Connections → Your own email: the form answers 500 for everybody, because a secret field's help is lazy text #359

New issue

Closed

opened 2026-10-01 10:46:07 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-10-01 10:46:07 +00:00

Owner

Found on 2026-09-29 in a read-only review of postulo at 95348908d, rendering the connection form of each built-in connected plugin with the Django test client.

Checked again on 2026-10-01 against main at 0a5cad587: still present.

form_field_for builds a secret field's help with str.join, which accepts only str. The Your own email outbox gives its password field lazy help text, so building its form raises TypeError on every GET and POST. Nobody can set up the outbox that #149 and #151 built, including the XOAUTH2 path Microsoft 365 will require.

Where: plugins/forms.py:125 (form_field_for, the secret branch: help_text=" ".join(part for part in (spec.help, hint) if part)); plugins/own_mail/__init__.py:109-119 (the password FieldSpec, help=_lazy(...)).
What happens: GET /settings/connections/add/outbox/own-mail/ raises TypeError: sequence item 0: expected str instance, __proxy__ found at plugins/forms.py:125. The webhook and browser forms answer 200, because their plugins pass str(_(...)); the non-secret branches hand lazy text to Django, which accepts it. The help text has been lazy since the plugin arrived in 9d34da0eb (2026-09-09), so no own-mail connection has ever been saved through the interface.
Why it matters: a shipped feature is unreachable, and any third-party plugin that gives a secret FieldSpec lazy help, as the built-in does, gets the same 500. No test renders the own-mail form (tests/test_outbox.py makes no client request), which is how it went unnoticed.
Fix: coerce in one place: " ".join(str(part) for part in (spec.help, hint) if part). Do not land this before the issue about the outbox reaching private addresses when POSTULO_EMAIL_HOST is set, because this fix is what makes that one reachable.

Done when

tests/test_connections.py has a parametrised test that renders the create form (GET, and a POST with empty values) for every registered connected plugin and expects no 500; it fails today on own-mail.

Found on 2026-09-29 in a read-only review of postulo at 95348908d, rendering the connection form of each built-in connected plugin with the Django test client. Checked again on 2026-10-01 against `main` at `0a5cad587`: still present. `form_field_for` builds a secret field's help with `str.join`, which accepts only `str`. The *Your own email* outbox gives its `password` field lazy help text, so building its form raises `TypeError` on every GET and POST. Nobody can set up the outbox that #149 and #151 built, including the XOAUTH2 path Microsoft 365 will require. - **Where:** `plugins/forms.py:125` (`form_field_for`, the secret branch: `help_text=" ".join(part for part in (spec.help, hint) if part)`); `plugins/own_mail/__init__.py:109-119` (the `password` `FieldSpec`, `help=_lazy(...)`). - **What happens:** `GET /settings/connections/add/outbox/own-mail/` raises `TypeError: sequence item 0: expected str instance, __proxy__ found` at `plugins/forms.py:125`. The webhook and browser forms answer 200, because their plugins pass `str(_(...))`; the non-secret branches hand lazy text to Django, which accepts it. The help text has been lazy since the plugin arrived in 9d34da0eb (2026-09-09), so no own-mail connection has ever been saved through the interface. - **Why it matters:** a shipped feature is unreachable, and any third-party plugin that gives a secret `FieldSpec` lazy help, as the built-in does, gets the same 500. No test renders the own-mail form (`tests/test_outbox.py` makes no client request), which is how it went unnoticed. - **Fix:** coerce in one place: `" ".join(str(part) for part in (spec.help, hint) if part)`. Do not land this before the issue about the outbox reaching private addresses when `POSTULO_EMAIL_HOST` is set, because this fix is what makes that one reachable. ## Done when - `tests/test_connections.py` has a parametrised test that renders the create form (GET, and a POST with empty values) for every registered connected plugin and expects no 500; it fails today on `own-mail`.

tiagoagueda added this to the 0.5.0 milestone

2026-10-01 10:46:07 +00:00

tiagoagueda added the

tier

bug

labels

2026-10-01 10:46:07 +00:00

tiagoagueda referenced this issue from a commit

2026-10-04 10:04:57 +00:00

Stop a lazy help text from crashing the connection form

tiagoagueda closed this issue

2026-10-04 10:04:57 +00:00