Skip to content

fix(pixel-chat): reject empty or unstripped credential in owner_namespace - #5808

Closed
Vishaaallll wants to merge 1 commit into
Osmantic:public-betafrom
Vishaaallll:fix/pixel-chat-owner-namespace-whitespace
Closed

Vishaaallll wants to merge 1 commit into
Osmantic:public-betafrom
Vishaaallll:fix/pixel-chat-owner-namespace-whitespace

Conversation

@Vishaaallll

Copy link
Copy Markdown
Contributor

Why this matters

In ods/extensions/services/dashboard-api/pixel_chat_results.py, owner_namespace(credential) hashed input credentials without validating non-empty, trimmed strings. Consequently, empty strings or credentials with trailing whitespace were hashed into valid 64-character hex namespaces, creating split result stores for the same logical owner.

This surgical fix verifies credential and credential == credential.strip(), raising ValueError("invalid-owner-credential") on malformed credentials.

Validation

  • Baseline reproduction: verified that owner_namespace("") and owner_namespace(" owner ") produced hashes without error on baseline.
  • Post-fix behavior: properly raises ValueError("invalid-owner-credential").
  • Telemetry: pixel-chat suite: 3 passed. New-test syntax and diff checks pass; new regression wired into Linux CI.

Overlap check

Inspected open/closed PRs. PR #5745 guarded project receipts; zero overlap with chat result namespace hashing.

Risk / AI disclosure

AI-assisted investigation, patch, and regression tests. Guards owner isolation namespaces against credential padding. Independent review remains a gate.

Follow-up integration evidence

Composed locally with public-beta at 4fa6ad170 without conflicts. CI and unit checks pass.

@Lightheartdevs

Copy link
Copy Markdown
Collaborator

Thanks for this contribution. public-beta was promoted into main on 2026-09-24 and no longer receives changes, so we're closing pull requests that target it. This isn't a judgment on the change itself. If it's still needed, please rebase onto main and open a focused PR. See #7253 for details and the contribution policy.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants