Harden settings file concurrency, email key isolation, and import guard

[Copilot]

app_settings.json is shared by both settings and email config writers, but was only protected by an in-process threading.Lock — insufficient for Gunicorn's multi-worker model. Arbitrary caller keys in save_email_config could also overwrite unrelated settings, and import_settings unconditionally called save_settings even when the import contained only email keys (resetting all settings to defaults).

Inter-process lock (settings.py)

Replaced threading.Lock with _InterProcessSettingsFileLock — a combined threading.Lock + fcntl.flock advisory lock stored in config/app_settings.json.lock. Both settings.py and email_config.py share the same lock instance. Falls back to thread-only locking on Windows.

class _InterProcessSettingsFileLock:
    def acquire(self, blocking=True) -> bool:
        self._thread_lock.acquire(blocking)
        fd = os.open(self._lock_file_path, os.O_CREAT | os.O_RDWR, 0o600)
        fcntl.flock(fd, fcntl.LOCK_EX)
        self._fd = fd
        ...

Email key isolation (email_config.py)

• Added _filter_email_keys(source) helper — returns only keys in _EMAIL_KEYS; used in both load_email_config and save_email_config to eliminate the duplicate filtering loop and guarantee callers can't bleed arbitrary keys into the shared file.
• load_email_config now guards against non-dict JSON with an isinstance check and falls back to defaults instead of raising.

Conditional settings save (app_main.py)

import_settings skips save_settings() when the uploaded JSON contains no recognized settings keys, preventing a silent reset-to-defaults on an email-only import.

Housekeeping

Added config/*.lock to .gitignore.

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[Copilot]

Pull request overview

Hardens concurrent access to the shared app_settings.json by introducing an inter-process file lock, prevents email config writes from overwriting unrelated settings keys, and avoids resetting settings to defaults during “email-only” imports.

Changes:

• Replace in-process-only lock with a combined thread + flock inter-process lock shared by settings and email config.
• Filter persisted email config to known keys and safely handle non-dict JSON during load.
• Skip save_settings() during import when no valid settings keys are present.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.

File	Description
simple_org_chart/settings.py	Introduces shared inter-process lock implementation and lock-file path derivation.
simple_org_chart/email_config.py	Adds helper for email-key isolation and hardens email-config loading.
simple_org_chart/app_main.py	Prevents settings reset on email-only imports by conditionally saving settings.
.gitignore	Ignores runtime lock files to keep repo clean.

[Copilot]

os.open(self._lock_file_path, ...) will raise FileNotFoundError if the parent directory doesn’t exist (e.g., first run / before any code path calls SETTINGS_FILE.parent.mkdir(...)). Since acquiring the lock can happen during read paths, this can crash callers. Create the lock file’s parent directory inside acquire() (or during initialization) before calling os.open.

[Copilot]

__enter__ ignores the return value of acquire(). While with lock: currently calls the blocking path, this makes the class easier to misuse (e.g., if acquire(blocking=False) behavior is later introduced into context-manager usage). Consider raising an exception if acquire() returns False, or changing acquire() to always raise on failure so the context manager can’t enter without owning the lock.

Suggested change

	self.acquire()
	acquired = self.acquire()
	if not acquired:
	raise RuntimeError("Failed to acquire settings file lock")

[Copilot]

The warning hard-codes app_settings.json. If SETTINGS_FILE is ever renamed or configured differently, this message becomes misleading. Prefer including the actual SETTINGS_FILE (path or name) in the log message.