Repository navigation
fix: stop returning stored rollback context from rollback and deployment apis - #23
Merged
Merged
Conversation
…ent apis Что: - rollback.delete больше не возвращает поле fullContext удаленного отката. - deployment.allByType загружает rollback без колонки fullContext, вместо частичной редакции только паролей реестров. - Удален неиспользуемый хелпер redactRollbackFullContextSecrets и его тест; добавлен регрессионный тест обоих эндпоинтов. Зачем: - fullContext - это снимок приложения на момент деплоя: env, buildArgs, buildSecrets, пароль Docker, refreshToken, customGitUrl, basic auth, содержимое mount-файлов, env окружения и проекта, токен метрик сервера и пароли реестров в открытом виде. UI читает из отката только rollbackId, поэтому эти данные не должны уходить в ответ API. Риски: - Внешние клиенты API, читавшие fullContext из этих ответов, больше его не получат. Сам откат не изменился: снимок по-прежнему хранится в базе и используется rollback(). - Пароли реестров все еще хранятся внутри fullContext в базе; перенос их загрузки на момент отката и очистка старых записей оставлены отдельной задачей. Проверки: - Команды и результаты: `CI=true bunx vitest run --config __test__/vitest.config.ts __test__/security/rollback-context-exposure.test.ts __test__/security/secret-redaction.test.ts` - 18 passed; новые тесты падают (2 failed) на роутерах из origin/AgentHits-Dev; `__test__/security __test__/deployment __test__/env` - 32 файла, 363 passed; `bun run typecheck` - exit 0; `bunx biome check` по измененным файлам - без ошибок. - Ограничения: реальный откат с Docker локально не запускался. What: - rollback.delete no longer returns the deleted rollback's fullContext field. - deployment.allByType loads the rollback without the fullContext column instead of partially redacting only registry passwords. - Removed the unused redactRollbackFullContextSecrets helper and its test; added a regression test for both endpoints. Why: - fullContext is a snapshot of the application at deploy time: env, buildArgs, buildSecrets, Docker password, refreshToken, customGitUrl, basic auth, mount file contents, environment and project env, server metrics token and plaintext registry passwords. The UI only reads rollbackId from a rollback, so this data must not be sent in API responses. Risks: - External API clients that read fullContext from these responses will no longer get it. The rollback itself is unchanged: the snapshot is still stored in the database and used by rollback(). - Registry passwords are still stored inside fullContext in the database; loading them at rollback time and scrubbing old rows is left as a separate task. Checks: - Commands and results: `CI=true bunx vitest run --config __test__/vitest.config.ts __test__/security/rollback-context-exposure.test.ts __test__/security/secret-redaction.test.ts` - 18 passed; the new tests fail (2 failed) against the routers from origin/AgentHits-Dev; `__test__/security __test__/deployment __test__/env` - 32 files, 363 passed; `bun run typecheck` - exit 0; `bunx biome check` on the changed files - no errors. - Limitations: a real rollback with Docker was not run locally. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is this PR about?
Two API responses returned the stored rollback snapshot (
rollback.fullContext). That snapshot is the whole application row at deploy time: env, buildArgs, buildSecrets, Docker password, refreshToken, customGitUrl, basic auth passwords, mount file contents, environment and project env, the server metrics token, and plaintext registry / build registry / rollback registry passwords (createRollbackloads them with credentials on purpose).rollback.deletereturned the full deleted rollback row. It now returns the same row withoutfullContext.deployment.allByTypereturnedfullContextwith only the registry passwords redacted. It now loads the rollback relation withcolumns: { fullContext: false }, so the snapshot is not read from the database at all (this query is polled every second by the deployments tab).redactRollbackFullContextSecretshad no other callers, so it is removed together with its unit test.The UI only reads
deployment.rollback.rollbackIdand whetherrollbackexists; it does not callrollback.delete. Nothing changes for owners, admins or members in the dashboard. The stored snapshot androllback()are unchanged, so rollbacks work the same way.Follow-up (not in this PR): registry passwords are still persisted inside
fullContext. Loading them at rollback time changes behaviour when a registry is edited or removed after the deploy, and old rows would need a data cleanup, so it is left as a separate task.Checks
CI=true bunx vitest run --config __test__/vitest.config.ts __test__/security/rollback-context-exposure.test.ts __test__/security/secret-redaction.test.ts: 18 passed.expected ... to not have property "fullContext") when the routers are restored fromorigin/AgentHits-Dev.__test__/security __test__/deployment __test__/env: 32 files, 363 passed.bun run typecheck: exit 0.bunx biome checkon the changed files: no errors.Rollout notes
fullContextfromrollback.deleteordeployment.allByTypeno longer receive it.🤖 Generated with Claude Code