Bugfixes (#343)

* set referrer same-origin

required for ajax, and will be stricter than _not_ setting it security wise

* handle "new-cluster" syndrome

a brand new cluster will have no resident pods, can't reap what's not there

* supress StopIteration errors from going to Sentry

This is the intentional design, sentry-sdk is just noting it as it flies up to gunicorn

ref: miguelgrinberg/flask-sock#64
ref: getsentry/sentry-python#3616

* make: add 'check', a combo of lint and type-check

ruff and ty are so fast, i don't see why you'd bother invoking them separately

Author: ewdurbin

Makefile

@@ -70,3 +70,5 @@ security-check: .state/docker-build-base
 
 type-check: .state/docker-build-base
 	docker compose run --rm base ty check cabotage
+
+check: lint type-check

cabotage/celery/tasks/maintain.py

@@ -144,6 +144,8 @@ def reap_pods():
     pods = core_api_instance.list_pod_for_all_namespaces(
         label_selector="resident-pod.cabotage.io=true",
     )
+    if not pods.items:
+        return
     candidate = sorted(pods.items, key=lambda pod: pod.status.start_time)[0]
     lookback = datetime.datetime.now().replace(
         tzinfo=datetime.timezone.utc

cabotage/client/templates/_base.html

@@ -5,6 +5,7 @@
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <meta name="theme-color" content="#0f0f17" />
+    <meta name="referrer" content="same-origin" />
     <script>
     // Apply theme + accent before render to prevent flash
     (function() {

cabotage/server/__init__.py

@@ -91,10 +91,28 @@ class Model(Base):
 sock = Sock()
 csrf = CSRFProtect()
 babel = Babel()
+
+
+def _sentry_before_send(event, hint):
+    """Filter out the StopIteration raised by flask-sock to signal
+    gunicorn that a WebSocket connection has closed (not an error)."""
+    exc_info = hint.get("exc_info")
+    if exc_info:
+        exc_type, exc_value, tb = exc_info
+        if exc_type is StopIteration and tb is not None:
+            # Walk to the innermost frame
+            while tb.tb_next:
+                tb = tb.tb_next
+            if "simple_websocket" in (tb.tb_frame.f_code.co_filename or ""):
+                return None
+    return event
+
+
 sentry_sdk.init(
     dsn=os.getenv("SENTRY_DSN"),
     integrations=[FlaskIntegration()],
     release=os.getenv("SOURCE_COMMIT"),
+    before_send=_sentry_before_send,
 )
 
 

tests/test_sentry_filter.py

@@ -0,0 +1,71 @@
+import types
+
+from cabotage.server import _sentry_before_send
+
+
+def _make_traceback(filename):
+    """Create a minimal traceback-like object with a single frame."""
+    frame = types.SimpleNamespace(
+        f_code=types.SimpleNamespace(co_filename=filename),
+    )
+    return types.SimpleNamespace(tb_next=None, tb_frame=frame)
+
+
+def _make_nested_traceback(filenames):
+    """Create a chained traceback from a list of filenames (outermost first)."""
+    tb = None
+    for filename in reversed(filenames):
+        frame = types.SimpleNamespace(
+            f_code=types.SimpleNamespace(co_filename=filename),
+        )
+        tb = types.SimpleNamespace(tb_next=tb, tb_frame=frame)
+    return tb
+
+
+class TestSentryBeforeSend:
+    def test_filters_stop_iteration_from_simple_websocket(self):
+        tb = _make_traceback(
+            "/lib/python3.13/site-packages/simple_websocket/__init__.py"
+        )
+        hint = {"exc_info": (StopIteration, StopIteration(), tb)}
+        assert _sentry_before_send({"event": "data"}, hint) is None
+
+    def test_passes_stop_iteration_from_other_source(self):
+        tb = _make_traceback("/app/cabotage/server/views.py")
+        event = {"event": "data"}
+        hint = {"exc_info": (StopIteration, StopIteration(), tb)}
+        assert _sentry_before_send(event, hint) is event
+
+    def test_passes_other_exceptions(self):
+        tb = _make_traceback(
+            "/lib/python3.13/site-packages/simple_websocket/__init__.py"
+        )
+        event = {"event": "data"}
+        hint = {"exc_info": (ValueError, ValueError("oops"), tb)}
+        assert _sentry_before_send(event, hint) is event
+
+    def test_passes_events_without_exc_info(self):
+        event = {"message": "hello"}
+        assert _sentry_before_send(event, {}) is event
+
+    def test_walks_to_innermost_frame(self):
+        tb = _make_nested_traceback(
+            [
+                "/app/cabotage/server/__init__.py",
+                "/lib/python3.13/site-packages/flask/app.py",
+                "/lib/python3.13/site-packages/simple_websocket/__init__.py",
+            ]
+        )
+        hint = {"exc_info": (StopIteration, StopIteration(), tb)}
+        assert _sentry_before_send({"event": "data"}, hint) is None
+
+    def test_does_not_filter_when_innermost_is_not_websocket(self):
+        tb = _make_nested_traceback(
+            [
+                "/lib/python3.13/site-packages/simple_websocket/__init__.py",
+                "/app/cabotage/server/views.py",
+            ]
+        )
+        event = {"event": "data"}
+        hint = {"exc_info": (StopIteration, StopIteration(), tb)}
+        assert _sentry_before_send(event, hint) is event