diff --git a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py index 92b76286088..436ea98740f 100644 --- a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py +++ b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py @@ -406,7 +406,12 @@ def test_current_ip_check_uses_trusted_resolver_after_service_admission_and_disa service = MagicMock() config_overrides(NETWORK_ACCESS_TRUSTED_PROXY_CIDRS="172.18.0.0/16") - def check_current_ip(_context, *, group_id, client_ip_supplier): + def check_current_ip( + _context: RequestContext, + *, + group_id: str, + client_ip_supplier: Callable[[], str], + ) -> dict[str, object]: assert group_id == GROUP_ID return {"client_ip": client_ip_supplier(), "allowed": True, "policy_version": 4} diff --git a/api/tests/unit_tests/core/network_access/test_client_ip.py b/api/tests/unit_tests/core/network_access/test_client_ip.py index f10f812eacf..b876f5b0a82 100644 --- a/api/tests/unit_tests/core/network_access/test_client_ip.py +++ b/api/tests/unit_tests/core/network_access/test_client_ip.py @@ -6,7 +6,7 @@ TRUSTED = "172.18.0.0/16,10.0.0.0/8,2400:cb00::/32" @pytest.mark.parametrize("config", ["", TRUSTED]) -def test_untrusted_socket_ignores_all_forwarding_headers(config: str): +def test_untrusted_socket_ignores_all_forwarding_headers(config: str) -> None: assert ( resolve_network_access_client_ip( { @@ -31,7 +31,7 @@ def test_untrusted_socket_ignores_all_forwarding_headers(config: str): (" 2001:0db8:0:0::1234 , 10.2.3.4 ", "2001:db8::1234"), ], ) -def test_trusted_chain_strips_only_rightmost_trusted_hops(header: str, expected: str): +def test_trusted_chain_strips_only_rightmost_trusted_hops(header: str, expected: str) -> None: assert ( resolve_network_access_client_ip({"REMOTE_ADDR": "172.18.0.2", "HTTP_X_FORWARDED_FOR": header}, TRUSTED) == expected @@ -55,18 +55,18 @@ def test_trusted_chain_strips_only_rightmost_trusted_hops(header: str, expected: "x" * 2049, ], ) -def test_trusted_peer_rejects_missing_invalid_or_all_trusted_chains(header: object): +def test_trusted_peer_rejects_missing_invalid_or_all_trusted_chains(header: object) -> None: with pytest.raises(NetworkAccessClientIPUnavailableError): resolve_network_access_client_ip({"REMOTE_ADDR": "172.18.0.2", "HTTP_X_FORWARDED_FOR": header}, TRUSTED) @pytest.mark.parametrize("peer", [None, "", "unknown", "[::1]", "203.0.113.42:5000", "fe80::1%eth0", 1]) -def test_invalid_socket_peer_is_unavailable(peer: object): +def test_invalid_socket_peer_is_unavailable(peer: object) -> None: with pytest.raises(NetworkAccessClientIPUnavailableError): resolve_network_access_client_ip({"REMOTE_ADDR": peer}, TRUSTED) -def test_proxy_fix_cannot_make_untrusted_origin_appear_trusted(): +def test_proxy_fix_cannot_make_untrusted_origin_appear_trusted() -> None: environ = { "REMOTE_ADDR": "172.18.0.2", "werkzeug.proxy_fix.orig": {"REMOTE_ADDR": "203.0.113.42"}, @@ -75,7 +75,7 @@ def test_proxy_fix_cannot_make_untrusted_origin_appear_trusted(): assert resolve_network_access_client_ip(environ, TRUSTED) == "203.0.113.42" -def test_proxy_fix_preserves_trusted_socket_even_after_remote_addr_rewrite(): +def test_proxy_fix_preserves_trusted_socket_even_after_remote_addr_rewrite() -> None: environ = { "REMOTE_ADDR": "192.0.2.1", "werkzeug.proxy_fix.orig": {"REMOTE_ADDR": "172.18.0.2"}, @@ -85,7 +85,7 @@ def test_proxy_fix_preserves_trusted_socket_even_after_remote_addr_rewrite(): @pytest.mark.parametrize("original", ["invalid", {}, {"REMOTE_ADDR": None}]) -def test_malformed_proxy_fix_original_is_unavailable(original: object): +def test_malformed_proxy_fix_original_is_unavailable(original: object) -> None: with pytest.raises(NetworkAccessClientIPUnavailableError): resolve_network_access_client_ip({"REMOTE_ADDR": "203.0.113.42", "werkzeug.proxy_fix.orig": original}, TRUSTED) @@ -93,12 +93,12 @@ def test_malformed_proxy_fix_original_is_unavailable(original: object): @pytest.mark.parametrize( "config", ["not-a-cidr", "172.18.0.1/16", "172.18.0.0/16,", "fe80::%eth0/64", "10.0.0.0/8," * 257] ) -def test_invalid_proxy_configuration_is_unavailable(config: str): +def test_invalid_proxy_configuration_is_unavailable(config: str) -> None: with pytest.raises(NetworkAccessClientIPUnavailableError): resolve_network_access_client_ip({"REMOTE_ADDR": "203.0.113.42"}, config) -def test_mapped_socket_and_proxy_cidr_match_ipv4(): +def test_mapped_socket_and_proxy_cidr_match_ipv4() -> None: assert ( resolve_network_access_client_ip( {"REMOTE_ADDR": "::ffff:172.18.0.2", "HTTP_X_FORWARDED_FOR": "::ffff:203.0.113.42"}, diff --git a/api/tests/unit_tests/repositories/test_network_access_group_repository.py b/api/tests/unit_tests/repositories/test_network_access_group_repository.py index 59b1f3e92a8..0e62ebf17b5 100644 --- a/api/tests/unit_tests/repositories/test_network_access_group_repository.py +++ b/api/tests/unit_tests/repositories/test_network_access_group_repository.py @@ -219,7 +219,7 @@ def test_list_apps_batch_loads_agent_routes_and_excludes_hidden_workflow_backing agent_selects: list[str] = [] - def record_agent_select(_conn, _cursor, statement, _parameters, _context, _executemany) -> None: + def record_agent_select(_conn, _cursor, statement: str, _parameters, _context, _executemany) -> None: if "FROM agents" in statement: agent_selects.append(statement) diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx index ab794d9cfb0..1db4de9ad53 100644 --- a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx +++ b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx @@ -23,7 +23,7 @@ import { IP_POLICY_NAME_MAX_LENGTH, } from './validate-ip-entry' -export type IpPolicyDialogSubmit = { +type IpPolicyDialogSubmit = { name: string allowed_cidrs: string[] }