XF/GIA
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Improve security

Browse Source
This commit is contained in:
Mark Veidemanis
2026-03-07 15:34:23 +00:00
parent add685a326
commit 611de57bf8
31 changed files with 3617 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
core/tasks/codex_approval.py
View File

@@ -22,7 +22,9 @@ def queue_codex_event_with_pre_approval(
action: str,
provider_payload: dict,
idempotency_key: str,
provider: str = "codex_cli",
) -> tuple[ExternalSyncEvent, CodexPermissionRequest]:
provider = str(provider or "codex_cli").strip() or "codex_cli"
approval_key = _deterministic_approval_key(idempotency_key)
waiting_event, _ = ExternalSyncEvent.objects.update_or_create(
idempotency_key=f"codex_waiting:{idempotency_key}",
@@ -30,7 +32,7 @@ def queue_codex_event_with_pre_approval(
"user": user,
"task": task,
"task_event": task_event,
"provider": "codex_cli",
"provider": provider,
"status": "waiting_approval",
"payload": {
"action": str(action or "append_update"),
@@ -43,16 +45,18 @@ def queue_codex_event_with_pre_approval(
run.error = ""
run.save(update_fields=["status", "error", "updated_at"])
provider_label = "Claude" if provider == "claude_cli" else "Codex"
xmpp_cmd = ".claude" if provider == "claude_cli" else ".codex"
request, _ = CodexPermissionRequest.objects.update_or_create(
approval_key=approval_key,
defaults={
"user": user,
"codex_run": run,
"external_sync_event": waiting_event,
"summary": "Pre-submit approval required before sending to Codex",
"summary": f"Pre-submit approval required before sending to {provider_label}",
"requested_permissions": {
"type": "pre_submit",
"provider": "codex_cli",
"provider": provider,
"action": str(action or "append_update"),
},
"resume_payload": {
@@ -68,7 +72,7 @@ def queue_codex_event_with_pre_approval(
},
)
cfg = TaskProviderConfig.objects.filter(user=user, provider="codex_cli", enabled=True).first()
cfg = TaskProviderConfig.objects.filter(user=user, provider=provider, enabled=True).first()
settings_payload = dict(getattr(cfg, "settings", {}) or {})
approver_service = str(settings_payload.get("approver_service") or "").strip().lower()
approver_identifier = str(settings_payload.get("approver_identifier") or "").strip()
@@ -78,10 +82,10 @@ def queue_codex_event_with_pre_approval(
approver_service,
approver_identifier,
text=(
f"[codex approval] key={approval_key}\n"
"summary=Pre-submit approval required before sending to Codex\n"
f"[{provider} approval] key={approval_key}\n"
f"summary=Pre-submit approval required before sending to {provider_label}\n"
"requested=pre_submit\n"
f"use: .codex approve {approval_key} or .codex deny {approval_key}"
f"use: {xmpp_cmd} approve {approval_key} or {xmpp_cmd} deny {approval_key}"
),
attachments=[],
metadata={"origin_tag": f"codex-pre-approval:{approval_key}"},