Feat/sign in gate pilot - #20
Merged
Merged
Conversation
0b1b80b fixed it; nothing held it. The store file is the only thing gunicorn's workers share, so a board toggle lands everywhere only because _load_overrides re-reads on an mtime change — remove that and the suite stays green while an anonymous refresh goes back to being a coin flip decided by which worker answered. Four tests, playing the OTHER worker: a foreign write is picked up, consecutive writes each land, a direct _overrides injection survives when no file exists (the convention every other access test relies on), and a worker's own persist does not bounce back. 186 passed on flask. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
`2plot-clerk-satellite , 2plot-satellite-reporting , 2plot-network-shared` rode in on 0b1b80b — Render environment-group names, pasted past the end of the last comment block, with no newline after them. Harmless to the app (nothing reads this file in production) but not to the file's job: it is the template a developer copies to .env, and python-dotenv answers it with "could not parse statement starting at line 155". A template that emits a parse error on first use teaches people to ignore parse errors. Verified: 6 keys parse, no warnings. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The security fix this host already shipped as a local shim on 2026-08-21. Sign out ran window.Clerk.signOut() and reloaded — client-side only — while server-side identity resolves from the signed __dca_identity cookie FIRST, so a signed-out browser kept being served every gated page until that cookie aged out. Up to session_lifetime_days: seven days by default, and on a shared machine the next person inherited the previous user's access for a week. 1.0.3 sequences it properly (Clerk sign-out, then POST /api/auth/signout, then reload, awaited so the reload cannot race the Set-Cookie) and also fires the POST on a signed-in -> signed-out transition, which covers a sign-out performed in another tab or on another host of the same Clerk instance. This repo's shim never did that last part. THE SHIM STAYS, one release. The package's POST is idempotent — its changelog says so precisely so an app can keep its own handler through the upgrade — and both cannot run on one click anyway, because the shim owns the capture phase and calls stopImmediatePropagation. It retires in 1.0.4. Its docstring now says which of the two it is. The build vendored here is the one carrying the follow-up import fix. 1.0.3's avatar helper inlined `quote(svg, safe="/:='? ")` inside an f-string — PEP 701 syntax, a hard SyntaxError on 3.10/3.11, and therefore an IMPORT failure. The package registers a [dash_hooks] entry point Dash auto-imports at every Dash() construction, so on this repo's own CI matrix (3.10/3.12/3.13) that would have taken down the whole documentation site, not just sign-in. Verified by reading the vendored tarball: `encoded` is hoisted out of the f-string. Not verified by executing on 3.10 — no such interpreter is available here. session_lifetime_days is now passed EXPLICITLY at 7 rather than inherited. 1.0.3 makes it a re-vendor decision because it is the only knob an application controls: __dca_identity is a stateless signed token, so a value captured before sign-out keeps verifying until max-age — there is no revocation list, and adding one would mean giving up the fast path the cookie exists to provide. 7 is right for a host whose gated content is documentation and whose gate exists to drive account creation. The one thing that would change it is /admin/control-board, which trusts this cookie and can hide any page on the site; lib/auth.py records that condition. clerk-backend-api stays >=5.0.0,<8 in the package metadata, so the cryptography>=50.0.0 floor still resolves. requires-python >=3.10 unchanged. Verified: 186 passed (flask) / 185 + 1 skip (fastapi), smoke 72/72, flake8 clean, and a real boot against 1.0.3 in both primary and satellite mode — /api/auth/signout answers 200, satelliteSignInRedirect is populated, both shims and the package's own handler coexist in the index, and no [auth] warning fires when the redirect env is set. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
… it was The authoring repo closed the loop with the execution check this sandbox could not run: both artifacts compile under a real 3.11 (compileall -f over every module) and the avatar helper, lifted out with ast so it runs without dash, returns output byte-identical to 3.12. So the import fix is behaviourally neutral across versions, not merely parseable — which is the claim that matters, and stronger than the source inspection this comment previously recorded. The sha256 is now written down, and it is the hash of the blob committed here rather than of the working file — verified against the authoring repo's dist, byte for byte. That is what lets a future reader confirm this vendored binary is the good build without re-deriving the whole story from mtimes, which is precisely what looked wrong: the tarball is stamped 23 seconds BEFORE the fix commit, because the sequence was build → verify → commit. Also written down because it is a live trap: the authoring repo's `main` still holds the BROKEN build, with the fix waiting on a PR before v1.0.3 is tagged. Anyone re-vendoring from main before that lands gets an artifact that takes the whole site down at boot on 3.10/3.11. Take the dist artifact whose hash matches, or wait for the tag. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.