[HardMax71]

Summary

Closes #308. A secret nested in a logged dict, list or model printed in full, since the log sanitizer only checks top-level values. The secrets are now typed so they can't print, instead of a deeper scrubber.

Changes

The Settings secrets (SECRET_KEY, MONGO_PASSWORD, MONGODB_URL, REDIS_PASSWORD), the passwords in UserCreate, UserUpdate and PasswordResetRequest, UserDocument.hashed_password and the two tokens in LoginResult are SecretStr. They print as ********** at any depth. The 13 places that need the value call .get_secret_value(), and Beanie still writes the real hash. The spec marks the three password fields writeOnly, so hey-api now generates UserCreateWritable, and the register page and the create-user form validate with it. The dummy hash that evens out login timing is now computed at startup with BCRYPT_ROUNDS, not hardcoded. Webhook URLs stay plain, since the settings page loads them back.

Warning

A password under 8 characters now answers 422 with password: Value should have at least 8 items after validation, not 5 instead of password: String should have at least 8 characters. That's Pydantic's wording for a length check on SecretStr. The frontend checks the length before sending, so only direct API clients see it.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)
• CI/CD or tooling changes

Test Plan

• Backend unit tests pass (cd backend && uv run pytest tests/unit)
• Frontend unit tests pass (cd frontend && npm run test)
• Backend E2E tests pass (docker compose exec -T backend sh -c 'uv sync --group test --no-dev --frozen --no-install-project --no-build && pytest tests/e2e')
• Frontend E2E tests pass (cd frontend && npm run test:e2e)
• API spec and client regenerated if routes or schemas changed (./deploy.sh openapi, then ./deploy.sh types), never edited by hand
• Manual testing performed

Validation: a new unit test logs a user document, a login result and the settings nested in one dict. On main the line holds all six secrets; here it holds none. ruff, mypy --strict, 574 unit tests, svelte-check, ESLint, Prettier, 870 Vitest tests and mkdocs build --strict pass. The full backend e2e suite with k3s and the worker: 493 passed, 1 skipped, as on main.

Checklist

• My code follows the project's style guidelines
• I have run pre-commit run --all-files and all checks pass
• I have added tests that prove my fix/feature works
• I have updated documentation if needed
• My changes don't introduce new warnings

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: f47e2009-b569-4094-ac90-86b2ef8c12af

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Flag	Coverage Δ
backend-e2e	82.26% <96.29%> (+0.01%)	⬆️
backend-unit	74.75% <96.29%> (+0.01%)	⬆️
frontend-unit	92.27% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
backend/app/api/routes/auth.py	100.00% <100.00%> (ø)
backend/app/core/dishka_lifespan.py	100.00% <100.00%> (ø)
backend/app/core/providers.py	97.57% <ø> (ø)
backend/app/core/security.py	96.90% <100.00%> (ø)
backend/app/db/docs/user.py	100.00% <100.00%> (ø)
backend/app/db/repositories/user_repository.py	95.94% <100.00%> (+0.05%)	⬆️
backend/app/domain/user/user_models.py	100.00% <100.00%> (ø)
backend/app/schemas_pydantic/user.py	100.00% <100.00%> (ø)
backend/app/services/admin/admin_user_service.py	99.20% <100.00%> (+<0.01%)	⬆️
backend/app/services/auth_service.py	95.49% <100.00%> (+0.08%)	⬆️
... and 4 more

Components	Coverage Δ
Backend	92.60% <100.00%> (+<0.01%)	⬆️
Frontend	92.27% <ø> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud