Harden configuration and persistence baseline for long-term Flapjack maintenance - #2
Harden configuration and persistence baseline for long-term Flapjack maintenance#2Gonza10V wants to merge 1 commit into
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7024d368f1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| # rest framework config | ||
| CORS_ORIGIN_ALLOW_ALL = env_bool("DJANGO_CORS_ALLOW_ALL", default=not IS_PRODUCTION) | ||
| CORS_ALLOWED_ORIGINS = env_list("DJANGO_CORS_ALLOWED_ORIGINS", default=[]) |
There was a problem hiding this comment.
This settings block assigns CORS_ALLOWED_ORIGINS, but the repo pins django-cors-headers==3.2.1 (see flapjack_api/requirements.txt), where the documented allowlist setting is CORS_ORIGIN_WHITELIST. As a result, DJANGO_CORS_ALLOWED_ORIGINS is ignored; with APP_ENV=production forcing CORS_ORIGIN_ALLOW_ALL off, the effective origin allowlist stays empty and cross-origin browser requests from the frontend will be rejected.
Useful? React with 👍 / 👎.
| - name: Run migrations | ||
| run: python manage.py migrate --noinput | ||
| - name: Run backend tests | ||
| run: python manage.py test accounts |
There was a problem hiding this comment.
The backend workflow’s “Run backend tests” step only executes python manage.py test accounts, which skips tests in other apps (registry, analysis, plot) and the newly added project-level health checks, so regressions in most backend functionality can pass CI undetected. For this baseline-hardening change, the CI command should run the full suite (or explicitly include all relevant test labels).
Useful? React with 👍 / 👎.
1 participant
Motivation
Description
flapjack_api/flapjack_api/env.py, switchedflapjack_api/flapjack_api/settings.pyto read all sensitive/config values from env with production fail-fast checks, and tightened CORS/ALLOWED_HOSTS handling.flapjack_api/flapjack_api/health.pyand registered/healthz/inflapjack_api/flapjack_api/urls.py.docker-compose.yml, added root and per-component.env.examplefiles (.env.example,flapjack_api/.env.example,flapjack_frontend/.env.example) and sanitizedflapjack_api/.env.prod.scripts/migrate.sh,scripts/backup_postgres.sh,scripts/restore_postgres.sh), a simple health unit test (flapjack_api/flapjack_api/tests.py), a CI workflow for backend checks/tests and frontend build (.github/workflows/ci.yml), and a.gitignorerule to avoid committing env files/backups.(Changed/added files include:
flapjack_api/flapjack_api/settings.py,flapjack_api/flapjack_api/env.py,flapjack_api/flapjack_api/health.py,flapjack_api/flapjack_api/tests.py,flapjack_api/flapjack_api/urls.py,docker-compose.yml,scripts/*,.env.example,flapjack_api/.env.example,flapjack_frontend/.env.example,.github/workflows/ci.yml,README.md,ARCHITECTURE.md, updatedADR-001.md.)Testing
python3 -m compileall flapjack_api/flapjack_api scriptswhich succeeded.python manage.py check(insideflapjack_api) failed in this environment because Django is not installed here, so runtime integration checks must run inside CI or a proper dev container.docker compose configand local Compose health validation were not run here becausedockeris not available in the execution environment.npm run buildlocally failed in this environment due to missing node modules (react-app-rewired), but the added GitHub Actions CI (.github/workflows/ci.yml) will run dependency install and execute backend checks/migrations/tests and frontend build on push/PR.Codex Task