Protect alert credentials and preserve recovery edits - #1959
Open
pulse-triage[bot] wants to merge 17 commits into
Open
Protect alert credentials and preserve recovery edits#1959pulse-triage[bot] wants to merge 17 commits into
pulse-triage[bot] wants to merge 17 commits into
Conversation
The populated Ceph thresholds browser test reproduced Space on the disclosure moving focus to search instead of collapsing it. Leave Space to buttons, summaries and role buttons, while preserving ordinary type-to-search input. Protect the keyboard journey with a full collapsed focus cycle and reopened action focus, plus focused hook coverage. Chromium failed before this repair and passes after it; 59 focused unit tests pass. Change-source: pulse-maintainer
Change-source: pulse-maintainer
The recovery browser fixture used no-op configuration setters, so prior passes could not demonstrate unsaved-value retention. Exercise a reactive synthetic ping URL and dirty flag through rejection, cancellation, refresh failure and message clearing without expanding the product surface. All 12 serialized Chromium cases pass, including six edited-value cases; installed and assistive-technology acceptance remain separate. Change-source: pulse-maintainer
A large Retry-After integer can overflow time.Duration during multiplication and become zero, defeating the existing 30-second cap. Clamp seconds before conversion and parse at a consistent 64-bit width. Preserve existing negative-value and HTTP-date handling. Validation: new parser cases fail before the repair; focused parser, HTTP error classification and synthetic terminal-rejection tests pass with -race -count=20. No persistent queue tests or release qualification performed. Change-source: pulse-maintainer
Change-source: pulse-maintainer
Change-source: pulse-maintainer
Change-source: pulse-maintainer
Mask username and password credentials before existing path and query redaction, and fail closed when the URL cannot be parsed. Reproduce the leak through rate-limit logs and transport errors, preserving error unwrapping and destination configuration. Change-source: pulse-maintainer
The previous recovery browser fixture owned the edited URL in a synthetic parent, leaving the production configuration-state integration untested. Mount the real Alerts settings surface and assert edits and dirty state survive recovery without reload or implicit save, then reach the explicit save boundary intact. Two serialized Chromium runs passed 12 cases each, including six real settings-parent cases. Record the exact script hash and final result; retain earlier harness failures and distinguish mocked API evidence from persistence, installed recovery and recipient receipt. Change-source: pulse-maintainer
Change-source: pulse-maintainer
The held latency failure lacks contemporaneous resource context, and isolated passing samples do not explain it. Retain allowlisted backend boundary counters including cgroup ancestors in the existing durable log, preserving backend failures and unchanged qualification thresholds. Focused tests cover failure exits, unavailable telemetry, ancestor collection and environment filtering. Change-source: pulse-maintainer
Change-source: pulse-maintainer
Reproduce PR #1959 Frontend formatting failure and apply the locked formatter to the two affected files. Preserve keyboard behaviour; all five focused hook tests and the full frontend formatting check pass. Change-source: pulse-maintainer
Slack incoming webhook paths contain credentials, but existing diagnostic redaction retained them. Mask standard and legacy Slack/GovSlack paths while preserving host and error-cause diagnostics; cover encoded paths and actual rate-limit logs. Change-source: pulse-maintainer
pulse-triage
Bot
changed the title
Change-source: pulse-maintainer
Discord webhook paths include tokens authorising webhook operations. Mask the credential suffix on exact Discord hosts without changing destinations or error causes, and cover helper output, transport errors and rate-limit logs with synthetic regressions. Change-source: pulse-maintainer
PR #1959 exposed that the URL-only redactor was called with a complete delivery error, causing safe but unhelpful replacement of the whole diagnostic. Redact embedded webhook URLs separately so credentials stay masked and non-secret failure context remains available; malformed URLs continue to fail closed. Change-source: pulse-maintainer
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Outcome
Make alert recovery and webhook diagnostics safer and more dependable:
Why
The Notifications demand ledger and installed-v6.4.1 reports #1761 and #1812 call for dependable, non-destructive recovery and discoverable delivery detail. Focused probes reproduced the Space-key conflict, retry overflow and webhook credential disclosures. The failed release rehearsal
20260907T131615Z-releaselacked contemporaneous resource context, so the added instrumentation preserves evidence for disciplined follow-up rather than relaxing the failed latency assertion.PR #1959's exact-head
rest-1log also exposed a combined-batch defect: the new URL-only redactor was receiving a complete delivery error and replaced all context with[invalid webhook URL]. Additive correctiona2dbb27a68463adb02b614e9927174543f5b7799masks embedded URLs separately and restores useful status text without rewriting any reviewed commit.These are bounded reliability, confidentiality and release-evidence improvements, not a new notification surface or a release-readiness claim.
Included candidates and range
20260907T141007Z-web-product:f81b6594977c5ca51441bc7bf0bb4746c094f8df.20260907T144528Z-web-product:504d9a0c6e28e860a97ad92e8b88fcc5be5f9b6c.20260907T145014Z-core-runtime:8970c3b1b446027743d94480060a342124e62ddf.20260907T152512Z-core-runtime:db0c72c367bb2bd16fdc97a82e78a209d8958582.20260907T152524Z-web-product:fc3ebefd8668100f368a6c8e6d8095084b090ae6.20260907T154236Z-delivery-trust:b116f2defc6db69c37c3cce9a809b19ecc82ba81.20260907T160005Z-web-product: formatting correction468c2fef5c751c2c6b0d6006be26e8133d710500.20260907T160012Z-core-runtime:77a8e4ee359dc1e2e82344b9c75d8d37c7f8942c.20260907T163510Z-core-runtime:3c77ecb338ee3d68f1dd7d57a367b4727040a61c.a2dbb27a68463adb02b614e9927174543f5b7799.7e34b00d4face3ffa33a36946bb527dbfbdfd74c..a2dbb27a68463adb02b614e9927174543f5b7799.All reviewed commit identities remain unchanged; the gate-start reviewed tip
3c77ecb338ee3d68f1dd7d57a367b4727040a61cis an ancestor of the proposal head.Validation
git diff --check, and clean-worktree checks passed.internal/notificationsandinternal/api/alerting, including the exact regression that failed PR Protect alert credentials and preserve recovery edits #1959'srest-1job.pulse-heavy-runwith six real-settings-parent edit-retention cases each.468c2fef5c751c2c6b0d6006be26e8133d710500, Frontend, API,rest-0, all eight Playwright shards, E2E verdict, build smoke, governance, scans, CodeQL and advisory Benchmarks passed.rest-1failed only on the delivery-log context regression corrected here.aab925d6757fc1ac7a983f9a77d131307ebe490badvisory benchmark failure (NormalizeSegment/long_token, +16.77%, p=0.000) remains adverse evidence despite the later passing advisory run; it is not represented as a pass or release approval.Exact-head protected checks remain the landing gate. This source proposal does not establish installed recovery, intended-recipient receipt, assistive-technology announcement acceptance, release qualification or release approval.
How Pulse handles triage