create-caspian-app 1.3.19 → 1.3.20

package/dist/main.py

@@ -27,6 +27,7 @@ from fastapi.responses import (
     RedirectResponse,
     HTMLResponse,
     JSONResponse,
+    PlainTextResponse,
 )
 from starlette.datastructures import MutableHeaders
 from starlette.middleware import Middleware
@@ -472,6 +473,54 @@ class SecurityHeadersMiddleware:
         await self.app(scope, receive, send_wrapper)
 
 
+# Top-level directories under `public/` are asset namespaces, not page routes:
+# `public/js/**` owns `/js/**` and nothing in `src/app/` can answer there. Built
+# once, like SECURITY_HEADERS -- adding a new asset *directory* is a restart-level
+# change, unlike adding a file to an existing one, which stays live.
+PUBLIC_ASSET_NAMESPACES: frozenset[str] = (
+    frozenset(entry.name.casefold() for entry in Path("public").iterdir() if entry.is_dir())
+    if Path("public").is_dir()
+    else frozenset()
+)
+
+
+class MissingPublicAssetMiddleware:
+    """404 a missing file in a public asset namespace instead of falling through.
+
+    `PublicFilesMiddleware` deliberately falls through when no file matches, so
+    normal routing keeps working. With `is_all_routes_private=True` that means a
+    missing asset reaches `AuthMiddleware` and answers `303 -> /signin`, which is
+    the wrong answer twice over: a `<script src="/js/typo.js">` then receives the
+    sign-in *page* as `200 text/html` and fails with a parse error that names the
+    wrong file, and every bogus asset path returns a full HTML page to anonymous
+    traffic. A path whose first segment is a real `public/` directory can only be
+    an asset request, so a miss there is a genuine 404.
+
+    Runs inside the rate limiter -- a 404 flood is still a flood -- but outside
+    sessions, CSRF, and auth, so a missing asset costs no session decryption.
+    """
+
+    def __init__(self, app: ASGIApp):
+        self.app = app
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send):
+        if scope["type"] != "http" or scope.get("method", "GET").upper() not in {
+            "GET",
+            "HEAD",
+        }:
+            await self.app(scope, receive, send)
+            return
+
+        segment = str(scope.get("path", "")).lstrip("/").split("/", 1)[0].casefold()
+        if segment not in PUBLIC_ASSET_NAMESPACES:
+            await self.app(scope, receive, send)
+            return
+
+        # PublicFilesMiddleware sits outside this one, so reaching here means it
+        # already declined: the file does not exist or escapes the public root.
+        await PlainTextResponse("Not Found", status_code=404)(scope, receive, send)
+
+
 class BodySizeLimitMiddleware:
     """Reject oversized HTTP request bodies before route or RPC parsing."""
 
@@ -1534,6 +1583,9 @@ app.add_middleware(
     path="/",
 )
 app.add_middleware(BodySizeLimitMiddleware)
+# Sits between the limiter and the session/auth layers: a miss under a public
+# asset namespace is a 404, not a sign-in redirect, and costs no session work.
+app.add_middleware(MissingPublicAssetMiddleware)
 # Outermost of the security layers: reject flooding before any session
 # decryption, template rendering, or database work is spent on the request.
 app.add_middleware(RateLimitMiddleware)

package/dist/settings/check_templates.py

@@ -90,7 +90,17 @@ RULES: list[Rule] = [
     Rule(
         "unquoted-brace-attr",
         # `class={...}` / `selected={...}` -- invalid HTML, silently blanks the page.
-        re.compile(r"\s[\w:.\-]+=\{"),
+        #
+        # An attribute only exists *inside an opening tag*, and the rule must say
+        # so. A bare `\s[\w:.\-]+=\{` also matches `DIR={path}` in a shell script
+        # and `ENV PORT={port}` in a Dockerfile -- and this repo embeds both in
+        # triple-quoted strings under `src/lib/aws/`, which the Python scan keeps
+        # because it cannot tell a heredoc from a template. Requiring the opening
+        # tag is not a loosening: a real violation is always inside one.
+        #
+        # `[^<>]*?` bounds the attribute run to a single tag; it matches newlines
+        # (negated classes do), so an attribute on its own line is still caught.
+        re.compile(r"<[a-zA-Z][\w:.\-]*(?:[^<>]*?)?\s[\w:.\-]+=\{"),
         "Unquoted brace attribute. This is invalid HTML: the parser splits the "
         "value on spaces, the component root never compiles, and the page "
         'renders blank with no console error. Quote it: attr="{expr}".',
@@ -116,7 +126,12 @@ RULES: list[Rule] = [
     ),
     Rule(
         "jsx-fragment",
-        re.compile(r"<>|</>"),
+        # `</>` is unambiguous, and a well-formed fragment always has one. A bare
+        # `<>` is not: it is SQL's not-equals operator, and this repo runs
+        # `WHERE pid <> pg_backend_pid()` from a triple-quoted string. So the
+        # open tag counts only when an element follows it, which is what a
+        # fragment looks like and what `<> value` in SQL never does.
+        re.compile(r"</>|<>\s*<"),
         "JSX fragment. A template needs exactly one real root element.",
     ),
     Rule(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-caspian-app",
-  "version": "1.3.19",
+  "version": "1.3.20",
   "description": "Scaffold a new Caspian project (FastAPI-powered reactive Python framework).",
   "main": "dist/index.js",
   "type": "module",