TASK-028: Add exception logging to fire-and-forget asyncio.create_task()
- Create logged_task() helper in backend/app/utils/async_utils.py to wrap fire-and-forget coroutines with exception logging - Ensures unhandled task exceptions are always logged to structlog instead of silently discarded (Python 3.11+ RuntimeWarning) - Update ban_service.py to use logged_task() for geo_cache.lookup_batch() background resolution - Add comprehensive tests for logged_task() in test_async_utils.py - Document fire-and-forget task conventions in Backend-Development.md The logged_task() wrapper catches any exception raised in a background task, logs it with full traceback context and task name, and never re-raises. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
@@ -1,36 +1,3 @@
|
||||
## TASK-027 — Debug compose hardcodes a publicly known weak session secret
|
||||
|
||||
**Severity:** Medium
|
||||
|
||||
### Where found
|
||||
`Docker/compose.debug.yml` line ~63:
|
||||
```yaml
|
||||
BANGUI_SESSION_SECRET: "${BANGUI_SESSION_SECRET:-dev-secret-do-not-use-in-production}"
|
||||
```
|
||||
|
||||
### Why this is needed
|
||||
The fallback value `dev-secret-do-not-use-in-production` is now publicly visible in the repository. If `compose.debug.yml` is used in any environment where `BANGUI_SESSION_SECRET` is not set (e.g., a CI environment or a staging server that uses the debug compose file), all session tokens can be forged by anyone who has seen this repository.
|
||||
|
||||
### Goal
|
||||
Remove the insecure default. Require the secret to be set explicitly before the container starts.
|
||||
|
||||
### What to do
|
||||
1. Change to `BANGUI_SESSION_SECRET: "${BANGUI_SESSION_SECRET:?BANGUI_SESSION_SECRET must be set — generate with: python -c 'import secrets; print(secrets.token_hex(32))'}"`.
|
||||
2. Create a `.env.example` file at the project root with placeholder values and generation instructions.
|
||||
3. Add `.env` to `.gitignore` (verify it is already there).
|
||||
|
||||
### Possible traps and issues
|
||||
- This will break `docker compose -f Docker/compose.debug.yml up` without a `.env` file. Add a clear error message and setup instructions to the README or `Instructions.md`.
|
||||
- `docker-compose.yml` (the legacy file) already uses the `:?` pattern — follow the same approach.
|
||||
|
||||
### Docs changes needed
|
||||
- `Instructions.md` — add first-run setup instructions for the `.env` file.
|
||||
|
||||
### Doc references
|
||||
- [Instructions.md](Instructions.md) — developer setup
|
||||
|
||||
---
|
||||
|
||||
## TASK-028 — Fire-and-forget `asyncio.create_task()` silently discards exceptions
|
||||
|
||||
**Severity:** Low
|
||||
|
||||
Reference in New Issue
Block a user