Skip to content

fix(api): log a key store failure that the REST routes meet - #870

Queued
ThomasK33 wants to merge 3 commits into
mainfrom
log-rest-key-failures
Queued

fix(api): log a key store failure that the REST routes meet#870
ThomasK33 wants to merge 3 commits into
mainfrom
log-rest-key-failures

Conversation

@ThomasK33

@ThomasK33 ThomasK33 commented Nov 14, 2026

Copy link
Copy Markdown
Member

Why

Follow-up to #865. That PR made the git and LFS routes log the cause of a key store failure, and of a registered key that does not parse, at most once a minute for each kind. The REST token paths answer a fixed text for both failures, and they logged nothing. An operator whose clients use only the REST API had no log line for a failed key store.

What changed

  • githttp.KeyFailureLog is exported. Its Report method holds the rule for what to log: the key store failed, or a registered key does not parse. It does not log an unknown issuer or a request that ended while the keys were read.
  • The REST middleware (requireAuth) and the fork source token check report their Verify error to Report. The REST routes have a limiter of their own, so for each kind they write at most one line per minute, in addition to the line of the git and LFS routes.
  • docs/how-to/deploy-production.md says so in its two verify token rows.
  • The REST answers and status codes do not change.

Scope

Verification

  • A key store that fails, a registered key that does not parse, and an unknown issuer each go through requireAuth. The first two write one line with the cause, and the third writes none.
  • The fork source token check writes the line of a failed key store.
  • Each test fails when its Report call is removed from the code.
  • internal/auth, the internal/api tests on SQLite and the internal/githttp tests on the local backend pass. golangci-lint, the docs gate and both fingerprint gates pass.

Generated with xum • Model: anthropic:claude-sonnet-5-5 • Thinking: xhigh

@ThomasK33
fix(api): log a key store failure that the REST routes meet
9296a9a 
The git and LFS routes log the cause of a key store failure, or of a
registered key that does not parse, at most once a minute for each kind.
The REST token paths answered a fixed text for both, and logged
nothing, so an operator whose clients use only the REST API had no log
line for a failed key store.

KeyFailureLog is now exported from githttp, and its Report method holds
the classification: an unknown issuer and a request that ended are not
logged. The REST middleware and the fork source token check report
their Verify errors to a limiter of their own, so the REST routes write
at most one more line for each kind per minute. The answers do not
change.

Change-Id: Icbea51ba4d51bd0cc502140babf06d660a11b773
Signed-off-by: Thomas Kosiewski <tk@coder.com>
@ThomasK33
chore: record the lane-schedule fingerprint of type Server
aad9964 
Change-Id: Ic7c9c5e5d5b7370b8cba9cc0d89c1524cb5b5f1f
Signed-off-by: Thomas Kosiewski <tk@coder.com>
@ThomasK33

ThomasK33 commented Nov 14, 2026

Copy link
Copy Markdown
Member Author

@codex review

@ThomasK33

ThomasK33 commented Nov 14, 2026

Copy link
Copy Markdown
Member Author

@codex security review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-14T04:25:16.523484Z 8bbd693 Manual request
🔒 Security Review ✅ Completed 2026-11-14T04:26:19.102209Z 8bbd693 Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 14, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: aad9964512

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 14, 2026

Copy link
Copy Markdown

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: aad9964512

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@ThomasK33
test(api): pin the REST limit and ended-request cases of the key fail…
8bbd693 
…ure log

Change-Id: I5ba79a158bc70fd3f8ef1a8135dae5cfb6a90b59
Signed-off-by: Thomas Kosiewski <tk@coder.com>
@ThomasK33

ThomasK33 commented Nov 14, 2026

Copy link
Copy Markdown
Member Author

@codex review

@ThomasK33

ThomasK33 commented Nov 14, 2026

Copy link
Copy Markdown
Member Author

@codex security review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 14, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: 8bbd69335a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 14, 2026

Copy link
Copy Markdown

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 8bbd69335a

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@ThomasK33
ThomasK33 added this pull request to the merge queue Nov 14, 2026
Any commits made after this event will not be merged.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ThomasK33