domainkit 0.6.1__tar.gz → 0.6.2__tar.gz

{domainkit-0.6.1 → domainkit-0.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: domainkit
-Version: 0.6.1
+Version: 0.6.2
 Summary: A Django-style framework for domain-driven FastAPI services.
 License-Expression: MIT
 License-File: LICENSE

{domainkit-0.6.1 → domainkit-0.6.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "domainkit"
-version = "0.6.1"
+version = "0.6.2"
 description = "A Django-style framework for domain-driven FastAPI services."
 readme = "README.md"
 license = "MIT"

{domainkit-0.6.1 → domainkit-0.6.2}/src/domainkit/contrib/auth/__init__.py

@@ -46,6 +46,7 @@ from .access import (
     Require,
     check_object_permissions,
     current_user,
+    mark_public,
     open_routes,
 )
 from .authentication import (
@@ -165,6 +166,7 @@ __all__ = [
     "has_perm",
     "has_perms",
     "make_password",
+    "mark_public",
     "open_routes",
     "password_help_texts",
     "validate_password",

{domainkit-0.6.1 → domainkit-0.6.2}/src/domainkit/contrib/auth/access.py

@@ -25,7 +25,7 @@ A refused anonymous caller gets 401, so it knows to log in; a refused user
 gets 403. ``AuthenticationMiddleware`` must be installed.
 """
 
-from collections.abc import Sequence
+from collections.abc import Iterator, Sequence
 from typing import Annotated, Any, ClassVar, Final, cast
 
 from fastapi import Depends, FastAPI, Request, status
@@ -33,6 +33,7 @@ from fastapi.dependencies.models import Dependant
 from fastapi.routing import APIRoute, APIWebSocketRoute, iter_route_contexts
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 from starlette.requests import HTTPConnection
+from starlette.routing import BaseRoute, Host, Mount, Route, WebSocketRoute
 
 from domainkit.ddd import PermissionDenied
 from domainkit.exceptions import ImproperlyConfigured
@@ -43,8 +44,10 @@ from .backends import has_perms
 from .models import AbstractBaseUser, AnyUser
 
 SAFE_METHODS: Final = frozenset({"GET", "HEAD", "OPTIONS"})
-FRAMEWORK_ROUTES: Final = "domainkit.http."
-"""Modules whose routes (probes, metrics) guard themselves."""
+FRAMEWORK_ROUTES: Final = ("domainkit.http.", "fastapi.")
+"""Modules whose routes guard themselves (probes, metrics, ``API_DOCS``)."""
+PUBLIC_MARK: Final = "domainkit_public"
+"""The attribute ``mark_public`` sets."""
 MODEL_ACTIONS: Final = {
     "GET": "view",
     "HEAD": "view",
@@ -384,46 +387,103 @@ USER_GUARDS: Final[tuple[object, ...]] = (current_user, authenticated_user)
 """Dependencies that read the user, besides ``Require``."""
 
 
+def mark_public[T](served: T) -> T:
+    """Mark a mounted application or a Starlette endpoint public on purpose.
+
+    They take no dependencies, so ``Public`` cannot sit on them, and
+    ``open_routes`` lists them otherwise::
+
+        app.mount("/static", mark_public(StaticFiles(directory="static")))
+    """
+    setattr(served, PUBLIC_MARK, True)
+    return served
+
+
 def open_routes(app: FastAPI) -> list[str]:
     """``METHOD /path`` of every route that declares no access rule.
 
     A route declares one with ``Require``, ``CurrentUser``,
     ``AuthenticatedUser``, or ``Public``, on itself or its router. The
-    framework's own routes (``/health``, ``/ready``, ``/metrics``) guard
-    themselves.
+    framework's own routes (``/health``, ``/ready``, ``/metrics``, and the
+    ``API_DOCS``) guard themselves. Mounted FastAPI and Starlette
+    applications are walked route by route. What takes no dependencies (a
+    mounted ``StaticFiles``, Starlette's own ``Route``) is listed unless
+    marked with ``mark_public``.
     """
+    return [name for name, _ in unguarded_routes(app)]
+
+
+def unguarded_routes(app: FastAPI) -> list[tuple[str, bool]]:
+    """``open_routes``, each with whether it could take a rule (a dependency)."""
     guards = (public, *USER_GUARDS)
-    return [name for name, dependant in _routes(app) if not _uses(dependant, guards)]
+    return [
+        (name, dependant is not None)
+        for name, dependant in _routes(app.routes)
+        if dependant is None or not _uses(dependant, guards)
+    ]
 
 
 def routes_need_users(app: FastAPI) -> bool:
     """Whether some route of ``app`` reads the user or checks rules."""
-    return any(_uses(dependant, USER_GUARDS) for _, dependant in _routes(app))
+    return any(
+        dependant is not None and _uses(dependant, USER_GUARDS)
+        for _, dependant in _routes(app.routes)
+    )
 
 
-def _routes(app: FastAPI) -> list[tuple[str, Dependant]]:
+def _routes(
+    routes: Sequence[BaseRoute], prefix: str = ""
+) -> Iterator[tuple[str, Dependant | None]]:
     """``METHOD /path`` and dependencies of each route, but the framework's own.
 
     Routers are walked as OpenAPI walks them, so the prefixes and
-    dependencies of the routers a route is included through count.
+    dependencies of the routers a route is included through count, and so
+    are the applications mounted with routes of their own. What takes no
+    dependencies (an application without routes, Starlette's own routes)
+    has None, unless it was marked public.
     """
-    found = []
-    for context in iter_route_contexts(app.routes):
+    for context in iter_route_contexts(routes):
         route = context.original_route
+        # Routes of included routers keep their full path (and a WebSocket
+        # its dependencies) here; FastAPI's own context has them for others.
+        effective = getattr(context, "starlette_route", None)
+        if isinstance(effective, type(route)):
+            route = effective
+        found: tuple[str, Dependant | None]
         if isinstance(route, APIWebSocketRoute):
-            # Included WebSockets keep their full path and dependencies here.
-            effective = getattr(context, "starlette_route", None)
-            if isinstance(effective, APIWebSocketRoute):
-                route = effective
-            name, dependant = f"WEBSOCKET {route.path}", route.dependant
+            found = (f"WEBSOCKET {prefix}{route.path}", route.dependant)
         elif isinstance(route, APIRoute):
-            name = f"{' '.join(sorted(route.methods or ()))} {context.path}"
-            dependant = context.dependant
-        else:
+            methods = " ".join(sorted(route.methods or ()))
+            found = (f"{methods} {prefix}{context.path}", context.dependant)
+        elif _marked_public(route):
             continue
-        if not route.endpoint.__module__.startswith(FRAMEWORK_ROUTES):
-            found.append((name, dependant))
-    return found
+        elif isinstance(route, Mount | Host) and route.routes:
+            inner = prefix + route.path if isinstance(route, Mount) else prefix
+            yield from _routes(route.routes, inner)
+            continue
+        else:
+            path = getattr(route, "path", "")
+            found = (f"{_kind(route)} {prefix}{path}".rstrip(), None)
+        endpoint = getattr(route, "endpoint", None)
+        if not getattr(endpoint, "__module__", "").startswith(FRAMEWORK_ROUTES):
+            yield found
+
+
+def _marked_public(route: BaseRoute) -> bool:
+    """Whether what ``route`` serves was marked with ``mark_public``."""
+    served = (getattr(route, name, None) for name in ("endpoint", "app", "_base_app"))
+    return any(getattr(target, PUBLIC_MARK, False) is True for target in served)
+
+
+def _kind(route: BaseRoute) -> str:
+    """How ``open_routes`` names a route that takes no dependencies."""
+    if isinstance(route, Route):
+        return " ".join(sorted(route.methods)) if route.methods else "ANY"
+    if isinstance(route, WebSocketRoute):
+        return "WEBSOCKET"
+    if isinstance(route, Host):
+        return f"HOST {route.host}"
+    return "MOUNT" if isinstance(route, Mount) else type(route).__name__
 
 
 def _uses(dependant: Dependant, guards: tuple[object, ...]) -> bool:

{domainkit-0.6.1 → domainkit-0.6.2}/src/domainkit/contrib/auth/apps.py

@@ -16,7 +16,7 @@ from domainkit.db.routing import router
 from domainkit.exceptions import ImproperlyConfigured
 from domainkit.utils.module_loading import import_string
 
-from .access import open_routes, routes_need_users
+from .access import routes_need_users, unguarded_routes
 from .authentication import get_authenticators
 from .backends import get_backends
 from .hashers import insecure_hashers
@@ -97,7 +97,11 @@ class AuthConfig(DomainConfig):
             problems.extend(
                 f"{route} declares no access rule: add Depends(Require(...)), or "
                 "dependencies=[Public] if anyone may call it."
-                for route in open_routes(app)
+                if takes_rules
+                else f"{route} takes no access rule: serve it from a FastAPI route "
+                "with Require(...), or wrap it in mark_public(...) if anyone may "
+                "call it."
+                for route, takes_rules in unguarded_routes(app)
             )
         return problems
 

{domainkit-0.6.1 → domainkit-0.6.2}/src/domainkit/contrib/auth/middleware.py

@@ -22,7 +22,9 @@ callers may do (``domainkit.contrib.auth.access``).
 Refused credentials never reach ``RateLimitMiddleware``, so they are
 counted here, per client address, against ``RATE_LIMIT``. Past it, the
 address gets 429, and its requests with an ``Authorization`` header are
-refused before any lookup until ``Retry-After`` has passed.
+refused before any lookup until ``Retry-After`` has passed. Credentials in
+other headers, which only a project's own class reads, are refused too,
+once read, even when they hold: a guess that works gets the same 429.
 """
 
 import logging
@@ -83,18 +85,20 @@ class AuthenticationMiddleware:
             await self.app(scope, receive, send)
             return
         connection = HTTPConnection(scope)
-        if (
-            self.rate is not None
-            and "authorization" in connection.headers
-            and (held := self._held(address_key(scope))) is not None
-        ):
-            await refuse(scope, receive, send, self.rate[0], held)
+        held = self._held(address_key(scope))
+        if held is not None and "authorization" in connection.headers:
+            await refuse(scope, receive, send, *held)
             return
         try:
             credentials = await self._authenticate(connection)
         except _Refused as refused:
             await self._refuse(scope, receive, send, refused)
             return
+        if held is not None and credentials is not None:
+            # Credentials in another header, read by a project's own class,
+            # are refused once read: a guess that works must not stand out.
+            await refuse(scope, receive, send, *held)
+            return
         scope["user"] = AnonymousUser() if credentials is None else credentials.user
         scope["auth"] = credentials
         context = current_request()
@@ -151,16 +155,19 @@ class AuthenticationMiddleware:
         if len(self.held) > MAX_HELD:
             self.held.popitem(last=False)
 
-    def _held(self, address: str) -> Decision | None:
-        """The refusal ``address`` is still held to, if any."""
+    def _held(self, address: str) -> tuple[int, Decision] | None:
+        """The limit and the refusal ``address`` is still held to, if any."""
         until = self.held.get(address)
-        if until is None:
+        if until is None or self.rate is None:
             return None
         left = until - monotonic()
         if left <= 0:
             del self.held[address]
             return None
-        return Decision(allowed=False, remaining=0, reset_after=left, retry_after=left)
+        refusal = Decision(
+            allowed=False, remaining=0, reset_after=left, retry_after=left
+        )
+        return self.rate[0], refusal
 
 
 class _Refused(Exception):

{domainkit-0.6.1 → domainkit-0.6.2}/src/domainkit/contrib/auth/repositories.py

@@ -129,15 +129,20 @@ class UserRepository(SqlAlchemyRepository[AbstractBaseUser, UserId]):
         )
 
     async def active_superusers(self) -> int:
-        """How many active superusers there are."""
+        """How many active superusers there are, locked until the commit.
+
+        Two transactions that each demote one of the last two superusers
+        would both count two; with the rows locked, the second count waits
+        for the first transaction and sees what it left.
+        """
         table = get_user_table()
         found = await self.session.execute(
-            select(func.count())
-            .select_from(table)
+            select(table.c.id)
             .where(table.c.is_superuser.is_(True), table.c.is_active.is_(True))
+            .order_by(table.c.id)
+            .with_for_update()
         )
-        count: int = found.scalar_one()
-        return count
+        return len(found.all())
 
     async def record_login(self, user: AbstractBaseUser) -> None:
         """Store the login time and record ``UserLoggedIn``.

{domainkit-0.6.1 → domainkit-0.6.2}/src/domainkit/contrib/idempotency/middleware.py

@@ -213,7 +213,7 @@ class IdempotencyMiddleware:
             )
         else:
             headers = [
-                (name.encode(), value.encode())
+                (name.encode("latin-1"), value.encode("latin-1"))
                 for name, value in (existing["headers"] or {}).items()
             ]
             await send(
@@ -287,10 +287,10 @@ async def _finish(
             )
             if released.rowcount:
                 return
-        headers = {
-            name.decode().lower(): value.decode()
+        headers = {  # ASGI header values are Latin-1 bytes, not always UTF-8.
+            name.decode("latin-1").lower(): value.decode("latin-1")
             for name, value in started.get("headers", [])
-            if name.decode().lower() in _STORED_HEADERS
+            if name.decode("latin-1").lower() in _STORED_HEADERS
         }
         await connection.execute(
             update(idempotency_keys)