Repository navigation
fix(dart-client): export the SSE parser, keep mutation bodies out of devtools - #116
Merged
Merged
Conversation
Devtools recorded argsKey(args), which included the request body, so a mutation carrying an API key sat in the in-memory ring in debug and profile builds. tagContextJson now keeps path and query only, the same rule requests.dart already follows. That covers the mutation log, explain output and the inspector.
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
Conventional Commits ValidationPR Title: valid |
forge_client now exports SseEvent and SseParser, so a schema with either name would be ambiguous next to it. The generator renames such a schema like any other forge_client export.
Contributor
Conventional Commits ValidationPR Title: valid |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You can now import
SseParserandSseEventfrompackage:forge_client/forge_client.dart. They only lived insrc/sse.dartbefore, so the Loomplane app reached into the package's internals to follow an agent task's event stream, with animplementation_importsignore on top.Devtools also stops keeping mutation bodies.
tagContextJsonindevtools/explain.dartturned a call's wholeTagContextinto text, body included, and the mutation log,argsKeyand the inspector all go through it. So a mutation carrying an API key or a secret value sat in the devtools ring in debug and profile builds. Release builds compile devtools out, which means shipped apps were never exposed. It now keeps the path and the query only, the ruledevtools/requests.dartalready follows for requests.One thing this doesn't touch:
MutationLog.tagsstill holds the resolved invalidation tags, so a template that reads from the body (Order:{body.id}) puts that value in the tags, same as before.Tested with
fvm dart teston Flutter 3.47.5: forge_client 1332 passed (26 skipped), forge_client_devtools 194, forge_client_flutter 218.dart analyzeanddart formatare clean. The new test sends a mutation whose body holds a marker string and checks it never shows up in the log,argsKey, the explain output or the snapshot, while the operation and its path params still do. Two older tests inlog_test.dartassumed the body was inMutationLog.args, so they changed with it.