Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
#2172 - Push Celery Migration #2266
#2172 - Push Celery Migration #2266
Changes from 32 commits
f3019ce
e80ccc2
a1ceb86
04fd501
abad0f0
54efa68
9c5a073
507e5c2
d388b6a
21b8c24
d73fe3d
9f8dc2e
8c6c9d6
1b9e1ee
724dc33
70bddf5
badaaae
d21629e
f64dfd7
8b38fa2
cfec08d
a4cb75f
e17694e
6a9ba77
a22f5cf
e05d4ce
b1f2562
260d21c
4ac1ff8
199b765
805e040
7b4852d
d9a9c33
2bbba70
af738a8
ad7ad30
6aed1a4
8076deb
a126db8
a89ac4b
d2f2d22
c99f7df
e2ae94b
2f4efe0
3690d3d
41f0297
539e8f2
a7dffc1
99a5d0f
556471b
c5ce747
0f1cf98
c310886
d90ede0
5392409
bb6a0a1
5643965
27d888d
10254ad
f561628
f68e79f
70ad51f
6a9d081
685620d
a945b05
82b1abe
9c2a3da
5d66364
35afc98
c86e156
72c4eec
0edfd08
60dfd17
7dc9253
363fbe6
4b4e4e5
0909ebc
f79e030
88f7556
6b7fd34
152f5fd
33211c7
885d478
c2ad753
4c8040e
99df24a
eea2606
426bca0
98f2c88
2913a02
85a7655
0c774ff
6dbd8f3
6b02a97
df80697
b6b1f50
0c73498
936c75b
9f82c7a
8bc6eaf
285e790
2c6d960
314698e
dacadb5
c82550c
5eace56
558f147
500b82d
27223bb
f5daa41
File filter
Filter by extension
Conversations
Jump to
There are no files selected for viewing
Check warning
Code scanning / CodeQL
Reflected server-side cross-site scripting Medium
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Covered in tests
tests/app/internal/test_rest.py
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We need to resolve the CodeQL issue here. @k-macmillan maybe dismiss as false positive?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm not sure - This internal endpoint does log the header from the incoming request.
@k-macmillan
![Screenshot 2025-02-06 at 10 30 28 PM](https://private-user-images.githubusercontent.com/16658577/410745884-d57cedef-5713-4ba4-9e3f-1c7f795d0b81.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MzkyNjgwNTQsIm5iZiI6MTczOTI2Nzc1NCwicGF0aCI6Ii8xNjY1ODU3Ny80MTA3NDU4ODQtZDU3Y2VkZWYtNTcxMy00YmE0LTllM2YtMWM3Zjc5NWQwYjgxLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNTAyMTElMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjUwMjExVDA5NTU1NFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTEzMWYzZmQzZmM1ZmYxZjk0ZWM5ZWNkZWY1MTYyN2MzZTE5ZDQ1NGVhNTZmMjljMDIxMzgyOGY1YmVjNjk5MDkmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0In0.-V8hCfTG6yRyuXpG4y-wVAwW4edK8OMQ_tmkH1diKqc)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
My gut tells me this is not great.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We should never be logging the header since the headers all contain bearer tokens. But I don't think that is what CodeQL is complaining about.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@cris-oddball talk to @k-macmillan about this - and we decided to make a ticket to address this issue since the code throwing the error was not code written for this PR.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Created ticket for this
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please put the ticket number in a comment near this, so the next time it flags we won't create a new ticket. AC of the new ticket should include removal of the comment. You can fill out the ticket details after requesting re-review of this PR.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Updated and recreated the ticket in the team repo
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
should this be an exception or critical, instead of warning?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Updated
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we convert this to an f-string while we are here?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Updated
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't understand why this isn't 400. If it should be 403, it seems like we should be raising a different exception.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It is currently a 400. A 403 status code means access to a requested resource is forbidden. It occurs when a server understands a request but refuses to authorize it. In this case, that seems more appropriate (the service is not authorized to send push).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@cris-oddball Thank you for responding to Dave
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I concur that 403 makes more sense. I'm suggesting that we should create a new exception, perhaps "PermissionDeniedError," rather than hack the BadRequestError. A bad request is 400.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ooh I gotcha. Yea, the BadRequestError threw me too. PermissionDeniedError seems better.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We do not use
PermissionDeniedError
anywhere in this code base - For 403 errors we generally useInvalidRequest
,AuthError
, orBadRequestError
. I'm hesitant to add error type to this code baseThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I have no issues with the
BadRequestError
. The class allows for any status code. The name of it could have been more narrow orInvalidRequest
could have more derived classes but I don't think any of that is necessary for this ticket.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We generally need to stop writing these long, Java-esq try/except blocks. It's not PEP8 compliant. This line might raise ValidationError, and it is the only line that should be in this "try" block. The subsequent if/else should not raise any exception. (Please verify that, if necessary.)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ok - I believe we can remove the TypeError and the general Exception.
I believe this still needs to stay in the Try/Except block. The
get_app
method was updated to throw a KeyError we may need to catch and log.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It should still be broken up. Similar to this . . .
This is in line with PEP8, and it makes it obvious what code might raise what exception.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ah gotcha. I like that
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Have a specific section of the pep8 for me @kalbfled ?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Updated but would also appreciate seeing an reference @kalbfled
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Attempted to update this which lead down a rabbit hole - Reverted.
#2266 (comment)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
From PEP8: "Additionally, for all try/except clauses, limit the try clause to the absolute minimum amount of code necessary. Again, this avoids masking bugs."
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The link to that in PEP8 (scroll down or just search for the sentence) is https://peps.python.org/pep-0008/#programming-recommendations
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you - I will keep this in mind for the future. At this time - I would prefer not to refactor this unless its a requirement.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I know we've been using
DEAFULT_MOBILE_APP_TYPE
for the past four years (inherited typo) but since we are here, can we fix the spelling now, wherever it appears in the repo?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Updating.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is this still relevant? You deleted the call to send_push_notification, which might have raised KeyError via the calling parameters.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes -
validate
method raises a ValidationError. We would like to include the logs below if a ValidationError is thrown.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I decided not to remove the TypeError due to issues with test
tests/app/integration/test_push_notification.py::test_mobile_app_push_notification_failed_validation
. I tried to update this test and remove testing forTypeError
. While updating the test,TypeError
continued to be thrown - appears aTypeError
is thrown ifmobile_app
is None in the request_body.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What condition would put you in this block?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
None - We should remove this.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Removed.