| 1 | # csrf_token.py DOX |
| 2 | |
| 3 | ## Purpose |
| 4 | |
| 5 | - Own the `csrf_token.py` API endpoint. |
| 6 | - This module issues or refreshes CSRF tokens for browser API clients. |
| 7 | - Keep this file-level DOX profile synchronized with `csrf_token.py` because this directory is intentionally flat. |
| 8 | |
| 9 | ## Ownership |
| 10 | |
| 11 | - `csrf_token.py` owns the runtime implementation. |
| 12 | - `csrf_token.py.dox.md` owns durable notes about responsibilities, contracts, side effects, and verification for that implementation. |
| 13 | - Classes: |
| 14 | - `GetCsrfToken` (`ApiHandler`) |
| 15 | - `get_methods(cls) -> list[str]` |
| 16 | - `requires_csrf(cls) -> bool` |
| 17 | - `async process(self, input: Input, request: Request) -> Output` |
| 18 | - `async check_allowed_origin(self, request: Request)` |
| 19 | - `async is_allowed_origin(self, request: Request)` |
| 20 | - `get_origin_from_request(self, request: Request)` |
| 21 | - `async get_allowed_origins(self) -> list[str]` |
| 22 | - `get_default_allowed_origins(self) -> list[str]` |
| 23 | - Notable constants/configuration names: `ALLOWED_ORIGINS_KEY`. |
| 24 | |
| 25 | ## Runtime Contracts |
| 26 | |
| 27 | - HTTP handlers must derive from `helpers.api.ApiHandler`; WebSocket handlers must derive from `helpers.ws.WsHandler`. |
| 28 | - Update this file whenever request payloads, authentication or CSRF requirements, response shapes, route side effects, or WebSocket event contracts change. |
| 29 | - `GetCsrfToken` is an `ApiHandler`. |
| 30 | - `GetCsrfToken` defines `process(...)`. |
| 31 | - `GetCsrfToken` defines `get_methods(...)`. |
| 32 | - `GetCsrfToken` defines `requires_csrf(...)`. |
| 33 | - Observed side-effect areas: filesystem writes, network calls, secret handling, tunnel state. |
| 34 | - Imported dependency areas include: `fnmatch`, `helpers`, `helpers.api`, `secrets`, `urllib.parse`. |
| 35 | |
| 36 | ## Key Concepts |
| 37 | |
| 38 | - Important called helpers/classes observed in the source: `login.is_login_required`, `self.initialize_allowed_origins`, `self.get_origin_from_request`, `urlparse`, `dotenv.get_dotenv_value`, `self.get_default_allowed_origins`, `dotenv.save_dotenv_value`, `self.check_allowed_origin`, `secrets.token_urlsafe`, `runtime.get_runtime_id`, `self.is_allowed_origin`, `self.get_allowed_origins`, `origin.strip`, `join`, `fnmatch.fnmatch`, `split`, `tunnel_api_process`. |
| 39 | - Keep request/response, tool, or helper semantics documented here at the same time as source changes. |
| 40 | |
| 41 | ## Work Guidance |
| 42 | |
| 43 | - Preserve authentication, CSRF, loopback, and API-key checks unless the endpoint contract explicitly changes. |
| 44 | - Update frontend callers, plugin callers, and tests together when payload shape changes. |
| 45 | - Use `helpers.api.Response` for non-JSON responses, files, redirects, or status-specific replies. |
| 46 | |
| 47 | ## Verification |
| 48 | |
| 49 | - Run endpoint-specific or API/WebSocket tests for changed behavior; smoke-test browser callers when no focused test exists. |
| 50 | - Related tests observed by source search: |
| 51 | - `tests/test_http_auth_csrf.py` |
| 52 | - `tests/test_self_update_tag_filter.py` |
| 53 | - `tests/test_ws_security.py` |
| 54 | |
| 55 | ## Child DOX Index |
| 56 | |
| 57 | No child DOX files. |