Nan Gao 2b301e8211 fix(channels): harden runtime credential management APIs (#3581) ...

* fix(channels): harden runtime credential management APIs

* fix(channels): address review feedback on credential hardening

Follow-up to the runtime credential-hardening pass, resolving five review
findings:

- WeChat auth persistence now writes through a 0o600 NamedTemporaryFile +
  Path.replace instead of write_text-then-chmod, so the iLink bot_token is
  never briefly readable at umask defaults (mirrors ChannelRuntimeConfigStore).
- The post-write chmod is split into its own try/except: a chmod failure on a
  filesystem without POSIX perms now logs at debug instead of masquerading as
  a "failed to persist" warning.
- Extracted the three near-identical _require_admin_user helpers (mcp,
  channel_connections, channels) into a single require_admin_user(request, *,
  detail) in app/gateway/deps.py; each router supplies its own detail string.
- Strengthened the runtime-config-store chmod coverage: a new test injects a
  temp-file chmod failure and asserts it is logged at debug while the
  destination is still owner-only (mutation-verified to fail if the chmod is
  dropped), plus a loose-pre-existing-file case.
- Removed the unused _FakeRepo from the blocking-io test: its isinstance gate
  routes through the repo-less 503 path, so neither stub was ever invoked.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Willem Jiang <willem.jiang@gmail.com>

2026-06-18 10:45:33 +08:00

..

__init__.py

feat(tests): add Blockbuster runtime gate for event-loop blocking IO (#3229)

2026-05-26 23:03:49 +08:00

conftest.py

feat(tests): add Blockbuster runtime gate for event-loop blocking IO (#3229)

2026-05-26 23:03:49 +08:00

test_agents_router.py

fix(agents): offload blocking filesystem IO in the custom-agent router off the event loop (#3457)

2026-06-09 22:24:53 +08:00

test_channel_runtime_config_store.py

fix(channels): harden runtime credential management APIs (#3581)

2026-06-18 10:45:33 +08:00

test_channels_ingest.py

fix(channels): offload blocking filesystem IO in inbound file ingestion (#3529)

2026-06-13 06:38:54 +08:00

test_dynamic_context_middleware.py

fix(middleware): offload memory injection off event loop to prevent tiktoken blocking (#3402) (#3411)

2026-06-08 12:21:55 +08:00

test_gate_smoke.py

feat(tests): add Blockbuster runtime gate for event-loop blocking IO (#3229)

2026-05-26 23:03:49 +08:00

test_jsonl_run_event_store.py

test(runtime): add Blockbuster runtime anchor for JsonlRunEventStore async IO (#3313)

2026-05-29 23:02:41 +08:00

test_skills_install.py

fix(skills): keep skill archive installation off the event loop (#3505)

2026-06-12 15:17:40 +08:00

test_skills_load.py

feat(tests): add Blockbuster runtime gate for event-loop blocking IO (#3229)

2026-05-26 23:03:49 +08:00

test_sqlite_lifespan.py

feat(tests): add Blockbuster runtime gate for event-loop blocking IO (#3229)

2026-05-26 23:03:49 +08:00

test_uploads_middleware.py

fix(agents): offload UploadsMiddleware uploads scan off the event loop (#3311)

2026-05-30 21:46:35 +08:00