refactor: extract SSRF worker-URL validation into app/worker_proxy.py (CashPilot-sux)

[GeiserX]

Splits a cohesive, self-contained slice out of the main.py god module — the architect-endorsed least-coupled candidate from bead CashPilot-sux.

What moved

The SSRF/worker-URL guard → new app/worker_proxy.py:

• policy constants (_WORKER_URL_POLICY, metadata/loopback block sets, allowlist),
• _parse_worker_allowlist, _normalize_ip, _assert_ip_not_blocked, _assert_ip_strict_allowed,
• _validate_worker_url (DNS-rebinding-safe validation), _pin_url_to_ip.

main.py's _get_verified_worker_url composes them and stays in main (it also needs FLEET_API_KEY + database). worker_proxy imports nothing from main, so no new import cycle. main.py drops ~160 lines and the SSRF policy is now isolated and unit-testable on its own.

Test seams

• The 8 app.main.socket.getaddrinfo patches → app.worker_proxy.socket (that's where _validate_worker_url resolves the host).
• The strict-mode / allowlist tests that mutate the policy constants repoint their main alias to app.worker_proxy (where _validate_worker_url reads them).
• The _validate_worker_url / _pin_url_to_ip patches keep working via main's import binding — unchanged.

Verification

Behavior-preserving: 1172 tests green; ruff check + ruff format --check clean; verified worker_proxy imports nothing from app.main.

Scope

This lands the module-extraction half of sux. The other half — resolving the main → routers → main import cycle — is intentionally left as-is: it's benign and documented, and breaking it churns ~40 app.main.* test seams for no correctness gain (per the architect review). The bead can close on the extraction or stay open for the cosmetic cycle cleanup — your call.

Addresses bead CashPilot-sux (extraction half).

[GeiserX]

@coderabbitai review

[coderabbitai]

Warning

Review limit reached

@GeiserX, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 43 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c6b8835c-9842-4117-ae9f-faa5bfcc3f65

📥 Commits

Reviewing files that changed from the base of the PR and between bcf730c and 6f51adc.

📒 Files selected for processing (3)

• app/main.py
• app/worker_proxy.py
• tests/test_main_routes.py

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/loop-sux-worker-proxy

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[codecov]

Codecov Report

❌ Patch coverage is 98.80952% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 93.90%. Comparing base (bcf730c) to head (6f51adc).

Files with missing lines	Patch %	Lines
app/worker_proxy.py	98.79%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #121   +/-   ##
=======================================
  Coverage   93.89%   93.90%           
=======================================
  Files          33       34    +1     
  Lines        3901     3905    +4     
=======================================
+ Hits         3663     3667    +4     
  Misses        238      238           

Files with missing lines	Coverage Δ
app/main.py	97.65% <100.00%> (-0.08%)	⬇️
app/worker_proxy.py	98.79% <98.79%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.