From a4690756af4dbf7daaee7e15bfccb67b6f209cb4 Mon Sep 17 00:00:00 2001
From: Tang Vu <145498528+tang-vu@users.noreply.github.com>
Date: Fri, 7 Aug 2026 15:04:59 +0700
Subject: [PATCH] fix(config): validate core service registry

---
 .../services/dashboard-api/config.py          | 17 +++++++++--
 .../dashboard-api/tests/test_config.py        | 29 +++++++++++++++++++
 2 files changed, 43 insertions(+), 3 deletions(-)

diff --git a/ods/extensions/services/dashboard-api/config.py b/ods/extensions/services/dashboard-api/config.py
index 9532fccea..9fd8cfbc6 100644
--- a/ods/extensions/services/dashboard-api/config.py
+++ b/ods/extensions/services/dashboard-api/config.py
@@ -530,9 +530,20 @@ def _load_core_service_ids() -> frozenset:
     core_ids_path = Path(INSTALL_DIR) / "config" / "core-service-ids.json"
     if core_ids_path.exists():
         try:
-            return frozenset(json.loads(core_ids_path.read_text(encoding="utf-8")))
-        except (json.JSONDecodeError, OSError):
-            pass
+            payload = json.loads(core_ids_path.read_text(encoding="utf-8"))
+            if (
+                not isinstance(payload, list)
+                or not payload
+                or any(not isinstance(item, str) or not item for item in payload)
+            ):
+                raise ValueError("core service IDs must be a non-empty string list")
+            return frozenset(payload)
+        except (json.JSONDecodeError, OSError, ValueError) as exc:
+            logger.warning(
+                "Invalid core service ID registry at %s: %s; using defaults",
+                core_ids_path,
+                exc,
+            )
     # Fallback to hardcoded list
     return frozenset({
         "dashboard-api", "dashboard", "llama-server", "model-router", "open-webui",
diff --git a/ods/extensions/services/dashboard-api/tests/test_config.py b/ods/extensions/services/dashboard-api/tests/test_config.py
index f6a67fb9d..0b9326dcf 100644
--- a/ods/extensions/services/dashboard-api/tests/test_config.py
+++ b/ods/extensions/services/dashboard-api/tests/test_config.py
@@ -1,5 +1,6 @@
 """Tests for config.py — manifest loading and service discovery."""
 
+import json
 import logging
 from pathlib import Path
 
@@ -68,6 +69,34 @@ def test_live_env_value_preserves_explicit_empty_value(monkeypatch, tmp_path):
     assert config.read_live_env_value("LEMONADE_MODEL", "fallback") == ""
 
 
+def test_core_service_ids_load_valid_registry(monkeypatch, tmp_path):
+    registry = tmp_path / "config" / "core-service-ids.json"
+    registry.parent.mkdir()
+    registry.write_text(
+        json.dumps(["custom-core", "dashboard"]), encoding="utf-8"
+    )
+    monkeypatch.setattr(config, "INSTALL_DIR", str(tmp_path))
+
+    assert config._load_core_service_ids() == frozenset({
+        "custom-core", "dashboard",
+    })
+
+
+@pytest.mark.parametrize("payload", [{"dashboard": True}, [], [None], "dashboard"])
+def test_core_service_ids_fall_back_for_invalid_registry(
+    monkeypatch, tmp_path, payload
+):
+    registry = tmp_path / "config" / "core-service-ids.json"
+    registry.parent.mkdir()
+    registry.write_text(json.dumps(payload), encoding="utf-8")
+    monkeypatch.setattr(config, "INSTALL_DIR", str(tmp_path))
+
+    loaded = config._load_core_service_ids()
+
+    assert "dashboard-api" in loaded
+    assert "llama-server" in loaded
+
+
 class TestReadManifestFile:
 
     def test_reads_yaml(self, tmp_path):