Chris CoutinhoandClaude Opus 4.8 9c0c6a0c50 fix(search): cap path_prefixes server-side; unify Iterable typing ...

Round 3 review follow-ups:
- Enforce the folder cap (MAX_PATH_PREFIXES=20) inside normalize_path_prefixes
  so the REST/viz endpoints are bounded too, not just the MCP tool's Field
  and the PHP client. Single server-side enforcement point; the MCP tool's
  Field(max_length=...) now references the same constant.
- Widen the SearchAlgorithm ABC and both concrete implementations'
  path_prefixes param to Iterable[str] | None, matching the widening of
  build_base_filter_conditions from the prior round.
- Add a normalize_path_prefixes cap test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-03 13:18:52 +02:00

..

api

refactor: change OAuth scope separator from colon to dot for IDP compatibility

2026-04-07 10:07:02 +02:00

client

fix(auth): authenticate stored app passwords with loginName, not UID

2026-05-31 21:34:05 +02:00

providers

fix(embedding): normalize gateway base_url to the /v1 base path

2026-06-01 17:39:23 +02:00

search

fix(search): cap path_prefixes server-side; unify Iterable typing

2026-06-03 13:18:52 +02:00

utils

feat(search): ADR-027 Phase 1 — modified-date range filter

2026-06-03 00:35:20 +02:00

vector

feat(search): ADR-027 Phase 2 — file-path filter

2026-06-03 00:51:12 +02:00

__init__.py

feat: Split read/write scopes into app:read/write scopes

2025-10-24 04:38:49 +02:00

conftest.py

fix(observability): address PR review + SonarCloud findings

2026-06-02 18:15:50 +02:00

test_acl_hash.py

feat: add opt-in MCP decomposition hook points (design §10)

2026-05-29 13:13:25 +02:00

test_app_password_loginname_auth.py

fix(auth): authenticate stored app passwords with loginName, not UID

2026-05-31 21:34:05 +02:00

test_app_password_storage.py

feat(storage): pluggable database backend via DATABASE_URL (ADR-026)

2026-05-16 18:06:42 +02:00

test_auth_tools.py

refactor: change OAuth scope separator from colon to dot for IDP compatibility

2026-04-07 10:07:02 +02:00

test_basic_auth_middleware.py

fix(config): address reviewer feedback

2025-12-20 21:16:17 +01:00

test_browser_oauth_routes.py

fix(auth): address PR #758 round-7 medium/minor review

2026-05-03 14:21:12 +02:00

test_browser_oauth_xss.py

fix(auth): address PR #758 round-3 review

2026-05-02 22:40:06 +02:00

test_browser_sessions.py

fix(auth): address PR #758 review — XSS, CSRF, open redirect, JWKS cache

2026-05-02 18:26:39 +02:00

test_chunk_bbox_helper.py

fix: address PR #813 review round 4 (log leak, cross-user chunk ctx, algo, overlap)

2026-05-29 16:55:00 +02:00

test_chunk_context_offset_gate.py

fix(vector): address PR review round 15 — concurrency, pagination, stale coercion

2026-05-10 13:49:17 +02:00

test_client_registry.py

feat(auth): drop test-client defaults, add ALLOWED_MGMT_CLIENT allowlist

2026-04-30 01:20:21 +02:00

test_config_paths.py

test: address PR #707 reviewer feedback on config path helpers

2026-04-14 21:14:42 +02:00

test_config_validators.py

fix(config): emit background-ops advisory logs once per process

2026-05-16 13:07:50 +02:00

test_config.py

feat: implement dynaconf configuration management (ADR-024 phases 1-3)

2026-04-07 09:22:19 +02:00

test_dcr_proxy.py

fix(auth): address PR #758 round-2 review

2026-05-02 21:56:08 +02:00

test_deck_server.py

refactor(deck): address PR #826 review feedback

2026-06-01 17:40:46 +02:00

test_decomposition_config.py

fix: address PR #814 review + SonarCloud gate

2026-05-29 18:36:42 +02:00

test_document_chunker.py

fix: Add async/await, PDF metadata, and type safety fixes

2025-11-20 02:37:07 +01:00

test_document_parse_metrics.py

fix(observability): address second review round

2026-06-02 21:09:50 +02:00

test_document_processor_config.py

feat: implement dynaconf configuration management (ADR-024 phases 1-3)

2026-04-07 09:22:19 +02:00

test_elicitation.py

fix(auth): address PR #757 round-2 review feedback

2026-05-02 16:33:43 +02:00

test_embedding_metrics.py

fix(observability): address PR review + SonarCloud findings

2026-06-02 18:15:50 +02:00

test_embedding_service.py

fix(embedding): instantiate BM25 singleton off the event loop

2026-05-17 19:33:24 +02:00

test_hybrid_auth_setup.py

fix(mcp): Move all imports to the top of modules

2025-12-26 10:05:27 -06:00

test_id_token_verification.py

fix(auth): address PR #758 round-4 review

2026-05-03 00:57:12 +02:00

test_instrument_tool.py

fix(test): fix 17 pre-existing unit test failures and add astrolabe CI build

2026-02-27 21:53:06 +01:00

test_logging_filter.py

chore: Remove /health and /metrics endpoints from logging

2025-11-10 02:07:45 +01:00

test_login_flow.py

test: avoid SonarCloud security rules instead of NOSONAR

2026-05-29 00:19:30 +02:00

test_management_app_password_endpoints.py

fix(api): distinguish Nextcloud 5xx from auth failure; tighten body parse (#824)

2026-06-01 15:15:48 +02:00

test_management_apps_endpoint.py

fix(webhooks): use HTTP 428 instead of 412 for unprovisioned users

2026-05-04 00:15:55 +02:00

test_management_chunk_context_endpoint.py

fix(chunk-context): address PR #767 review — doc_type filter parity + tests

2026-05-08 20:50:27 +02:00

test_management_pdf_preview_endpoint.py

fix(api): use stored app password for chunk-context and pdf-preview

2026-04-22 19:50:13 +02:00

test_management_status_endpoint.py

refactor(config)!: rename OAUTH_SINGLE_AUDIENCE to LOGIN_FLOW, gate on ENABLE_LOGIN_FLOW

2026-05-12 19:34:13 +02:00

test_nutrition_model.py

address review: exclude bool from coercion, parameterize tests over all fields

2026-04-14 23:02:56 +00:00

test_oauth_callback_session_cleanup.py

fix(auth): address PR #758 round-6 medium/low review

2026-05-03 13:03:49 +02:00

test_oauth_logout.py

fix(auth): address PR #758 round-7 medium/minor review

2026-05-03 14:21:12 +02:00

test_oauth_tools_app_password_provisioning.py

test: clear SonarCloud security false positives in new tests

2026-05-29 00:10:35 +02:00

test_oauth_tools_signatures.py

fix(auth): harden OAuth/session for hosted multi-tenant deployment (#626)

2026-05-02 17:03:57 +02:00

test_offline_access_detection.py

fix: conditionally include offline_access based on IdP discovery

2026-04-07 23:48:49 +02:00

test_oidc_discovery.py

fix(auth): address PR #758 round-2 review

2026-05-02 21:56:08 +02:00

test_origin_normalise.py

fix(auth): address PR #758 round-3 final review

2026-05-02 23:14:07 +02:00

test_payload_backfill.py

feat: add opt-in MCP decomposition hook points (design §10)

2026-05-29 13:13:25 +02:00

test_progress_notification.py

feat: Add text processing background worker for telling client about progress

2025-10-25 19:52:45 +02:00

test_provision_routes.py

fix: require bearer token on provision endpoints (open redirect mitigation)

2026-03-31 17:09:37 +02:00

test_response_models.py

fix(contacts): surface ORG/TITLE/NOTE/URL/CATEGORIES/PHOTO on read (refs #716)

2026-05-21 10:07:47 +02:00

test_safe_next_url.py

fix(auth): address PR #758 review — XSS, CSRF, open redirect, JWKS cache

2026-05-02 18:26:39 +02:00

test_scope_authorization_stored.py

fix(auth): invalidate scope cache on web/REST provisioning paths

2026-05-02 16:59:53 +02:00

test_scope_decorator.py

refactor: change OAuth scope separator from colon to dot for IDP compatibility

2026-04-07 10:07:02 +02:00

test_scope_prefix.py

fix: address second round of PR review for scope prefix

2026-04-07 16:58:29 +02:00

test_ssl_config.py

fix(storage): address PR #798 review feedback (credentials, asyncpg extra, TLS, pool)

2026-05-16 18:53:45 +02:00

test_stdio.py

chore: address review-round-4 nits — stale delenv, upgrade hint, in-sync notes

2026-05-12 22:35:50 +02:00

test_storage_engine.py

fix(storage): address review on PR #799 (stale comments, docs deprecation, unit test)

2026-05-17 18:45:14 +02:00

test_storage_logging.py

fix(storage): address PR #798 round-4 review (NOSONAR syntax + pg_advisory_lock + engine dispose + nits)

2026-05-17 09:25:42 +02:00

test_tag_exclusion.py

fix(webdav): address PR #764 review round 4

2026-05-06 20:24:11 +02:00

test_token_broker.py

fix(auth): harden OAuth/session for hosted multi-tenant deployment (#626)

2026-05-02 17:03:57 +02:00

test_token_utils_user_id.py

fix(auth): fail closed on missing sub claim, delete Flow 2 callback session

2026-05-02 19:46:36 +02:00

test_unified_verifier.py

feat(auth): drop test-client defaults, add ALLOWED_MGMT_CLIENT allowlist

2026-04-30 01:20:21 +02:00

test_viz_routes_chunk_context.py

fix(chunk-context): address PR #767 review — doc_type filter parity + tests

2026-05-08 20:50:27 +02:00

test_webdav_tools_exclusion.py

fix(webdav): address PR #764 review round 4

2026-05-06 20:24:11 +02:00

test_webhook_endpoint.py

feat: add opt-in MCP decomposition hook points (design §10)

2026-05-29 13:13:25 +02:00

test_webhook_parser.py

fix(webhooks): authenticate deliveries via WEBHOOK_SECRET; review nits

2026-04-30 03:50:28 +02:00

test_webhook_presets.py

feat(webhooks): add Deck card sync preset with vector indexing

2026-05-21 09:03:59 +02:00

test_webhook_routes_register.py

refactor(webhooks): address PR review on auth-pass

2026-04-30 04:02:26 +02:00

test_webhook_routes_xss.py

fix(webhooks): escape HTML in error responses, compare bearer as bytes

2026-04-30 14:17:45 +02:00

test_webhook_storage.py

fix(storage): address PR #798 review feedback (credentials, asyncpg extra, TLS, pool)

2026-05-16 18:53:45 +02:00

test_webhook_uri.py

refactor(webhooks): bound queue waits, route URLs through dynaconf

2026-04-30 04:17:00 +02:00

test_webhooks_api_auth.py

fix(webhooks): use HTTP 428 instead of 412 for unprovisioned users

2026-05-04 00:15:55 +02:00