cello-framework 1.2.2__tar.gz → 1.2.3__tar.gz

{cello_framework-1.2.2 → cello_framework-1.2.3}/CLAUDE.md

@@ -4,7 +4,7 @@
 
 **Cello** is an ultra-fast, Rust-powered Python async web framework designed to achieve C-level performance on the hot path while maintaining Python's developer experience. It's the successor to frameworks like FastAPI, Robyn, and Litestar, combining their best features with pure Rust implementation for maximum performance.
 
-**Version:** 1.2.2
+**Version:** 1.2.3
 **License:** MIT
 **Python Requirement:** 3.12+
 **Author:** Jagadeesh Katla
@@ -346,6 +346,7 @@ def handle_value_error(request, exc):
 
 ## Version History
 
+- **v1.2.3**: Full middleware Python API — `cello.middleware` module with `JwtAuth`, `BasicAuth`, `ApiKeyAuth`, `CsrfConfig`, `AdaptiveRateLimitConfig`; `app.use()` dispatcher; 6 new `enable_*` methods on App (`enable_jwt`, `enable_session`, `enable_security_headers`, `enable_csrf`, `enable_basic_auth`, `enable_api_key`); all docs import paths corrected (`from cello import RoleGuard` not `cello.guards`)
 - **v1.2.2**: Security & bug fixes — CSRF `HttpOnly` on double-submit cookie (critical, broke all AJAX CSRF); all middleware `skip_path` prefix bypass fixed via `path_matches_skip()` helper; `FixedWindowStore` window_start never updated after reset; unused `mut` cleaned in minijinja tests
 - **v1.2.1**: Bug fixes — server port never bound (`pyo3_asyncio` replaced with native `py.allow_threads` + `tokio::block_on`); `ProblemDetails` was missing from Python module export; `And`/`Or` guards now accept both `*args` and list styles; CSRF `HttpOnly` removed from double-submit cookie (JS must read it); `FixedWindowStore` window_start never updated after reset; all middleware `skip_path` used raw `starts_with` allowing prefix bypass; doc corrections (`type_uri` not `type_url`)
 - **v1.2.0**: Bug fixes (shutdown coroutine never awaited, KeyboardInterrupt in shutdown handler, `request.redis` AttributeError); Redis Lua scripting (`eval`, `evalsha`, `script_load`); Rust-native `AsyncClient` backed by `reqwest + Tokio` — GIL never held during HTTP I/O, HTTP/2, gzip, rustls

{cello_framework-1.2.2 → cello_framework-1.2.3}/Cargo.lock

@@ -341,7 +341,7 @@ dependencies = [
 
 [[package]]
 name = "cello-framework"
-version = "1.2.2"
+version = "1.2.3"
 dependencies = [
  "async-graphql",
  "async-graphql-value",

{cello_framework-1.2.2 → cello_framework-1.2.3}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cello-framework"
-version = "1.2.2"
+version = "1.2.3"
 edition = "2021"
 description = "Ultra-fast Rust-powered Python async web framework"
 license = "MIT"

{cello_framework-1.2.2 → cello_framework-1.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cello-framework
-Version: 1.2.2
+Version: 1.2.3
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License

{cello_framework-1.2.2 → cello_framework-1.2.3}/docs/features/core/async.md

@@ -254,8 +254,7 @@ All Python-side decorators and wrappers in Cello automatically detect whether a
 | Pydantic validation | Yes | Validates the request body, then awaits the handler |
 
 ```python
-from cello import App, cache
-from cello.guards import RoleGuard
+from cello import App, cache, RoleGuard
 from pydantic import BaseModel
 
 app = App()

{cello_framework-1.2.2 → cello_framework-1.2.3}/docs/features/core/blueprints.md

@@ -183,8 +183,7 @@ app.register_blueprint(v2)
 Apply middleware to all routes within a blueprint. Async handlers work seamlessly with blueprint-level middleware and per-route guards:
 
 ```python
-from cello import App, Blueprint
-from cello.guards import RoleGuard, Authenticated
+from cello import App, Blueprint, RoleGuard, Authenticated
 
 # Public blueprint -- no auth required
 public_bp = Blueprint("/public")

{cello_framework-1.2.2 → cello_framework-1.2.3}/docs/features/middleware/overview.md

@@ -172,8 +172,7 @@ app.use(ApiKeyAuth(keys={"key1": "service-a"}, header="X-API-Key"))
 All Python-side middleware wrappers -- including the `@cache` decorator, guard wrappers, and Pydantic validation -- fully support async handlers. Each wrapper uses `inspect.iscoroutinefunction()` to detect async handlers at decoration time and generates the appropriate sync or async wrapper. This means you can freely use `async def` handlers with any combination of caching, guards, and validation without encountering unawaited coroutine issues.
 
 ```python
-from cello import App, cache
-from cello.guards import RoleGuard
+from cello import App, cache, RoleGuard
 from pydantic import BaseModel
 
 class Item(BaseModel):

{cello_framework-1.2.2 → cello_framework-1.2.3}/docs/features/security/overview.md

@@ -261,7 +261,7 @@ app.use(api_auth)
 Control access with composable guards:
 
 ```python
-from cello.guards import RoleGuard, PermissionGuard, And, Or
+from cello import RoleGuard, PermissionGuard, And, Or
 
 # Simple role check
 admin_only = RoleGuard(["admin"])

{cello_framework-1.2.2 → cello_framework-1.2.3}/docs/index.md

@@ -37,7 +37,7 @@ hide:
 [:material-package-variant: PyPI](https://pypi.org/project/cello-framework/){ .md-button }
 
 <div class="hero-badges">
-  <code class="badge-version">v1.2.0</code>
+  <code class="badge-version">v1.2.3</code>
   <code class="badge-tests">441 tests passing</code>
   <code class="badge-license">MIT License</code>
   <code class="badge-python">Python 3.12+</code>
@@ -178,8 +178,7 @@ hide:
 === ":material-api: REST API"
 
     ```python
-    from cello import App, Response, Blueprint
-    from cello.guards import RoleGuard
+    from cello import App, Response, Blueprint, RoleGuard
 
     app = App()
     api = Blueprint("api", url_prefix="/api/v1")
@@ -371,21 +370,23 @@ How Cello stacks up against popular Python web frameworks (4 workers, 5 processe
 
 <!-- ===== WHAT'S NEW ===== -->
 
-## :material-creation: What's New in v1.2.0
+## :material-creation: What's New in v1.2.3
 
 <div class="whats-new-box" markdown>
 
-!!! tip "v1.2.0 -- Bug Fixes & Rust-Native AsyncClient"
+!!! tip "v1.2.3 -- Full Middleware Python API & Correct Import Paths"
 
-    Cello v1.2.0 ships critical bug fixes and a brand-new Rust-native HTTP client — the GIL is never held during HTTP I/O.
+    Cello v1.2.3 exposes the complete auth & security middleware suite to Python, and fixes all doc import errors.
 
-    - :material-bug-check: **Critical Bug Fixes** -- Shutdown coroutine now properly awaited, `KeyboardInterrupt` handled cleanly in shutdown handler, `request.redis` AttributeError resolved.
+    - :material-api: **`app.use(middleware)`** -- New universal dispatcher: `app.use(JwtAuth(...))`, `app.use(BasicAuth(...))`, `app.use(ApiKeyAuth(...))`, `app.use(CsrfConfig())`.
 
-    - :material-language-rust: **Rust-Native AsyncClient** -- Backed by `reqwest + Tokio` with HTTP/2, gzip, and rustls. GIL is never held during HTTP I/O — true async performance.
+    - :material-package: **`cello.middleware` module** -- `from cello.middleware import JwtAuth, BasicAuth, ApiKeyAuth, CsrfConfig` now works.
 
-    - :material-database: **Redis Lua Scripting** -- New `eval`, `evalsha`, and `script_load` methods for atomic server-side operations.
+    - :material-language-rust: **6 new Rust-backed methods** -- `enable_jwt()`, `enable_session()`, `enable_security_headers()`, `enable_csrf()`, `enable_basic_auth()`, `enable_api_key()` added to App.
 
-    [:material-tag: Full Release Notes](releases/v1.2.0.md){ .md-button .md-button--primary }
+    - :material-import: **All import paths corrected** -- `from cello import RoleGuard` (not `from cello.guards`). All 9 affected doc pages fixed.
+
+    [:material-tag: Full Release Notes](releases/v1.2.3.md){ .md-button .md-button--primary }
     [:material-book-open-variant: Migration Guide](releases/migration.md){ .md-button }
 
 </div>

{cello_framework-1.2.2 → cello_framework-1.2.3}/docs/overrides/main.html

@@ -2,7 +2,7 @@
 
 {% block announce %}
 <span class="cello-announce">
-  Cello v1.2.0 — Redis Lua scripting, Rust-native AsyncClient, critical bug fixes
+  Cello v1.2.3 — Full middleware Python API (JwtAuth, BasicAuth, ApiKeyAuth, app.use())
   <a href="{{ base_url }}/releases/" class="cello-announce-link">
     Release notes →
   </a>
@@ -37,7 +37,7 @@
     "operatingSystem": "Linux, macOS, Windows",
     "programmingLanguage": ["Python", "Rust"],
     "license": "https://opensource.org/licenses/MIT",
-    "softwareVersion": "1.2.0",
+    "softwareVersion": "1.2.3",
     "author": {
       "@type": "Person",
       "name": "Jagadeesh Katla",

{cello_framework-1.2.2 → cello_framework-1.2.3}/docs/reference/api/app.md

@@ -728,9 +728,9 @@ Add a global guard to all routes.
 > *Since v0.5.0*
 
 ```python
-from cello.guards import AuthenticatedGuard
+from cello import Authenticated
 
-app.add_guard(AuthenticatedGuard())
+app.add_guard(Authenticated())
 ```
 
 | Parameter | Type | Description |

{cello_framework-1.2.2 → cello_framework-1.2.3}/docs/reference/index.md

@@ -78,7 +78,7 @@ The building blocks of every Cello application -- from creating your app to hand
 
     Role-based and permission-based access control. Composable guards that protect routes and blueprints.
 
-    **Key classes:** `RoleGuard` `PermissionGuard` `CompositeGuard`
+    **Key classes:** `RoleGuard` `PermissionGuard` `Authenticated` `And` `Or` `Not`
 
     [:octicons-arrow-right-24: Guards Reference](api/guards.md)
 
@@ -166,8 +166,8 @@ The most commonly used classes and functions at a glance.
 | [`Response`](api/response.md) | `cello` | HTTP response builder |
 | [`Blueprint`](api/blueprint.md) | `cello` | Route grouping |
 | [`Depends`](api/context.md) | `cello` | Dependency injection marker |
-| [`RoleGuard`](api/guards.md) | `cello.guards` | Role-based access guard |
-| [`PermissionGuard`](api/guards.md) | `cello.guards` | Permission-based access guard |
+| [`RoleGuard`](api/guards.md) | `cello` | Role-based access guard |
+| [`PermissionGuard`](api/guards.md) | `cello` | Permission-based access guard |
 | [`JwtConfig`](config/security.md) | `cello.middleware` | JWT authentication config |
 | [`RateLimitConfig`](config/middleware.md) | `cello.middleware` | Rate limiting config |
 | [`SessionConfig`](config/security.md) | `cello.middleware` | Session management config |
@@ -219,8 +219,7 @@ The most commonly used classes and functions at a glance.
 === "Guards & Auth"
 
     ```python
-    from cello import App
-    from cello.guards import RoleGuard, PermissionGuard
+    from cello import App, RoleGuard, PermissionGuard
     from cello.middleware import JwtConfig, JwtAuth
 
     app = App()

{cello_framework-1.2.2 → cello_framework-1.2.3}/docs/releases/v0.5.0.md

@@ -65,14 +65,18 @@ def profile(request, user=Depends(get_current_user)):
 
 Composable access control guards that run before the handler. Guards inspect the request context and either allow or deny access.
 
+!!! note "API names updated in v1.x"
+    `RoleGuard`, `PermissionGuard`, `AuthenticatedGuard`, `AndGuard`, `OrGuard`, `NotGuard` were the original v0.5.0 names.
+    Current names: `RoleGuard` → still `RoleGuard` (from `cello`), `PermissionGuard` → still `PermissionGuard` (from `cello`),
+    `AuthenticatedGuard` → `Authenticated`, `AndGuard` → `And`, `OrGuard` → `Or`, `NotGuard` → `Not`.
+
 ```python
-from cello import App
-from cello.guards import RoleGuard, PermissionGuard, AuthenticatedGuard
+from cello import App, RoleGuard, PermissionGuard, Authenticated
 
 app = App()
 
 # Require authentication
-@app.get("/dashboard", guards=[AuthenticatedGuard()])
+@app.get("/dashboard", guards=[Authenticated()])
 def dashboard(request):
     return {"welcome": request.context.get("user_id")}
 
@@ -90,18 +94,18 @@ def delete_user(request):
 **Composable logic with And, Or, Not:**
 
 ```python
-from cello.guards import AndGuard, OrGuard, NotGuard
+from cello import And, Or, Not, RoleGuard, PermissionGuard, Authenticated
 
 # Admin OR has special permission
-flexible = OrGuard([
+flexible = Or([
     RoleGuard(["admin"]),
     PermissionGuard(["elevated:access"]),
 ])
 
 # Authenticated AND not banned
-safe = AndGuard([
-    AuthenticatedGuard(),
-    NotGuard(RoleGuard(["banned"])),
+safe = And([
+    Authenticated(),
+    Not(RoleGuard(["banned"])),
 ])
 
 @app.get("/resource", guards=[flexible])

{cello_framework-1.2.2 → cello_framework-1.2.3}/docs/releases/v0.6.0.md

@@ -56,17 +56,10 @@ def create_user(request):
 Rate limits now adjust based on server health:
 
 ```python
-from cello.middleware import AdaptiveRateLimitConfig
-
-config = AdaptiveRateLimitConfig(
-    base_requests=100,
-    window=60,
-    cpu_threshold=0.8,      # Reduce limits at 80% CPU
-    memory_threshold=0.9,   # Reduce limits at 90% memory
-    latency_threshold=100,  # Reduce limits if latency > 100ms
-    min_requests=10         # Never go below 10 req/min
-)
+from cello import App, RateLimitConfig
 
+# Adaptive rate limiting (adjusts based on server load)
+config = RateLimitConfig.adaptive(capacity=100, refill_rate=10)
 app.enable_rate_limit(config)
 ```
 
@@ -109,18 +102,15 @@ Invalid requests return RFC 7807 Problem Details:
 Protect against cascading failures:
 
 ```python
-from cello.middleware import CircuitBreaker, CircuitBreakerConfig
+from cello import App
 
-config = CircuitBreakerConfig(
-    failure_threshold=5,     # Open after 5 failures
-    recovery_timeout=30,     # Try again after 30 seconds
-    half_open_requests=3     # Allow 3 test requests
+app.enable_circuit_breaker(
+    failure_threshold=5,   # Open after 5 failures
+    reset_timeout=30,      # Try again after 30 seconds
+    half_open_target=3,    # Allow 3 test requests in half-open state
 )
 
-circuit = CircuitBreaker(config)
-
 @app.get("/external-api")
-@circuit.protect
 async def call_external(request):
     return await external_service.fetch()
 ```
@@ -130,8 +120,7 @@ async def call_external(request):
 Guards can now be applied at multiple levels:
 
 ```python
-from cello import App, Blueprint
-from cello.guards import RoleGuard, PermissionGuard
+from cello import App, Blueprint, RoleGuard, PermissionGuard
 
 # Controller-level guard
 admin_bp = Blueprint("/admin", guards=[RoleGuard(["admin"])])
@@ -181,9 +170,7 @@ The cache middleware configuration has changed:
 app.enable_cache(max_age=300)
 
 # After (v0.6.0)
-from cello.middleware import CacheConfig
-config = CacheConfig(default_ttl=300, max_size=1000)
-app.enable_cache(config)
+app.enable_caching(ttl=300)
 ```
 
 ### Rate Limit Response

cello_framework-1.2.3/docs/releases/v1.2.3.md

@@ -0,0 +1,121 @@
+---
+title: v1.2.3 Release Notes
+description: Cello Framework v1.2.3 — Full Middleware Python API & Docs Fixes
+tags:
+  - v1.2.3
+  - Release Notes
+  - New Features
+  - Bug Fixes
+---
+
+# Cello v1.2.3 — Full Middleware Python API & Docs Fixes
+
+**Release Date:** June 14, 2026
+**License:** MIT
+**Python:** 3.12+
+
+---
+
+## Overview
+
+Cello v1.2.3 exposes the complete authentication and security middleware suite to
+Python — functionality that existed in Rust since v0.4.0 but had no Python API.
+It also fixes all incorrect import paths across the documentation.
+
+Drop-in upgrade from v1.2.2. No breaking changes.
+
+---
+
+## New Features
+
+### Full Middleware Python API
+
+All authentication and security middleware is now accessible from Python.
+
+#### `app.use(middleware)` — universal middleware dispatcher
+
+```python
+from cello import App, JwtConfig
+from cello.middleware import JwtAuth, BasicAuth, ApiKeyAuth, CsrfConfig
+
+app = App()
+
+# JWT authentication
+app.use(JwtAuth(JwtConfig(secret="your-32-byte-secret-key!", algorithm="HS256")))
+
+# Basic auth with credential dict
+app.use(BasicAuth(credentials={"admin": "s3cr3t"}, realm="My API"))
+
+# API key validation
+app.use(ApiKeyAuth(keys={"key-abc": "service-a", "key-xyz": "service-b"}))
+
+# CSRF protection
+app.use(CsrfConfig())
+```
+
+#### New `App` enable methods
+
+```python
+app.enable_jwt(JwtConfig(secret="...", algorithm="HS256"), skip_paths=["/health"])
+app.enable_session(SessionConfig(cookie_name="sid", max_age=3600))
+app.enable_security_headers(strict=False)
+app.enable_csrf()
+app.enable_basic_auth(credentials={"admin": "secret"}, realm="Protected")
+app.enable_api_key(keys={"key123": "service-a"}, header="X-API-Key")
+```
+
+### New `cello.middleware` module
+
+```python
+from cello.middleware import (
+    JwtAuth,               # JWT auth wrapper for app.use()
+    BasicAuth,             # Basic auth wrapper for app.use()
+    ApiKeyAuth,            # API key auth wrapper for app.use()
+    CsrfConfig,            # CSRF middleware config for app.use()
+    AdaptiveRateLimitConfig,  # Convenience wrapper for RateLimitConfig.adaptive()
+    # Also re-exported from cello for convenience:
+    JwtConfig,
+    SessionConfig,
+    SecurityHeadersConfig,
+    RateLimitConfig,
+    CSP,
+)
+```
+
+---
+
+## Docs Fixes
+
+All documentation pages now use correct import paths. Previously, several pages
+showed imports that raised `ImportError` at runtime.
+
+| Wrong (raised ImportError) | Correct |
+|---------------------------|---------|
+| `from cello.guards import RoleGuard` | `from cello import RoleGuard` |
+| `from cello.guards import PermissionGuard` | `from cello import PermissionGuard` |
+| `from cello.guards import AuthenticatedGuard` | `from cello import Authenticated` |
+| `from cello.guards import AndGuard` | `from cello import And` |
+| `from cello.middleware import CircuitBreaker` | `app.enable_circuit_breaker(...)` |
+| `from cello.middleware import CacheConfig` | `app.enable_caching(ttl=...)` |
+
+---
+
+## Files Changed
+
+| File | Change |
+|------|--------|
+| `src/lib.rs` | Add `enable_jwt`, `enable_session`, `enable_security_headers`, `enable_csrf`, `enable_basic_auth`, `enable_api_key` to Rust `Cello` struct |
+| `python/cello/middleware.py` | **New file** — `JwtAuth`, `BasicAuth`, `ApiKeyAuth`, `CsrfConfig`, `AdaptiveRateLimitConfig` |
+| `python/cello/__init__.py` | Add `App.use()` dispatcher and 6 new `enable_*` methods |
+| `docs/` | 9 pages updated with correct import paths |
+| `docs/overrides/main.html` | Announcement bar updated to v1.2.3 |
+
+---
+
+## Upgrade
+
+```bash
+pip install --upgrade cello-framework==1.2.3
+```
+
+Drop-in replacement for v1.2.2. No API changes.

{cello_framework-1.2.2 → cello_framework-1.2.3}/mkdocs.yml

@@ -364,6 +364,7 @@ nav:
 
   - Release Notes:
     - releases/index.md
+    - v1.2.3: releases/v1.2.3.md
     - v1.2.2: releases/v1.2.2.md
     - v1.2.1: releases/v1.2.1.md
     - v1.2.0: releases/v1.2.0.md

{cello_framework-1.2.2 → cello_framework-1.2.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "cello-framework"
-version = "1.2.2"
+version = "1.2.3"
 description = "Ultra-fast Rust-powered Python async web framework"
 readme = "README.md"
 license = { text = "MIT" }

{cello_framework-1.2.2 → cello_framework-1.2.3}/python/cello/__init__.py

@@ -296,7 +296,7 @@ __all__ = [
     "validate_rate_limit_config",
     "validate_tls_config",
 ]
-__version__ = "1.2.2"
+__version__ = "1.2.3"
 
 
 class Blueprint:
@@ -661,6 +661,102 @@ class App:
         """
         self._app.enable_circuit_breaker(failure_threshold, reset_timeout, half_open_target, failure_codes)
 
+    def enable_jwt(self, config: "JwtConfig", skip_paths: list = None):
+        """Enable JWT authentication middleware.
+
+        Args:
+            config: JwtConfig instance with secret, algorithm, etc.
+            skip_paths: List of paths to exclude from JWT validation.
+        """
+        self._app.enable_jwt(config, skip_paths)
+
+    def enable_session(self, config: "SessionConfig" = None):
+        """Enable session middleware (in-memory store).
+
+        Args:
+            config: SessionConfig instance (optional).
+        """
+        self._app.enable_session(config)
+
+    def enable_security_headers(self, strict: bool = False):
+        """Enable security headers middleware (HSTS, X-Frame-Options, etc.).
+
+        Args:
+            strict: Use stricter CSP and CORS settings (default: False).
+        """
+        self._app.enable_security_headers(strict)
+
+    def enable_csrf(self):
+        """Enable CSRF protection middleware (double-submit cookie pattern)."""
+        self._app.enable_csrf()
+
+    def enable_basic_auth(self, credentials: dict, realm: str = "Restricted"):
+        """Enable HTTP Basic authentication middleware.
+
+        Args:
+            credentials: Dict of {username: password} pairs.
+            realm: WWW-Authenticate realm string.
+        """
+        self._app.enable_basic_auth(credentials, realm)
+
+    def enable_api_key(self, keys: dict, header: str = "X-API-Key"):
+        """Enable API Key authentication middleware.
+
+        Args:
+            keys: Dict of {api_key: client_name} pairs.
+            header: Header name that carries the key (default: ``"X-API-Key"``).
+        """
+        self._app.enable_api_key(keys, header)
+
+    def use(self, middleware):
+        """Apply a middleware instance to the application.
+
+        Accepts any middleware object from ``cello.middleware``:
+
+        - :class:`~cello.middleware.JwtAuth` → :meth:`enable_jwt`
+        - :class:`~cello.middleware.BasicAuth` → :meth:`enable_basic_auth`
+        - :class:`~cello.middleware.ApiKeyAuth` → :meth:`enable_api_key`
+        - :class:`~cello.middleware.CsrfConfig` → :meth:`enable_csrf`
+        - :class:`~cello.middleware.SessionConfig` → :meth:`enable_session`
+        - :class:`~cello.middleware.SecurityHeadersConfig` → :meth:`enable_security_headers`
+
+        Example::
+
+            from cello import App, JwtConfig
+            from cello.middleware import JwtAuth
+
+            app = App()
+            app.use(JwtAuth(JwtConfig(secret="your-secret", algorithm="HS256")))
+        """
+        # Import lazily to avoid circular imports
+        from cello.middleware import JwtAuth, BasicAuth, ApiKeyAuth, CsrfConfig
+
+        if isinstance(middleware, JwtAuth):
+            self.enable_jwt(middleware.config, middleware.skip_paths or None)
+        elif isinstance(middleware, BasicAuth):
+            self.enable_basic_auth(middleware.credentials, middleware.realm)
+        elif isinstance(middleware, ApiKeyAuth):
+            self.enable_api_key(middleware.keys, middleware.header)
+        elif isinstance(middleware, CsrfConfig):
+            self.enable_csrf()
+        else:
+            # Try SessionConfig (from cello._cello)
+            try:
+                from cello._cello import SessionConfig, SecurityHeadersConfig
+                if isinstance(middleware, SessionConfig):
+                    self.enable_session(middleware)
+                    return
+                if isinstance(middleware, SecurityHeadersConfig):
+                    self.enable_security_headers()
+                    return
+            except ImportError:
+                pass
+            raise TypeError(
+                f"Unknown middleware type: {type(middleware).__name__}. "
+                "Use one of: JwtAuth, BasicAuth, ApiKeyAuth, CsrfConfig, "
+                "SessionConfig, SecurityHeadersConfig."
+            )
+
     # -------------------------------------------------------------------------
     # v1.1.0 — MiniJinja template engine
     # -------------------------------------------------------------------------