bitranox-template-py-cli 2.1.0__tar.gz → 2.1.2__tar.gz

{bitranox_template_py_cli-2.1.0 → bitranox_template_py_cli-2.1.2}/CHANGELOG.md

@@ -6,6 +6,43 @@ the [Keep a Changelog](https://keepachangelog.com/) format.
 
 ## [Unreleased]
 
+## [2.1.2] 2026-10-08 09:43:32
+
+### Changed
+- **A refused attachment exits 77, not 1 with a traceback (exit code change).** An attachment
+  btx_lib_mail's security checks refuse (a blocked extension such as `.exe`, a file under a
+  blocked directory, a symlink, a file over the size limit) made `send-email` exit 1 with
+  `Error: Unexpected error - Attachment security violation (...)` and log the refusal with a
+  traceback, as if the program had crashed. Since btx_lib_mail 4.0.0 every blocked extension is
+  refused on every platform, so this is an ordinary outcome on Linux and macOS too. It now exits
+  77 (`ExitCode.ATTACHMENT_REFUSED`, sysexits `EX_NOPERM`: not permitted by policy) with one
+  line, `Error: Attachment refused by security policy - <the library's reason>`, logs no
+  traceback, and delivers nothing. A script that checks for 1 after a refused attachment must
+  check for 77. With `email.attachments.raise_on_security_violation = false` the attachment is
+  still skipped with a warning and the message sent, as before; a violation that names no attachment
+  left to drop is refused in warn mode too, and now exits 77 where it exited 1.
+
+## [2.1.1] 2026-10-06 18:13:05
+
+### Fixed
+- **A refused `LOG_*` variable no longer disables every command (exit code change).** A value
+  lib_log_rich refuses in a `LOG_*` variable, set in the environment or in the `.env` logging
+  reads (`LOG_CONSOLE_LEVEL=bogus` in the `--env-file`), made every command, `info` and
+  `config-deploy` included, exit 1 with `InvalidLoggingConfigError: lib_log_rich: Unknown log
+  level: 'bogus'`: the fallback restarted logging with an empty configuration, but lib_log_rich
+  reads the `LOG_*` variables on every start and refused the same variable again. Logging now
+  falls back to its defaults with every `LOG_*` variable hidden for that start (and put back
+  afterwards), so only the commands that read the configuration (`config`, `send-email`,
+  `send-notification`) exit 78, and the others run with exit 0. The 78 carries lib_log_rich's
+  own message, `Error: lib_log_rich: Unknown log level: 'bogus'`, which may name neither the
+  variable nor where it was set. A refused `[lib_log_rich]` value still leaves every valid
+  `LOG_*` variable in force for the fallback, as in 2.1.0: only a refused variable hides them.
+- **The testing composition ignores the developer's `LOG_*` variables.** `build_testing()`'s
+  logging runtime (`init_logging_in_memory`) now starts with every `LOG_*` variable hidden and
+  puts them back afterwards. A `LOG_CONSOLE_LEVEL=bogus` in the shell running the tests made
+  every command under `build_testing()` fail with `ValueError: Unknown log level: 'bogus'`, and a
+  valid one changed the quiet test runtime. Production logging is unaffected.
+
 ## [2.1.0] 2026-10-06 15:37:27
 
 ### Added

{bitranox_template_py_cli-2.1.0 → bitranox_template_py_cli-2.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: bitranox_template_py_cli
-Version: 2.1.0
+Version: 2.1.2
 Summary: Template CLI application with configuration management and structured logging
 Project-URL: Homepage, https://github.com/bitranox/bitranox_template_py_cli
 Project-URL: Repository, https://github.com/bitranox/bitranox_template_py_cli.git
@@ -26,7 +26,7 @@ Requires-Dist: click>=8.5.0
 Requires-Dist: lib-cli-exit-tools>=2.4.0
 Requires-Dist: lib-layered-config>=7.0.1
 Requires-Dist: lib-log-rich>=6.3.9
-Requires-Dist: orjson>=3.12.0
+Requires-Dist: orjson>=3.13.0
 Requires-Dist: pydantic>=2.13.5
 Requires-Dist: python-dotenv>=1.2.4
 Requires-Dist: rich-click>=1.9.9

{bitranox_template_py_cli-2.1.0 → bitranox_template_py_cli-2.1.2}/docs/systemdesign/module_reference.md

@@ -26,7 +26,7 @@ moves or removes a module, a CLI option or a public name.
 - `src/bitranox_template_py_cli/adapters/email/transport.py`  -  `send_email` / `send_notification` over btx_lib_mail
 - `src/bitranox_template_py_cli/adapters/email/sender.py`  -  Re-exports of `config.py` and `transport.py`
 - `src/bitranox_template_py_cli/adapters/email/validation.py`  -  Email recipient validation
-- `src/bitranox_template_py_cli/adapters/logging/setup.py`  -  lib_log_rich initialization
+- `src/bitranox_template_py_cli/adapters/logging/setup.py`  -  lib_log_rich initialization; takes only the `LOG_*` lines of a `.env`, and raises `InvalidLoggingConfigError` for a refused `[lib_log_rich]` value or `LOG_*` variable, after starting logging with its defaults (and without the `LOG_*` variables only when one of them is refused)
 - `src/bitranox_template_py_cli/adapters/cli/`  -  CLI adapter package:
   - `__init__.py`  -  Public facade
   - `constants.py`  -  Shared constants
@@ -70,6 +70,7 @@ moves or removes a module, a CLI option or a public name.
 - `tests/conftest.py`  -  Shared fixtures (see Test Fixtures below)
 - `tests/test_behaviors.py`  -  Domain function tests
 - `tests/test_cache_effectiveness.py`  -  Configuration loading returns consistent (cached) results
+- `tests/test_cli_attachment_refused.py`  -  An attachment btx_lib_mail's security checks refuse exits 77 with one `Error:` line, nothing delivered
 - `tests/test_cli_config.py`  -  `config`, `config-deploy`, `config-generate-examples` commands
 - `tests/test_cli_config_errors.py`  -  A configuration that cannot be loaded: who reports it, and who still runs
 - `tests/test_cli_core.py`  -  Traceback, main entry, help, hello, fail, info, unknown command
@@ -92,6 +93,7 @@ moves or removes a module, a CLI option or a public name.
 - `tests/test_enums.py`  -  Domain enum tests
 - `tests/test_errors.py`  -  Domain error types
 - `tests/test_logging.py`  -  Logging configuration model
+- `tests/test_logging_dotenv_isolation.py`  -  Only `LOG_*` lines of a `.env` reach the environment; an invalid `[lib_log_rich]` section or `LOG_*` variable is a configuration failure that leaves logging running
 - `tests/test_mail.py`  -  Email configuration and sending tests (the `integration` ones send real mail)
 - `tests/test_memory_logging.py`  -  Testing-composition logging runtime and the per-test logging reset
 - `tests/test_metadata.py`  -  Package metadata and PEP 561 marker tests
@@ -135,19 +137,20 @@ Run `lint-imports` to verify compliance.
 
 POSIX-conventional exit codes defined in `adapters/cli/exit_codes.py`:
 
-| Code | Name                | Usage                                                                                                                  |
-|------|---------------------|------------------------------------------------------------------------------------------------------------------------|
-| 0    | `SUCCESS`           | Command completed successfully                                                                                         |
-| 1    | `GENERAL_ERROR`     | Unhandled exception, general failure                                                                                   |
-| 2    | `FILE_NOT_FOUND`    | Attachment or file not found; also click's usage error (bad option value, malformed `--set`, invalid `--profile` name) |
-| 13   | `PERMISSION_DENIED` | Cannot write to target directory                                                                                       |
-| 22   | `INVALID_ARGUMENT`  | Invalid CLI argument or section not found                                                                              |
-| 69   | `SMTP_FAILURE`      | SMTP delivery failed                                                                                                   |
-| 78   | `CONFIG_ERROR`      | Configuration missing, not loadable or invalid                                                                         |
-| 110  | `TIMEOUT`           | Operation timed out                                                                                                    |
-| 130  | `SIGNAL_INT`        | Interrupted (SIGINT/Ctrl+C)                                                                                            |
-| 141  | `BROKEN_PIPE`       | Output pipe closed                                                                                                     |
-| 143  | `SIGNAL_TERM`       | Terminated (SIGTERM)                                                                                                   |
+| Code | Name                 | Usage                                                                                                                  |
+|------|----------------------|------------------------------------------------------------------------------------------------------------------------|
+| 0    | `SUCCESS`            | Command completed successfully                                                                                         |
+| 1    | `GENERAL_ERROR`      | Unhandled exception, general failure                                                                                   |
+| 2    | `FILE_NOT_FOUND`     | Attachment or file not found; also click's usage error (bad option value, malformed `--set`, invalid `--profile` name) |
+| 13   | `PERMISSION_DENIED`  | Cannot write to target directory                                                                                       |
+| 22   | `INVALID_ARGUMENT`   | Invalid CLI argument or section not found                                                                              |
+| 69   | `SMTP_FAILURE`       | SMTP delivery failed                                                                                                   |
+| 77   | `ATTACHMENT_REFUSED` | Attachment refused by btx_lib_mail's security checks (blocked extension or directory, symlink, size, ...)              |
+| 78   | `CONFIG_ERROR`       | Configuration missing, not loadable or invalid                                                                         |
+| 110  | `TIMEOUT`            | Operation timed out                                                                                                    |
+| 130  | `SIGNAL_INT`         | Interrupted (SIGINT/Ctrl+C)                                                                                            |
+| 141  | `BROKEN_PIPE`        | Output pipe closed                                                                                                     |
+| 143  | `SIGNAL_TERM`        | Terminated (SIGTERM)                                                                                                   |
 
 ---
 
@@ -242,7 +245,7 @@ Send email using configured SMTP settings.
 | `--raise-on-missing-attachments / --no-raise-on-missing-attachments` | Override missing-attachment handling |
 | `--raise-on-invalid-recipient / --no-raise-on-invalid-recipient`     | Override invalid-recipient handling  |
 
-**Exit codes:** 0, 2 (file not found, or usage error), 22 (invalid option value), 69 (SMTP failure), 78 (no SMTP hosts, an invalid `[email]` section, or configuration not loadable)
+**Exit codes:** 0, 2 (file not found, or usage error), 22 (invalid option value), 69 (SMTP failure), 77 (an attachment refused by btx_lib_mail's security checks), 78 (no SMTP hosts, an invalid `[email]` section, or configuration not loadable)
 
 ### send-notification
 
@@ -322,9 +325,9 @@ Raises `ValueError` with descriptive message on invalid input.
 `EmailConfig` (`adapters/email/config.py`, re-exported by `adapters/email/sender.py`) subclasses
 btx_lib_mail's `ConfMail`: frozen, a name that is not a field is refused, the password is a
 `SecretStr`, and a validation error never shows the password or a host. It adds `from_address` and
-`recipients`, and checks every SMTP host's syntax (port range, IPv6 brackets) when it loads. In
-Python the fields use the library's names; the configuration file keeps its own keys (third
-column).
+`recipients`. ConfMail checks every SMTP host's syntax (port range, IPv6 brackets, host name
+labels) when it loads, so `EmailConfig` has no host check of its own. In Python the fields use
+the library's names; the configuration file keeps its own keys (fourth column).
 
 | Field                          | Type                | Default | File key (`[email]`)           | Description                                                      |
 |--------------------------------|---------------------|---------|--------------------------------|------------------------------------------------------------------|
@@ -362,7 +365,7 @@ lib_layered_config is the only reader of configuration: it merges every layer (t
 defaults, the app, host and user files, `.env`, the environment, `--set`) into one mapping.
 `load_email_config_from_dict()` turns that mapping's `[email]` section into an `EmailConfig`:
 
-- the six keys in the third column that differ from the field names are mapped;
+- the six keys in the fourth column that differ from the field names are mapped;
 - `[email.attachments]` keys become `attachment_<key>`;
 - a key that is not listed is refused (exit 78, `email.<key>: unknown key`), whatever layer it came from;
 - blank text means "not configured"; a single host or address string is a one-entry list;
@@ -379,7 +382,7 @@ problem, never with the refused value.
 |---------------------|------------------------------------------------------------------------------|
 | `SECTION_KEYS`      | Every key `[email]` accepts (the `attachments` table included)               |
 | `ATTACHMENT_KEYS`   | Every key `[email.attachments]` accepts; each names field `attachment_<key>` |
-| `FILE_KEY_TO_FIELD` | File key -> `EmailConfig` field, for the five keys whose names differ        |
+| `FILE_KEY_TO_FIELD` | File key -> `EmailConfig` field, for the six keys whose names differ         |
 
 ---
 

{bitranox_template_py_cli-2.1.0 → bitranox_template_py_cli-2.1.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "bitranox_template_py_cli"
-version = "2.1.0"
+version = "2.1.2"
 description = "Template CLI application with configuration management and structured logging"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -14,7 +14,7 @@ dependencies = [
     "lib_layered_config>=7.0.1",
     "btx_lib_mail>=4.0.0",
     "pydantic>=2.13.5",
-    "orjson>=3.12.0",
+    "orjson>=3.13.0",
 ]
 license = { text = "MIT" }
 authors = [{ name = "bitranox", email = "bitranox@gmail.com" }]

{bitranox_template_py_cli-2.1.0 → bitranox_template_py_cli-2.1.2}/src/bitranox_template_py_cli/__init__conf__.py

@@ -40,7 +40,7 @@ name = "bitranox_template_py_cli"
 #: Human-readable summary shown in CLI help output.
 title = "Template CLI application with configuration management and structured logging"
 #: Current release version pulled from ``pyproject.toml`` by automation.
-version = "2.1.0"
+version = "2.1.2"
 #: Repository homepage presented to users.
 homepage = "https://github.com/bitranox/bitranox_template_py_cli"
 #: Author attribution surfaced in CLI output.

{bitranox_template_py_cli-2.1.0 → bitranox_template_py_cli-2.1.2}/src/bitranox_template_py_cli/adapters/cli/commands/email/_common.py

@@ -11,6 +11,7 @@ import logging
 import os
 from typing import TYPE_CHECKING, Any, NoReturn, cast
 
+from btx_lib_mail import AttachmentSecurityError
 from pydantic import ValidationError
 
 from bitranox_template_py_cli import __init__conf__
@@ -84,8 +85,8 @@ def smtp_config_options(func: Callable[..., Any]) -> Callable[..., Any]:
 
     Adds CLI flags for the SMTP connection and delivery settings (hosts, credentials,
     STARTTLS, timeout, the two raise_on_* switches). ``starttls_verify``,
-    ``local_hostname`` and the attachment settings have no flag; set them with
-    ``--set email.<key>=...``.
+    ``local_hostname``, ``delivery_deadline``, ``recipient_max_count`` and the attachment
+    settings have no flag; set them with ``--set email.<key>=...``.
     """
     options = [
         option(
@@ -169,8 +170,10 @@ def execute_with_email_error_handling(
         1. ConfigurationError -> CONFIG_ERROR (78): Missing/invalid config
         2. ValueError -> INVALID_ARGUMENT (22): Invalid parameters or email format
         3. FileNotFoundError -> FILE_NOT_FOUND (2): Missing attachment (if enabled)
-        4. DeliveryError/RuntimeError -> SMTP_FAILURE (69): SMTP transport failures
-        5. Exception (catch-all) -> GENERAL_ERROR (1): Unexpected errors with traceback
+        4. AttachmentSecurityError -> ATTACHMENT_REFUSED (77): An attachment btx_lib_mail's
+           security checks refuse (blocked extension or directory, symlink, size, ...)
+        5. DeliveryError/RuntimeError -> SMTP_FAILURE (69): SMTP transport failures
+        6. Exception (catch-all) -> GENERAL_ERROR (1): Unexpected errors with traceback
 
         This ordering ensures specific exceptions aren't caught by broader handlers.
         When adding new exception types, insert them before the catch-all Exception handler.
@@ -205,6 +208,8 @@ def execute_with_email_error_handling(
             "Attachment file not found",
             exit_code=ExitCode.FILE_NOT_FOUND,
         )
+    except AttachmentSecurityError as exc:
+        _refuse_attachment(exc)
     except (DeliveryError, RuntimeError) as exc:
         _handle_send_error(
             exc,
@@ -264,6 +269,27 @@ def _refuse_email_config(exc: ValidationError, heading: str, *, exit_code: ExitC
     get_current_context().exit(exit_code)
 
 
+def _refuse_attachment(exc: AttachmentSecurityError) -> NoReturn:
+    """Report an attachment btx_lib_mail refused on security grounds, then exit 77.
+
+    The refusal is policy working as configured, not a crash, so no traceback is logged. The
+    user sees the library's reason, which names the violation and the resolved path; it never
+    carries a credential.
+
+    Args:
+        exc: The refusal btx_lib_mail raised.
+
+    Raises:
+        click.exceptions.Exit: Always raised, with the ATTACHMENT_REFUSED exit code.
+    """
+    logger.error(
+        "Attachment refused by security policy",
+        extra={"reason": exc.reason, "violation_type": exc.violation_type.value},
+    )
+    safe_console.echo(f"\nError: Attachment refused by security policy - {exc.reason}", err=True)
+    get_current_context().exit(ExitCode.ATTACHMENT_REFUSED)
+
+
 def _handle_send_result(result: bool, recipients: list[str] | None, message_type: str) -> None:
     """Handle the result of a send operation.
 

{bitranox_template_py_cli-2.1.0 → bitranox_template_py_cli-2.1.2}/src/bitranox_template_py_cli/adapters/cli/config_load.py

@@ -14,7 +14,8 @@ configuration.
 
 Contents:
     * :func:`load_config` - load with profile, ``.env`` and ``--set``, or say why not.
-    * :func:`start_logging` - start logging; an invalid ``[lib_log_rich]`` is a load failure.
+    * :func:`start_logging` - start logging; an invalid ``[lib_log_rich]`` value or ``LOG_*``
+      variable is a load failure.
     * :func:`require_config` - the configuration, or exit 78 naming the failure.
     * :func:`report_load_failure` - the one-line report, after the traceback on request.
     * :func:`echo_load_traceback` - the loader's traceback alone, for a caller with its own line.
@@ -97,9 +98,13 @@ def start_logging(
 ) -> tuple[Config, Exception | None]:
     """Start logging with ``config``; a logging section it refuses is recorded like a load failure.
 
-    An invalid ``[lib_log_rich]`` value would otherwise stop every command, ``config-deploy``
-    (which replaces the file holding it) included. Logging then starts with its defaults, and
-    the commands that read the configuration refuse with exit 78 naming the key.
+    An invalid ``[lib_log_rich]`` value or ``LOG_*`` variable would otherwise stop every
+    command, ``config-deploy`` (which replaces the file holding it) included. ``init_logging``
+    then starts logging with its defaults (and no ``LOG_*`` variable, if one of them is the
+    refused setting) before it raises, and the commands that read the configuration refuse with
+    exit 78 and the refusal: ``lib_log_rich.<key>: <reason>`` for a problem the section's type
+    check finds, lib_log_rich's own message for a value only lib_log_rich refuses, whether it
+    came from the section or a ``LOG_*`` variable (``lib_log_rich: Unknown log level: 'bogus'``).
 
     Args:
         services: The composition's services; only ``init_logging`` is used.
@@ -114,7 +119,6 @@ def start_logging(
     try:
         services.init_logging(config, dotenv_path=env_file)
     except InvalidLoggingConfigError as exc:
-        services.init_logging(Config({}, {}), dotenv_path=env_file)
         return Config({}, {}), config_error or exc
     return config, config_error
 

{bitranox_template_py_cli-2.1.0 → bitranox_template_py_cli-2.1.2}/src/bitranox_template_py_cli/adapters/cli/exit_codes.py

@@ -27,6 +27,8 @@ class ExitCode(IntEnum):
     * 2-13: errno-derived codes (ENOENT, EACCES)
     * 22: EINVAL
     * 69: EX_UNAVAILABLE (sysexits.h)
+    * 77: EX_NOPERM (sysexits.h): refused by policy, such as an email attachment
+      btx_lib_mail's security checks reject
     * 78: EX_CONFIG (sysexits.h)
     * 110: ETIMEDOUT
     * 128+N: signal N (informational only)
@@ -44,6 +46,7 @@ class ExitCode(IntEnum):
     PERMISSION_DENIED = 13
     INVALID_ARGUMENT = 22
     SMTP_FAILURE = 69
+    ATTACHMENT_REFUSED = 77
     CONFIG_ERROR = 78
     TIMEOUT = 110
     SIGNAL_INT = 130

{bitranox_template_py_cli-2.1.0 → bitranox_template_py_cli-2.1.2}/src/bitranox_template_py_cli/adapters/config/defaultconfig.d/50-mail.toml

@@ -235,5 +235,6 @@ allow_symlinks = false
 # Default: true (raise AttachmentSecurityError)
 # Environment Variable: BITRANOX_TEMPLATE_PY_CLI___EMAIL__ATTACHMENTS__RAISE_ON_SECURITY_VIOLATION=true
 # .env: EMAIL__ATTACHMENTS__RAISE_ON_SECURITY_VIOLATION=true
-# Note: When false, violations log a warning and skip the attachment
+# Note: When true, send-email refuses the whole message and exits 77 (EX_NOPERM)
+#   naming the violation; when false, violations log a warning and skip the attachment
 raise_on_security_violation = true

{bitranox_template_py_cli-2.1.0 → bitranox_template_py_cli-2.1.2}/src/bitranox_template_py_cli/adapters/email/transport.py

@@ -122,10 +122,16 @@ def send_email(
 
     Raises:
         ValueError: No from_address configured and no override provided,
-            or no recipients configured and no override provided.
+            or no recipients configured and no override provided, or more
+            recipients or attachments than config.recipient_max_count or
+            config.attachment_max_count allow (refused before any delivery).
         ConfigurationError: No SMTP hosts configured.
-        FileNotFoundError: Required attachment missing and config.raise_on_missing_attachments
-            is True.
+        FileNotFoundError: Required attachment missing or unreadable and
+            config.raise_on_missing_attachments is True.
+        AttachmentSecurityError: btx_lib_mail's security checks refused an
+            attachment (blocked extension or directory, symlink, size, ...)
+            and config.attachment_raise_on_security_violation is True.
+            Raised before anything is delivered.
         DeliveryError: All SMTP hosts failed for a recipient.
 
     Side Effects:

{bitranox_template_py_cli-2.1.0 → bitranox_template_py_cli-2.1.2}/src/bitranox_template_py_cli/adapters/logging/setup.py

@@ -5,8 +5,10 @@ eliminating duplication between module entry (__main__.py) and console script
 (cli.py) while ensuring initialization happens exactly once.
 
 Contents:
-    * :func:`init_logging` - idempotent logging initialization with layered config.
-    * :class:`InvalidLoggingConfigError` - the ``[lib_log_rich]`` section cannot configure logging.
+    * :func:`init_logging` - idempotent logging initialization from the ``[lib_log_rich]``
+      section and the ``LOG_*`` variables (the environment, plus the ``LOG_*`` lines of a ``.env``).
+    * :class:`InvalidLoggingConfigError` - the ``[lib_log_rich]`` section or a ``LOG_*`` variable
+      cannot configure logging.
     * :func:`_build_runtime_config` - constructs RuntimeConfig from layered sources.
 
 System Role:
@@ -18,18 +20,20 @@ System Role:
 from __future__ import annotations
 
 import os
+from contextlib import contextmanager
 from pathlib import Path
 from typing import TYPE_CHECKING, cast
 
 import lib_log_rich.runtime
 from dotenv import dotenv_values
+from lib_layered_config import Config
 from pydantic import BaseModel, ConfigDict, ValidationError
 
 from bitranox_template_py_cli import __init__conf__
 from bitranox_template_py_cli.domain.errors import ConfigurationError
 
 if TYPE_CHECKING:
-    from lib_layered_config import Config
+    from collections.abc import Generator
 
 
 class LoggingConfigModel(BaseModel):
@@ -94,18 +98,20 @@ def _build_runtime_config(config: Config) -> lib_log_rich.runtime.RuntimeConfig:
 class InvalidLoggingConfigError(ConfigurationError):
     """lib_log_rich refuses its settings: one ``<key>: <reason>`` in :attr:`problems` per problem.
 
-    The settings are the ``[lib_log_rich]`` section plus any ``LOG_*`` variable. A problem names
-    the key and never repeats the refused value.
+    The settings are the ``[lib_log_rich]`` section plus any ``LOG_*`` variable. A problem the
+    type check of the section finds names the key and never repeats the refused value. A value
+    only lib_log_rich itself refuses, such as an unknown level in ``LOG_CONSOLE_LEVEL`` or in the
+    section's ``console_level``, is reported in lib_log_rich's own words (``lib_log_rich: Unknown
+    log level: 'bogus'``), which may name neither the setting nor where it was set.
 
     Attributes:
         problems: One line per refused setting.
 
     Example:
-        >>> from lib_layered_config import Config
         >>> try:
-        ...     init_logging(Config({"lib_log_rich": {"rate_limit": "100:60"}}, {}))
-        ... except InvalidLoggingConfigError as exc:
-        ...     print(exc)
+        ...     _build_runtime_config(Config({"lib_log_rich": {"rate_limit": "100:60"}}, {}))
+        ... except ValidationError as exc:
+        ...     print(InvalidLoggingConfigError(_problems(exc)))
         lib_log_rich.rate_limit: Input should be a valid tuple
     """
 
@@ -126,8 +132,8 @@ def _problems(error: BaseException) -> list[str]:
     while cause is not None and not isinstance(cause, ValidationError):
         cause = cause.__cause__ or cause.__context__
     if cause is None:
-        # Not a pydantic error (e.g. an unknown level name): its own first line, which names
-        # the setting.
+        # Not a pydantic error (e.g. an unknown level name in a LOG_* variable): lib_log_rich's
+        # own first line, which may name neither the variable nor where it was set.
         return [f"lib_log_rich: {str(error).splitlines()[0]}"]
     return [f"lib_log_rich.{'.'.join(str(part) for part in item['loc'])}: {item['msg']}" for item in cause.errors()]
 
@@ -182,6 +188,41 @@ def _load_log_variables(dotenv_path: str | None) -> None:
             os.environ.setdefault(name, value)
 
 
+@contextmanager
+def log_variables_hidden() -> Generator[None]:
+    """Remove every ``LOG_*`` variable from the environment for the block, then put each back.
+
+    Example:
+        >>> os.environ["LOG_HIDDEN_PROBE"] = "x"
+        >>> with log_variables_hidden():
+        ...     "LOG_HIDDEN_PROBE" in os.environ
+        False
+        >>> os.environ.pop("LOG_HIDDEN_PROBE")
+        'x'
+    """
+    names = [name for name in os.environ if name.startswith(_LOG_VARIABLE_PREFIX)]
+    hidden = {name: os.environ.pop(name) for name in names}
+    try:
+        yield
+    finally:
+        os.environ.update(hidden)
+
+
+def _start_default_logging() -> None:
+    """Start lib_log_rich with the package defaults; without the ``LOG_*`` variables only if needed.
+
+    lib_log_rich reads the ``LOG_*`` variables from the environment on every init. When the
+    refused setting came from the ``[lib_log_rich]`` section, the defaults start with them and
+    a valid ``LOG_CONSOLE_LEVEL`` still applies. When one of them is the refused setting, that
+    start is refused again, and only then do the defaults start with every ``LOG_*`` hidden.
+    """
+    try:
+        lib_log_rich.runtime.init(_build_runtime_config(Config({}, {})))
+    except ValueError:  # pydantic's ValidationError is a ValueError
+        with log_variables_hidden():
+            lib_log_rich.runtime.init(_build_runtime_config(Config({}, {})))
+
+
 def init_logging(config: Config, *, dotenv_path: str | None = None) -> None:
     """Initialize lib_log_rich runtime with the provided configuration.
 
@@ -199,8 +240,12 @@ def init_logging(config: Config, *, dotenv_path: str | None = None) -> None:
             to use the nearest ``.env`` from the working directory up to the project root.
 
     Raises:
-        InvalidLoggingConfigError: The ``[lib_log_rich]`` section holds a value lib_log_rich
-            refuses; logging is not started.
+        InvalidLoggingConfigError: The ``[lib_log_rich]`` section or a ``LOG_*`` variable holds
+            a value lib_log_rich refuses. Logging is started anyway, with the package defaults
+            and the ``LOG_*`` variables (every one of them ignored if the defaults are refused
+            with them too), so the caller can record the failure and run the commands that do
+            not read the configuration. Only the first call can raise: logging is running after
+            it, so a later call returns at once, also with the same refused configuration.
 
     Side Effects:
         Copies the ``LOG_*`` lines of that ``.env`` into the process environment on first
@@ -226,9 +271,11 @@ def init_logging(config: Config, *, dotenv_path: str | None = None) -> None:
     _load_log_variables(dotenv_path)
     try:
         lib_log_rich.runtime.init(_build_runtime_config(config))
-    except (ValidationError, ValueError) as exc:
+    except ValueError as exc:  # pydantic's ValidationError is a ValueError
         # The type check of the section and lib_log_rich's own range checks (which also see the
         # LOG_* variables) both refuse here; neither has started the runtime.
+        _start_default_logging()
+        lib_log_rich.runtime.attach_std_logging()
         raise InvalidLoggingConfigError(_problems(exc)) from exc
     lib_log_rich.runtime.attach_std_logging()
 
@@ -237,4 +284,5 @@ __all__ = [
     "InvalidLoggingConfigError",
     "LoggingConfigModel",
     "init_logging",
+    "log_variables_hidden",
 ]

{bitranox_template_py_cli-2.1.0 → bitranox_template_py_cli-2.1.2}/src/bitranox_template_py_cli/adapters/memory/logging.py

@@ -12,6 +12,7 @@ import lib_log_rich.runtime
 from lib_log_rich.domain import LogLevel
 
 from bitranox_template_py_cli import __init__conf__
+from bitranox_template_py_cli.adapters.logging.setup import log_variables_hidden
 
 if TYPE_CHECKING:
     from lib_layered_config import Config
@@ -29,7 +30,10 @@ def init_logging_in_memory(config: Config, *, dotenv_path: str | None = None) ->
     double has no business writing to a system log, and a queue is a background thread the
     test run would have to reap. The console level is ERROR so ordinary INFO logging cannot
     land in the output a test asserts on. Unlike the production initializer this never loads
-    a ``.env`` file, so a test run does not pick up the developer's own environment.
+    a ``.env`` file, and it starts with every ``LOG_*`` variable hidden (each is put back
+    afterwards): lib_log_rich reads them on every init, so a developer's own
+    ``LOG_CONSOLE_LEVEL`` would otherwise change the test runtime, and a value lib_log_rich
+    refuses would fail every command run under ``build_testing()``.
 
     Args:
         config: Layered configuration object. Unused: the test runtime is fixed, and the
@@ -45,17 +49,18 @@ def init_logging_in_memory(config: Config, *, dotenv_path: str | None = None) ->
     """
     if lib_log_rich.runtime.is_initialised():
         return
-    lib_log_rich.runtime.init(
-        lib_log_rich.runtime.RuntimeConfig(
-            service=f"{__init__conf__.name}-test",
-            environment="test",
-            console_level=LogLevel.ERROR,
-            enable_journald=False,
-            enable_eventlog=False,
-            enable_graylog=False,
-            queue_enabled=False,
+    with log_variables_hidden():
+        lib_log_rich.runtime.init(
+            lib_log_rich.runtime.RuntimeConfig(
+                service=f"{__init__conf__.name}-test",
+                environment="test",
+                console_level=LogLevel.ERROR,
+                enable_journald=False,
+                enable_eventlog=False,
+                enable_graylog=False,
+                queue_enabled=False,
+            )
         )
-    )
 
 
 __all__ = ["init_logging_in_memory"]

{bitranox_template_py_cli-2.1.0 → bitranox_template_py_cli-2.1.2}/src/bitranox_template_py_cli/application/ports.py

@@ -102,6 +102,8 @@ class InitLogging(Protocol):
     """Initialize lib_log_rich runtime with the provided configuration.
 
     ``dotenv_path`` is the ``.env`` the configuration was loaded with, or None for the nearest one.
+    A refused logging setting raises ``InvalidLoggingConfigError`` only after logging has been
+    started with its defaults, so the caller never has to start it a second time.
     """
 
     def __call__(self, config: Config, *, dotenv_path: str | None = None) -> None: ...