8000 fix(privacy-shield): add missing await on upstream.read() call by patil2001 · Pull Request #1 · patil2001/ODS · GitHub
[go: up one dir, main page]

Skip to content

fix(privacy-shield): add missing await on upstream.read() call - #1

Open
patil2001 wants to merge 4 commits into
mainfrom
fix/bug-002-missing-await-privacy-shield
Open

patil2001 wants to merge 4 commits into
mainfrom
fix/bug-002-missing-await-privacy-shield

Conversation

@patil2001
Copy link
Copy Markdown
Owner

Problem

In raw_chunks() in proxy.py, when StreamConsumed is raised during streaming, the fallback path calls upstream.read() which is a coroutine but is not awaited. This returns a coroutine object instead of bytes, which gets yielded downstream as raw data.

Impact

  • StreamRestorer.feed() receives coroutine object, raises TypeError
  • Client receives HTTP 200 with partial/corrupted response body
  • No way for caller to distinguish truncated response from complete one

Fix

Added await: raw = await upstream.read()

Verification

git diff --check passed. Syntax verified.

Three fixes to Update-ComposeFlags in ods.ps1:

1. Probe that bash actually runs before delegating to
   resolve-compose-stack.sh. Get-Command bash resolves to the System32
   WSL relay whenever WSL is enabled, but it fails with
   "execvpe(/bin/bash) failed" when the only registered distro is
   docker-desktop (a standard Docker Desktop setup).

2. Run native bash calls with a non-terminating error preference.
   Under $ErrorActionPreference = "Stop", PowerShell 5.1 wraps redirected
   native stderr in a terminating NativeCommandError, which killed the
   CLI mid-command and made the minimal-swap fallback unreachable dead
   code -- leaving the service stopped but .compose-flags unchanged.

3. Make the fallback apply only the single-service delta instead of
   re-scanning extensions/services. Installer-skipped services still
   carry a plain compose.yaml, so the old directory scan re-added every
   extension (19 services on a Tier 1 install) to .compose-flags.

Fixes Osmantic#1770
Installer-skipped services keep a plain compose.yaml, so 'ods.ps1
enable <svc>' reported "already enabled" while the service was absent
from .compose-flags and never joined the stack. When the compose
fragment exists but the flags entry is missing, add it via the
single-service delta and report "enabled (added to compose stack)".

Edge cases verified on a live Tier 1 install:
- disable hermes leaves hermes-proxy entries untouched (trailing
  path-separator in the removal regex prevents prefix collisions)
- repeated enable stays idempotent (single flags entry)
- enable n8n (installer-skipped) now joins the stack
Bug #2: In raw_chunks(), when StreamConsumed is raised, upstream.read() is a
coroutine but was not awaited. This returned a coroutine object instead of
bytes, causing TypeError downstream in StreamRestorer.feed() and resulting
in truncated 200 responses.
Lightheartdevs added a commit that referenced this pull request Sep 28, 2026
… errors with the failure

The swagger-ui thin build failed on tower2 with a 429 from docker.swagger.io.
That host (like cr.weaviate.io) is a vanity proxy for Docker Hub: its /v2/
challenge names auth.docker.io and Docker Hub rate-limits it by the proxy's own
egress address (ratelimit-source 54.184.99.3, remaining 0), so every anonymous
user of the host shares one pull budget, and docker.io mirrors or `docker
login` do not apply. docker.io served the same digests from tower2 with its
own budget. Point swagger-ui, swagger-editor and weaviate at docker.io with the
unchanged digests, and add a contract that every recipe, service and compose
image names a registry that serves it, plus a check that a single-stage thin
build starts from exactly the upstream.json image.

The build diagnostic already kept the last 7600 characters, but BuildKit prints
its step log first and the decisive error last. The whole swagger-ui log fit
the bound, so the message began at step #1 and readers that show its beginning
(the dashboard card's collapsed summary, a 400-character excerpt) never reached
the 429. Lead the message with the final error line, bounded and keeping its
end, then the compacted tail, still redacted first and labelled untrusted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

0