fix(svc): scrub streaming responses in the sanitize interceptor #25

Merged

nalum merged 1 commit from fix/stream-sanitize into main

2026-08-13 11:38:47 +00:00

nalum commented

2026-08-13 10:08:13 +00:00

Owner

WrapStreamingHandler returned next untouched, so the structural scrub guarantee was unary-only. A future streaming RPC emitting a User would have leaked password_hash/pin_hash with nothing failing.

The interceptor now wraps the streaming conn and runs the same recursive scrub walk (including has_pin derivation) on every Send. Tests cover a streamed User (secrets cleared), a Notification (byte-identical pass-through), and error propagation.

Fixes #21

🤖 Generated with Claude Code

`WrapStreamingHandler` returned `next` untouched, so the structural scrub guarantee was unary-only. A future streaming RPC emitting a `User` would have leaked `password_hash`/`pin_hash` with nothing failing. The interceptor now wraps the streaming conn and runs the same recursive scrub walk (including `has_pin` derivation) on every `Send`. Tests cover a streamed `User` (secrets cleared), a `Notification` (byte-identical pass-through), and error propagation. Fixes #21 🤖 Generated with [Claude Code](https://claude.com/claude-code)

nalum added 1 commit

2026-08-13 10:08:13 +00:00

fix(svc): scrub streaming responses in the sanitize interceptor

check / go (push) Successful in 1m43s

Details

check / web (push) Successful in 1m38s

Details

4105d47fa0

WrapStreamingHandler returned next untouched, so the structural scrub
guarantee held for unary responses only. Today's streams (Watch's
DataChange, Subscribe's Notification) carry no scrub-map fields, but a
future streaming RPC emitting a User would have leaked password_hash
and pin_hash silently. Wrapping the handler conn so Send runs the same
recursive scrub walk closes that gap before any secret-bearing stream
exists.

Fixes #21

nalum force-pushed fix/stream-sanitize from 4105d47fa0

check / go (push) Successful in 1m43s

Details

check / web (push) Successful in 1m38s

Details

to cfc070cfe4

tag / tag (push) Has been cancelled

Details

check / go (push) Successful in 1m46s

Details

check / web (push) Successful in 1m27s

Details