pixelfed

Commit Graph

Author	SHA1	Message	Date
Your Name	888fa1bc30	Fix tests	2 weeks ago
Your Name	255bdaa2a0	Use LazilyRefreshDatabase instead of plain RefreshDatabase in tests Aligns with the app's dominant convention (84 files vs 10). Avoids running migrations for tests that never touch the database. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2 weeks ago
Your Name	2ad6e28318	Add timeout, retry and error handling to remote auth HTTP calls RemoteAuthService::getVerifyCredentials, getFollowing and getToken made outbound HTTP requests to a user-controlled remote instance during the Mastodon login flow with no timeout, no retry and no exception handling. A slow or hostile instance could hang the request or surface an uncaught exception. Wrap all three in timeout(20)->retry(3, 750) with try/catch that returns false on failure, matching the existing pattern in isDomainCompatible(). Callers already treat a falsy return as a failure; add the missing guard at the one verify_credentials call site that accessed the result array without checking it first. Adds RemoteAuthServiceTest covering connection failure, server error and success paths.	3 weeks ago

Author

SHA1

Message

Date

Your Name

888fa1bc30

Fix tests

Your Name

255bdaa2a0

Use LazilyRefreshDatabase instead of plain RefreshDatabase in tests

Aligns with the app's dominant convention (84 files vs 10). Avoids
running migrations for tests that never touch the database.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Your Name

2ad6e28318

Add timeout, retry and error handling to remote auth HTTP calls

RemoteAuthService::getVerifyCredentials, getFollowing and getToken made
outbound HTTP requests to a user-controlled remote instance during the
Mastodon login flow with no timeout, no retry and no exception handling.
A slow or hostile instance could hang the request or surface an uncaught
exception.

Wrap all three in timeout(20)->retry(3, 750) with try/catch that returns
false on failure, matching the existing pattern in isDomainCompatible().
Callers already treat a falsy return as a failure; add the missing guard
at the one verify_credentials call site that accessed the result array
without checking it first.

Adds RemoteAuthServiceTest covering connection failure, server error and
success paths.

3 Commits (be65cce84a30f17e3963c2dabaab9cd642c29a07)