You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tooling.apache.org by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/09/03 01:12:34 UTC
[I] AuthzError re-renders the page template, returning a 500 with a traceback (tooling-llmao)
andrewmusselman opened a new issue, #5:
URL: https://github.com/apache/tooling-llmao/issues/5
`/fleet` returns a stack trace rather than a 403, and the same pattern affects
every route that raises authz partway through a handler.
```python
@APP.get("/fleet")
async def fleet_page(result):
if not result.is_site_admin:
raise AuthzError("site admin only") # line 217
...
result.litellm_ui = f"{litellm}/ui" # line 222 -- never reached
```
The error propagates, something catches it and flashes `site admin only`, then
**the page template renders anyway**. `fleet.ezt` line 9 reads `[litellm_ui]`,
which the aborted handler never assigned, and ezt raises `UnknownReference`.
Quart has no handler for that and returns a 500 with the full traceback —
session dict, filesystem paths, template internals.
Both halves are visible in the failure output:
```
'flashes': [{'category': 'warning', 'message': 'site admin only'}]
UnknownReference litellm_ui in fleet.ezt at line 9
```
`/keys/other` (line 341) and `/keys/other/new` have the identical shape.
Two problems, worst first:
- **Disclosure.** An authorization failure returns more information than a
success would, to a user who was just told they lack access.
- **Diagnosis.** The error names `litellm_ui`, sending the reader after a
missing variable rather than a failed permission check.
**Fix:** render an error template that shares no variables with page templates,
or move authz into a decorator that runs before the handler. The second is
cleaner — the check is already the first statement in every affected handler.
**Related:** `site_admins` defaults to `[]`, so a fresh deployment has no site
admin and `/fleet` is unreachable by anyone. There is no bootstrap path in the
UI; the first admin is added to `config.yaml` by hand. Worth documenting.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org
Re: [I] AuthzError re-renders the page template, returning a 500 with a traceback (tooling-llmao)
Posted by "gstein (via GitHub)" <gi...@apache.org>.
gstein commented on issue #5:
URL: https://github.com/apache/tooling-llmao/issues/5#issuecomment-5613846629
I might have an example decorator around here somewhere, which catches such errors and can render a proper error page.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org
Re: [I] AuthzError re-renders the page template, returning a 500 with a traceback (tooling-llmao)
Posted by "andrewmusselman (via GitHub)" <gi...@apache.org>.
andrewmusselman commented on issue #5:
URL: https://github.com/apache/tooling-llmao/issues/5#issuecomment-5613723878
Done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org
Re: [I] AuthzError re-renders the page template, returning a 500 with a traceback (tooling-llmao)
Posted by "andrewmusselman (via GitHub)" <gi...@apache.org>.
andrewmusselman closed issue #5: AuthzError re-renders the page template, returning a 500 with a traceback
URL: https://github.com/apache/tooling-llmao/issues/5
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org
Re: [I] AuthzError re-renders the page template, returning a 500 with a traceback (tooling-llmao)
Posted by "andrewmusselman (via GitHub)" <gi...@apache.org>.
andrewmusselman closed issue #5: AuthzError re-renders the page template, returning a 500 with a traceback
URL: https://github.com/apache/tooling-llmao/issues/5
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org
Re: [I] AuthzError re-renders the page template, returning a 500 with a traceback (tooling-llmao)
Posted by "gstein (via GitHub)" <gi...@apache.org>.
gstein commented on issue #5:
URL: https://github.com/apache/tooling-llmao/issues/5#issuecomment-5613835838
I removed AuthzError from that one handler, but there are others. And the extra render despite the `raise` is very concerning.
I'd like to keep this open to ensure our 500 handling is Proper. We may need some middleware to properly catch such errors.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org
Re: [I] AuthzError re-renders the page template, returning a 500 with a traceback (tooling-llmao)
Posted by "andrewmusselman (via GitHub)" <gi...@apache.org>.
andrewmusselman commented on issue #5:
URL: https://github.com/apache/tooling-llmao/issues/5#issuecomment-5626009873
Fixed in 99ee646bb7532e46e0e4cfa96853033ad6e845b3
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org