feat(retest-queue): 0.2.0 — date filters, counts, comments, admin-gated delete #37

Merged

haskos-bot merged 1 commit from feat/retest-queue-filters into dev

2026-07-19 15:49:18 +00:00

john commented

2026-07-19 14:29:48 +00:00

Owner

What

New endpoints on the shared @haskytech/retest-queue Python package:

Endpoint	Purpose
`GET /retest-queue?reported_after=...&reported_before=...`	Date range filter on the bug list
`GET /retest-queue/counts`	Per-status counts (also honors date filter)
`POST /retest-queue/{bug_id}/comment`	Append note without status change
`POST /retest-queue/{bug_id}/delete`	Admin-password gated delete

New optional constructor params on create_retest_router:

admin_api_key — elevated (operator+) HaskyOS API key for delete
admin_password — shared password the UI must pass to gate deletes

Both fall back to env vars (HASKOS_ADMIN_API_KEY, RETEST_QUEUE_ADMIN_PASSWORD); the delete endpoint returns 503 if either is missing.

Why

Superclean /testing page needs:

Date range filter — legacy bugs cluttering the queue
Per-status counts in the filter pills
Add comment button (separate from Confirm Fixed / Still Broken)
Delete button (admin-only, hidden behind password)

Implementation notes

add_comment PATCHes with the current status re-asserted (matches audit pattern from operator workflows, no state transition)
delete uses POST /{bug_id}/delete rather than DELETE because httpx doesn't support JSON bodies on DELETE cleanly
admin password validated with secrets.compare_digest to avoid timing oracle
Service API key (viewer role) cannot delete — only the admin key can

Tests

10 new tests in packages/retest-queue/tests/test_router.py covering:

Date filter pass-through (with/without params)
Counts endpoint (response shape + date filter)
Comment path (note appended, current status preserved, empty text rejected)
Delete endpoint (correct password 204, wrong password 403 unauthenticated, missing config 503, HaskyOS 403 propagated as 502)

Spec Drift Callouts

The original HaskyOS DELETE endpoint uses HTTP DELETE method, but our package uses POST /{bug_id}/delete instead — httpx doesn't cleanly support JSON bodies on DELETE, and most HTTP clients/intermediaries don't either. The HaskyOS DELETE endpoint is still called normally under the hood via client.delete_bug().

Depends on

haskytech/smeos#1414 (kernel-side reported_after/reported_before + /counts endpoint) — must be merged and deployed to HaskyOS prod before this package's new endpoints work end-to-end. The package itself can ship first; consumers just won't use the new features until kernel lands.

Publish Runbook

After merge to dev:

CI publishes 0.2.0 to Forgejo PyPI (tag retest-queue-v0.2.0)
Smoke test: consumer app imports haskytech_retest_queue==0.2.0 and the new endpoints respond without 404

## What New endpoints on the shared `@haskytech/retest-queue` Python package: | Endpoint | Purpose | |---|---| | `GET /retest-queue?reported_after=...&reported_before=...` | Date range filter on the bug list | | `GET /retest-queue/counts` | Per-status counts (also honors date filter) | | `POST /retest-queue/{bug_id}/comment` | Append note without status change | | `POST /retest-queue/{bug_id}/delete` | Admin-password gated delete | New optional constructor params on `create_retest_router`: - `admin_api_key` — elevated (operator+) HaskyOS API key for delete - `admin_password` — shared password the UI must pass to gate deletes Both fall back to env vars (`HASKOS_ADMIN_API_KEY`, `RETEST_QUEUE_ADMIN_PASSWORD`); the delete endpoint returns 503 if either is missing. ## Why Superclean /testing page needs: 1. Date range filter — legacy bugs cluttering the queue 2. Per-status counts in the filter pills 3. Add comment button (separate from Confirm Fixed / Still Broken) 4. Delete button (admin-only, hidden behind password) ## Implementation notes - `add_comment` PATCHes with the current status re-asserted (matches audit pattern from operator workflows, no state transition) - delete uses `POST /{bug_id}/delete` rather than `DELETE` because httpx doesn't support JSON bodies on DELETE cleanly - admin password validated with `secrets.compare_digest` to avoid timing oracle - Service API key (viewer role) cannot delete — only the admin key can ## Tests 10 new tests in `packages/retest-queue/tests/test_router.py` covering: - Date filter pass-through (with/without params) - Counts endpoint (response shape + date filter) - Comment path (note appended, current status preserved, empty text rejected) - Delete endpoint (correct password 204, wrong password 403 unauthenticated, missing config 503, HaskyOS 403 propagated as 502) ## Spec Drift Callouts - The original HaskyOS DELETE endpoint uses HTTP `DELETE` method, but our package uses `POST /{bug_id}/delete` instead — httpx doesn't cleanly support JSON bodies on DELETE, and most HTTP clients/intermediaries don't either. The HaskyOS DELETE endpoint is still called normally under the hood via `client.delete_bug()`. ## Depends on - haskytech/smeos#1414 (kernel-side `reported_after`/`reported_before` + `/counts` endpoint) — must be merged and deployed to HaskyOS prod before this package's new endpoints work end-to-end. The package itself can ship first; consumers just won't use the new features until kernel lands. ## Publish Runbook After merge to `dev`: - [ ] CI publishes 0.2.0 to Forgejo PyPI (tag `retest-queue-v0.2.0`) - [ ] Smoke test: consumer app imports `haskytech_retest_queue==0.2.0` and the new endpoints respond without 404

john added 1 commit

2026-07-19 14:29:48 +00:00

feat(retest-queue): 0.2.0 — date filters, counts, comments, admin-gated delete

CI / Lint & Format (pull_request) Has been cancelled

Details

CI / detect-changes (pull_request) Has been cancelled

Details

CI / Unit Tests (pull_request) Has been cancelled

Details

d73412b1b6

API additions (router):
- GET /retest-queue?reported_after=YYYY-MM-DD&reported_before=YYYY-MM-DD — date filter
- GET /retest-queue/counts — per-status counts (also honors date filter)
- POST /retest-queue/{bug_id}/comment — append note without status change
- POST /retest-queue/{bug_id}/delete — admin-password gated delete

Constructor params:
- admin_api_key: elevated (operator+) HaskyOS API key for delete operations
- admin_password: shared password the UI must pass to gate deletes
  Both fall back to env vars (HASKOS_ADMIN_API_KEY, RETEST_QUEUE_ADMIN_PASSWORD)
  if not set; the delete endpoint returns 503 if either is missing.

Implementation notes:
- add_comment re-asserts current status in PATCH (matches audit pattern, no
  state transition)
- delete uses POST /{bug_id}/delete rather than DELETE method because httpx
  and most HTTP clients don't support JSON bodies on DELETE cleanly
- admin password validated with secrets.compare_digest to avoid timing oracle
- 10 tests covering: date filter pass-through, counts endpoint, comment path,
  delete password gate (right/wrong/missing config), HaskyOSError propagation

Bumps version 0.1.1 → 0.2.0 — breaking API additions (new endpoints, new
optional constructor params, no removals), but new params default to None so
existing callers keep working without changes.