c842e3352a
Implementeaza PRD 5.6 complet (14 stories, TDD). Doua axe:
Lifecycle trimiteri blocate (Val A):
- submissions_admin.py: sterge/repune scoped (404 cross-account inaintea lui 409 stare)
- reactivare dedup peste `error` cu CAS (WHERE id=? AND status='error'), creds noi in
submissions + accounts.rar_creds_enc; worker invalideaza sesiunea RAR la creds proaspete
(JWT 30h vechi nu mai trimite cu parola gresita); camp aditiv `reactivated:true`
- retentie randuri blocate 30z; purge_expired exclude queued/sending; purge_after curatat
la reactivare/requeue
- API DELETE /v1/prezentari/{id} + /repune (200+JSON); UI butoane + bulk + banner actionabil
Observabilitate:
- app/observ.py log_event: dublu canal app_events (DB) + RotatingFileHandler per-proces,
redactare creds/PII la scriere (redact_pii/vin_partial)
- request_id middleware + X-Request-ID pe toate raspunsurile
- handler global excepții -> 500 envelope 6-chei + request_id (traceback doar in jurnal)
- audit cerere API (api_prezentari/api_auth_esuat) + audit worker (rar_login/tranzitii)
- tab "Jurnal" filtrabil scoped (non-admin doar contul sau); retentie jurnal 90z
- rar_error expus in GET /v1/prezentari/{id} (recovery observabil)
pytest -q: 741 passed, 0 failed. Docs: PRD raport VERIFY, contract endpointuri noi, ROADMAP.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
34 lines
1.3 KiB
Python
34 lines
1.3 KiB
Python
"""Middleware HTTP: request_id per cerere (PRD 5.6 US-002).
|
|
|
|
Fiecare raspuns primeste un header `X-Request-ID` (generat daca clientul nu trimite
|
|
unul). Pe durata cererii, id-ul e disponibil prin `observ.request_id_var` (contextvar)
|
|
in handlerul de erori (US-001) si in `log_event` (US-003) — fara a polua semnaturile.
|
|
|
|
Format opac, fara PII: `secrets.token_hex(8)` (16 hex). Daca clientul trimite un
|
|
`X-Request-ID`, il pastram (corelare end-to-end), dar il scurtam defensiv (max 64).
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import secrets
|
|
|
|
from starlette.middleware.base import BaseHTTPMiddleware
|
|
from starlette.requests import Request
|
|
|
|
from ..observ import request_id_var
|
|
|
|
|
|
class RequestIDMiddleware(BaseHTTPMiddleware):
|
|
async def dispatch(self, request: Request, call_next):
|
|
incoming = request.headers.get("X-Request-ID")
|
|
request_id = (incoming.strip()[:64] if incoming and incoming.strip() else secrets.token_hex(8))
|
|
token = request_id_var.set(request_id)
|
|
# Expune si pe request.state pentru handlerele care prefera accesul explicit.
|
|
request.state.request_id = request_id
|
|
try:
|
|
response = await call_next(request)
|
|
finally:
|
|
request_id_var.reset(token)
|
|
response.headers["X-Request-ID"] = request_id
|
|
return response
|