auditry 0.2.0__tar.gz → 0.2.2__tar.gz

{auditry-0.2.0/src/auditry.egg-info → auditry-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: auditry
-Version: 0.2.0
+Version: 0.2.2
 Summary: Observability middleware for FastAPI and Quart with request/response logging, correlation IDs, and sensitive data redaction
 Author-email: Liv Stark <livstark.work@gmail.com>
 License: MIT
@@ -133,11 +133,13 @@ config = ObservabilityConfig(
 )
 ```
 
+**Note:** The `service_name` is required and must be provided. This ensures all services have meaningful names in logs rather than generic defaults.
+
 ### Full Configuration Options
 
 ```python
 config = ObservabilityConfig(
-    # REQUIRED: Service name for log filtering
+    # REQUIRED: Service name for log filtering (no default)
     service_name="my-service-name",
 
     # Correlation ID header name (default: X-Correlation-ID)
@@ -158,6 +160,14 @@ config = ObservabilityConfig(
 
     # Whether to log query parameters (default: True)
     log_query_params=True,
+
+    # Whether to log request bodies for all endpoints (default: True)
+    # Set to False for applications handling sensitive data
+    log_request_body=True,
+
+    # Whether to log response bodies for all endpoints (default: True)
+    # Set to False for applications returning sensitive data
+    log_response_body=True,
 )
 
 # For FastAPI:
@@ -355,9 +365,11 @@ All logs are structured JSON, ready for log aggregators:
 }
 ```
 
-## Sensitive Data Redaction
+## Sensitive Data Handling
+
+### Automatic Redaction
 
-Automatically redacts these sensitive field patterns:
+Automatically redacts these sensitive field patterns in all logged requests/responses:
 
 - `password`
 - `token`
@@ -376,6 +388,24 @@ config = ObservabilityConfig(
     additional_redaction_patterns=["internal_token", "employee_id"],
 )
 ```
+
+### Disabling Body Logging (Application-Wide)
+
+For applications handling sensitive data, you can disable logging of request and/or response bodies across the entire application:
+
+```python
+config = ObservabilityConfig(
+    service_name="my-service-name",
+
+    # Disable request body logging for all endpoints
+    log_request_body=False,
+
+    # Disable response body logging for all endpoints
+    log_response_body=False,
+)
+```
+
+When body logging is disabled, logs will show `[BODY_LOGGING_DISABLED]` instead of the actual content, while still logging metadata like headers, status codes, and timing information.
 ## Best Practices
 
 ### 1. Configure Logging Early

{auditry-0.2.0 → auditry-0.2.2}/README.md

@@ -90,11 +90,13 @@ config = ObservabilityConfig(
 )
 ```
 
+**Note:** The `service_name` is required and must be provided. This ensures all services have meaningful names in logs rather than generic defaults.
+
 ### Full Configuration Options
 
 ```python
 config = ObservabilityConfig(
-    # REQUIRED: Service name for log filtering
+    # REQUIRED: Service name for log filtering (no default)
     service_name="my-service-name",
 
     # Correlation ID header name (default: X-Correlation-ID)
@@ -115,6 +117,14 @@ config = ObservabilityConfig(
 
     # Whether to log query parameters (default: True)
     log_query_params=True,
+
+    # Whether to log request bodies for all endpoints (default: True)
+    # Set to False for applications handling sensitive data
+    log_request_body=True,
+
+    # Whether to log response bodies for all endpoints (default: True)
+    # Set to False for applications returning sensitive data
+    log_response_body=True,
 )
 
 # For FastAPI:
@@ -312,9 +322,11 @@ All logs are structured JSON, ready for log aggregators:
 }
 ```
 
-## Sensitive Data Redaction
+## Sensitive Data Handling
+
+### Automatic Redaction
 
-Automatically redacts these sensitive field patterns:
+Automatically redacts these sensitive field patterns in all logged requests/responses:
 
 - `password`
 - `token`
@@ -333,6 +345,24 @@ config = ObservabilityConfig(
     additional_redaction_patterns=["internal_token", "employee_id"],
 )
 ```
+
+### Disabling Body Logging (Application-Wide)
+
+For applications handling sensitive data, you can disable logging of request and/or response bodies across the entire application:
+
+```python
+config = ObservabilityConfig(
+    service_name="my-service-name",
+
+    # Disable request body logging for all endpoints
+    log_request_body=False,
+
+    # Disable response body logging for all endpoints
+    log_response_body=False,
+)
+```
+
+When body logging is disabled, logs will show `[BODY_LOGGING_DISABLED]` instead of the actual content, while still logging metadata like headers, status codes, and timing information.
 ## Best Practices
 
 ### 1. Configure Logging Early

{auditry-0.2.0 → auditry-0.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "auditry"
-version = "0.2.0"
+version = "0.2.2"
 description = "Observability middleware for FastAPI and Quart with request/response logging, correlation IDs, and sensitive data redaction"
 authors = [
     {name = "Liv Stark", email = "livstark.work@gmail.com"}
@@ -23,14 +23,12 @@ classifiers = [
     "Topic :: System :: Logging",
 ]
 
-# Core dependencies needed for all functionality
 dependencies = [
     "pydantic>=2.0.0",
     "structlog>=23.0.0",
     "asgi-correlation-id>=4.0.0",
 ]
 
-# Optional dependencies for specific frameworks
 [project.optional-dependencies]
 fastapi = [
     "fastapi>=0.100.0",

{auditry-0.2.0 → auditry-0.2.2}/src/auditry/__init__.py

@@ -31,7 +31,7 @@ from .logging_config import configure_logging, get_logger
 from .correlation import get_correlation_id
 from .models import ObservabilityConfig, BusinessEventConfig
 
-__version__ = "0.2.0"
+__version__ = "0.2.2"
 
 __all__ = [
     # Configuration

{auditry-0.2.0 → auditry-0.2.2}/src/auditry/core/logger.py

@@ -81,9 +81,11 @@ class RequestResponseLogger:
         if raw_data.get("path_params"):
             prepared["path_params"] = raw_data["path_params"]
 
-        # Parse and redact body
-        if raw_data.get("body"):
+        # Parse and redact body (only if configured to log request body)
+        if self.config.log_request_body and raw_data.get("body"):
             prepared["body"] = self._parse_and_redact_body(raw_data["body"])
+        elif raw_data.get("body") and not self.config.log_request_body:
+            prepared["body"] = "[BODY_LOGGING_DISABLED]"
 
         return prepared
 
@@ -110,9 +112,11 @@ class RequestResponseLogger:
         if self.config.log_response_headers and raw_data.get("headers"):
             prepared["headers"] = redact_headers(raw_data["headers"])
 
-        # Parse and redact body
-        if raw_data.get("body"):
+        # Parse and redact body (only if configured to log response body)
+        if self.config.log_response_body and raw_data.get("body"):
             prepared["body"] = self._parse_and_redact_body(raw_data["body"])
+        elif raw_data.get("body") and not self.config.log_response_body:
+            prepared["body"] = "[BODY_LOGGING_DISABLED]"
 
         return prepared
 

{auditry-0.2.0 → auditry-0.2.2}/src/auditry/fastapi/adapters.py

@@ -5,7 +5,8 @@ These adapters implement the abstract base classes to extract data from
 FastAPI/Starlette request and response objects.
 """
 
-from typing import Any, Dict, Optional
+import inspect
+from typing import Dict, Optional
 
 from fastapi import Request, Response
 from starlette.responses import StreamingResponse
@@ -104,8 +105,14 @@ class FastAPIResponseAdapter(BaseResponseAdapter):
         if isinstance(response, StreamingResponse):
             return None
 
+        # Check if response has a body_iterator (generator/async generator)
+        if hasattr(response, "body_iterator"):
+            # Check if it's a generator or async generator
+            if inspect.isasyncgen(response.body_iterator) or inspect.isgenerator(response.body_iterator):
+                return None
+
         # Get body if available
         if hasattr(response, "body"):
             return response.body
 
-        return None
+        return None

{auditry-0.2.0 → auditry-0.2.2}/src/auditry/models.py

@@ -68,4 +68,12 @@ class ObservabilityConfig(BaseModel):
     log_response_headers: bool = Field(
         default=False, description="Whether to log response headers (redacted)"
     )
-    log_query_params: bool = Field(default=True, description="Whether to log query parameters")
+    log_query_params: bool = Field(default=True, description="Whether to log query parameters")
+    log_request_body: bool = Field(
+        default=True,
+        description="Whether to log request bodies for the application"
+    )
+    log_response_body: bool = Field(
+        default=True,
+        description="Whether to log response bodies for the application"
+    )

{auditry-0.2.0 → auditry-0.2.2}/src/auditry/quart/adapters.py

@@ -5,7 +5,7 @@ These adapters implement the abstract base classes to extract data from
 Quart request and response objects.
 """
 
-from typing import Any, Dict, Optional
+import inspect
 import json
 
 from quart import Request, Response, g
@@ -133,17 +133,44 @@ class QuartResponseAdapter(BaseResponseAdapter):
         """
         Extract body from Quart response.
 
+        Returns None for streaming responses to avoid consuming the stream.
         Handles both Response objects and tuple returns.
         """
         try:
             # For Response objects
+            if hasattr(response, "response"):
+                # Check if the response is an async generator (streaming)
+                if inspect.isasyncgen(response.response):
+                    # This is a streaming response, return None to avoid consuming it
+                    return None
+
+                # Check if it's a regular generator (also streaming)
+                if inspect.isgenerator(response.response):
+                    return None
+
+            # For Response objects with get_data method (non-streaming)
             if hasattr(response, "get_data"):
-                return await response.get_data()
+                # Only call get_data if we're sure it's not streaming
+                # Double-check for streaming response attribute
+                if hasattr(response, "response"):
+                    resp_attr = response.response
+                    if inspect.isasyncgen(resp_attr) or inspect.isgenerator(resp_attr):
+                        return None
+
+                # Safe to get data for non-streaming responses
+                data = await response.get_data()
+                if isinstance(data, str):
+                    return data.encode("utf-8")
+                return data
 
             # For tuple responses (body, status_code, headers)
             if isinstance(response, tuple) and len(response) >= 1:
                 body = response[0]
 
+                # Check if body is a generator (streaming)
+                if inspect.isasyncgen(body) or inspect.isgenerator(body):
+                    return None
+
                 # Convert various body types to bytes
                 if isinstance(body, bytes):
                     return body
@@ -154,4 +181,4 @@ class QuartResponseAdapter(BaseResponseAdapter):
 
             return None
         except Exception:
-            return None
+            return None

{auditry-0.2.0 → auditry-0.2.2}/src/auditry/quart/middleware.py

@@ -89,6 +89,41 @@ class QuartMiddleware(BaseMiddleware):
             if not hasattr(request, "observability_start_time"):
                 return response
 
+            # Check if this is a streaming response - if so, handle it separately
+            if hasattr(response, "response"):
+                if inspect.isasyncgen(response.response) or inspect.isgenerator(response.response):
+                    # For streaming responses, log without consuming the stream
+                    duration_ms = (time.time() - request.observability_start_time) * 1000
+
+                    # Get stored correlation ID from before_request
+                    correlation_id = getattr(request, "observability_correlation_id", None)
+                    request_data = getattr(request, "observability_request_data", {})
+
+                    # Re-extract user_id (might have been set during request processing)
+                    user_id = await self.request_adapter.extract_user_id(request)
+
+                    # Log with minimal response data (no body for streaming)
+                    self.logger.log_success(
+                        request_data=request_data,
+                        response_data={
+                            "status_code": response.status_code if hasattr(response, "status_code") else 200,
+                            "headers": dict(response.headers) if hasattr(response, "headers") else {},
+                            "body": None  # Don't try to extract body for streaming
+                        },
+                        duration_ms=duration_ms,
+                        correlation_id=correlation_id,
+                        user_id=user_id,
+                    )
+
+                    # Add correlation ID to response headers (same as non-streaming)
+                    if correlation_id:
+                        response.headers[self.config.correlation_id_header] = correlation_id
+
+                    # Clear cache and return immediately
+                    self.request_adapter.clear_cache(request)
+                    return response
+
+            # Non-streaming response handling
             # Calculate duration
             duration_ms = (time.time() - request.observability_start_time) * 1000
 

{auditry-0.2.0 → auditry-0.2.2/src/auditry.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: auditry
-Version: 0.2.0
+Version: 0.2.2
 Summary: Observability middleware for FastAPI and Quart with request/response logging, correlation IDs, and sensitive data redaction
 Author-email: Liv Stark <livstark.work@gmail.com>
 License: MIT
@@ -133,11 +133,13 @@ config = ObservabilityConfig(
 )
 ```
 
+**Note:** The `service_name` is required and must be provided. This ensures all services have meaningful names in logs rather than generic defaults.
+
 ### Full Configuration Options
 
 ```python
 config = ObservabilityConfig(
-    # REQUIRED: Service name for log filtering
+    # REQUIRED: Service name for log filtering (no default)
     service_name="my-service-name",
 
     # Correlation ID header name (default: X-Correlation-ID)
@@ -158,6 +160,14 @@ config = ObservabilityConfig(
 
     # Whether to log query parameters (default: True)
     log_query_params=True,
+
+    # Whether to log request bodies for all endpoints (default: True)
+    # Set to False for applications handling sensitive data
+    log_request_body=True,
+
+    # Whether to log response bodies for all endpoints (default: True)
+    # Set to False for applications returning sensitive data
+    log_response_body=True,
 )
 
 # For FastAPI:
@@ -355,9 +365,11 @@ All logs are structured JSON, ready for log aggregators:
 }
 ```
 
-## Sensitive Data Redaction
+## Sensitive Data Handling
+
+### Automatic Redaction
 
-Automatically redacts these sensitive field patterns:
+Automatically redacts these sensitive field patterns in all logged requests/responses:
 
 - `password`
 - `token`
@@ -376,6 +388,24 @@ config = ObservabilityConfig(
     additional_redaction_patterns=["internal_token", "employee_id"],
 )
 ```
+
+### Disabling Body Logging (Application-Wide)
+
+For applications handling sensitive data, you can disable logging of request and/or response bodies across the entire application:
+
+```python
+config = ObservabilityConfig(
+    service_name="my-service-name",
+
+    # Disable request body logging for all endpoints
+    log_request_body=False,
+
+    # Disable response body logging for all endpoints
+    log_response_body=False,
+)
+```
+
+When body logging is disabled, logs will show `[BODY_LOGGING_DISABLED]` instead of the actual content, while still logging metadata like headers, status codes, and timing information.
 ## Best Practices
 
 ### 1. Configure Logging Early

{auditry-0.2.0 → auditry-0.2.2}/src/auditry.egg-info/SOURCES.txt

@@ -22,6 +22,7 @@ src/auditry/fastapi/middleware.py
 src/auditry/quart/__init__.py
 src/auditry/quart/adapters.py
 src/auditry/quart/middleware.py
+tests/test_body_logging.py
 tests/test_correlation.py
 tests/test_fastapi_middleware.py
 tests/test_quart_middleware.py

auditry-0.2.2/tests/test_body_logging.py

@@ -0,0 +1,166 @@
+"""Tests for request/response body logging configuration."""
+import pytest
+from fastapi import FastAPI, Request
+from fastapi.testclient import TestClient
+from quart import Quart
+
+from auditry import ObservabilityConfig, configure_logging
+from auditry.fastapi import create_middleware
+from auditry.quart import create_middleware as create_quart_middleware
+
+
+configure_logging(level="INFO")
+
+
+def test_fastapi_disable_request_body_logging():
+    """Test that request body logging can be disabled in FastAPI."""
+    app = FastAPI()
+    app = create_middleware(
+        app,
+        config=ObservabilityConfig(
+            service_name="test-service",
+            log_request_body=False,  # Disable request body logging
+            log_response_body=True,
+        )
+    )
+
+    @app.post("/users")
+    def create_user():
+        return {"id": "123", "status": "created"}
+
+    client = TestClient(app)
+    response = client.post(
+        "/users",
+        json={"name": "Test User", "password": "secret123", "ssn": "123-45-6789"}
+    )
+    assert response.status_code == 200
+    # Body should not be logged, but response should be
+
+
+def test_fastapi_disable_response_body_logging():
+    """Test that response body logging can be disabled in FastAPI."""
+    app = FastAPI()
+    app = create_middleware(
+        app,
+        config=ObservabilityConfig(
+            service_name="test-service",
+            log_request_body=True,
+            log_response_body=False,  # Disable response body logging
+        )
+    )
+
+    @app.post("/users")
+    def create_user():
+        return {
+            "id": "123",
+            "name": "Test User",
+            "ssn": "123-45-6789",  # Sensitive data in response
+            "api_key": "secret-key"
+        }
+
+    client = TestClient(app)
+    response = client.post(
+        "/users",
+        json={"name": "Test User"}
+    )
+    assert response.status_code == 200
+    # Request body should be logged, but response body should not be
+
+
+def test_fastapi_disable_both_body_logging():
+    """Test that both request and response body logging can be disabled."""
+    app = FastAPI()
+    app = create_middleware(
+        app,
+        config=ObservabilityConfig(
+            service_name="test-service",
+            log_request_body=False,
+            log_response_body=False,
+        )
+    )
+
+    @app.post("/sensitive")
+    def sensitive_endpoint():
+        return {"secret": "data"}
+
+    client = TestClient(app)
+    response = client.post(
+        "/sensitive",
+        json={"password": "secret", "credit_card": "1234-5678-9012-3456"}
+    )
+    assert response.status_code == 200
+    # Neither request nor response bodies should be logged
+
+
+@pytest.mark.asyncio
+async def test_quart_disable_request_body_logging():
+    """Test that request body logging can be disabled in Quart."""
+    app = Quart(__name__)
+    app = create_quart_middleware(
+        app,
+        config=ObservabilityConfig(
+            service_name="test-quart-service",
+            log_request_body=False,  # Disable request body logging
+            log_response_body=True,
+        )
+    )
+
+    @app.route("/users", methods=["POST"])
+    async def create_user():
+        return {"id": "123", "status": "created"}
+
+    client = app.test_client()
+    response = await client.post(
+        "/users",
+        json={"name": "Test User", "password": "secret123", "ssn": "123-45-6789"}
+    )
+    assert response.status_code == 200
+
+
+@pytest.mark.asyncio
+async def test_quart_disable_response_body_logging():
+    """Test that response body logging can be disabled in Quart."""
+    app = Quart(__name__)
+    app = create_quart_middleware(
+        app,
+        config=ObservabilityConfig(
+            service_name="test-quart-service",
+            log_request_body=True,
+            log_response_body=False,  # Disable response body logging
+        )
+    )
+
+    @app.route("/users", methods=["POST"])
+    async def create_user():
+        return {
+            "id": "123",
+            "name": "Test User",
+            "ssn": "123-45-6789",  # Sensitive data in response
+            "api_key": "secret-key"
+        }
+
+    client = app.test_client()
+    response = await client.post(
+        "/users",
+        json={"name": "Test User"}
+    )
+    assert response.status_code == 200
+
+
+def test_service_name_required():
+    """Test that service_name is required and cannot be empty."""
+    # Should raise validation error without service_name
+    with pytest.raises(Exception):  # Pydantic ValidationError
+        ObservabilityConfig()
+
+    # Should raise validation error with empty service_name
+    with pytest.raises(Exception):  # Pydantic ValidationError
+        ObservabilityConfig(service_name="")
+
+    # Should raise validation error with whitespace-only service_name
+    with pytest.raises(Exception):  # Pydantic ValidationError
+        ObservabilityConfig(service_name="   ")
+
+    # Should work with valid service_name
+    config = ObservabilityConfig(service_name="valid-service")
+    assert config.service_name == "valid-service"