Description
PR #735 changed src/meraki_dashboard_exporter/api/client.py:24-65 to preserve Authorization across origin changes when the destination host has a Meraki-owned suffix. That resolves PR #733 P1.2 by contradicting frozen decision D9, which requires credentials to be stripped unconditionally whenever the origin changes. Restore an origin comparison based on the request origin in effect before redirect handling; same-origin explicit default ports remain equivalent, but every changed scheme, host, or port loses Authorization. Do not weaken the operator-selected custom-base-url policy.
Acceptance Criteria
- #1 Authorization is preserved for same-origin requests including equivalent explicit default ports
- #2 Authorization is stripped for every cross-origin request, including another Meraki-owned host
- #3 Lookalike hosts and scheme or port changes are covered by regression tests
- #4 The implementation and docs agree with frozen decision D9
Definition of Done
- #1 make check (uv run ruff check . && uv run ruff format –check . && uv run mypy . && uv run pytest -v)
- #2 make docgen, when metrics, config, endpoints or collectors changed — CI fails the build on generated-docs drift
- #3 Grafana queries in grafana/dashboards/*.json and grafana/alerts/ updated, if a metric or label name changed
Implementation Plan
- Replace Meraki-domain suffix trust with configured-origin equality. 2. Reverse the shard-host regression test and add scheme/port boundary coverage. 3. Run the focused transport tests, then the repository gate and security review before commit.
Implementation Notes
Red proof: uv run pytest -q tests/unit/test_697_698_api_transport.py -k “697 or meraki or scheme_or_port” failed 2 tests because shard-host and non-default-port requests retained Authorization. After the implementation change the same selection passed 10 tests. CodeRabbit reviewed the staged security diff on the rknightion plan with 0 findings. Final gate: make check passed ruff, format (377 files), mypy (121 source files), and 2737 pytest tests with 1 Starlette deprecation warning.
Final Summary
Implemented configured-origin credential binding in commit 163e16bd91d19d9fd0a511bf6f805637f70f81b4. Same-origin and explicit default-port requests retain Authorization; Meraki shard hosts, lookalikes, scheme changes, and non-default ports lose it. Red proof failed the shard and port cases before the fix; focused validation passed 10 tests, CodeRabbit reported 0 findings, and make check passed 2737 tests plus ruff, format, and mypy. make docgen and Grafana edits were not applicable because no generator input, metric, or label changed.