From 32f1973b6fa764bbd08ed17ed79693ecb9f47fee Mon Sep 17 00:00:00 2001 From: Alex Schapiro Date: Tue, 1 Sep 2026 18:35:35 +0000 Subject: [PATCH] Remove preview protection bypass plumbing from cloud CLI --- strix/interface/cloud/http.py | 3 --- strix/interface/cloud/payment_proxy.py | 6 +----- strix/interface/platform_cli.py | 10 ---------- tests/test_cloud_session.py | 27 -------------------------- 4 files changed, 1 insertion(+), 45 deletions(-) diff --git a/strix/interface/cloud/http.py b/strix/interface/cloud/http.py index 3d11688e..7b57f80a 100644 --- a/strix/interface/cloud/http.py +++ b/strix/interface/cloud/http.py @@ -159,9 +159,6 @@ def request( headers = { "Authorization": f"Bearer {api_token(token)}", } - bypass = os.environ.get("STRIX_VERCEL_PROTECTION_BYPASS", "").strip() - if bypass: - headers["x-vercel-protection-bypass"] = bypass workspace_id = _expected_workspace_id(token_override=token is not None) if workspace_id: headers["X-Strix-Workspace"] = workspace_id diff --git a/strix/interface/cloud/payment_proxy.py b/strix/interface/cloud/payment_proxy.py index 54b52a05..eada8787 100644 --- a/strix/interface/cloud/payment_proxy.py +++ b/strix/interface/cloud/payment_proxy.py @@ -8,7 +8,6 @@ requests (challenge and paid retry) to the fixed billing endpoint. from __future__ import annotations -import os import secrets import threading from contextlib import contextmanager, suppress @@ -164,9 +163,6 @@ def _make_handler(state: _BridgeState) -> type[BaseHTTPRequestHandler]: headers = _forward_request_headers(self) headers["X-Strix-Authorization"] = state.authorization - bypass = os.environ.get("STRIX_VERCEL_PROTECTION_BYPASS", "").strip() - if bypass: - headers["x-vercel-protection-bypass"] = bypass try: response = requests.request( "POST", @@ -250,7 +246,7 @@ def wallet_payment_bridge( expected_body: bytes, timeout: float | None = None, response_observer: Callable[[WalletUpstreamResponse], None] | None = None, -) -> Generator[str, None, None]: +) -> Generator[str]: """Yield a one-run loopback URL that injects the Strix API token upstream. The random path prevents accidental cross-process requests and limits local diff --git a/strix/interface/platform_cli.py b/strix/interface/platform_cli.py index 1835d367..bf57e9cc 100644 --- a/strix/interface/platform_cli.py +++ b/strix/interface/platform_cli.py @@ -11,7 +11,6 @@ from __future__ import annotations import argparse import contextlib import json -import os import sys import time import webbrowser @@ -210,7 +209,6 @@ def _run_device_flow( # noqa: PLR0912, PLR0915 try: response = requests.post( f"{app_url}/api/v1/cli/login", - headers=_preview_headers(), timeout=_HTTP_TIMEOUT_S, allow_redirects=False, ) @@ -275,7 +273,6 @@ def _run_device_flow( # noqa: PLR0912, PLR0915 try: poll = requests.post( f"{app_url}/api/v1/cli/login/poll", - headers=_preview_headers(), json=poll_body, timeout=_HTTP_TIMEOUT_S, allow_redirects=False, @@ -415,7 +412,6 @@ def _complete_selection( try: response = requests.post( f"{app_url}/api/v1/cli/login/complete", - headers=_preview_headers(), json=body, timeout=_HTTP_TIMEOUT_S, allow_redirects=False, @@ -581,17 +577,11 @@ def _error_detail(response: requests.Response) -> str: return f"HTTP {response.status_code}" -def _preview_headers() -> dict[str, str]: - bypass = os.environ.get("STRIX_VERCEL_PROTECTION_BYPASS", "").strip() - return {"x-vercel-protection-bypass": bypass} if bypass else {} - - def _session_headers(record: dict[str, Any]) -> dict[str, str]: headers = {"Authorization": f"Bearer {record['api_token']}"} workspace_id = record.get("organization_id") if isinstance(workspace_id, str) and workspace_id: headers["X-Strix-Workspace"] = workspace_id - headers.update(_preview_headers()) return headers diff --git a/tests/test_cloud_session.py b/tests/test_cloud_session.py index aecda688..e9ccc862 100644 --- a/tests/test_cloud_session.py +++ b/tests/test_cloud_session.py @@ -35,7 +35,6 @@ def auth_path(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path: monkeypatch.setattr(platform_cli, "AUTH_PATH", path) monkeypatch.delenv("STRIX_API_TOKEN", raising=False) monkeypatch.delenv("STRIX_WORKSPACE_ID", raising=False) - monkeypatch.delenv("STRIX_VERCEL_PROTECTION_BYPASS", raising=False) return path @@ -69,32 +68,6 @@ def test_http_workspace_pin_is_captured_once( assert sent[0]["X-Strix-Workspace"] == "org_start" -def test_preview_bypass_is_opt_in_and_shared_by_login_and_api_requests( - auth_path: Path, monkeypatch: pytest.MonkeyPatch -) -> None: - assert auth_path.parent.exists() - platform_cli.save_record( - { - "api_token": "secret", - "organization_id": "org_1", - "app_url": "https://preview.example.test", - } - ) - sent: list[dict[str, str]] = [] - monkeypatch.setenv("STRIX_VERCEL_PROTECTION_BYPASS", "preview-secret") - monkeypatch.setattr( - http.requests, - "request", - lambda *_args, **kwargs: sent.append(dict(kwargs["headers"])) or Response({}), - ) - - http.configure() - http.request("GET", "/scans") - - assert sent[0]["x-vercel-protection-bypass"] == "preview-secret" - assert platform_cli._preview_headers() == {"x-vercel-protection-bypass": "preview-secret"} - - def test_session_scope_update_persists_only_for_stored_session( auth_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: Any ) -> None: