Skip to content

fix(auth): eliminate duplicate DB sessions in auth and RBAC middleware #3886

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
crivetimihai merged 7 commits into from
Mar 31, 2026
Merged

fix(auth): eliminate duplicate DB sessions in auth and RBAC middleware #3886

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
f2b0dad
fix: eliminate duplicate DB sessions in auth and RBAC middleware
MohanLaksh Mar 27, 2026
35fa7b5
fix: ensure auth logs are committed in hard-deny paths
MohanLaksh Mar 30, 2026
efcd95f
fix(build): use system uv binary consistently in Makefile
MohanLaksh Mar 31, 2026
889d75a
fix(auth): prevent stale session reference and ensure log persistence
crivetimihai Mar 31, 2026
b40a401
fix(auth): rollback shared session on logging failure and rewrite int…
crivetimihai Mar 31, 2026
c6667f0
chore: update secrets baseline after rebase
crivetimihai Mar 31, 2026
d1baef8
chore: exclude .npmrc from sdist to fix check-manifest
crivetimihai Mar 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 12 additions & 12 deletions .secrets.baseline
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
"files": "package-lock.json|Cargo.lock|^.secrets.baseline$|scripts/sign_image.sh|scripts/zap|sonar-project.properties|^/Users/brian/dev/github.ibm.com/contextforge-org/sps-pipeline-config/.secrets.baseline$|^./.secrets.baseline$",
"lines": null
},
"generated_at": "2026-03-30T23:20:07Z",
"generated_at": "2026-03-31T10:20:49Z",
"plugins_used": [
{
"name": "AWSKeyDetector"
Expand Down Expand Up @@ -344,71 +344,71 @@
"hashed_secret": "844c398e469ef3fb919da3778944365ab2175fb7",
"is_secret": false,
"is_verified": false,
"line_number": 367,
"line_number": 368,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "319037749ce37e577db0b3628c7f90e333544391",
"is_secret": false,
"is_verified": false,
"line_number": 792,
"line_number": 793,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "6ae2832e494d1098e8901fe156083e39399a24f1",
"is_secret": false,
"is_verified": false,
"line_number": 794,
"line_number": 795,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "9d989e8d27dc9e0ec3389fc855f142c3d40f0c50",
"is_secret": false,
"is_verified": false,
"line_number": 1497,
"line_number": 1498,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "d3ac7a4ef1a838b4134f2f6e7f3c0d249d74b674",
"is_secret": false,
"is_verified": false,
"line_number": 5836,
"line_number": 5837,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "5932862bcd24dd27d0dc0407ec94fe9d6ea24aeb",
"is_secret": false,
"is_verified": false,
"line_number": 6333,
"line_number": 6334,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "c77c805e32f173e4321ee9187de9c29cb3804513",
"is_secret": false,
"is_verified": false,
"line_number": 6345,
"line_number": 6346,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "8fe3df8a68ddd0d4ab2214186cbb8e38ccd0e06a",
"is_secret": false,
"is_verified": false,
"line_number": 6417,
"line_number": 6418,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "93ac8946882128457cd9e283b30ca851945e6690",
"is_secret": false,
"is_verified": false,
"line_number": 7520,
"line_number": 7521,
"type": "Secret Keyword",
"verified_result": null
}
Expand Down Expand Up @@ -8316,15 +8316,15 @@
"hashed_secret": "ab73a3eaca01a7059dcdff6f95556ec7fd83de96",
"is_secret": false,
"is_verified": false,
"line_number": 1388,
"line_number": 1389,
"type": "Secret Keyword",
"verified_result": null
},
{
"hashed_secret": "92dd4a2de441b63e6ac51fdb81a05a416dffd182",
"is_secret": false,
"is_verified": false,
"line_number": 1475,
"line_number": 1476,
"type": "Secret Keyword",
"verified_result": null
}
Expand Down
1 change: 1 addition & 0 deletions MANIFEST.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,6 +192,7 @@ exclude .hadolint.yaml
exclude .ruff.toml
exclude .pre-commit-config.yaml
exclude .secrets.baseline
exclude .npmrc

# Backup and temporary files
global-exclude *~
Expand Down
33 changes: 17 additions & 16 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,8 +146,8 @@ endef
define ensure_pip_package
@test -d "$(VENV_DIR)" || $(MAKE) venv
@/bin/bash -c "source $(VENV_DIR)/bin/activate && \
uv pip show $(1) >/dev/null 2>&1 || \
uv pip install -q $(1)"
$(UV_BIN) pip show $(1) >/dev/null 2>&1 || \
$(UV_BIN) pip install -q $(1)"
endef

# =============================================================================
Expand Down Expand Up @@ -178,6 +178,7 @@ uv:

# UV_BIN: prefer uv in PATH, fallback to ~/.local/bin/uv
UV_BIN := $(shell type -p uv 2>/dev/null || echo "$(HOME)/.local/bin/uv")
export UV_BIN

.PHONY: venv
venv: uv
Expand All @@ -192,15 +193,15 @@ activate:

.PHONY: install
install: venv
@/bin/bash -c "source $(VENV_DIR)/bin/activate && uv pip install ."
@/bin/bash -c "source $(VENV_DIR)/bin/activate && $(UV_BIN) pip install ."

.PHONY: install-db
install-db: venv
@/bin/bash -c "source $(VENV_DIR)/bin/activate && uv pip install .[redis,postgres]"
@/bin/bash -c "source $(VENV_DIR)/bin/activate && $(UV_BIN) pip install .[redis,postgres]"

.PHONY: install-dev
install-dev: venv
@/bin/bash -c "source $(VENV_DIR)/bin/activate && uv pip install --group dev ."
@/bin/bash -c "source $(VENV_DIR)/bin/activate && $(UV_BIN) pip install --group dev ."
@if [ "$(ENABLE_RUST_BUILD)" = "1" ]; then \
echo "🦀 Building Rust plugins..."; \
$(MAKE) rust-dev || echo "⚠️ Rust plugins not available (optional)"; \
Expand All @@ -211,7 +212,7 @@ install-dev: venv
.PHONY: update
update:
@echo "⬆️ Updating installed dependencies..."
@/bin/bash -c "source $(VENV_DIR)/bin/activate && uv pip install -U --group dev ."
@/bin/bash -c "source $(VENV_DIR)/bin/activate && $(UV_BIN) pip install -U --group dev ."

# help: check-env - Verify all required env vars in .env are present
.PHONY: check-env check-env-dev
Expand Down Expand Up @@ -2987,7 +2988,7 @@ mutmut-clean:
.PHONY: ensure-pip-licenses pip-licenses license-check scc scc-report

ensure-pip-licenses:
@/bin/bash -c "source $(VENV_DIR)/bin/activate && uv pip install -q pip-licenses"
@/bin/bash -c "source $(VENV_DIR)/bin/activate && $(UV_BIN) pip install -q pip-licenses"

pip-licenses: ensure-pip-licenses
@mkdir -p $(dir $(LICENSES_MD))
Expand Down Expand Up @@ -3865,9 +3866,9 @@ tox: ## 🧪 Multi-Python tox matrix (uv)
sbom: uv ## 🛡️ Generate SBOM & security report
@echo "🛡️ Generating SBOM & security report..."
@rm -Rf "$(VENV_DIR).sbom"
@uv venv "$(VENV_DIR).sbom"
@/bin/bash -c "source $(VENV_DIR).sbom/bin/activate && uv pip install .[dev]"
@/bin/bash -c "source $(VENV_DIR)/bin/activate && uv pip install -q cyclonedx-bom sbom2doc"
@$(UV_BIN) venv "$(VENV_DIR).sbom"
@/bin/bash -c "source $(VENV_DIR).sbom/bin/activate && $(UV_BIN) pip install .[dev]"
@/bin/bash -c "source $(VENV_DIR)/bin/activate && $(UV_BIN) pip install -q cyclonedx-bom sbom2doc"
@echo "🔍 Generating SBOM from environment..."
@/bin/bash -c "source $(VENV_DIR)/bin/activate && \
python3 -m cyclonedx_py environment \
Expand Down Expand Up @@ -6317,7 +6318,7 @@ LOCAL_PYPI_AUTH := $(LOCAL_PYPI_DIR)/.htpasswd

local-pypi-install:
@echo "📦 Installing pypiserver..."
@/bin/bash -c "source $(VENV_DIR)/bin/activate && uv pip install 'pypiserver>=2.3.0' passlib"
@/bin/bash -c "source $(VENV_DIR)/bin/activate && $(UV_BIN) pip install 'pypiserver>=2.3.0' passlib"
@mkdir -p $(LOCAL_PYPI_DIR)

local-pypi-start: local-pypi-install local-pypi-stop
Expand Down Expand Up @@ -6409,7 +6410,7 @@ local-pypi-test:
local-pypi-clean: clean dist local-pypi-start-auth local-pypi-upload-auth local-pypi-test
@echo "🎉 Full local PyPI cycle complete!"
@echo "📊 Package info:"
@/bin/bash -c "source $(VENV_DIR)/bin/activate && uv pip show $(PROJECT_NAME)"
@/bin/bash -c "source $(VENV_DIR)/bin/activate && $(UV_BIN) pip show $(PROJECT_NAME)"

# Convenience target to restart server
local-pypi-restart: local-pypi-stop local-pypi-start
Expand Down Expand Up @@ -6587,7 +6588,7 @@ devpi-test:
devpi-clean: clean dist devpi-upload devpi-test
@echo "🎉 Full devpi cycle complete!"
@echo "📊 Package info:"
@/bin/bash -c "source $(VENV_DIR)/bin/activate && uv pip show mcp-contextforge-gateway"
@/bin/bash -c "source $(VENV_DIR)/bin/activate && $(UV_BIN) pip show mcp-contextforge-gateway"

.PHONY: devpi-status
devpi-status:
Expand Down Expand Up @@ -6756,7 +6757,7 @@ shell-linters-install: ## 🔧 Install shellcheck, shfmt, bashate
if ! $(VENV_DIR)/bin/bashate -h >/dev/null 2>&1 ; then \
echo "🛠 Installing bashate (into venv)..." ; \
test -d "$(VENV_DIR)" || $(MAKE) venv ; \
/bin/bash -c "source $(VENV_DIR)/bin/activate && uv pip install -q bashate" ; \
/bin/bash -c "source $(VENV_DIR)/bin/activate && $(UV_BIN) pip install -q bashate" ; \
fi
@echo "✅ Shell linters ready."

Expand Down Expand Up @@ -6823,7 +6824,7 @@ ALEMBIC_CONFIG = mcpgateway/alembic.ini

alembic-install:
@echo "➜ Installing Alembic ..."
@/bin/bash -c "source $(VENV_DIR)/bin/activate && uv pip install -q alembic sqlalchemy"
@/bin/bash -c "source $(VENV_DIR)/bin/activate && $(UV_BIN) pip install -q alembic sqlalchemy"

.PHONY: db-init
db-init: ## Initialize alembic migrations
Expand Down Expand Up @@ -8171,7 +8172,7 @@ rust-ensure-deps: ## Ensure Rust toolchain, maturin, and a
@if ! command -v maturin > /dev/null 2>&1; then \
if [ -f "$(VENV_DIR)/bin/activate" ]; then \
echo "📦 Installing maturin into venv..."; \
/bin/bash -c "source $(VENV_DIR)/bin/activate && uv pip install maturin"; \
/bin/bash -c "source $(VENV_DIR)/bin/activate && $(UV_BIN) pip install maturin"; \
elif command -v pip > /dev/null 2>&1; then \
echo "📦 Installing maturin globally (venv not found)..."; \
pip install maturin; \
Expand Down
Loading
Loading