api/main.py (1)

136-147: Consider: Use raise ... from None for cleaner exception chaining.

The static analyzer flags that re-raising exceptions without from can make tracebacks confusing. Since you're intentionally raising a new HTTPException, using from None explicitly suppresses the original exception chain:

Optional improvement

     except httpx.TimeoutException:
         raise HTTPException(
             status_code=status.HTTP_504_GATEWAY_TIMEOUT,
             detail="Upstream OSM service timed out",
-        )
+        ) from None
     except httpx.ConnectError:
         raise HTTPException(
             status_code=status.HTTP_502_BAD_GATEWAY,
             detail="Could not connect to upstream OSM service",
-        )
+        ) from None

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/main.py` around lines 136 - 147, Update the exception re-raises in the
try/except around _osm_client.send(rp_req, stream=True) to suppress the original
exception chain by using "raise HTTPException(...) from None" for both the
httpx.TimeoutException and httpx.ConnectError handlers; locate the block
handling rp_resp and replace the current raises so the new HTTPException
(status.HTTP_504_GATEWAY_TIMEOUT and status.HTTP_502_BAD_GATEWAY respectively)
are raised with "from None" to produce cleaner tracebacks.

api/core/jwt.py (1)

21-33: Blocking HTTP call in async context and silent failure on missing payload.

Two concerns:

1. get_signing_key_from_jwt() (line 23) makes a synchronous HTTP call, which can block the event loop. The TODO on line 22 acknowledges this, but consider prioritizing the async migration.

2. Line 33 returns an empty dict if "payload" is missing, which would cause validate_token to raise a credentials exception due to missing "sub". Consider raising explicitly here for clearer error attribution:

Suggested improvement

-    return decoded.get("payload", {})
+    payload = decoded.get("payload")
+    if payload is None:
+        raise ValueError("Token payload missing")
+    return payload

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/core/jwt.py` around lines 21 - 33, The validate_and_decode_token function
currently blocks by calling _get_jwks_client().get_signing_key_from_jwt(token)
synchronously and silently returns {} when payload is missing; change this by
using an async JWKS fetcher (replace the synchronous get_signing_key_from_jwt
call with an awaitable async client or an async wrapper so the event loop is not
blocked) and after calling jwt.decode_complete ensure you explicitly raise a
clear exception (e.g., InvalidTokenError or a custom error) if
decoded.get("payload") is None or missing required fields (like "sub") so
callers such as validate_token receive a precise error instead of an empty dict.

api/main.py (2)

181-182: ⚠️ Potential issue | 🟡 Minor

Remove unused authorizedWorkspace assignments.

Line 181 and Line 198 assign authorizedWorkspace but it is never read.

Suggested fix

-    authorizedWorkspace = None
-
     if request.headers.get("X-Workspace") is not None:
@@
-        authorizedWorkspace = workspace_id

Also applies to: 198-198

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/main.py` around lines 181 - 182, The variable authorizedWorkspace is
being assigned (e.g., "authorizedWorkspace = None") but never read; remove the
unused assignments and any declaration of authorizedWorkspace from the affected
scope (search for "authorizedWorkspace" occurrences) or, if the variable was
intended to be used, implement the intended usage; otherwise simply delete the
variable and its assignments so dead code is eliminated (ensure imports or other
references are not left dangling).

---

113-124: ⚠️ Potential issue | 🟠 Major

Still forwarding Host to upstream; filter it out.

Host is not excluded in HOP_BY_HOP_HEADERS, so the incoming host can be forwarded at Line 213-Line 217. This can misroute upstream requests.

Suggested fix

 HOP_BY_HOP_HEADERS = frozenset(
     [
+        "host",
         "connection",
         "keep-alive",
         "proxy-authenticate",

Also applies to: 213-217

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/main.py` around lines 113 - 124, The proxy is still forwarding the
incoming Host header because "host" is not in HOP_BY_HOP_HEADERS; update
HOP_BY_HOP_HEADERS to include "host" (lowercase) and ensure the header-filtering
code that builds the upstream request (the block that filters/forwards headers
around the current header-forwarding logic) performs case-insensitive
comparisons against HOP_BY_HOP_HEADERS so Host is never forwarded to upstream.

api/main.py (2)

204-221: ⚠️ Potential issue | 🟠 Major

Remove unused authorizedWorkspace (ruff F841).

Lines [204] and [221] assign a local that is never read.

Proposed fix

-    authorizedWorkspace = None
-
     if request.headers.get("X-Workspace") is not None:
         try:
             workspace_id = int(request.headers.get("X-Workspace") or "-1")
         except ValueError:
             raise HTTPException(
                 status_code=status.HTTP_400_BAD_REQUEST,
                 detail="X-Workspace header must be a valid integer",
             )
@@
-        authorizedWorkspace = workspace_id

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/main.py` around lines 204 - 221, The local variable authorizedWorkspace
is assigned but never used (ruff F841); remove the unused declaration and all
assignments to authorizedWorkspace in this block, or if intended, replace its
usage by passing workspace_id where needed; locate the code around the
header-parsing logic that uses request.headers.get("X-Workspace") and the
current_user.isWorkspaceContributor(workspace_id) check and either drop the
authorizedWorkspace variable entirely or wire workspace_id into the subsequent
logic that requires the authorized workspace.

---

76-83: ⚠️ Potential issue | 🟠 Major

Tighten CORS: credentialed wildcard policy is still open.

Line [78] (allow_origin_regex=r".*") with Line [79] (allow_credentials=True) effectively permits credentialed cross-origin reads from any origin.

Suggested direction

 app.add_middleware(
     CORSMiddleware,
-    allow_origin_regex=r".*",
+    # Use an explicit trusted-origin allowlist from config/env.
+    allow_origins=settings.CORS_ALLOWED_ORIGINS,
     allow_credentials=True,
-    allow_methods=["*"],
-    allow_headers=["*"],
+    allow_methods=["GET", "POST", "PUT", "DELETE", "OPTIONS", "HEAD", "PATCH"],
+    allow_headers=settings.CORS_ALLOWED_HEADERS,
     max_age=100,
 )

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/main.py` around lines 76 - 83, The CORS setup using app.add_middleware
with CORSMiddleware currently sets allow_origin_regex=r".*" while
allow_credentials=True, which allows credentialed requests from any origin;
change this to a safe configuration by removing the permissive regex and either
(a) set allow_origins to a strict list of allowed origins (e.g., from
config/env) and keep allow_credentials only if those origins are explicit, or
(b) if you must use a pattern, replace allow_origin_regex with a specific,
tightened regex that matches only trusted domains, or (c) disable
allow_credentials (set to False) if wildcard/regex origins are required; update
the CORSMiddleware call (app.add_middleware, CORSMiddleware, allow_origin_regex,
allow_origins, allow_credentials) accordingly.

api/core/security.py (2)

231-234: Add exception chaining for JSON parsing error.

Same pattern as above - use from None to suppress the original traceback when converting to auth failure.

Proposed fix

     try:
         pg_data = response.json()
     except Exception:
-        raise credentials_exception
+        raise credentials_exception from None

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/core/security.py` around lines 231 - 234, The JSON parsing try/except
around response.json() should chain the exception with "from None" when raising
credentials_exception to suppress the underlying traceback; update the except
block that catches Exception from response.json() to raise credentials_exception
from None so the auth failure mirrors the existing pattern (look for the
response.json() call and the credentials_exception symbol in this file).

---

159-162: Add exception chaining for cleaner tracebacks.

The static analyzer correctly identifies that raise ... from None should be used to suppress the original exception traceback, which is appropriate here since you're converting the original error to an auth failure.

Proposed fix

     try:
         payload = validate_and_decode_token(token)
     except Exception:
-        raise credentials_exception
+        raise credentials_exception from None

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/core/security.py` around lines 159 - 162, The except block that catches
errors from validate_and_decode_token(token) should suppress the original
traceback by using exception chaining: change the raise to "raise
credentials_exception from None" so the auth failure replaces the original
exception; update the try/except around validate_and_decode_token(token) to use
that form referencing the existing credentials_exception symbol.

api/main.py (2)

146-161: Consider defensive None check for _osm_client.

While the lifespan manager should guarantee _osm_client is initialized before endpoints are called, direct access to the module-level variable (line 156, 164) could raise AttributeError if accessed during shutdown or if the lifespan fails. This is a low-probability edge case but worth considering for robustness.

Optional defensive pattern

# At the start of the endpoint:
if _osm_client is None:
    raise HTTPException(
        status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
        detail="OSM proxy client not initialized",
    )

Or continue without the check if you're confident the lifespan guarantees are sufficient.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/main.py` around lines 146 - 161, Add a defensive None-check for the
module-level _osm_client at the start of the capabilities(request: Request)
endpoint to avoid AttributeError during shutdown or failed lifespan; if
_osm_client is None, raise fastapi.HTTPException with
status_code=status.HTTP_503_SERVICE_UNAVAILABLE and a short detail like "OSM
proxy client not initialized" before any access to _osm_client.base_url.host or
similar, keeping STRIP_REQUEST_HEADERS usage unchanged.

---

166-177: Add exception chaining for proxy error handling.

The static analyzer flags that exceptions raised within except clauses should use from None (or from err) to clarify the exception chain. This pattern appears multiple times in the file.

Proposed fix for this block and similar patterns

     try:
         rp_resp = await _osm_client.send(rp_req, stream=True)
     except httpx.TimeoutException:
         raise HTTPException(
             status_code=status.HTTP_504_GATEWAY_TIMEOUT,
             detail="Upstream OSM service timed out",
-        )
+        ) from None
     except httpx.ConnectError:
         raise HTTPException(
             status_code=status.HTTP_502_BAD_GATEWAY,
             detail="Could not connect to upstream OSM service",
-        )
+        ) from None

Apply the same pattern to lines 208-211, 249-252, and 254-257.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/main.py` around lines 166 - 177, The except handlers around the proxy
call (where rp_resp = await _osm_client.send(rp_req, stream=True)) raise new
HTTPException instances without exception chaining; update the
httpx.TimeoutException and httpx.ConnectError blocks to re-raise the
HTTPException using "from err" (capture the original exception as err) or "from
None" to satisfy the static analyzer, e.g., capture the caught exception (except
httpx.TimeoutException as err) and then raise
HTTPException(status_code=status.HTTP_504_GATEWAY_TIMEOUT, detail="Upstream OSM
service timed out") from err; apply the same pattern to the other similar blocks
referenced in the comment (the handlers around lines 208-211, 249-252, 254-257)
so all raises include explicit exception chaining.