Fix AI review finding: reverse middleware ordering

testdays/app.py

@@ -323,9 +323,11 @@ def create_app(config_obj=None):
 
     # --- Reverse proxy middleware ---
     if os.getenv("IS_OPENSHIFT"):
-        # Normalize duplicated X-Forwarded-* values (e.g. "https,https")
-        # before ProxyFix processes the headers.
-        app.wsgi_app = _ForwardedHeaderFix(app.wsgi_app)
+        # Apply ProxyFix first (inner), then wrap with _ForwardedHeaderFix
+        # (outer).  WSGI middlewares execute outside-in, so the outermost
+        # wrapper runs first on incoming requests.  _ForwardedHeaderFix must
+        # normalize duplicated X-Forwarded-* values (e.g. "https,https")
+        # *before* ProxyFix parses them.
         app.wsgi_app = ProxyFix(
             app.wsgi_app,
             x_for=int(app.config["PROXYFIX_X_FOR"]),
@@ -334,6 +336,7 @@ def create_app(config_obj=None):
             x_port=int(app.config["PROXYFIX_X_PORT"]),
             x_prefix=int(app.config["PROXYFIX_X_PREFIX"]),
         )
+        app.wsgi_app = _ForwardedHeaderFix(app.wsgi_app)
 
     if app.config.get("SHOW_DB_URI"):
         app.logger.debug("using DBURI: %s", app.config["SQLALCHEMY_DATABASE_URI"])

tests/unit/test_proxy_fix.py

@@ -39,9 +39,10 @@ class TestProxyFixMiddleware:
         """
         GIVEN IS_OPENSHIFT is set in environment
         WHEN the app is created
-        THEN the outermost wsgi_app layer should be a ProxyFix instance
+        THEN _ForwardedHeaderFix should be outermost, wrapping a ProxyFix
         """
-        assert isinstance(openshift_app.wsgi_app, ProxyFix)
+        assert isinstance(openshift_app.wsgi_app, _ForwardedHeaderFix)
+        assert isinstance(openshift_app.wsgi_app.app, ProxyFix)
 
     def test_proxyfix_not_applied_when_is_openshift_unset(self, app):
         """
@@ -58,7 +59,7 @@ class TestProxyFixMiddleware:
         WHEN the app is created
         THEN ProxyFix should have x_for=1, x_proto=1, others=0
         """
-        pf = openshift_app.wsgi_app
+        pf = openshift_app.wsgi_app.app  # unwrap _ForwardedHeaderFix
         assert pf.x_for == 1
         assert pf.x_proto == 1
         assert pf.x_host == 0
@@ -80,7 +81,7 @@ class TestProxyFixMiddleware:
         config_obj.PROXYFIX_X_PREFIX = 1
         with mock.patch.dict(os.environ, {"IS_OPENSHIFT": "1"}):
             app = create_app(config_obj)
-        pf = app.wsgi_app
+        pf = app.wsgi_app.app  # unwrap _ForwardedHeaderFix
         assert pf.x_for == 2
         assert pf.x_proto == 2
         assert pf.x_host == 1
@@ -92,13 +93,13 @@ class TestProxyFixMiddleware:
         GIVEN IS_OPENSHIFT is set
         WHEN the app is created
         THEN the middleware stack should be:
-             ProxyFix -> _ForwardedHeaderFix -> ComponentsMiddleware (WhiteNoise)
+             _ForwardedHeaderFix -> ProxyFix -> ComponentsMiddleware (WhiteNoise)
         """
-        proxy_fix = openshift_app.wsgi_app
-        assert isinstance(proxy_fix, ProxyFix)
-        header_fix = proxy_fix.app
+        header_fix = openshift_app.wsgi_app
         assert isinstance(header_fix, _ForwardedHeaderFix)
-        assert isinstance(header_fix.app, ComponentsMiddleware)
+        proxy_fix = header_fix.app
+        assert isinstance(proxy_fix, ProxyFix)
+        assert isinstance(proxy_fix.app, ComponentsMiddleware)
 
 
 class TestForwardedHeaderFix: