Skip to content

Resolves bug in Delete which deletes ALL emails from that user not just the X number shown. #90

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AgardnerAU wants to merge 26 commits into
base: main
Choose a base branch
from
Open

Resolves bug in Delete which deletes ALL emails from that user not just the X number shown. #90

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
98b6e20
fix: add thread synchronization to AppState to prevent race conditions
AgardnerAU Dec 28, 2025
5e384a6
security: fix Gmail query injection vulnerability in sender parameters
AgardnerAU Dec 28, 2025
e45726f
feat: add rate limiting to API endpoints with slowapi
AgardnerAU Dec 28, 2025
2c7eb0a
Fix thread-safe state access and add delete.py tests
AgardnerAU Dec 28, 2025
f1b378a
Add mock-based tests for scan.py
AgardnerAU Dec 28, 2025
e0953d2
Fix thread-safe state access in auth modules
AgardnerAU Dec 28, 2025
284e2ea
Update CHANGELOG with security fixes and test improvements
AgardnerAU Dec 28, 2025
8783031
Add tests for mark_read, unsubscribe, and archive modules
AgardnerAU Dec 28, 2025
238b53f
Add tests for important, download, and labels modules
AgardnerAU Dec 28, 2025
901e261
Add tests for auth_handlers OAuth callback processing
AgardnerAU Dec 28, 2025
cb374e1
Add comprehensive tests for auth.py authentication service
AgardnerAU Dec 28, 2025
10d38d1
Fix security issues in auth.py
AgardnerAU Dec 28, 2025
5740d6b
Fix delete count mismatch - use cached message IDs from scan
AgardnerAU Dec 28, 2025
46b1676
Add delete confirmation with email count
AgardnerAU Dec 28, 2025
cd67dc5
Update delete button text to 'Delete all selected emails'
AgardnerAU Dec 28, 2025
7c2b48e
Use consistent thread-safe state mutation in auth handlers
AgardnerAU Dec 29, 2025
4da7ee6
Clean up unused imports and variables
AgardnerAU Dec 29, 2025
081e6f6
Remove unused mock attributes from auth handler tests
AgardnerAU Dec 29, 2025
a2bd20e
Use f-string conversion flags for exception formatting
AgardnerAU Dec 29, 2025
e4d946d
Sanitize label parameter in Gmail query builder
AgardnerAU Dec 29, 2025
bcd652a
Add Unread Emails tab for bulk managing unread messages by sender
AgardnerAU Dec 29, 2025
f80a3ab
Add display limit, skip confirmations, and delete to Unread Emails tab
AgardnerAU Dec 29, 2025
3ead6e2
Add retry limit to polling functions in unread.js
AgardnerAU Dec 29, 2025
991a93e
Fix race condition in unread scan results filtering
AgardnerAU Dec 29, 2025
6d261b0
Fix test coverage, Docker OAuth support, and date tracking
AgardnerAU Dec 29, 2025
f3a1af5
Improve config validation, linting, and test coverage
AgardnerAU Dec 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,23 +7,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

### Security
- **Thread-Safe State Management**: Added `threading.Lock` synchronization to `AppState` class to prevent race conditions in concurrent operations
- **Gmail Query Injection Prevention**: Added `sanitize_gmail_query_value()` function to properly escape user-supplied values in Gmail API queries
- **API Rate Limiting**: Added `slowapi` middleware with tiered rate limits:
- Status endpoints: 120 req/min
- Action endpoints: 30 req/min
- Auth endpoints: 10 req/min
- Heavy operations: 10 req/min

### Added
- CodeRabbit AI code review integration with `.coderabbit.yaml` configuration
- Pre-commit hooks for code quality checks (ruff, bandit, trailing whitespace, etc.)
- Comprehensive type annotations throughout the codebase
- 33 new mock-based tests for `delete.py` (81% coverage)
- 12 new mock-based tests for `scan.py` (84% coverage)
- 13 new tests for query sanitization function
- `slowapi` dependency for rate limiting

### Changed
- Updated pre-commit hook versions to latest stable releases
- Improved code formatting consistency (double quotes, trailing commas, whitespace)
- Enhanced function signatures with multiline formatting for better readability
- Normalized code style across Python, JavaScript, CSS, and HTML files
- All Gmail service files now use thread-safe state methods instead of direct dictionary mutation
- Auth modules updated to use thread-safe state access patterns
- API action handlers use `body` parameter name to avoid FastAPI `Request` conflicts

### Fixed
- Timezone handling in CSV filename generation (now uses UTC)
- Missing return type annotations in multiple functions
- Closure variable binding in batch callback functions
- Test coverage improvements with proper mock assertions
- Boolean positional argument pattern in `mark_important_background`
- Race condition vulnerability in global state management
- State mutation bug where property accessors returned copies (mutations were discarded)
- All 192 tests now passing (up from 178 with 2 failures)

## [1.0.0] - 2024-11-29

Expand Down
Loading
Loading