@vercel/python 9.0.0 → 10.0.1

package/dist/index.js

@@ -10311,7 +10311,7 @@ var import_execa9 = __toESM(require_execa());
 var import_build_utils20 = require("@vercel/build-utils");
 var scriptPath3 = (0, import_path17.join)(__dirname, "..", "templates", "vc_fastapi_static.py");
 var STATIC_COLLECTION_WARNING = "Warning: FastAPI static file collection failed. Static files will not be served from the CDN.";
-async function getFastAPIStaticDiscovery(venvPath, entrypointAbs, variableName, env, workPath) {
+async function getFastAPIStaticDiscovery(venvPath, entrypointAbs, variableName, env, workPath, suppressMiddlewareMounts) {
   const pythonPath = getVenvPythonBin(venvPath);
   const outputDir = (0, import_path17.join)(workPath, ".vercel", "python");
   const outputPath = (0, import_path17.join)(outputDir, "vc_fastapi_static_output.json");
@@ -10320,7 +10320,14 @@ async function getFastAPIStaticDiscovery(venvPath, entrypointAbs, variableName,
   try {
     const { stderr } = await (0, import_execa9.default)(
       pythonPath,
-      [scriptPath3, variableName, outputPath, workPath, moduleName],
+      [
+        scriptPath3,
+        variableName,
+        outputPath,
+        workPath,
+        moduleName,
+        suppressMiddlewareMounts ? "1" : "0"
+      ],
       { env, cwd: workPath }
     );
     if (stderr) {
@@ -10384,13 +10391,14 @@ function shadowSrc(bodies) {
   return `^/((?:${bodies.join("|")})/?)$`;
 }
 var SHADOW_SRC_WRAPPER_LENGTH = shadowSrc([]).length;
-async function runFastAPICollectStatic(venvPath, workPath, env, outputStaticDir, entrypointAbs, variableName) {
+async function runFastAPICollectStatic(venvPath, workPath, env, outputStaticDir, entrypointAbs, variableName, suppressMiddlewareMounts = true) {
   const { mounts, shadowRoutes } = await getFastAPIStaticDiscovery(
     venvPath,
     entrypointAbs,
     variableName,
     env,
-    workPath
+    workPath,
+    suppressMiddlewareMounts
   );
   if (mounts.length === 0) {
     (0, import_build_utils20.debug)("FastAPI: no StaticFiles mounts found, skipping");
@@ -10506,7 +10514,7 @@ function fastapiFallbackRoutes(discovery) {
   });
 }
 function getFastAPICdnBundle(collectedMounts, workPath, fastapiConfig) {
-  if (fastapiConfig?.static?.exclude === false)
+  if (fastapiConfig?.static?.exclude !== true)
     return { excludePatterns: [], directoryStubs: {}, redirects: [] };
   const excludePatterns = [];
   const directoryStubs = {};
@@ -11463,7 +11471,9 @@ ${detail}`
       pythonEnv,
       outputStaticDir,
       entrypointAbs,
-      variableName
+      variableName,
+      // Suppress middleware mounts unless the user explicitly set cdn = true.
+      staticCdn !== true
     );
     if (!fastapiStatic)
       return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/python",
-  "version": "9.0.0",
+  "version": "10.0.1",
   "main": "./dist/index.js",
   "license": "Apache-2.0",
   "homepage": "https://vercel.com/docs/runtimes#official-runtimes/python",
@@ -17,7 +17,7 @@
     "@vercel/python-analysis": "0.14.0"
   },
   "peerDependencies": {
-    "@vercel/build-utils": "14.5.0"
+    "@vercel/build-utils": "14.6.1"
   },
   "devDependencies": {
     "@renovatebot/pep440": "4.2.1",
@@ -38,7 +38,7 @@
     "smol-toml": "1.5.2",
     "vitest": "4.1.10",
     "which": "3.0.0",
-    "@vercel/build-utils": "14.5.0",
+    "@vercel/build-utils": "14.6.1",
     "@vercel/error-utils": "2.2.1",
     "@vercel/python-runtime": "0.22.1"
   },

package/templates/vc_fastapi_static.py

@@ -25,8 +25,13 @@ Writes a JSON object to the output file:
     * app.mount():   routes declared BEFORE the mount win (evaluated in order).
     * app.frontend(): all normal routes win (the build is low-priority).
 
+Mounts are suppressed (omitted from output) when the app or a mounted sub-app
+has user-defined middleware, because CDN-served files bypass the middleware
+stack. Suppression can be disabled by passing "0" as the sixth argument (set
+when [tool.vercel.fastapi.static] cdn = true in pyproject.toml).
+
 Usage:
-    python <this_script> <variable_name> <output_path> <project_root> <module_name>
+    python <this_script> <variable_name> <output_path> <project_root> <module_name> <suppress_middleware_mounts>
 """
 
 from __future__ import annotations
@@ -399,7 +404,12 @@ def _subtree_shadow_route(prefix: str, mounts: list[StaticMount]) -> ShadowRoute
 
 
 def _collect_mount(
-    route: Mount, prefix: str, prior: Precedence
+    route: Mount,
+    prefix: str,
+    prior: Precedence,
+    *,
+    has_middleware: bool,
+    suppress_middleware_mounts: bool,
 ) -> tuple[list[StaticMount], list[ShadowRoute]]:
     """Discover one app.mount(): a StaticFiles mount serves from the CDN, a
     Router/sub-app recurses, and a raw ASGI app owns its subtree opaquely.
@@ -408,11 +418,14 @@ def _collect_mount(
     if prior.eclipses(url_prefix):
         return [], []
 
+    if suppress_middleware_mounts:
+        has_middleware = has_middleware or bool(getattr(route.app, "user_middleware", []))
+
     mounts: list[StaticMount] = []
     shadow_routes: list[ShadowRoute] = []
 
     static = StaticMount.from_route(route, prefix, frontend=False)
-    if static:
+    if static and not has_middleware:
         mounts.append(static)
         shadow_routes += prior.shadow_bodies(static)
         shadow_routes += _divergent_url_shadows(static, html=route.app.html)
@@ -428,7 +441,13 @@ def _collect_mount(
         # Recurse for the sub-app's own StaticFiles mounts, then shadow the
         # rest of its subtree to the Lambda.
         sub_prefix = prefix + route.path.rstrip("/")
-        sub_mounts, sub_shadow = collect(sub_router, sub_prefix, prior)
+        sub_mounts, sub_shadow = collect(
+            sub_router,
+            sub_prefix,
+            prior,
+            has_middleware=has_middleware,
+            suppress_middleware_mounts=suppress_middleware_mounts,
+        )
         mounts.extend(sub_mounts)
         shadow_routes += sub_shadow
         shadow_routes.append(_subtree_shadow_route(sub_prefix, sub_mounts))
@@ -446,6 +465,9 @@ def collect(
     router: Router,
     prefix: str = "",
     prior: Precedence | None = None,
+    *,
+    has_middleware: bool,
+    suppress_middleware_mounts: bool,
 ) -> tuple[list[StaticMount], list[ShadowRoute]]:
     """Walk the route table for (static mounts to copy, shadow routes).
 
@@ -464,7 +486,11 @@ def collect(
         return frozenset(m) if m else None
 
     def collect_mount(mount_route: Mount) -> None:
-        sub_mounts, sub_shadow = _collect_mount(mount_route, prefix, prior)
+        sub_mounts, sub_shadow = _collect_mount(
+            mount_route, prefix, prior,
+            has_middleware=has_middleware,
+            suppress_middleware_mounts=suppress_middleware_mounts,
+        )
         mounts.extend(sub_mounts)
         shadow_routes.extend(sub_shadow)
 
@@ -500,7 +526,7 @@ def collect(
 
         # app.include_router() with a frontend build.
         for ctx in _effective_low_priority_routes(route):
-            if _frontend_has_dependencies(ctx):
+            if suppress_middleware_mounts and (_frontend_has_dependencies(ctx) or has_middleware):
                 continue
             for r in ctx.original_route.routes:
                 if m := StaticMount.from_route(
@@ -510,7 +536,7 @@ def collect(
 
     # app.frontend() builds.
     for group in _frontend_groups(router):
-        if _frontend_has_dependencies(group):
+        if suppress_middleware_mounts and (_frontend_has_dependencies(group) or has_middleware):
             continue
         for route in group.routes:
             if m := StaticMount.from_route(route, prefix, frontend=True):
@@ -586,7 +612,7 @@ def write_output(output_path: str, discovery: Output) -> None:
         json.dump(discovery.to_dict(), f)
 
 
-def discover(variable_name: str, project_root: str, module_name: str) -> Output:
+def discover(variable_name: str, project_root: str, module_name: str, suppress_middleware_mounts: bool) -> Output:
     """Import the entrypoint as its real module and walk its app's router.
 
     The project root is put on sys.path so importlib.import_module loads the
@@ -608,13 +634,21 @@ def discover(variable_name: str, project_root: str, module_name: str) -> Output:
     if router is None:
         return Output()
 
-    mounts, shadow_routes = collect(router)
+    # If the top-level app has middleware, no mounts can be promoted —
+    # CDN-served files would bypass the middleware stack entirely.
+    if suppress_middleware_mounts and getattr(app, "user_middleware", []):
+        return Output()
+
+    mounts, shadow_routes = collect(
+        router, has_middleware=False, suppress_middleware_mounts=suppress_middleware_mounts
+    )
     return Output(mounts=mounts, shadowRoutes=shadow_routes)
 
 
 def main() -> None:
     variable_name, output_path, project_root, module_name = sys.argv[1:5]
-    write_output(output_path, discover(variable_name, project_root, module_name))
+    suppress_middleware_mounts = sys.argv[5] != "0"
+    write_output(output_path, discover(variable_name, project_root, module_name, suppress_middleware_mounts))
 
 
 if __name__ == "__main__":