Bump ruff from 0.16.4 to 0.16.5 - #84
Open
dependabot[bot] wants to merge 40 commits into
Open
dependabot[bot] wants to merge 40 commits into
dependabot[bot] wants to merge 40 commits into
Conversation
Lets pyobs-robotic-backend resolve each configured module's class locally, so it can filter by interface on its own side. Dumb, hub-facing endpoint like api_acl_matrix/api_comm_user_map, authenticated via the existing HUB_CLIENTS shared-secret mechanism. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SE1UYzGvZXb89QRB3st6ci
Prevents cookie collisions with other pyobs Django apps (e.g. robotic-backend) when run on localhost at once - cookies are scoped by host, not port. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0135Rr2o6tUQycA5sgB7ZXmL
getCsrfToken() (base.html and git_config.html) still read the old default 'csrftoken' cookie, which no longer exists now that CSRF_COOKIE_NAME is project-specific - broke POSTs from the UI with a 403 CSRF failure. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0135Rr2o6tUQycA5sgB7ZXmL
Prose-only comment updates in modules/views.py, modules/services.py,
modules/tests.py, pyobs_web_admin/authentication/{keycloak,admin_sync}.py, and
pyobs_web_admin/settings.py (missed by the original grep). No code identifiers
involved. Per ADR 0013 in pyobs-core, following the pyobs-robotic-backend ->
pyobs-portal rename (pyobs/pyobs-portal#104).
Update pyobs-robotic-backend references to pyobs-portal
Documents the plan to make api_module_classes self-aggregate across HUB_HOSTS, following api_all_logs's pattern rather than acl_matrix's raw+page split, since this endpoint has no human-facing page consumer.
pyobs-auth, gunicorn, packaging, and whitenoise were in pyproject.toml's dependencies but not mirrored here, breaking RTD's build (ModuleNotFoundError: pyobs_auth, since conf.py's django.setup() needs the full INSTALLED_APPS list importable). Verified with a clean venv + sphinx-build locally. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ALX9XMNDZkm4rMDmXzfV34
Adds tests.yml (Django test suite), ruff.yml, and pyrefly.yml, matching the patterns used across pyobs-core/pyobs-gui (ruff+pyrefly) and pyobs-portal (Django test job). Ruff and pyrefly are added as dev dependencies; E501 is ignored (pre-existing long lines, mostly in tests.py, matching pyobs-gui's precedent) and the codebase is made clean against both: import-order fix, ambiguous `l` variable renames, a mistyped session dict, an unguarded Popen.stdout.close(), an unguarded range() bound, and two Django ORM false positives suppressed with `# pyrefly: ignore` (pyrefly has no django-stubs-plugin equivalent for custom models). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EZ2zxaCf9nBQNNYogFHqXw
Mirrors the automerge setup already in use across the other Python repos: enable auto-merge for patch/minor dependabot bumps once required checks pass.
api_module_classes was "always local" (a flat {name: class} dict), the only
hub-facing endpoint in this app without a fleet-aggregating counterpart. It
now loops ["localhost"] + HUB_HOSTS and merges, following api_all_logs'
self-aggregating pattern rather than acl_matrix's raw+page split, since this
endpoint has no human-facing page consuming it.
Response shape changes from a flat dict to a host-tagged list:
{"modules": [{"name", "class", "host"}, ...], "unreachable_hosts": [...]}
This is a deliberate breaking change (a same-named module on two hosts no
longer silently collides) -- the one known caller, pyobs-portal, needs a
matching update, tracked as pyobs-portal#119 rather than done here since
it's a separate repo/PR.
- services.merge_module_classes: flattens each host's dict into
{name, class, host} rows, no collision arbitration, mirroring
merge_acl_matrices.
- api_module_classes: loops hosts like api_all_logs, reporting per-host
failures via unreachable_hosts instead of failing the whole request.
- 7 new tests (4 service-level, 3 view-level); 313/313 total passing.
Moves specs/design/module-classes-fleet-aggregation.md to
specs/plans/2026-08-25-... and marks its work plan implemented, per this
repo's design/plans convention.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EZ2zxaCf9nBQNNYogFHqXw
Fixes review findings on #72: - Blocking: the remote branch re-flattened a remote's already host-tagged rows into one {name: class} dict, silently colliding same-named modules on two of that remote's own sub-hosts when it was itself a hub. Each row's inner host is now preserved (only an inner "localhost" tag is rewritten to the outer hub's name), so nested-hub composition is actually free, not just one hop. - A remote's own unreachable_hosts are now propagated up instead of swallowed. - A remote still on the pre-#68 flat-dict shape (mid-rollout fleet) is now reported as unreachable instead of silently contributing nothing. - merge_module_classes's return type tightened to list[dict[str, str]]. - Fixed the pre-existing (from #70) CI pyrefly failure on develop: the gitignored local_settings.py import is now in ignore-missing-imports. - 3 new tests for the nested-hub/old-shape cases; 316/316 passing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EZ2zxaCf9nBQNNYogFHqXw
Make api_module_classes fleet-aggregating
User-facing docs shouldn't point at internal design docs; inline the relevant facts instead.
Captures the module dashboard and the per-module YAML config editor. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RKRey9bBbX8BRXaHtgdJA4
resolve_user now mints new accounts active - authorization is the PYOBS_AUTH['REQUIRED_GROUPS'] claims gate (Keycloak group membership), not local activation. Replaces the "activate this user in Django admin" guidance in README.md and local_settings.py.example with the Keycloak group-membership model - the Keycloak admin console is now the people-management surface for this service, not Django's admin site. Depends on pyobs-auth's REQUIRED_GROUPS support (pyobs/pyobs-auth#15, unreleased) - REQUIRED_GROUPS is a no-op on pyobs-auth<2.1. Tracks pyobs-core issue #823; see specs/design/shared-authz-keycloak.md, ADR 0014-centralized-authorization-via-keycloak-groups.md, and plan 2026-08-28-shared-authz-keycloak.md there.
…loak refresh tokens SESSION_ENGINE was signed_cookies. Once this service bumps its pyobs-auth dependency past the version that stores a Keycloak refresh token in the session, that would have serialized a bearer credential (can mint fresh access tokens indefinitely) into the browser's signed-but-unencrypted cookie. Switched to django.contrib.sessions.backends.db, backed by the sqlite3 db this service already has for the Keycloak-linked User table. Applies to every session app-wide (shared admin/password login included, not just Keycloak) - corrected the README/settings.py comments that claimed sessions/the shared login stayed fully DB-free, which is no longer true.
…s; note clearsessions for long-lived deployments
Centralize authorization via Keycloak groups
…pre-2.1 is_active gating on top of the Keycloak group gate
pyobs-auth 2.1.0 is now released, so the REQUIRED_GROUPS claims gate this service already configures (see previous commits, issue pyobs/pyobs-core#823) actually takes effect on session refresh, not just at login. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013H8VL4AieTWPM9LL3PtSYE
…eware Wire in KeycloakSessionRefreshMiddleware, require pyobs-auth>=2.1.0
The end date was only a client-side filter: fetchLogs sent the start date as `since`, but the server never learned about the end date, so it kept returning the newest N lines (>= since). Any range ending before the newest activity was then wiped out entirely by the client-side end filter, showing "(no matching log lines)" even though the window contained lines. Send the end date to the API as a new `until` param and bound the server query by it: journald gets --until, the file backend filters/clips the tail by it, and the page-back cursor (`before`) combines with it as a second upper bound, the earlier of the two winning. The log windows send `until` on every fetch (initial, auto-refresh, scroll-to-top page-back) and after click-to-set-time / clear-time-filter, since both bounds are server-side now. Bump version to 2.1.1.
Sequential client-side queue over the existing single-package update/status endpoints: only one pip install can run host-wide at a time, so packages are updated one at a time (awaiting each terminal state) rather than fired in parallel or staggered like Dashboard's controlAll/controlOutdated. A failed or interrupted package doesn't stop the queue -- it's logged and the queue moves on to the rest. VCS-installed (Reinstall) packages are included. Closes #79.
…rding - updateAllPackages() sets a bulkRunning flag synchronously before its first await, so two overlapping invocations (double click, or two tabs) can't both pass the "already updating?" guard and interleave queues. - resumeUpdateIfActive() disables Update all immediately when it detects a resumed in-flight job, instead of leaving it clickable until someone hits the alert. - Guard against a missing/undefined status.state (lock file gone between the start POST and first poll) by recording it as interrupted. - Reword the queue summary header: lumping interrupted/not-started into "failed" was misleading since the per-line list already shows real state.
Add "Update all" bulk action to the Packages page
Overlay-only (no native Fullscreen API, for iOS Safari support): a #log-container wrapping toolbar + status + <pre> gets position:fixed;inset:0 via a .log-fullscreen class toggle. Applied identically to both All Logs and the per-module Logs tab, kept in lockstep per repo convention. Verified in a running dev server: auto-refresh keeps polling while expanded, Esc and the button both exit, collapsed state (600px/520px) restores exactly.
# Conflicts: # specs/plans/index.md
… match implementation - Add aria-pressed to the fullscreen button, kept in sync by toggleLogFullscreen(), since it's a stateful toggle unlike the file's other title-only icon buttons. - Update the plan's CSS/JS snippets to match what actually shipped: the .log-fullscreen class goes on the new #log-container wrapper (toolbar + pre), not on #log-output alone -- the original snippet would have hidden the toolbar behind the fixed pre, which is exactly the bug the real browser check caught during implementation.
Add fullscreen button for logs
Bumps [ruff](https://github.com/astral-sh/ruff) from 0.16.4 to 0.16.5. - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.16.4...0.16.5) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.16.5 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Author
|
A newer version of ruff exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps ruff from 0.16.4 to 0.16.5.
Release notes
Sourced from ruff's releases.
... (truncated)
Changelog
Sourced from ruff's changelog.
Commits
9e4938cBump 0.16.5 (#28110)aad0e90Allow rules without codes (#28049)5fdab73Update preview default rules and categories (#27877)29c8e5bDocument rule acceptance guidelines (#27910)50a4d7fDocument the new category selectors (#27906)ada8795Introduce category selectors (#27666)d894723[ty] Infer lambda parameters through callable type aliases (#28109)2685fde[ty] Narrow functional enum members in==andmatch(#28103)efcffd2[ty] Intersection simplifications with subtype-related generic specialization...eb78048[ty] Bump ecosystem-analyzer for HTML escaping (#28104)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)