cone.app 2.2.0__tar.gz → 2.2.1__tar.gz

{cone_app-2.2.0 → cone_app-2.2.1}/CHANGES.rst

@@ -1,6 +1,16 @@
 Changes
 =======
 
+2.2.1 (2026-11-09)
+------------------
+
+- ``request_property`` keeps the instance in its cache entry. The cache key is
+  built from ``id(self)``, and since ``cone.tile`` renders a copy of the tile on
+  every call, a tile rendered later in the same request could get the address
+  of a collected one and read its cached value.
+  [rnix]
+
+
 2.2.0 (2026-11-09)
 ------------------
 

{cone_app-2.2.0 → cone_app-2.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cone.app
-Version: 2.2.0
+Version: 2.2.1
 Summary: Web application stub
 Project-URL: Homepage, http://github.com/conestack/cone.app
 Author-email: Cone Contributors <dev@conestack.org>
@@ -104,6 +104,16 @@ Contributors
 Changes
 =======
 
+2.2.1 (2026-11-09)
+------------------
+
+- ``request_property`` keeps the instance in its cache entry. The cache key is
+  built from ``id(self)``, and since ``cone.tile`` renders a copy of the tile on
+  every call, a tile rendered later in the same request could get the address
+  of a collected one and read its cached value.
+  [rnix]
+
+
 2.2.0 (2026-11-09)
 ------------------
 

{cone_app-2.2.0 → cone_app-2.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cone.app"
-version = "2.2.0"
+version = "2.2.1"
 description = "Web application stub"
 dynamic = ["readme"]
 requires-python = ">=3.10"

{cone_app-2.2.0 → cone_app-2.2.1}/src/cone/app/browser/actions.py

@@ -118,11 +118,6 @@ class Action:
         ⚠ **Not called ``bind``**: ``LinkAction.bind`` is the ajax event and
         several actions set it to ``None``, so a method of that name would be
         a string on half of them.
-
-        ⚠ Do not add a ``request_property`` to an action. Its cache key is
-        built from ``id(self)``, and two bound copies of one render can land on
-        the same address once the first is collected - the second would then
-        read the first's answer.
         """
         action = copy.copy(self)
         action.model = model

{cone_app-2.2.0 → cone_app-2.2.1}/src/cone/app/browser/utils.py

@@ -110,10 +110,13 @@ def request_property(func):
     def wrapper(self):
         cache_key = f'{id(self)!s}.{self.__class__.__name__}.{func.__name__}'
         try:
-            return self.request.environ[cache_key]
+            return self.request.environ[cache_key][1]
         except KeyError:
-            val = self.request.environ[cache_key] = func(self)
-            return val
+            # Holding the instance keeps its id, and so the cache key, from
+            # being reused by another object while the request lives.
+            value = func(self)
+            self.request.environ[cache_key] = (self, value)
+            return value
 
     wrapper.__doc__ = func.__doc__
     return property(wrapper)

{cone_app-2.2.0 → cone_app-2.2.1}/src/cone/app/tests/test_browser_utils.py

@@ -116,6 +116,22 @@ class TestBrowserUtils(TileTestCase):
         self.assertEqual(rpuc.cached_attr, 'cached attribute')
         self.assertEqual(counter['computed'], 1)
 
+    def test_request_property_per_instance(self):
+        class RequestPropertyUsingClass:
+            def __init__(self, request, value):
+                self.request = request
+                self.value = value
+
+            @request_property
+            def cached_attr(self):
+                return self.value
+
+        request = self.layer.new_request()
+        # Each instance is collected right away, so the next one usually gets
+        # its address and thus its id.
+        for value in range(100):
+            self.assertEqual(RequestPropertyUsingClass(request, value).cached_attr, value)
+
     def test_client_error_message(self):
         request = self.layer.new_request()
         try: