Fix Vite permissions and healthcheck logs - #166
Conversation
Made-with: Cursor
There was a problem hiding this comment.
Pull request overview
Adjusts the frontend container build to avoid Vite runtime write-permission issues, and reduces backend log noise by suppressing /health access logs with accompanying unit coverage.
Changes:
- Run
pnpm installas thenodeuser in the frontend Docker image so Vite can write optimizer/cache files at runtime. - Add a
uvicorn.accesslogging filter that drops access logs for/health. - Add unit tests covering the healthcheck access-log filter behaviour.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
src/frontend/Dockerfile |
Switches to USER node before dependency install to ensure Vite/pnpm-created files are writable at runtime. |
src/backend/app/main.py |
Introduces and installs a uvicorn.access logging filter to suppress /health access logs. |
src/backend/tests/unit/test_access_logging.py |
Adds unit tests verifying the access-log filter drops /health while keeping other paths. |
| def filter(self, record: logging.LogRecord) -> bool: | ||
| args = record.args | ||
| if isinstance(args, tuple) and len(args) >= 3 and args[2] == "/health": | ||
| return False | ||
| return True |
There was a problem hiding this comment.
The PR description says to filter uvicorn access logs for GET /health, but the filter currently drops any request whose path is "/health" regardless of method (and status). This can hide unexpected traffic (e.g., non-GET /health returning 405) that would be useful to keep in logs. Consider checking both method (args[1] == "GET") and optionally the status code before returning False, and update the unit test(s) accordingly.
There was a problem hiding this comment.
Fixed in ac5a0c4. The filter now checks args[1] == "GET" and args[2] == "/health", so non-GET requests to /health (e.g. a 405) are preserved in logs. Added a test_healthcheck_access_filter_keeps_non_get_health test covering POST /health → 405.
Agent-Logs-Url: https://github.com/bihius/guard-proxy/sessions/bd23545c-ddc0-4e58-92c7-5ae772abcd4c Co-authored-by: bihius <119067436+bihius@users.noreply.github.com>
…s filter - Docker Compose, HAProxy, and ADR updates for M1 local dev. - Alembic env and migration style (ruff); tests and seed script line length. - main.py: format healthcheck log filter, only suppress GET /health. - Ruff format on logs router and related tests. Made-with: Cursor
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 28755231 | Triggered | Generic CLI Secret | 0af3714 | src/backend/scripts/seed_admin.py | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secret safely. Learn here the best practices.
- Revoke and rotate this secret.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
Summary
Test plan