velocity-python 0.0.238__tar.gz → 0.0.240__tar.gz

{velocity_python-0.0.238/src/velocity_python.egg-info → velocity_python-0.0.240}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.0.238
+Version: 0.0.240
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.0.238 → velocity_python-0.0.240}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "velocity-python"
-version = "0.0.238"
+version = "0.0.240"
 authors = [
   { name="Velocity Team", email="info@codeclubs.org" },
 ]

{velocity_python-0.0.238 → velocity_python-0.0.240}/src/velocity/__init__.py

@@ -1,4 +1,4 @@
-__version__ = version = "0.0.238"
+__version__ = version = "0.0.240"
 
 from . import aws
 from . import db

{velocity_python-0.0.238 → velocity_python-0.0.240}/src/velocity/app/formbuilder/reshaper.py

@@ -168,7 +168,32 @@ def reshape_formbuilder_template(raw_row: Dict[str, Any]) -> Dict[str, Any]:
         if key.startswith("sys_"):
             del fb[key]
 
-    for key in ("url_slug", "url_slug_alternate"):
+    for key in (
+        "url_slug",
+        "url_slug_alternate",
+        # Administrative / validation metadata — not read by DonateMain frontend
+        "is_published",
+        "datetime_last_validated",
+        "last_validation_result",
+        "last_validation_reason",
+        # Backend-only: security / fraud prevention
+        "whitelist_end_date",
+        "recaptcha_version",
+        "recaptcha_v3_score_threshold",
+        # Backend-only: routing / campaign metadata
+        "campaign",
+        "sub_campaign",
+        # Backend-only: email receipts (server-side sending only)
+        "receipt_from_address",
+        "receipt_subject",
+        "receipt_body_text",
+        "mail_bcc",
+        # Backend-only: rally out-of-band receipts
+        "rally_receipt_from_address",
+        "rally_receipt_subject",
+        "rally_receipt_body_text",
+        "rally_mail_bcc",
+    ):
         fb.pop(key, None)
 
     return fb

{velocity_python-0.0.238 → velocity_python-0.0.240/src/velocity_python.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.0.238
+Version: 0.0.240
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.0.238 → velocity_python-0.0.240}/tests/test_formbuilder_reshaper.py

@@ -23,6 +23,9 @@ def _make_row(**overrides):
         "campaign": "2024",
         "sub_campaign": "",
         "is_published": True,
+        "datetime_last_validated": "2024-01-01T00:00:00Z",
+        "last_validation_result": "passed",
+        "last_validation_reason": "[]",
         "url_slug": "tigers-2024",
         "url_slug_alternate": "",
         "primary_color": "#003087",
@@ -135,6 +138,55 @@ class TestFieldStripping:
         assert "url_slug" not in result
         assert "url_slug_alternate" not in result
 
+    def test_admin_metadata_stripped(self):
+        row = _make_row(
+            is_published=True,
+            datetime_last_validated="2024-01-01T00:00:00Z",
+            last_validation_result="passed",
+            last_validation_reason="[]",
+        )
+        result = reshape_formbuilder_template(row)
+        assert "is_published" not in result
+        assert "datetime_last_validated" not in result
+        assert "last_validation_result" not in result
+        assert "last_validation_reason" not in result
+
+    def test_backend_only_fields_stripped(self):
+        """Fields used only on the server side must never reach the browser."""
+        row = _make_row(
+            whitelist_end_date="2024-12-31",
+            recaptcha_version="v3",
+            recaptcha_v3_score_threshold=0.5,
+            campaign="2024-annual",
+            sub_campaign="fall",
+            receipt_from_address="receipts@example.com",
+            receipt_subject="Thank you",
+            receipt_body_text="<p>Thank you!</p>",
+            mail_bcc="bcc@example.com",
+            rally_receipt_from_address="rally@example.com",
+            rally_receipt_subject="Rally receipt",
+            rally_receipt_body_text="<p>Rally!</p>",
+            rally_mail_bcc="rallybcc@example.com",
+        )
+        result = reshape_formbuilder_template(row)
+        backend_only = [
+            "whitelist_end_date",
+            "recaptcha_version",
+            "recaptcha_v3_score_threshold",
+            "campaign",
+            "sub_campaign",
+            "receipt_from_address",
+            "receipt_subject",
+            "receipt_body_text",
+            "mail_bcc",
+            "rally_receipt_from_address",
+            "rally_receipt_subject",
+            "rally_receipt_body_text",
+            "rally_mail_bcc",
+        ]
+        for field in backend_only:
+            assert field not in result, f"Backend-only field '{field}' must be stripped"
+
     def test_num_entries_added(self):
         row = _make_row()
         result = reshape_formbuilder_template(row)
@@ -249,11 +301,12 @@ class TestTopLevelFields:
         assert result["primary_color"] == "#003087"
         assert result["page_title"] == "Give Now"
 
-    def test_client_campaign_preserved(self):
+    def test_client_preserved(self):
+        """client is used by the frontend (RivalThermometer, Braintree display name)."""
         row = _make_row(client="TIGERS", campaign="2024")
         result = reshape_formbuilder_template(row)
         assert result["client"] == "TIGERS"
-        assert result["campaign"] == "2024"
+        assert "campaign" not in result  # campaign is backend-only routing metadata
 
     def test_unknown_custom_fields_preserved(self):
         """Extra columns added to the DB table should pass through untouched."""