Release v2.0.1 — session expiry configurable + audit consistency fixes - #6
Merged
Conversation
- add parse_duration_seconds() pure parser to config.py (24h/90m/1d/45s/bare seconds; invalid or non-positive -> 24h default, never raises) - AuthManager.session_expiry_seconds feeds create_session_token exp; keep the SESSION_EXPIRY_SECONDS constant as the 24h fallback default - _set_session_cookie takes max_age; login/setup/configure pass the configured expiry so the cookie Max-Age matches the token exp (no more hardcoded 86400) - lifespan wires config.auth.session_expiry -> auth.session_expiry_seconds - tests/unit/test_session_expiry.py: parser + token-exp + end-to-end cookie proof
…ng-only vendors - get_fanpilot_status guards the cold-start 'auto'->'fanpilot' fallback behind is_fan_capable(vendor); HPE/Lenovo/generic (no IPMI fan control) now report the truthful 'auto' instead of a false 'fanpilot active' - SELECT vendor; default NULL/empty vendor to 'dell' to match /mode Decision G - fan-capable vendors (dell/supermicro/ibm) keep the prior 'fanpilot' behavior - integration tests: HPE reports 'auto', dell still reports 'fanpilot'
…0 literal) - test_fallback_is_pep440_canonical asserts the PEP 440 X.Y.Z shape via regex instead of the pinned '2.0.0' literal, so a future _VERSION_FALLBACK bump stays committable through the pre-commit hook + CI gate - test_version_fallback_when_uninstalled proves the PackageNotFoundError branch was actually taken (took_fallback flag) so the assert is no longer vacuous; keeps resolved == _VERSION_FALLBACK and adds an X.Y.Z shape check - add 'import re'; leave the bump-agnostic '2.0.0-alpha.1' source-grep untouched
…h shipped code - Security section names the IPMIDECK_AUTH_SESSION_EXPIRY / auth.session_expiry knob and the 24h default (the 'configurable expiry' claim is true after SX0-A) - header BMC badge adds Generic (alt text + shields.io src label) so it agrees with the support matrix's sixth monitoring-only row
…ipts check-wheel.py and smoke-docker.ps1 hardcoded "2.0.0", which would false-fail the maintainer's manual wheel-check and Docker-smoke after any version bump. Both now read _VERSION_FALLBACK from backend/core/branding.py (the single source of truth, same value release.yml's guard reads), so a bump needs no edit here.
…y_path Add a Keep-a-Changelog CHANGELOG.md and rework the release-draft job to slice the tagged version's section into the release body (body_path) instead of the empty generate_release_notes — the repo has no PRs in-range, so that produced near-empty notes. Kept draft:true (option B): the body arrives pre-filled from the changelog and the maintainer reviews + Publishes. The slice step fails the release if the tag has no CHANGELOG section, forcing a promote of [Unreleased] before tagging.
Bump _VERSION_FALLBACK 2.0.0 -> 2.0.1 and promote CHANGELOG [Unreleased] -> [2.0.1]. Fixes: session expiry is now actually configurable (IPMIDECK_AUTH_SESSION_EXPIRY); FanPilot /status no longer reports a false active state for monitoring-only vendors.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release v2.0.1
Batch of fixes + release plumbing. Cut from the
chore(release): 2.0.1commit (branding bumped to 2.0.1, CHANGELOG promoted).Fixes (user-facing)
IPMIDECK_AUTH_SESSION_EXPIRY/auth.session_expirynow drive both the session-token expiry and the cookiemax_age(previously dead config — the lifetime was hardcoded at 24h). Invalid values fall back to 24h without crashing. Newparse_duration_seconds()parser + tests./statusno longer reports a false "active" state for monitoring-only vendors (HPE, Lenovo, generic). The endpoint now readsvendorand only forcesfanpilotmode when the vendor is fan-capable. Loop-skip / warn-but-allow behaviour (D-13/D-14) unchanged.Internal / tooling
test_branding.pyis now bump-agnostic (no pinned2.0.0literal), so a one-line version bump is committable through the pre-commit hook + CI gate.check-wheel.pyandsmoke-docker.ps1derive the version frombranding._VERSION_FALLBACKinstead of hardcoding it.CHANGELOG.md(Keep a Changelog). Therelease-draftjob now slices the tagged version's section into the release body viabody_path(keptdraft: true— the body arrives pre-filled and the maintainer reviews + Publishes).Genericto match the support matrix.Gates:
pytest335 passed,ruffclean.