gabriel / musehub public
feat patch security task/stream-security-phase1 #1 / 1
AI Agent gabriel · 124 days ago · May 11, 2026 · Diff

feat(security): blocked-hash check in stream path — Phase 1 of issue #51

Adds a _BlockedHashError sentinel exception and a blocked-hash query inside _flush_batch. Any object whose object_id appears in musehub_blocked_hashes is rejected before any MinIO PUT or DB write; the branch pointer is never advanced. All three flush call sites (mid-batch, OC mid-batch, COMMIT_PACK pre-flush) are wrapped to yield an ERROR frame (403) and return.

5 TDD tests green (test_stream_security_phase1.py); 65 wire_push_stream regression tests still pass.

sha256:ad161dc342a5a864c95565fb8f8649e6eb642a34192a6f2215e3e9c385e32260 sha
sha256:29f2935a56feb415c441b14c6a891ec69e63cf5677ea7cb089b7770b2d2c078e parent
+35 ~1 symbols
sha256:3816fd5eb1e50138b373b2cce284106eab7f9671fbd765d77f46a51f7cf06278 snapshot
+35
symbols added
~1
symbol modified
0
dead code introduced
Semantic Changes 36 symbols
~ tests/test_stream_security_phase1.py .py 35 symbols added
+ _collect function async_function _collect L89–93
+ _commit_pack function function _commit_pack L67–70
+ _end function function _end L73–74
+ _fw variable variable _fw L39–39
+ _header function function _header L52–57
+ _make_commit function function _make_commit L77–86
+ _make_repo function async_function _make_repo L98–121
+ _obj function function _obj L60–64
+ _pack function function _pack L44–45
+ _stub_backend function function _stub_backend L124–143
+ _wrap function function _wrap L48–49
+ AsyncMock import import AsyncMock L24–24
+ AsyncSession import import AsyncSession L23–23
+ MuseWireFrameWriter import import MuseWireFrameWriter L37–37
+ MusehubBranch import import MusehubBranch L28–28
+ MusehubRepo import import MusehubRepo L28–28
+ SFRAME_COMMIT_PACK import import SFRAME_COMMIT_PACK L29–29
+ SFRAME_END import import SFRAME_END L29–29
+ SFRAME_ERROR import import SFRAME_ERROR L29–29
+ SFRAME_HEADER import import SFRAME_HEADER L29–29
+ SFRAME_OBJECT import import SFRAME_OBJECT L29–29
+ SFRAME_RESULT import import SFRAME_RESULT L29–29
+ annotations import import annotations L16–16
+ blob_id import import blob_id L26–26
+ db import import db L27–27
+ hashlib import import hashlib L18–18
+ msgpack import import msgpack L20–20
+ now_utc_iso import import now_utc_iso L26–26
+ pytest import import pytest L21–21
+ select import import select L22–22
+ test_blocked_object_in_second_batch_yields_error function async_function test_blocked_object_in_second_batch_yields_error L224–274
+ test_blocked_object_nothing_written_to_db function async_function test_blocked_object_nothing_written_to_db L186–220
+ test_blocked_object_single_batch_yields_error function async_function test_blocked_object_single_batch_yields_error L151–182
+ test_blocked_push_is_idempotent function async_function test_blocked_push_is_idempotent L307–331
+ test_clean_stream_bypasses_blocklist_check function async_function test_clean_stream_bypasses_blocklist_check L278–303
~ musehub/services/musehub_wire.py .py 1 symbol modified
~ wire_push_stream
← Older Oldest on task/stream-security-phase1
All commits
Newer → Latest on task/stream-security-phase1

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:ad161dc342a5a864c95565fb8f8649e6eb642a34192a6f2215e3e9c385e32260 --body "your comment"