fix(version): sanitise error bodies, warn on bad versions, test network path #194

Merged

nrupard merged 1 commit from feat/pms-238-self-hosted-version-check into main

2026-06-12 17:15:56 +02:00

nrupard commented

2026-06-12 17:15:45 +02:00

Owner

Addresses the remaining review nits on the update-check endpoint.

The error response body no longer interpolates the raw reqwest/serde error. A reqwest error can embed the request URL (and thus any credentials in MOKOSH_UPDATE_CHECK_URL), which would undo the pre-sanitised display URL the body is supposed to use. The raw detail now goes to tracing::warn! only; the body references just the sanitised display URL plus a category (request failed / status N / invalid manifest).

parse_version now warns when a version component fails to parse instead of silently degrading it to 0, so a misconfigured publishing side (typo, calendar versioning) is visible rather than quietly never advertising an update. is_newer documents that pre-release/build metadata is stripped, so a pre-release build compares equal to its final release.

fetch_update_check takes (client, url, display) instead of the global probe, so the network path is unit-testable without a mock-server dependency. Four new tests drive it through a one-shot loopback HTTP server: update-available with release_url, up-to-date for an older manifest, error on non-2xx status, and a regression test asserting the error body never contains the raw upstream URL.

#PMS-238

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com

Addresses the remaining review nits on the update-check endpoint. The error response body no longer interpolates the raw reqwest/serde error. A reqwest error can embed the request URL (and thus any credentials in MOKOSH_UPDATE_CHECK_URL), which would undo the pre-sanitised display URL the body is supposed to use. The raw detail now goes to tracing::warn! only; the body references just the sanitised display URL plus a category (request failed / status N / invalid manifest). parse_version now warns when a version component fails to parse instead of silently degrading it to 0, so a misconfigured publishing side (typo, calendar versioning) is visible rather than quietly never advertising an update. is_newer documents that pre-release/build metadata is stripped, so a pre-release build compares equal to its final release. fetch_update_check takes (client, url, display) instead of the global probe, so the network path is unit-testable without a mock-server dependency. Four new tests drive it through a one-shot loopback HTTP server: update-available with release_url, up-to-date for an older manifest, error on non-2xx status, and a regression test asserting the error body never contains the raw upstream URL. #PMS-238 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nrupard added 1 commit

2026-06-12 17:15:45 +02:00

fix(version): sanitise error bodies, warn on bad versions, test network path

Create release / Create release from merged PR (pull_request) Has been skipped

Details

E2E (staging) / Playwright against staging (pull_request) Successful in 33s

Details

Check / fmt + clippy + compile + tests (pull_request) Successful in 1m31s

Details

Build OCI container / Build and push mokosh-api image (push) Successful in 3m28s

Details

fcf44f5e81

Addresses the remaining review nits on the update-check endpoint.

The error response body no longer interpolates the raw reqwest/serde error. A reqwest error can embed the request URL (and thus any credentials in MOKOSH_UPDATE_CHECK_URL), which would undo the pre-sanitised display URL the body is supposed to use. The raw detail now goes to tracing::warn! only; the body references just the sanitised display URL plus a category (request failed / status N / invalid manifest).

parse_version now warns when a version component fails to parse instead of silently degrading it to 0, so a misconfigured publishing side (typo, calendar versioning) is visible rather than quietly never advertising an update. is_newer documents that pre-release/build metadata is stripped, so a pre-release build compares equal to its final release.

fetch_update_check takes (client, url, display) instead of the global probe, so the network path is unit-testable without a mock-server dependency. Four new tests drive it through a one-shot loopback HTTP server: update-available with release_url, up-to-date for an older manifest, error on non-2xx status, and a regression test asserting the error body never contains the raw upstream URL.

#PMS-238

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>