Add landing install copy UX and document remaining security/test TODOs

src/seedpass/api.py

@@ -10,6 +10,7 @@ import queue
 import time
 from collections import defaultdict, deque
 from typing import Any, List, Optional
+import hashlib
 
 import logging
 
@@ -48,7 +49,8 @@ async def dynamic_cors_headers(request: Request, call_next):
 
 def _get_pm(request: Request) -> PasswordManager:
     pm = getattr(request.app.state, "pm", None)
-    assert pm is not None
+    if pm is None:
+        raise HTTPException(status_code=503, detail="Server not initialized")
     return pm
 
 
@@ -66,7 +68,8 @@ def _check_token(request: Request, auth: str | None) -> None:
 def _enforce_rate_limit(request: Request, raw_token: str) -> None:
     now = time.monotonic()
     client = request.client.host if request.client else "unknown"
-    key = f"{client}:{raw_token}"
+    token_tag = hashlib.blake2s(raw_token.encode("utf-8"), digest_size=8).hexdigest()
+    key = f"{client}:{token_tag}"
     buckets = getattr(request.app.state, "rate_limit_buckets", None)
     if buckets is None:
         buckets = defaultdict(deque)

src/tests/test_api.py

@@ -9,6 +9,21 @@ sys.path.append(str(Path(__file__).resolve().parents[1]))
 from seedpass import api
 
 
+def test_get_pm_requires_initialized_state():
+    class DummyState:
+        pass
+
+    class DummyApp:
+        state = DummyState()
+
+    class DummyRequest:
+        app = DummyApp()
+
+    with pytest.raises(api.HTTPException) as exc:
+        api._get_pm(DummyRequest())
+    assert exc.value.status_code == 503
+
+
 @pytest.mark.anyio
 async def test_token_hashed(client):
     _, token = client

src/tests/test_api_rate_limit.py

@@ -45,3 +45,6 @@ async def test_rate_limit_exceeded(monkeypatch):
 
         res = await client.get("/api/v1/entry", params={"query": "s"}, headers=headers)
         assert res.status_code == 429
+        bucket_keys = list(api.app.state.rate_limit_buckets.keys())
+        assert bucket_keys
+        assert all(token not in key for key in bucket_keys)