email_id}")
+        return Mailbox(email=email, password=f"{self.password_prefix}{email_id}")
 
     def inbox(self, mailbox: Mailbox) -> Inbox:
         email_id = self._extract_mailbox_id(mailbox)

package/backend/rpc_server.py

@@ -72,7 +72,7 @@ class RPCServer:
             masked = ""
             if value:
                 masked = value[:4] + "***" + value[-4:] if len(value) > 12 else "***"
-            items.append({"key": key, "label": label, "value": value, "masked": masked})
+            items.append({"key": key, "label": label, "masked": masked})
         return {"items": items, "path": str(self._settings_path())}
 
     def _set_setting(self, key: str, value: str) -> None:
@@ -228,7 +228,9 @@ class RPCServer:
 
         if m == "settings.set":
             key = self._as_str_param(p, "key")
-            value = self._as_str_param(p, "value")
+            value = p.get("value")
+            if not isinstance(value, str):
+                raise RPCError(-32602, "Invalid params", {"details": "'value' must be string"})
             self._set_setting(key, value)
             return make_success_response(req.request_id, {"ok": True})
 
@@ -268,10 +270,7 @@ class RPCServer:
                     RPCError(
                         -32000,
                         "Server error",
-                        {
-                            "details": str(e),
-                            "traceback": tb,
-                        },
+                        {"details": str(e)},
                     ),
                 )
 

package/backend/ui_facade.py

@@ -221,14 +221,24 @@ class UIFacade:
         log(f"Браузер {label} открыт. Закройте окно браузера для возврата.")
         wait_for_browser_close(context, log=log)
 
+    def _replace_manager(self, manager: SlotManager) -> None:
+        if self.manager:
+            try:
+                self.manager.close()
+            except Exception:
+                pass
+        self.manager = manager
+
     def login_admin(self, email: str, log: LogFunc) -> None:
-        self.manager = SlotManager(store=self.store, admin_email=email, log=log)
-        self.manager.login_admin()
+        manager = SlotManager(store=self.store, admin_email=email, log=log)
+        self._replace_manager(manager)
+        manager.login_admin()
         self.sync_codex_files()
 
     def login_admin_manual(self, email: str, log: LogFunc) -> None:
-        self.manager = SlotManager(store=self.store, admin_email=email, log=log)
-        self.manager.login_admin_manual()
+        manager = SlotManager(store=self.store, admin_email=email, log=log)
+        self._replace_manager(manager)
+        manager.login_admin_manual()
         self.sync_codex_files()
 
     def run_slots_pipeline(
@@ -238,7 +248,8 @@ class UIFacade:
         log: LogFunc,
         progress: ProgressFunc | None = None,
     ) -> dict[str, int]:
-        self.manager = SlotManager(store=self.store, admin_email=admin_email, log=log, headless=False)
+        manager = SlotManager(store=self.store, admin_email=admin_email, log=log, headless=False)
+        self._replace_manager(manager)
         ok = 0
         for i in range(count):
             slot_no = i + 1
@@ -246,11 +257,11 @@ class UIFacade:
             if progress:
                 progress(slot_no, count, f"slot {slot_no}/{count}")
             try:
-                self.manager.create_invite_login_one()
+                manager.create_invite_login_one()
                 ok += 1
             except Exception as e:
                 log(f"Ошибка: {e}")
-        self.manager._close_admin_page()
+        manager._close_admin_page()
         log(f"Готово: {ok}/{count} слотов")
         self.sync_codex_files()
         return {"ok": ok, "total": count}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "izteamslots",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "description": "ChatGPT Team slot management — automated invite, register, OAuth login & codex token pipeline",
   "bin": {
     "izteamslots": "bin/izteamslots.mjs"

package/ui/src/menus/types.ts

@@ -50,7 +50,6 @@ export interface MailAccountRow {
 export interface SettingItem {
   key: string
   label: string
-  value: string
   masked: string
 }
 

package/ui/src/screens/MainScreen.ts

@@ -375,7 +375,7 @@ export class MainScreen {
 
   private async loadSettings() {
     try {
-      const result = await this.rpc.request<{ items: Array<{ key: string; label: string; value: string; masked: string }> }>("settings.get")
+      const result = await this.rpc.request<{ items: Array<{ key: string; label: string; masked: string }> }>("settings.get")
       this.state = { ...this.state, settings: result.items }
     } catch (error) {
       this.pushLog(`Ошибка загрузки настроек: ${String(error)}`)