Conversation
Promote to preprod — 2026-07-09 09:06 UTC
Promote to preprod — 2026-07-09 17:53 UTC
Promote to prod — 2026-07-09 18:22 UTC
Promote to preprod — 2026-07-12 20:34 UTC
Promote to prod — 2026-07-12 20:48 UTC
Promote to preprod — 2026-07-28 09:34 UTC
Promote to prod — 2026-07-28 11:05 UTC
Promote to preprod — 2026-08-09 12:54 UTC
Promote to prod — 2026-08-09 13:42 UTC
Promote to preprod — 2026-08-12 06:54 UTC
Promote to prod — 2026-08-12 09:01 UTC
fix: exclude redirect urls
Promote to prod — 2026-08-12 14:25 UTC
Promote to prod — 2026-08-17 07:05 UTC
api/login/ was stock SimpleJWT, so a failed sign-in always returned the
same generic "no active account" message. The mobile app therefore could
not tell a wrong password from an account that only has Google or Apple
sign-in, and had no way to tell the user to use the buttons above.
The web auth endpoint already detects this: email_login returns
401 {error, _auth: {code: 'sso_only_account', providers}}. This extends
the same signal to api/login/ rather than reimplementing it, via a
serializer (SSOAwareTokenObtainPairSerializer) that delegates to
SimpleJWT and only decorates the failure path -- simplejwt's documented
extension point, instead of catching AuthenticationFailed in post() and
returning a raw JsonResponse from a DRF view.
The detection itself moves into a shared sso_only_account_info() helper
that email_login and password_reset_api now both call too, so the three
call sites cannot drift. It also collapses detection from four queries
(user_exists, get_user, socialaccount_set.exists(), then
socialaccount_set.values_list(...)) down to one user lookup and one
social-account fetch; has_usable_password() needs no query of its own.
Behavior is otherwise unchanged. Success still returns exactly
{access, refresh} at 200, and an ordinary wrong-password or unknown-user
failure re-raises SimpleJWT's original exception untouched, preserving
the existing body and status for current clients. password_reset_api and
email_login keep their exact prior status codes and response bodies.
Note for review: this extends account enumeration to api/login/. An
unauthenticated caller can now learn whether an email is registered and
which providers are linked, and neither this endpoint nor email_login is
throttled (no DEFAULT_THROTTLE_CLASSES anywhere). The same exposure
already ships on the web endpoint, so this doubles the surface rather
than introducing a new class of leak -- but it is a deliberate tradeoff
worth an explicit decision, not an oversight.
Supersedes #3580 (closed pending mobile consumption, which has now
landed) and replaces #3612 (view-based approach). Related: #3609.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JMEqissBzfRtQuukMijY4u
The mobile app's forgot-password screen holds no csrftoken cookie and sends no Referer, so CsrfViewMiddleware rejects it with a 403 HTML body before the view ever runs. The endpoint is unauthenticated and reads its target email from the JSON body rather than the session, so CSRF protects nothing here -- mirrors the existing google_mobile/apple_mobile exemptions. sc-46557
The existing wrong-password test used an account with no linked provider, so it passed with or without the guard. Add the case that actually distinguishes them: a user holding both a password and a Google account, mistyping the password. Without the guard they would be told their account is Google-only. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JMEqissBzfRtQuukMijY4u
Reviewer was right that the branch is unreachable: nothing produces an account with both a usable password and a linked provider. Linking wipes the password (adapters.py pre_social_login), the reset API rejects SSO-only accounts, and the web reset form inherits Django's get_users(), which skips unusable-password users. Keep the check -- it is free, and "SSO always wins on an email collision" is a documented product decision rather than an invariant -- but stop the docstring and test implying it guards a live case. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JMEqissBzfRtQuukMijY4u
…t-api-login hotfix(sso): surface sso_only_account on the mobile JWT login endpoint
Promote to preprod — 2026-08-20 07:42 UTC
Promote to preprod — 2026-08-20 10:15 UTC
/healthz is served by the same gunicorn workers as real traffic, so it queues behind them. With no explicit failureThreshold the default of 3 means ~3 minutes of a slow-but-alive app is enough for the kubelet to kill the container. In production since 2026-08-23 that has produced 17-20 liveness-probe kills per pod (vs 1-2 before), with zero OOMKills - the containers are being killed for being slow, not dead. Each kill re-imports the whole application and shifts traffic onto the remaining pods, which then slow down and fail their own probes; kills arrive in waves of 3-5 pods. Readiness is deliberately left at the default so a slow pod is still pulled out of the Service. Liveness should only fire for a genuinely dead process. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DbbDpzvvxiRi2U9J9wssxi
The container already passes --timeout 420 to gunicorn, so the app itself tolerates a 7-minute request. The liveness probe, at the default failureThreshold of 3 with periodSeconds 60, kills the container after ~3 minutes - stricter than the app's own timeout. 60s x 7 = 420s makes the two consistent: the kubelet no longer kills a worker before gunicorn would have recycled it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DbbDpzvvxiRi2U9J9wssxi
…eshold hotfix(helm): stop the kubelet killing slow-but-alive web pods
sefaria/model/dependencies.py is imported while sefaria.model's __init__ is still running, so its module-level `from sefaria.helper.search import (...)` pulls that module - and transitively sefaria.search and the Elasticsearch client - into every worker boot, whether or not anything is ever indexed. Wraps each of the eight ES cascade handlers in a thunk that imports on first call. Subscription order is unchanged, which matters: several subscriptions carry explicit ordering comments. The handlers already defer their own imports (`from sefaria.search import index_topic_doc` inside the function body), so this makes the module consistent with them. Behaviour is identical; only the timing of the import changes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DbbDpzvvxiRi2U9J9wssxi
…boot hotfix(deps): defer sefaria.helper.search import to first use
The deploy job for #3661 built and tagged chart 0.87.5-preprod.2, but its push of the version bump was rejected non-fast-forward because #3663 merged three minutes later and moved the branch. The tag exists (preprod/6.111.0-preprod.4+chart.0.87.5-preprod.2) while its commit c917e87 was never pushed, so nothing references the chart. The follow-up run skipped release-chart, so the chart stayed pinned at 0.87.5-preprod.1 and #3661's livenessProbe failureThreshold never reached the cluster. This only updates the reference. The chart is already built and needs no rebuild. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DbbDpzvvxiRi2U9J9wssxi
…875preprod2 fix(preprod): point helmrelease at chart 0.87.5-preprod.2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promote
preprod→masterRollback Reference
masterv6.110.10, chart=0.87.3Changes
Auto-generated by Manual Promotion workflow