withcache 0.8.4__tar.gz → 0.8.6__tar.gz

{withcache-0.8.4 → withcache-0.8.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: withcache
-Version: 0.8.4
+Version: 0.8.6
 Summary: Operator-curated, URL-keyed artifact cache for a small lab (CUDA/ROCm/DOCA/firmware)
 Project-URL: Homepage, https://github.com/safl/withcache
 Author-email: "Simon A. F. Lund" <safl@safl.dk>

{withcache-0.8.4 → withcache-0.8.6}/deploy/Containerfile

@@ -12,6 +12,14 @@ COPY pyproject.toml README.md hatch_build.py /app/
 COPY src /app/src
 RUN pip install --no-cache-dir /app
 
+# curl: HEALTHCHECK below. ``-f`` maps any 4xx/5xx to a non-zero
+# exit without dumping a Traceback, matching the nbdmux sibling's
+# Pass 5 pattern; if a future /healthz ever grows a non-200 branch
+# (e.g. cache-disk-full check), no log-noise regression.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends curl \
+ && rm -rf /var/lib/apt/lists/*
+
 # Run as non-root; /data is the persistent volume for blobs + sqlite.
 RUN useradd --create-home --uid 10001 app \
  && mkdir -p /data && chown app:app /data
@@ -25,6 +33,6 @@ VOLUME ["/data"]
 # with WITHCACHE_SESSION_SECRET.
 
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
-  CMD python -c "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8081/healthz',timeout=2).status==200 else 1)"
+  CMD curl -fsS -o /dev/null --max-time 2 http://127.0.0.1:8081/healthz || exit 1
 
 ENTRYPOINT ["withcache-server", "--host", "0.0.0.0", "--port", "8081", "--data-dir", "/data"]

{withcache-0.8.4 → withcache-0.8.6}/shim/build.zig.zon

@@ -2,7 +2,7 @@
     .name = .withcache_shim,
     // Zig requires a literal here; keep it in lockstep with the project's
     // single source (src/withcache/__init__.py) via `make bump` / `make version-check`.
-    .version = "0.8.4",
+    .version = "0.8.6",
     .fingerprint = 0xd7d96c5ed212ccaa,
     .minimum_zig_version = "0.16.0",
     .paths = .{

{withcache-0.8.4 → withcache-0.8.6}/src/withcache/__init__.py

@@ -17,6 +17,6 @@ All modules are stdlib-only and self-contained.
 from . import oras
 from .client import blob_url, cache_base, is_cached, serve_url
 
-__version__ = "0.8.4"
+__version__ = "0.8.6"
 
 __all__ = ["__version__", "blob_url", "cache_base", "is_cached", "oras", "serve_url"]

{withcache-0.8.4 → withcache-0.8.6}/src/withcache/server.py

@@ -1087,7 +1087,13 @@ class Handler(http.server.BaseHTTPRequestHandler):
 
     def do_POST(self):
         parsed = urllib.parse.urlsplit(self.path)
-        form = self.read_form()
+        try:
+            form = self.read_form()
+        except ValueError:
+            # Duplicate field(s) -- reject with 400 rather than let
+            # a first-value-wins collapse hide a payload silently.
+            self.send_text(400, "malformed form (duplicate fields?)\n")
+            return
         if parsed.path == "/ui/login":
             self.handle_login_submit(form)
         elif parsed.path == "/ui/logout":
@@ -1208,8 +1214,11 @@ class Handler(http.server.BaseHTTPRequestHandler):
                 f"{Auth.COOKIE}={self.auth.make_token()}; HttpOnly; "
                 f"SameSite=Lax; Path=/; Max-Age={Auth.MAX_AGE}"
             )
-            self.redirect("/ui/cached", set_cookie=cookie)
+            # Log BEFORE the redirect so the line lands even if the
+            # client drops the connection mid-write, matching the
+            # ordering of the failure branch below.
             print(f"{self.address_string()} - login succeeded", flush=True)
+            self.redirect("/ui/cached", set_cookie=cookie)
         else:
             print(f"{self.address_string()} - login failed", flush=True)
             self.send_html(401, self.render_login(error="Invalid password."))
@@ -1310,9 +1319,19 @@ class Handler(http.server.BaseHTTPRequestHandler):
 
     # -- helpers -----------------------------------------------------------
     def read_form(self) -> dict:
+        """Parse form-encoded body into ``{key: value}``. Rejects
+        duplicate keys with ValueError -- an operator-facing form
+        never has repeated field names, so ``name=a&name=b`` is
+        either a bug or a client trying to hide a payload from a
+        naive read of the first value. Callers wrap the call and
+        turn a ValueError into a 400."""
         length = int(self.headers.get("Content-Length", 0) or 0)
         body = self.rfile.read(length).decode("utf-8") if length else ""
-        return {k: v[0] for k, v in urllib.parse.parse_qs(body).items()}
+        pairs = urllib.parse.parse_qs(body)
+        dups = [k for k, v in pairs.items() if len(v) > 1]
+        if dups:
+            raise ValueError(f"duplicate form field(s): {', '.join(sorted(dups))}")
+        return {k: v[0] for k, v in pairs.items()}
 
     def send_text(self, code: int, text: str):
         data = text.encode("utf-8")

{withcache-0.8.4 → withcache-0.8.6}/tests/test_withcache.py

@@ -31,6 +31,60 @@ from withcache import _shim, client, curlwithcache, server, wgetwithcache
 # --------------------------------------------------------------------------
 # Auth: signed-cookie round-trip, tamper + wrong-secret rejection, expiry
 # --------------------------------------------------------------------------
+class TestResolveSecret(unittest.TestCase):
+    """resolve_secret is the whole basis of the cookie-auth trust
+    boundary: the HMAC key that signs session tokens. Three branches
+    -- env-set, file-persisted, fresh-generation -- and a
+    security-adjacent invariant claimed in its docstring: 'a blank
+    env value must NOT silently weaken signing'. Mirrors nbdmux's
+    TestResolveSecret since the two functions are the same shape."""
+
+    def setUp(self):
+        self.tmpdir = tempfile.mkdtemp()
+        self._saved = os.environ.get("WITHCACHE_SESSION_SECRET")
+
+    def tearDown(self):
+        if self._saved is None:
+            os.environ.pop("WITHCACHE_SESSION_SECRET", None)
+        else:
+            os.environ["WITHCACHE_SESSION_SECRET"] = self._saved
+
+    def test_env_set_wins(self):
+        os.environ["WITHCACHE_SESSION_SECRET"] = "operator-chosen-secret"
+        self.assertEqual(server.resolve_secret(self.tmpdir), b"operator-chosen-secret")
+
+    def test_env_blank_falls_through_to_fresh_generation(self):
+        """The docstring promises a blank env value must NOT silently
+        weaken signing. A fresh secret must land under data_dir and
+        NOT be the empty string."""
+        os.environ["WITHCACHE_SESSION_SECRET"] = "   "
+        got = server.resolve_secret(self.tmpdir)
+        self.assertGreaterEqual(len(got), 32)
+        self.assertNotEqual(got, b"")
+        persisted = os.path.join(self.tmpdir, "session-secret")
+        self.assertTrue(os.path.exists(persisted))
+
+    def test_env_unset_generates_and_persists(self):
+        os.environ.pop("WITHCACHE_SESSION_SECRET", None)
+        got = server.resolve_secret(self.tmpdir)
+        self.assertGreaterEqual(len(got), 32)
+        with open(os.path.join(self.tmpdir, "session-secret"), "rb") as f:
+            self.assertEqual(f.read(), got)
+
+    def test_file_persisted_returned_on_second_call(self):
+        os.environ.pop("WITHCACHE_SESSION_SECRET", None)
+        first = server.resolve_secret(self.tmpdir)
+        second = server.resolve_secret(self.tmpdir)
+        self.assertEqual(first, second)
+
+    def test_persisted_file_permissions_are_private(self):
+        os.environ.pop("WITHCACHE_SESSION_SECRET", None)
+        server.resolve_secret(self.tmpdir)
+        path = os.path.join(self.tmpdir, "session-secret")
+        mode = os.stat(path).st_mode & 0o777
+        self.assertEqual(mode, 0o600)
+
+
 class TestAuth(unittest.TestCase):
     def test_token_roundtrip(self):
         a = server.Auth(b"secret-key", "pw")
@@ -1262,5 +1316,40 @@ class TestCatalogAdminEndpoints(unittest.TestCase):
         httpd2.server_close()
 
 
+class TestReadFormDuplicateKeys(unittest.TestCase):
+    """read_form rejects duplicate form keys so a first-value-wins
+    collapse can't hide a payload silently -- mirrors nbdmux's
+    Pass 6 hardening for cross-project parity."""
+
+    def setUp(self):
+        self.httpd, self.store = _start_withcache()
+        self.host = "127.0.0.1"
+        self.port = self.httpd.server_address[1]
+
+    def tearDown(self):
+        self.httpd.shutdown()
+        self.httpd.server_close()
+
+    def test_duplicate_form_field_returns_400(self):
+        import http.client
+
+        # Craft a raw body with duplicate ``url`` fields; urlencode +
+        # dict argument would collapse them client-side.
+        body = "url=https%3A%2F%2Fx%2Fa&url=https%3A%2F%2Fx%2Fb"
+        conn = http.client.HTTPConnection(self.host, self.port)
+        try:
+            conn.request(
+                "POST",
+                "/admin/fetch",
+                body=body,
+                headers={"Content-Type": "application/x-www-form-urlencoded"},
+            )
+            resp = conn.getresponse()
+            self.assertEqual(resp.status, 400)
+            resp.read()
+        finally:
+            conn.close()
+
+
 if __name__ == "__main__":
     unittest.main(verbosity=2)