David/HERMES-GIELIE
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(auth): tighten except to OSError, add type hints, fix test imports

Browse source
This commit is contained in:
Lucas Coutinho 2026-05-13 12:27:27 -03:00
parent 720e69cb83
commit 8ca29618fe
2 changed files with 4 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
api/auth.py
View file

@ -191,14 +191,14 @@ def _load_key(filename: str) -> bytes:
raw = key_file.read_bytes() raw = key_file.read_bytes()
if len(raw) >= 32: if len(raw) >= 32:
return raw[:32] return raw[:32]
except Exception: except OSError:
logger.debug("Failed to read key %s", filename) logger.debug("Failed to read key %s", filename)
key = secrets.token_bytes(32) key = secrets.token_bytes(32)
try: try:
STATE_DIR.mkdir(parents=True, exist_ok=True) STATE_DIR.mkdir(parents=True, exist_ok=True)
key_file.write_bytes(key) key_file.write_bytes(key)
key_file.chmod(0o600) key_file.chmod(0o600)
except Exception: except OSError:
logger.debug("Failed to persist key %s", filename) logger.debug("Failed to persist key %s", filename)
return key return key
@ -293,7 +293,7 @@ def is_auth_enabled() -> bool:
return get_password_hash() is not None return get_password_hash() is not None
def verify_password(plain) -> bool: def verify_password(plain: str) -> bool:
"""Verify a plaintext password against the stored hash. """Verify a plaintext password against the stored hash.
Supports transparent migration of password hashes that were computed Supports transparent migration of password hashes that were computed

3
tests/test_auth_password_hash_cache.py
View file

@ -17,6 +17,7 @@ the cached result.
import importlib import importlib
import os import os
import sys import sys
import tempfile
import threading import threading
import time import time
import unittest import unittest
@ -27,7 +28,6 @@ from pathlib import Path
# sibling test files that need a fresh config import). Deleting api.config # sibling test files that need a fresh config import). Deleting api.config
# would change its module-level STATE_DIR global and leak into all # would change its module-level STATE_DIR global and leak into all
# subsequently collected tests (breaking test_pytest_state_isolation.py). # subsequently collected tests (breaking test_pytest_state_isolation.py).
import tempfile
_TEST_STATE = Path(tempfile.mkdtemp()) _TEST_STATE = Path(tempfile.mkdtemp())
os.environ["HERMES_WEBUI_STATE_DIR"] = str(_TEST_STATE) os.environ["HERMES_WEBUI_STATE_DIR"] = str(_TEST_STATE)
@ -64,7 +64,6 @@ class TestPasswordHashCache(unittest.TestCase):
h = auth.get_password_hash() h = auth.get_password_hash()
self.assertIsNotNone(h) self.assertIsNotNone(h)
self.assertIsInstance(h, str) self.assertIsInstance(h, str)
assert h is not None # narrow type for type checker
self.assertGreater(len(h), 10) self.assertGreater(len(h), 10)
def test_cache_flag_set_after_first_call(self): def test_cache_flag_set_after_first_call(self):