create-caspian-app 0.3.0-rc.2 → 0.3.0-rc.21

package/dist/main.py

@@ -87,6 +87,11 @@ REQUEST_TIMEOUT_SECONDS = max(
     1.0,
     float(os.getenv('CASPIAN_REQUEST_TIMEOUT_SECONDS', 20)),
 )
+MAX_CONTENT_LENGTH_BYTES = max(1, MAX_CONTENT_LENGTH_MB) * 1024 * 1024
+
+
+class RequestBodyTooLarge(Exception):
+    pass
 
 
 def _client_error_message(exc: Exception) -> str:
@@ -228,6 +233,67 @@ class SecurityHeadersMiddleware:
         await self.app(scope, receive, send_wrapper)
 
 
+class BodySizeLimitMiddleware:
+    """Reject oversized HTTP request bodies before route or RPC parsing."""
+
+    def __init__(self, app: ASGIApp): self.app = app
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send):
+        if scope["type"] != "http":
+            await self.app(scope, receive, send)
+            return
+
+        headers = MutableHeaders(scope=scope)
+        content_length = headers.get("content-length")
+        if content_length:
+            try:
+                if int(content_length) > MAX_CONTENT_LENGTH_BYTES:
+                    await self._send_too_large(send)
+                    return
+            except ValueError:
+                pass
+
+        received = 0
+        response_started = False
+
+        async def limited_receive():
+            nonlocal received
+            message = await receive()
+            if message["type"] == "http.request":
+                received += len(message.get("body", b""))
+                if received > MAX_CONTENT_LENGTH_BYTES:
+                    raise RequestBodyTooLarge()
+            return message
+
+        async def send_wrapper(message):
+            nonlocal response_started
+            if message["type"] == "http.response.start":
+                response_started = True
+            await send(message)
+
+        try:
+            await self.app(scope, limited_receive, send_wrapper)
+        except RequestBodyTooLarge:
+            if not response_started:
+                await self._send_too_large(send)
+
+    async def _send_too_large(self, send: Send):
+        response = Response(
+            content="Request body too large.",
+            status_code=413,
+            media_type="text/plain",
+        )
+
+        async def receive_empty_body():
+            return {"type": "http.request", "body": b"", "more_body": False}
+
+        await response(
+            {"type": "http", "method": "POST", "path": "/", "headers": []},
+            receive=receive_empty_body,
+            send=send,
+        )
+
+
 class AuthMiddleware:
     """Auth middleware using pure ASGI pattern for proper session handling."""
 
@@ -318,7 +384,8 @@ class RequestDiagnosticsMiddleware:
 
         method = scope.get("method", "GET")
         path = scope.get("path", "")
-        should_log = not path.startswith(('/css/', '/js/', '/assets/', '/favicon.ico'))
+        should_log = not path.startswith(
+            ('/css/', '/js/', '/assets/', '/favicon.ico'))
         started = time.perf_counter()
 
         if should_log and not IS_PRODUCTION:
@@ -349,12 +416,14 @@ class RequestDiagnosticsMiddleware:
         except Exception:
             if should_log and not IS_PRODUCTION:
                 elapsed_ms = int((time.perf_counter() - started) * 1000)
-                print(f"[request:error] {method} {path} after {elapsed_ms}ms", flush=True)
+                print(
+                    f"[request:error] {method} {path} after {elapsed_ms}ms", flush=True)
             raise
         finally:
             if should_log and not IS_PRODUCTION:
                 elapsed_ms = int((time.perf_counter() - started) * 1000)
-                print(f"[request:end] {method} {path} {elapsed_ms}ms", flush=True)
+                print(
+                    f"[request:end] {method} {path} {elapsed_ms}ms", flush=True)
 
 # ====
 # Route Registration
@@ -674,7 +743,8 @@ async def custom_general_exception_handler(request: Request, exc: Exception):
         context_data = {'request': request,
                         'error_message': error_message, 'error_trace': error_trace}
         try:
-            rendered_content = compile_template(raw_content).render(**context_data)
+            rendered_content = compile_template(
+                raw_content).render(**context_data)
             html_output, root_layout_id = await render_with_nested_layouts(
                 children=rendered_content,
                 route_dir='src/app',
@@ -714,9 +784,19 @@ app.add_middleware(
     https_only=IS_PRODUCTION,
     path='/',
 )
+app.add_middleware(BodySizeLimitMiddleware)
 app.add_middleware(SecurityHeadersMiddleware)
-app.add_middleware(RequestDiagnosticsMiddleware)
+
+if not IS_PRODUCTION:
+    app.add_middleware(RequestDiagnosticsMiddleware)
 
 if __name__ == '__main__':
     port = int(os.getenv('PORT', 5091))
-    uvicorn.run("main:app", host="0.0.0.0", port=port, reload=False)
+    workers = max(1, int(os.getenv('UVICORN_WORKERS', '1')))
+    uvicorn.run(
+        "main:app",
+        host="0.0.0.0",
+        port=port,
+        reload=False,
+        workers=workers,
+    )