azaion/detections
1
0
Fork 0
mirror of https://github.com/azaion/detections.git synced 2026-04-22 17:46:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

[AZ-178] Fix Critical/High security findings: auth, CVEs, non-root containers, per-job SSE

Browse Source 
- Pin all deps; h11==0.16.0 (CVE-2025-43859), python-multipart>=1.3.1 (CVE-2026-28356), PyJWT==2.12.1
- Add HMAC JWT verification (require_auth FastAPI dependency, JWT_SECRET-gated)
- Fix TokenManager._refresh() to use ADMIN_API_URL instead of ANNOTATIONS_URL
- Rename POST /detect → POST /detect/image (image-only, rejects video files)
- Replace global SSE stream with per-job SSE: GET /detect/{media_id} with event replay buffer
- Apply require_auth to all 4 protected endpoints
- Fix on_annotation/on_status closure to use mutable current_id for correct post-upload event routing
- Add non-root appuser to Dockerfile and Dockerfile.gpu
- Add JWT_SECRET to e2e/docker-compose.test.yml and run-tests.sh
- Update all e2e tests and unit tests for new endpoints and HMAC token signing
- 64/64 tests pass

Made-with: Cursor
This commit is contained in:
Oleksandr Bezdieniezhnykh
2026-04-02 06:32:12 +03:00
parent dac350cbc5
commit 097811a67b
25 changed files with 369 additions and 429 deletions
Download Patch File Download Diff File Expand all files Collapse all files
e2e/tests/test_resilience.py
+5 -7
View File
@@ -5,13 +5,13 @@ _DETECT_TIMEOUT = 60
def test_nft_res_01_loader_outage_after_init(
warm_engine, http_client, mock_loader_url, image_small
warm_engine, http_client, mock_loader_url, image_small, auth_headers
):
requests.post(
f"{mock_loader_url}/mock/config", json={"mode": "error"}, timeout=10
).raise_for_status()
files = {"file": ("r1.jpg", image_small, "image/jpeg")}
r = http_client.post("/detect", files=files, timeout=_DETECT_TIMEOUT)
r = http_client.post("/detect/image", files=files, headers=auth_headers, timeout=_DETECT_TIMEOUT)
assert r.status_code == 200
assert isinstance(r.json(), list)
h = http_client.get("/health")
@@ -22,17 +22,15 @@ def test_nft_res_01_loader_outage_after_init(
def test_nft_res_03_transient_loader_first_fail(
mock_loader_url, http_client, image_small
mock_loader_url, http_client, image_small, auth_headers
):
requests.post(
f"{mock_loader_url}/mock/config", json={"mode": "first_fail"}, timeout=10
).raise_for_status()
files = {"file": ("r3a.jpg", image_small, "image/jpeg")}
r1 = http_client.post("/detect", files=files, timeout=_DETECT_TIMEOUT)
r1 = http_client.post("/detect/image", files=files, headers=auth_headers, timeout=_DETECT_TIMEOUT)
files2 = {"file": ("r3b.jpg", image_small, "image/jpeg")}
r2 = http_client.post("/detect", files=files2, timeout=_DETECT_TIMEOUT)
r2 = http_client.post("/detect/image", files=files2, headers=auth_headers, timeout=_DETECT_TIMEOUT)
assert r2.status_code == 200
if r1.status_code != 200:
assert r1.status_code != 500