fix(api): hash API keys in the /v1/models catalog cache key - #10309
fix(api): hash API keys in the /v1/models catalog cache key#10309RaviTharuma wants to merge 7 commits into
Conversation
…ouzapw#189, diegosouzapw#190) Bumps: nanoid ^3.3.17 (was transitive, now overridden), dompurify ^3.4.13 (with monaco-editor scoped override). Closes Dependabot diegosouzapw#189, diegosouzapw#190. Remaining diegosouzapw#182-diegosouzapw#188 (js-yaml + mermaid) already closed by diegosouzapw#9651 merge — awaiting Dependabot re-scan. npm audit → 0 vulnerabilities.
…egosouzapw#190 Closes Dependabot diegosouzapw#189 (dompurify 3.4.13) and diegosouzapw#190 (nanoid 3.3.17). npm audit → 0.
_tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential _tasks symlink can slip in via git add -A and, once pulled, checkout materializes it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks ignores the symlink too, preventing re-capture.
…pw#10026) Mirror the request-time exclusion rule (provider_specific_data.excludedModels) in the unified catalog builder: a model is hidden when its provider has connections but none of them is eligible for it. Applied across the PROVIDER_MODELS, synced, custom, alias-backed, and managed-fallback loops so ghost models no longer appear as available. Co-authored-by: ritheshcn25 <ritheshcn25@users.noreply.github.com>
…osouzapw#10055) * fix(models): memoize getModelsDevPricing for /v1/models catalog resolveCatalogPricing called getModelsDevPricing once per model while building GET /v1/models. Each call re-scanned models_dev_pricing and JSON.parsed every row (~10k SQL scans + multi-GB parse work), pegging the event loop so even /healthz timed out (diegosouzapw#9685, diegosouzapw#10052). Memoize the parsed map until saveModelsDevPricing / clearModelsDevPricing and add a unit test for invalidation. Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> * fix(db): invalidate modelsDevPricing cache on DB reset (diegosouzapw#10055) Copilot review fixes: 1. Register invalidateModelsDevPricingCache() with DB state reset system so resetDbInstance() clears the process-local memo, preventing stale pricing data from surviving across DB reset/restore operations. 2. Add test assertion verifying DB reset bypasses the memo (Copilot diegosouzapw#10055). The process-local memo at modelsDevSync.ts:204 caches getModelsDevPricing() results until saveModelsDevPricing()/clearModelsDevPricing() to avoid re-scanning all pricing rows on every /v1/models request. Without this hook, backup restore and test DB resets would serve stale cached data from the previous connection. Tests: npm run test:unit:serial -- tests/unit/modelsDevSync-extended.test.ts --------- Signed-off-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com>
buildCatalogCacheKey stored the raw bearer token in a process-wide Map. Heap dumps and inspectors could leak it. Fingerprint with sha256.
|
Implements / pairs with #10313. |
|
Thanks for this — the underlying fix is a real and worthwhile one. I checked and the raw-API-key-in-Map-key issue you describe in #10313 is still present on The reason I'm not marking this merge-ready as-is: your branch looks like it stacked on top of your own #10026 and #10055 before they merged, and wasn't rebased afterward. Both of those already landed on There's also a real trap hiding in there: Could you rebase (or just recreate the branch) onto current Nice catch on the original issue, by the way — that's a genuinely nasty little leak surface. |
Resolve catalog cache key conflict by combining the API-key hash fingerprint with the base's hideAuto/hideNoThink key segments; take base's version-checked getModelsDevPricing memo and its restructured test file (base diegosouzapw#10055 supersedes the older memo port); take base .gitignore and package-lock. Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>
Babysit summaryThe two failing checks (
Ready for human review & merge. |
3 participants
Summary
buildCatalogCacheKeyincatalogCache.tsput the raw API key into a process-wideMapkey (prefix|codex|${apiKey}|configuredOnly).Related Issues
Validation