gabriel / musehub public
fix BREAKING middleware fix/bot-throttle-get-reads #1 / 1
AI Agent gabriel · 171 days ago · Apr 9, 2026 · Diff

fix(middleware): exempt GET/HEAD from UA checks — public reads must be open

curl, scripts, and agent monitors reading public pages should never get a 429. GET and HEAD are idempotent safe methods; slowapi already caps their rate. UA blocking now applies only to non-GET/HEAD requests (write paths).

- Updated BotThrottleMiddleware: skip UA checks when method is GET or HEAD - Updated tests: 'blocked' tests switch to POST /api/v1/repos - Added 3 new tests verifying GET with curl/no-UA/scanner-UA all pass - Updated error message test to use POST path

sha256:79a47c477794af8320086b13ed176713d7e809026847482e74f4b3f27b290717 sha
sha256:842914d905f0ee5bcb83ad697ffd9c936948da8245bdf569ebc6375ea8e82da0 parent
+7 ~3 −5 symbols
sha256:d7740103b553a0d1055cca8ed90ba91895596fb670e7f9ab99b990a9e7a9cfc3 snapshot
+7
symbols added
~3
symbols modified
−5
symbols removed
0
dead code introduced
Semantic Changes 15 symbols
~ musehub/middleware/bot_throttle.py .py 2 symbols modified
~ BotThrottleMiddleware
~ __call__
~ tests/test_bot_throttle.py .py 7 symbols added, 5 symbols removed, 1 symbol modified
− test_unauthenticated_curl_ua_blocked function async_function test_unauthenticated_curl_ua_blocked L80–86
− test_unauthenticated_go_ua_blocked function async_function test_unauthenticated_go_ua_blocked L100–106
− test_unauthenticated_missing_ua_blocked function async_function test_unauthenticated_missing_ua_blocked L110–117
− test_unauthenticated_python_requests_ua_blocked function async_function test_unauthenticated_python_requests_ua_blocked L90–96
− test_unauthenticated_scanner_ua_blocked function async_function test_unauthenticated_scanner_ua_blocked L121–128
+ test_get_with_curl_ua_passes function async_function test_get_with_curl_ua_passes L82–93
+ test_get_with_no_ua_passes function async_function test_get_with_no_ua_passes L97–100
+ test_get_with_scanner_ua_passes function async_function test_get_with_scanner_ua_passes L104–114
+ test_post_unauthenticated_curl_ua_blocked function async_function test_post_unauthenticated_curl_ua_blocked L122–129
+ test_post_unauthenticated_missing_ua_blocked function async_function test_post_unauthenticated_missing_ua_blocked L144–151
+ test_post_unauthenticated_python_requests_ua_blocked function async_function test_post_unauthenticated_python_requests_ua_blocked L133–140
+ test_post_unauthenticated_scanner_ua_blocked function async_function test_post_unauthenticated_scanner_ua_blocked L155–163
~ test_blocked_response_body_is_informative
← Older Oldest on fix/bot-throttle-get-reads
All commits
Newer → Latest on fix/bot-throttle-get-reads

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:79a47c477794af8320086b13ed176713d7e809026847482e74f4b3f27b290717 --body "your comment"