Increase security and reformat
This commit is contained in:
@@ -7,7 +7,12 @@ from asgiref.sync import async_to_sync
|
||||
from django.core.management.base import BaseCommand
|
||||
|
||||
from core.clients.transport import send_message_raw
|
||||
from core.models import CodexPermissionRequest, CodexRun, ExternalSyncEvent, TaskProviderConfig
|
||||
from core.models import (
|
||||
CodexPermissionRequest,
|
||||
CodexRun,
|
||||
ExternalSyncEvent,
|
||||
TaskProviderConfig,
|
||||
)
|
||||
from core.tasks.providers import get_provider
|
||||
from core.util import logs
|
||||
|
||||
@@ -15,7 +20,9 @@ log = logs.get_logger("codex_worker")
|
||||
|
||||
|
||||
class Command(BaseCommand):
|
||||
help = "Process queued external sync events for worker-backed providers (codex_cli)."
|
||||
help = (
|
||||
"Process queued external sync events for worker-backed providers (codex_cli)."
|
||||
)
|
||||
|
||||
def add_arguments(self, parser):
|
||||
parser.add_argument("--once", action="store_true", default=False)
|
||||
@@ -73,7 +80,9 @@ class Command(BaseCommand):
|
||||
payload = dict(event.payload or {})
|
||||
action = str(payload.get("action") or "append_update").strip().lower()
|
||||
provider_payload = dict(payload.get("provider_payload") or payload)
|
||||
run_id = str(provider_payload.get("codex_run_id") or payload.get("codex_run_id") or "").strip()
|
||||
run_id = str(
|
||||
provider_payload.get("codex_run_id") or payload.get("codex_run_id") or ""
|
||||
).strip()
|
||||
codex_run = None
|
||||
if run_id:
|
||||
codex_run = CodexRun.objects.filter(id=run_id, user=event.user).first()
|
||||
@@ -104,9 +113,13 @@ class Command(BaseCommand):
|
||||
result_payload = dict(result.payload or {})
|
||||
requires_approval = bool(result_payload.get("requires_approval"))
|
||||
if requires_approval:
|
||||
approval_key = str(result_payload.get("approval_key") or uuid.uuid4().hex[:12]).strip()
|
||||
approval_key = str(
|
||||
result_payload.get("approval_key") or uuid.uuid4().hex[:12]
|
||||
).strip()
|
||||
permission_request = dict(result_payload.get("permission_request") or {})
|
||||
summary = str(result_payload.get("summary") or permission_request.get("summary") or "").strip()
|
||||
summary = str(
|
||||
result_payload.get("summary") or permission_request.get("summary") or ""
|
||||
).strip()
|
||||
requested_permissions = permission_request.get("requested_permissions")
|
||||
if not isinstance(requested_permissions, (list, dict)):
|
||||
requested_permissions = permission_request or {}
|
||||
@@ -121,28 +134,42 @@ class Command(BaseCommand):
|
||||
codex_run.status = "waiting_approval"
|
||||
codex_run.result_payload = dict(result_payload)
|
||||
codex_run.error = ""
|
||||
codex_run.save(update_fields=["status", "result_payload", "error", "updated_at"])
|
||||
codex_run.save(
|
||||
update_fields=["status", "result_payload", "error", "updated_at"]
|
||||
)
|
||||
CodexPermissionRequest.objects.update_or_create(
|
||||
approval_key=approval_key,
|
||||
defaults={
|
||||
"user": event.user,
|
||||
"codex_run": codex_run if codex_run is not None else CodexRun.objects.create(
|
||||
user=event.user,
|
||||
task=event.task,
|
||||
derived_task_event=event.task_event,
|
||||
source_service=str(provider_payload.get("source_service") or ""),
|
||||
source_channel=str(provider_payload.get("source_channel") or ""),
|
||||
external_chat_id=str(provider_payload.get("external_chat_id") or ""),
|
||||
status="waiting_approval",
|
||||
request_payload=dict(payload or {}),
|
||||
result_payload=dict(result_payload),
|
||||
error="",
|
||||
"codex_run": (
|
||||
codex_run
|
||||
if codex_run is not None
|
||||
else CodexRun.objects.create(
|
||||
user=event.user,
|
||||
task=event.task,
|
||||
derived_task_event=event.task_event,
|
||||
source_service=str(
|
||||
provider_payload.get("source_service") or ""
|
||||
),
|
||||
source_channel=str(
|
||||
provider_payload.get("source_channel") or ""
|
||||
),
|
||||
external_chat_id=str(
|
||||
provider_payload.get("external_chat_id") or ""
|
||||
),
|
||||
status="waiting_approval",
|
||||
request_payload=dict(payload or {}),
|
||||
result_payload=dict(result_payload),
|
||||
error="",
|
||||
)
|
||||
),
|
||||
"external_sync_event": event,
|
||||
"summary": summary,
|
||||
"requested_permissions": requested_permissions if isinstance(requested_permissions, dict) else {
|
||||
"items": list(requested_permissions or [])
|
||||
},
|
||||
"requested_permissions": (
|
||||
requested_permissions
|
||||
if isinstance(requested_permissions, dict)
|
||||
else {"items": list(requested_permissions or [])}
|
||||
),
|
||||
"resume_payload": dict(resume_payload or {}),
|
||||
"status": "pending",
|
||||
"resolved_at": None,
|
||||
@@ -150,9 +177,17 @@ class Command(BaseCommand):
|
||||
"resolution_note": "",
|
||||
},
|
||||
)
|
||||
approver_service = str((cfg.settings or {}).get("approver_service") or "").strip().lower()
|
||||
approver_identifier = str((cfg.settings or {}).get("approver_identifier") or "").strip()
|
||||
requested_text = result_payload.get("permission_request") or result_payload.get("requested_permissions") or {}
|
||||
approver_service = (
|
||||
str((cfg.settings or {}).get("approver_service") or "").strip().lower()
|
||||
)
|
||||
approver_identifier = str(
|
||||
(cfg.settings or {}).get("approver_identifier") or ""
|
||||
).strip()
|
||||
requested_text = (
|
||||
result_payload.get("permission_request")
|
||||
or result_payload.get("requested_permissions")
|
||||
or {}
|
||||
)
|
||||
if approver_service and approver_identifier:
|
||||
try:
|
||||
async_to_sync(send_message_raw)(
|
||||
@@ -168,10 +203,17 @@ class Command(BaseCommand):
|
||||
metadata={"origin_tag": f"codex-approval:{approval_key}"},
|
||||
)
|
||||
except Exception:
|
||||
log.exception("failed to notify approver channel for approval_key=%s", approval_key)
|
||||
log.exception(
|
||||
"failed to notify approver channel for approval_key=%s",
|
||||
approval_key,
|
||||
)
|
||||
else:
|
||||
source_service = str(provider_payload.get("source_service") or "").strip().lower()
|
||||
source_channel = str(provider_payload.get("source_channel") or "").strip()
|
||||
source_service = (
|
||||
str(provider_payload.get("source_service") or "").strip().lower()
|
||||
)
|
||||
source_channel = str(
|
||||
provider_payload.get("source_channel") or ""
|
||||
).strip()
|
||||
if source_service and source_channel:
|
||||
try:
|
||||
async_to_sync(send_message_raw)(
|
||||
@@ -185,7 +227,9 @@ class Command(BaseCommand):
|
||||
metadata={"origin_tag": "codex-approval-missing-target"},
|
||||
)
|
||||
except Exception:
|
||||
log.exception("failed to notify source channel for missing approver target")
|
||||
log.exception(
|
||||
"failed to notify source channel for missing approver target"
|
||||
)
|
||||
return
|
||||
|
||||
event.status = "ok" if result.ok else "failed"
|
||||
@@ -201,18 +245,24 @@ class Command(BaseCommand):
|
||||
approval_key = str(provider_payload.get("approval_key") or "").strip()
|
||||
if mode == "approval_response" and approval_key:
|
||||
req = (
|
||||
CodexPermissionRequest.objects.select_related("external_sync_event", "codex_run")
|
||||
CodexPermissionRequest.objects.select_related(
|
||||
"external_sync_event", "codex_run"
|
||||
)
|
||||
.filter(user=event.user, approval_key=approval_key)
|
||||
.first()
|
||||
)
|
||||
if req and req.external_sync_event_id:
|
||||
if result.ok:
|
||||
ExternalSyncEvent.objects.filter(id=req.external_sync_event_id).update(
|
||||
ExternalSyncEvent.objects.filter(
|
||||
id=req.external_sync_event_id
|
||||
).update(
|
||||
status="ok",
|
||||
error="",
|
||||
)
|
||||
elif str(event.error or "").strip() == "approval_denied":
|
||||
ExternalSyncEvent.objects.filter(id=req.external_sync_event_id).update(
|
||||
ExternalSyncEvent.objects.filter(
|
||||
id=req.external_sync_event_id
|
||||
).update(
|
||||
status="failed",
|
||||
error="approval_denied",
|
||||
)
|
||||
@@ -220,9 +270,16 @@ class Command(BaseCommand):
|
||||
codex_run.status = "ok" if result.ok else "failed"
|
||||
codex_run.error = str(result.error or "")
|
||||
codex_run.result_payload = result_payload
|
||||
codex_run.save(update_fields=["status", "error", "result_payload", "updated_at"])
|
||||
codex_run.save(
|
||||
update_fields=["status", "error", "result_payload", "updated_at"]
|
||||
)
|
||||
|
||||
if result.ok and result.external_key and event.task_id and not str(event.task.external_key or "").strip():
|
||||
if (
|
||||
result.ok
|
||||
and result.external_key
|
||||
and event.task_id
|
||||
and not str(event.task.external_key or "").strip()
|
||||
):
|
||||
event.task.external_key = str(result.external_key)
|
||||
event.task.save(update_fields=["external_key"])
|
||||
|
||||
@@ -250,7 +307,11 @@ class Command(BaseCommand):
|
||||
continue
|
||||
|
||||
for row_id in claimed_ids:
|
||||
event = ExternalSyncEvent.objects.filter(id=row_id).select_related("task", "user").first()
|
||||
event = (
|
||||
ExternalSyncEvent.objects.filter(id=row_id)
|
||||
.select_related("task", "user")
|
||||
.first()
|
||||
)
|
||||
if event is None:
|
||||
continue
|
||||
try:
|
||||
|
||||
Reference in New Issue
Block a user