Repository navigation
Fix should-fix issues: TRUSTED_PROXIES, RateLimiter cap, reopen UX, backup - #1
Merged
Merged
Conversation
…, admin item reopen UX, backup strategy 1. TRUSTED_PROXIES: clamp to max 3 with warning log. Prevents X-Forwarded-For forgery that bypasses rate limiting when misconfigured. 2. RateLimiter._sweep: add hard cap (4096 keys) with graceful LRU eviction. Prevents unbounded memory growth from proxy-pool attacks. 3. admin_item_reopen: cancel all active claims when reopening an item. Previously stale claims from the previous lifecycle remained visible in the queue with no indication they were obsolete. 4. Add backup.sh script and BACKUP.md documentation for the SQLite DB + uploads directory. Includes WAL checkpoint for consistency. Tests: 73 passing (4 new).
backup.sh ran PRAGMA journal_mode=WAL on the live database (a lasting change to it) and then tarred the file. feed's nightly Borg backup (reason.direct infra/server-backup) already takes a consistent copy with SQLite's online-backup API, plus the uploads volume. The hardening fixes stay. Tests: 73 passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FhuYBkdi4GZi3zBkmNm7Pj
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes 4 should-fix issues from the freestuff audit:
1. TRUSTED_PROXIES operational risk
Clamp
TRUSTED_PROXIESto a hard max of 3. Values above 3 are almost certainly misconfigured and allow clients to forgeX-Forwarded-Forheaders to bypass rate limiting. A warning is logged when clamping occurs.2. RateLimiter memory growth
Added a hard cap (4096 keys) to
RateLimiter._sweep()with graceful LRU eviction. Previously the dict could grow unbounded from sustained proxy-pool attacks even though individual keys age out after 1 hour.3. admin_item_reopen UX
When an item is reopened (status
gone→available), all old active claims are now cancelled. Previously the stale queue remained visible with no indication it was from a previous lifecycle of the item.4. Backup strategy
Added
backup.sh(executable, cron-ready) andBACKUP.mddocumentation. The script checkpoints the SQLite WAL before archiving the DB + uploads directory into a timestamped tarball.Changes
app.py: TRUSTED_PROXIES clamping, admin_item_reopen cancels claimshardening.py: RateLimiter hard cap in _sweeptests/test_app.py: 4 new tests (73 total, all passing)backup.sh: new backup scriptBACKUP.md: backup strategy documentationAGENTS.md: new repo documentationTesting
All 73 tests pass locally.