Enable origins by brucetony · Pull Request #195 · PrivateAIM/node-hub-api-adapter

brucetony · 2026-06-23T09:53:27Z

Summary by CodeRabbit

New Features
- Enhanced CORS origin configuration with improved input handling for greater flexibility.
- Restricted CORS middleware to explicit HTTP methods (GET, POST, PUT, DELETE) for improved security.
- Removed header exposure from CORS middleware configuration.
Chores
- Updated security dependencies: PyJWT to version 2.13.0 and Cryptography to version 48.0.1.

# Conflicts: # pyproject.toml # uv.lock

coderabbitai · 2026-06-23T09:53:41Z

Warning

Review limit reached

@brucetony, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 9 minutes and 22 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses rolling per-developer review limits. Reviews become available again as older review attempts age out of the rolling limit window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2d6a7095-50b3-4ddc-9971-55d0c17197b6

📥 Commits

Reviewing files that changed from the base of the PR and between 9a0605a and 5bab13d.

⛔ Files ignored due to path filters (1)

uv.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

hub_adapter/conf.py
pyproject.toml

📝 Walkthrough

Walkthrough

The PR hardens CORS configuration by adding a comma-split validator for cors_allowed_origins in settings and wiring it into CORSMiddleware with explicit allowed methods. It also corrects a 422 HTTP status constant name in the node router and its test, strengthens JWT test token signing keys, and bumps the pyjwt minimum version.

Changes

CORS Origins Configuration

Layer / File(s)	Summary
CORS origins setting and validator `hub_adapter/conf.py`	Adds `Annotated` and `field_validator` imports, annotates `cors_allowed_origins` with `NoDecode`, and introduces a `parse_origins` `before`-mode validator that splits comma-delimited strings, trims whitespace, and drops empty entries.
CORSMiddleware wiring `hub_adapter/server.py`	Replaces the hardcoded `""` origin with `settings.cors_allowed_origins`, narrows `allow_methods` to `["GET", "POST", "PUT", "DELETE"]`, and removes `expose_headers=[""]`.

422 Constant Fix and JWT Test Hardening

Layer / File(s)	Summary
422 status constant correction `hub_adapter/routers/node.py`, `tests/router_tests/test_node.py`	Switches `HTTP_422_UNPROCESSABLE_ENTITY` to `HTTP_422_UNPROCESSABLE_CONTENT` in both the exception handler and its test assertion; removes a stale `PydanticValidationError` import alias from the test.
JWT test secret and pyjwt version bump `tests/test_middleware.py`, `pyproject.toml`	Both middleware JWT tests switch from an empty string signing key to `"x" * 32`; pyjwt minimum version is raised from `>=2.10.1` to `>=2.13.0` with reordered dependency entries.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 Hopping through the headers with care,
No wildcards left floating in the air.
Origins split by comma and trim,
JWT secrets no longer slim.
Four HTTP methods, neat and bright—
This rabbit approves; the CORS is right! 🌟

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title 'Enable origins' is vague and generic, failing to clearly describe the specific changes made to CORS origin handling and security improvements across multiple files.	Consider a more descriptive title such as 'Configure CORS origins and restrict allowed methods' or 'Add configurable CORS origins with security improvements' to better reflect the main changes.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch 188-origins

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@hub_adapter/conf.py`:
- Around line 97-102: The parse_origins method in the field_validator for
cors_allowed_origins does not validate that at least one origin is present after
parsing an empty string input, which results in an empty list that blocks all
CORS origins. Add validation logic after processing the comma-separated string
to raise a ValueError or validation error if the resulting list is empty,
ensuring users are explicitly warned when their configuration results in
disabled CORS checking.

In `@hub_adapter/routers/node.py`:
- Around line 57-62: The HTTP status code constant
HTTP_422_UNPROCESSABLE_CONTENT used in the ValidationError exception handler (at
lines 57 and 62 in the detail dictionary and status_code parameter) may not
exist in Starlette versions prior to 0.48.0, while FastAPI 0.120.1 permits
Starlette versions as old as 0.40.0. Replace both occurrences of
HTTP_422_UNPROCESSABLE_CONTENT with the legacy constant
HTTP_422_UNPROCESSABLE_ENTITY which is available in all compatible Starlette
versions, or alternatively update the dependencies to pin Starlette to >=0.48.0
for forward compatibility.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d35f2af2-788a-4827-a64e-d025cbb60a21

📥 Commits

Reviewing files that changed from the base of the PR and between 094fef2 and 9a0605a.

⛔ Files ignored due to path filters (1)

uv.lock is excluded by !**/*.lock

📒 Files selected for processing (6)

hub_adapter/conf.py
hub_adapter/routers/node.py
hub_adapter/server.py
pyproject.toml
tests/router_tests/test_node.py
tests/test_middleware.py

brucetony added 4 commits June 23, 2026 08:46

feat(conf): enable allowed origins

ae5f73c

build: update pyjwt and handle deprecated vars

038cdbd

fix(conf): handle stupid hashable type in BaseSettings

b5338b7

Merge branch 'main' into 188-origins

9a0605a

# Conflicts: # pyproject.toml # uv.lock

brucetony linked an issue Jun 23, 2026 that may be closed by this pull request

Origins #188

Closed

coderabbitai Bot reviewed Jun 23, 2026

View reviewed changes

Comment thread hub_adapter/conf.py

Comment thread hub_adapter/routers/node.py

chore(conf): better CORS parsing and update fastapi

5bab13d

brucetony merged commit 751e035 into main Jun 23, 2026
3 checks passed

brucetony deleted the 188-origins branch June 23, 2026 10:46

Navigation Menu

Uh oh!

Enable origins - #195

Enable origins#195
brucetony merged 5 commits into
mainfrom
188-origins

brucetony commented Jun 23, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 23, 2026 •

edited

Loading

Review limit reached

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 warning, 1 inconclusive)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

brucetony commented Jun 23, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 warning, 1 inconclusive)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

brucetony commented Jun 23, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 23, 2026 •

edited

Loading