create-caspian-app 0.2.0-beta.97 → 0.2.0-beta.99

package/dist/.github/copilot-instructions.md

@@ -37,6 +37,7 @@
 - In app-owned starter config like this workspace, routes start public because `src/lib/auth/auth_config.py` sets `is_all_routes_private=False` by default.
 - Decide route privacy in `src/lib/auth/auth_config.py` at app setup time: use `is_all_routes_private=True` when only a few routes should stay public, otherwise keep `is_all_routes_private=False` and list the protected routes in `private_routes`.
 - In all-private mode, keep public exceptions in `public_routes`; the runtime defaults keep `/` public and keep `auth_routes=["/signin", "/signup"]` public.
+- When building or editing sign-in flows, do not implement app-owned `next` parsing or redirect selection inside the sign-in page or sign-in action unless the user explicitly asks to replace Caspian auth behavior. Guest redirects to `/signin?next=...`, authenticated auth-route redirects, and the default post-login destination are already owned by the Caspian runtime plus `src/lib/auth/auth_config.py`, which defaults `default_signin_redirect` to `/dashboard`.
 - Do not treat `token_auto_refresh` as the switch that makes routes private. In the current app it only affects sliding-session refresh if `auth.refresh_session()` is called.
 - Use PulsePoint as the default reactive frontend layer unless the user requests another stack.
 - When `caspian.config.json` has `tailwindcss: true`, treat Python `merge_classes(...)` plus browser `twMerge(...)` as the only Tailwind class-merging contract: `merge_classes(...)` emits frontend-ready `{twMerge(...)}` expressions, and authored PulsePoint attribute expressions or scripts may call global `twMerge(...)` directly.

package/dist/AGENTS.md

@@ -68,6 +68,7 @@ Use `.github/copilot-instructions.md` for the repo-wide implementation rules. Th
 - For grouped-subtree SPA navigation UX, the current browser runtime keeps unmarked shell scrollers stable and uses `pp-reset-scroll="true"` on the content pane that should reset. Check `pulsepoint.md`, `routing.md`, and `public/js/pp-reactive-v2.js` before changing that behavior.
 - Before updating docs, verify runtime-specific claims such as middleware order, route param injection, `layout()` behavior, `StateManager` persistence, safe public-file serving, response header, or session-secret behavior against the current `main.py` and installed `casp` package, especially `.venv/Lib/site-packages/casp/runtime_security.py`, rather than copying older notes.
 - When generating or reviewing `src/app/**/index.html`, `src/app/**/layout.html`, or component HTML templates, treat the single-root rule as a hard requirement: exactly one authored top-level parent element or one imported `x-*` root, with any owned `<script>` kept inside that same root. Do not allow sibling top-level tags, sibling scripts, or stray top-level text, because Caspian injects `pp-component` on that final root and errors if it cannot.
+- When generating or reviewing sign-in flows, do not ask the sign-in page to decide redirect targets by re-implementing `next` support or post-login routing. In this stack, redirect behavior is already owned by the Caspian auth runtime plus `src/lib/auth/auth_config.py`; protected-route guest redirects, auth-route redirects, and the default destination are centralized there, with `default_signin_redirect` defaulting to `/dashboard`.
 
 ## Task Routing
 

package/dist/app-gitignore

@@ -28,5 +28,4 @@ Thumbs.db # Windows
 .casp/
 caches/
 settings/bs-config.json
-settings/prisma-schema.json
-/src/generated/prisma
+settings/prisma-schema.json

package/dist/main.py

@@ -1,11 +1,13 @@
 from casp.components_compiler import transform_components
 from casp.scripts_type import transform_scripts
+import asyncio
 import inspect
 import os
 import importlib.util
 import secrets
 import traceback
 import json
+import time
 from pathlib import Path
 from fastapi import FastAPI, Request, Response
 from fastapi.responses import RedirectResponse, FileResponse, HTMLResponse
@@ -81,6 +83,10 @@ MAX_CONTENT_LENGTH_MB = int(os.getenv('MAX_CONTENT_LENGTH_MB', 16))
 IS_PRODUCTION = os.getenv('APP_ENV') == 'production'
 CACHE_ENABLED = os.getenv('CACHE_ENABLED', 'false').lower() == 'true'
 DEFAULT_TTL = int(os.getenv('CACHE_TTL', 600))
+REQUEST_TIMEOUT_SECONDS = max(
+    1.0,
+    float(os.getenv('CASPIAN_REQUEST_TIMEOUT_SECONDS', 20)),
+)
 
 
 def _client_error_message(exc: Exception) -> str:
@@ -299,6 +305,57 @@ class RPCMiddleware:
             return
         await self.app(scope, receive, send)
 
+
+class RequestDiagnosticsMiddleware:
+    """Log request start/end in dev and fail visibly when a route stalls."""
+
+    def __init__(self, app: ASGIApp): self.app = app
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send):
+        if scope["type"] != "http":
+            await self.app(scope, receive, send)
+            return
+
+        method = scope.get("method", "GET")
+        path = scope.get("path", "")
+        should_log = not path.startswith(('/css/', '/js/', '/assets/', '/favicon.ico'))
+        started = time.perf_counter()
+
+        if should_log and not IS_PRODUCTION:
+            print(f"[request:start] {method} {path}", flush=True)
+
+        try:
+            await asyncio.wait_for(
+                self.app(scope, receive, send),
+                timeout=REQUEST_TIMEOUT_SECONDS,
+            )
+        except asyncio.TimeoutError:
+            elapsed_ms = int((time.perf_counter() - started) * 1000)
+            print(
+                f"[request:timeout] {method} {path} exceeded "
+                f"{REQUEST_TIMEOUT_SECONDS:g}s after {elapsed_ms}ms",
+                flush=True,
+            )
+            response = HTMLResponse(
+                content=(
+                    "<h1>504 - Request Timeout</h1>"
+                    "<p>The route took too long to respond. "
+                    "Check the development terminal for the stalled path.</p>"
+                ),
+                status_code=504,
+            )
+            await response(scope, receive, send)
+            return
+        except Exception:
+            if should_log and not IS_PRODUCTION:
+                elapsed_ms = int((time.perf_counter() - started) * 1000)
+                print(f"[request:error] {method} {path} after {elapsed_ms}ms", flush=True)
+            raise
+        finally:
+            if should_log and not IS_PRODUCTION:
+                elapsed_ms = int((time.perf_counter() - started) * 1000)
+                print(f"[request:end] {method} {path} {elapsed_ms}ms", flush=True)
+
 # ====
 # Route Registration
 # ====
@@ -659,6 +716,7 @@ app.add_middleware(
     path='/',
 )
 app.add_middleware(SecurityHeadersMiddleware)
+app.add_middleware(RequestDiagnosticsMiddleware)
 
 if __name__ == '__main__':
     port = int(os.getenv('PORT', 5091))