fastapi-csp-docs 0.1.0__tar.gz → 0.1.2__tar.gz

{fastapi_csp_docs-0.1.0 → fastapi_csp_docs-0.1.2}/.github/workflows/pre-commit.yml

@@ -32,6 +32,8 @@ jobs:
       - name: Setup uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
+          # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+          # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
           version: "0.11.18"
           cache-dependency-glob: |
             pyproject.toml

{fastapi_csp_docs-0.1.0 → fastapi_csp_docs-0.1.2}/.github/workflows/test-redistribute.yml

@@ -12,6 +12,7 @@ jobs:
   changes:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       pull-requests: read
     timeout-minutes: 5
     outputs:

{fastapi_csp_docs-0.1.0 → fastapi_csp_docs-0.1.2}/.github/workflows/test.yml

@@ -6,9 +6,10 @@ on:
       - main
   pull_request:
   schedule:
+    # cron every week on monday
     - cron: "0 0 * * 1"
 
-permissions: { }
+permissions: {}
 
 env:
   UV_NO_SYNC: true
@@ -16,27 +17,31 @@ env:
 jobs:
   changes:
     runs-on: ubuntu-latest
+    # Required permissions
     permissions:
+      contents: read
       pull-requests: read
     timeout-minutes: 5
+    # Set job outputs to values from filter step
     outputs:
       src: ${{ steps.filter.outputs.src }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-        id: filter
-        with:
-          filters: |
-            src:
-              - .github/workflows/test.yml
-              - fastapi_csp_docs/**
-              - scripts/**
-              - tests/**
-              - .python-version
-              - pyproject.toml
-              - uv.lock
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
+    # For pull requests it's not necessary to checkout the code but for the main branch it is
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+      id: filter
+      with:
+        filters: |
+          src:
+            - .github/workflows/test.yml
+            - fastapi_csp_docs/**
+            - scripts/**
+            - tests/**
+            - .python-version
+            - pyproject.toml
+            - uv.lock
 
   test:
     needs:
@@ -79,14 +84,16 @@ jobs:
       - name: Setup uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
+          # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+          # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
           version: "0.11.18"
           enable-cache: true
-          cache-suffix: ${{ matrix.os }}-${{ matrix.python-version }}-${{ matrix.uv-resolution }}-fa${{ matrix.fastapi-version }}
+          cache-suffix: ${{ matrix.python-version }}-fa${{ matrix.fastapi-version }}
           cache-dependency-glob: |
             pyproject.toml
             uv.lock
 
-      - name: Install dependencies
+      - name: Install Dependencies
         run: uv sync
 
       - name: Override FastAPI version
@@ -97,17 +104,16 @@ jobs:
         run: mkdir coverage
 
       - name: Test
-        # GitHub Windows runners ship bash natively
         run: uv run --no-sync bash scripts/test-cov.sh
         env:
-          COVERAGE_FILE: coverage/.coverage.${{ runner.os }}-py${{ matrix.python-version }}-fa${{ matrix.fastapi-version }}
-          CONTEXT: ${{ runner.os }}-py${{ matrix.python-version }}-fa${{ matrix.fastapi-version }}
+          COVERAGE_FILE: coverage/.coverage.py${{ matrix.python-version }}-fa${{ matrix.fastapi-version }}
+          CONTEXT: py${{ matrix.python-version }}-fa${{ matrix.fastapi-version }}
 
       - name: Store coverage files
         if: matrix.coverage == 'coverage'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: coverage-${{ runner.os }}-${{ matrix.python-version }}-${{ matrix.fastapi-version }}
+          name: coverage-${{ matrix.python-version }}-${{ matrix.fastapi-version }}
           path: coverage
           include-hidden-files: true
 
@@ -119,6 +125,11 @@ jobs:
     permissions:
       contents: read
     steps:
+      - name: Dump GitHub context
+        env:
+          GITHUB_CONTEXT: ${{ toJson(github) }}
+        run: echo "$GITHUB_CONTEXT"
+
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
@@ -126,6 +137,8 @@ jobs:
       - name: Setup uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
+          # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+          # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
           version: "0.11.18"
           enable-cache: true
           cache-dependency-glob: |
@@ -145,6 +158,7 @@ jobs:
       - run: ls -la coverage
       - run: uv run coverage combine coverage
       - run: uv run coverage html --title "Coverage for ${{ github.sha }}"
+      - run: uv run coverage xml
 
       - name: Store coverage HTML
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -153,18 +167,28 @@ jobs:
           path: htmlcov
           include-hidden-files: true
 
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: coverage.xml
+          fail_ci_if_error: true
+
       - run: uv run coverage report --fail-under=100
 
   # https://github.com/marketplace/actions/alls-green#why
-  test-alls-green: # This job does nothing and is only used for the branch protection
+  test-alls-green:  # This job does nothing and is only used for the branch protection
     if: always()
     needs:
       - test
       - coverage-combine
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    permissions: { }
     steps:
+      - name: Dump GitHub context
+        env:
+          GITHUB_CONTEXT: ${{ toJson(github) }}
+        run: echo "$GITHUB_CONTEXT"
       - name: Decide whether the needed jobs succeeded or failed
         uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
         with:

{fastapi_csp_docs-0.1.0 → fastapi_csp_docs-0.1.2}/LICENSE

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2018 Sebastián Ramírez
+Copyright (c) 2026 Matteo Nieddu
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

{fastapi_csp_docs-0.1.0 → fastapi_csp_docs-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-csp-docs
-Version: 0.1.0
+Version: 0.1.2
 Summary: CSP-safe replacements for FastAPI's built-in /docs, /redoc, and OAuth2 redirect endpoints, with no inline script or style
 Project-URL: Homepage, https://github.com/mat81black/fastapi-csp-docs
 Project-URL: Repository, https://github.com/mat81black/fastapi-csp-docs
@@ -31,35 +31,22 @@ Description-Content-Type: text/markdown
 
 # FastAPI CSP Docs
 
-[![PyPI version](https://img.shields.io/pypi/v/fastapi-csp-docs.svg)](https://pypi.org/project/fastapi-csp-docs/)
-[![Test](https://github.com/mat81black/fastapi-csp-docs/actions/workflows/test.yml/badge.svg)](https://github.com/mat81black/fastapi-csp-docs/actions/workflows/test.yml)
-[![Python versions](https://img.shields.io/pypi/pyversions/fastapi-csp-docs.svg)](https://pypi.org/project/fastapi-csp-docs/)
-[![License: MIT](https://img.shields.io/pypi/l/fastapi-csp-docs.svg)](https://github.com/mat81black/fastapi-csp-docs/blob/main/LICENSE)
+[![Build Status](https://github.com/mat81black/fastapi-csp-docs/workflows/Test/badge.svg)](https://github.com/mat81black/fastapi-csp-docs/actions)
+[![codecov](https://codecov.io/gh/mat81black/fastapi-csp-docs/graph/badge.svg)](https://codecov.io/gh/mat81black/fastapi-csp-docs)
+[![Package version](https://badge.fury.io/py/fastapi-csp-docs.svg)](https://pypi.org/project/fastapi-csp-docs/)
+[![Supported Python versions](https://img.shields.io/pypi/pyversions/fastapi-csp-docs.svg?color=%2334D058)](https://pypi.org/project/fastapi-csp-docs/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
 
-FastAPI's built-in `/docs`, `/redoc`, and OAuth2 redirect pages embed inline `<script>`/`<style>`
-tags, so they break under a Content-Security-Policy without `'unsafe-inline'`. Following FastAPI's
-own ["Custom Docs UI Static Assets"](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/)
-recipe only swaps the CDN URLs for local ones — it doesn't remove any inline content:
-`get_swagger_ui_html()` still embeds the Swagger UI bootstrap script inline, `get_redoc_html()`
-still embeds a `<style>` reset inline, and `get_swagger_ui_oauth2_redirect_html()` still embeds
-the OAuth2 redirect logic inline. `fastapi-csp-docs` replaces all three pages with versions that
-load every script and stylesheet from a separate endpoint, with no inline content anywhere.
+FastAPI's built-in `/docs`, `/redoc`, and OAuth2 redirect pages embed inline `<script>`/`<style>` tags, so they break under a Content-Security-Policy without `'unsafe-inline'`. Following FastAPI's own ["Custom Docs UI Static Assets"](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/) recipe only swaps the CDN URLs for local ones; it doesn't remove any inline content: `get_swagger_ui_html()` still embeds the Swagger UI bootstrap script inline, `get_redoc_html()` still embeds a `<style>` reset inline, and `get_swagger_ui_oauth2_redirect_html()` still embeds the OAuth2 redirect logic inline. `fastapi-csp-docs` replaces all three pages with versions that load every script and stylesheet from a separate endpoint, with no inline content anywhere.
 
 ## Features
 
-- **Drop-in `setup()`**: one call replaces FastAPI's built-in `/docs`, `/redoc`, and OAuth2
-  redirect wiring — no inline script or style left anywhere.
-- **Fails fast on misconfiguration**: raises `RuntimeError` if the app's built-in docs aren't
-  disabled first, instead of silently letting them shadow the CSP-safe routes.
-- **CDN or fully self-hosted**: works with the default jsdelivr CDN
-  (`script-src 'self' <cdn-host>`) or entirely offline with your own static assets
-  (`script-src 'self'`, zero external origins).
-- **Reverse-proxy / sub-app aware**: doc URLs include the ASGI `root_path` computed per request,
-  so mounting under a prefix (`app.mount("/api", sub_app)`) works out of the box.
-- **Independently configurable mount paths**: `docs_url`/`redoc_url` are explicit `setup()`
-  parameters, each can be disabled on its own by passing `None`.
-- **Content generators exported for manual wiring**: the same building blocks `setup()` uses
-  internally are public, for a fully self-hosted setup with no CDN at all.
+- **Drop-in `setup()`**: one call replaces FastAPI's built-in `/docs`, `/redoc`, and OAuth2 redirect wiring, with no inline script or style left anywhere.
+- **Fails fast on misconfiguration**: raises `RuntimeError` if the app's built-in docs aren't disabled first, instead of silently letting them shadow the CSP-safe routes.
+- **CDN or fully self-hosted**: works with the default jsdelivr CDN (`script-src 'self' <cdn-host>`) or entirely offline with your own static assets (`script-src 'self'`, zero external origins).
+- **Reverse-proxy / sub-app aware**: doc URLs include the ASGI `root_path` computed per request, so mounting under a prefix (`app.mount("/api", sub_app)`) works out of the box.
+- **Independently configurable mount paths**: `docs_url`/`redoc_url` are explicit `setup()` parameters, each can be disabled on its own by passing `None`.
+- **Content generators exported for manual wiring**: the same building blocks `setup()` uses internally are public, for a fully self-hosted setup with no CDN at all.
 
 ## Requirements
 
@@ -101,20 +88,13 @@ async def add_csp_header(request: Request, call_next) -> Response:
 fastapi_csp_docs.setup(app)
 ```
 
-`docs_url`/`redoc_url` must already be `None` on the app for whichever mode you're enabling —
-`setup()` raises `RuntimeError` otherwise, so FastAPI's built-in inline-script docs can't
-silently shadow the routes it registers.
+`docs_url`/`redoc_url` must already be `None` on the app for whichever mode you're enabling. `setup()` raises `RuntimeError` otherwise, so FastAPI's built-in inline-script docs can't silently shadow the routes it registers.
 
-Full runnable version:
-[`examples/assisted_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/assisted_app.py).
+Full runnable version: [`examples/assisted_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/assisted_app.py).
 
 ### Fully self-hosted mode (no CDN at all)
 
-For a CSP with zero external origins (`script-src 'self'`), skip `setup()` and wire the
-endpoints directly — same mechanics as FastAPI's own
-["Custom Docs UI Static Assets"](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/)
-recipe, but built from this package's content generators instead of `fastapi.openapi.docs`, so
-the OAuth2 redirect page stays script-free too:
+For a CSP with zero external origins (`script-src 'self'`), skip `setup()` and wire the endpoints directly, using the same mechanics as FastAPI's own ["Custom Docs UI Static Assets"](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/) recipe, but built from this package's content generators instead of `fastapi.openapi.docs`, so the OAuth2 redirect page stays script-free too:
 
 ```python
 from fastapi import FastAPI
@@ -136,46 +116,19 @@ async def swagger_ui_html():
     )
 ```
 
-Full runnable version, including the `swagger-initializer.js`/`redoc.css`/OAuth2 redirect
-endpoints and the vendor assets:
-[`examples/self_hosted_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/self_hosted_app.py).
+Full runnable version, including the `swagger-initializer.js`/`redoc.css`/OAuth2 redirect endpoints and the vendor assets: [`examples/self_hosted_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/self_hosted_app.py).
 
 ## ReDoc and Content-Security-Policy
 
-Beyond the inline `<script>`/`<style>` tags this package removes from FastAPI's own generated
-HTML, ReDoc's *own* runtime does three more things that need explicit CSP entries. Both
-examples above already handle these (`examples/_csp.py` for the CDN-based ones,
-`examples/self_hosted_app.py` for the fully self-hosted one) — this section explains why.
-
-**Inline styles (`style-src`)** — ReDoc is built with `styled-components`, which injects
-`<style>` tags into the page at runtime instead of shipping one static stylesheet. This is
-unrelated to the inline content `fastapi-csp-docs` removes — it's ReDoc's own rendering
-mechanism, and this package can't eliminate it. A CSP hash allowlist is used to allow them
-without `'unsafe-inline'`: open DevTools, note the exact `'sha256-...'` value(s) the browser
-reports as blocked, and add them to `style-src`. These hashes are tied to the exact ReDoc
-build, so they need to be recaptured whenever `redoc.standalone.js` is upgraded.
-
-**Web Worker (`worker-src`)** — ReDoc runs its search indexing in a Web Worker, instantiated
-from a `blob:` URL rather than a separate `.js` file: the worker's entire source is inlined as
-a string inside `redoc.standalone.js`, so there's no real file URL to point `worker-src` at
-instead. Worker instantiation is governed by `worker-src`, not `script-src` — without it set
-explicitly, browsers fall back to `script-src`, which never matches a `blob:` URL, so search
-breaks the first time it's used (`Creating a worker from 'blob:...' violates ... worker-src`).
-Two ways to fix it:
-- Allow it explicitly: `worker-src 'self' blob:` — what `assisted_app.py` and the other
-  `setup()`-based examples do, since `setup()` deliberately has no CSP-specific parameters (it
-  mirrors FastAPI's own `docs_url`/`redoc_url` surface, nothing more).
-- Or skip the worker (and the search box) entirely by not using `setup()` for the ReDoc route:
-  pass `redoc_url=None` to `setup()` and wire `/redoc` yourself with
-  `get_redoc_html(disable_search=True)` instead — no `blob:` needed in `worker-src` then. See
-  [`examples/redoc_disable_search_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/redoc_disable_search_app.py).
-
-**Logo image (`img-src`)** — ReDoc's "API docs by Redocly" attribution logo hardcodes an
-absolute `cdn.redoc.ly` URL, with no supported way to override it or point it at a local file.
-There's no CSP hash mechanism for images (hash-source only applies to `script-src`/`style-src`), so the only way to allow it is
-whitelisting that origin in `img-src` — both examples do this, since it's a small, non-code
-image request and doesn't weaken `script-src`/`style-src` at all. It's the one external origin
-left in `self_hosted_app.py`'s otherwise fully self-hosted CSP.
+Beyond the inline `<script>`/`<style>` tags this package removes from FastAPI's own generated HTML, ReDoc's *own* runtime does three more things that need explicit CSP entries. Both examples above already handle these (`examples/_csp.py` for the CDN-based ones, `examples/self_hosted_app.py` for the fully self-hosted one); this section explains why.
+
+**Inline styles (`style-src`)**: ReDoc is built with `styled-components`, which injects `<style>` tags into the page at runtime instead of shipping one static stylesheet. This is unrelated to the inline content `fastapi-csp-docs` removes: it's ReDoc's own rendering mechanism, and this package can't eliminate it. A CSP hash allowlist is used to allow them without `'unsafe-inline'`: open DevTools, note the exact `'sha256-...'` value(s) the browser reports as blocked, and add them to `style-src`. These hashes are tied to the exact ReDoc build, so they need to be recaptured whenever `redoc.standalone.js` is upgraded.
+
+**Web Worker (`worker-src`)**: ReDoc runs its search indexing in a Web Worker, instantiated from a `blob:` URL rather than a separate `.js` file: the worker's entire source is inlined as a string inside `redoc.standalone.js`, so there's no real file URL to point `worker-src` at instead. Worker instantiation is governed by `worker-src`, not `script-src`; without it set explicitly, browsers fall back to `script-src`, which never matches a `blob:` URL, so search breaks the first time it's used (`Creating a worker from 'blob:...' violates ... worker-src`). Two ways to fix it:
+- Allow it explicitly: `worker-src 'self' blob:`, which is what `assisted_app.py` and the other `setup()`-based examples do, since `setup()` deliberately has no CSP-specific parameters (it mirrors FastAPI's own `docs_url`/`redoc_url` surface, nothing more).
+- Or skip the worker (and the search box) entirely by not using `setup()` for the ReDoc route: pass `redoc_url=None` to `setup()` and wire `/redoc` yourself with `get_redoc_html(disable_search=True)` instead, so no `blob:` is needed in `worker-src`. See [`examples/redoc_disable_search_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/redoc_disable_search_app.py).
+
+**Logo image (`img-src`)**: ReDoc's "API docs by Redocly" attribution logo hardcodes an absolute `cdn.redoc.ly` URL, with no supported way to override it or point it at a local file. There's no CSP hash mechanism for images (hash-source only applies to `script-src`/`style-src`), so the only way to allow it is whitelisting that origin in `img-src`; both examples do this, since it's a small, non-code image request and doesn't weaken `script-src`/`style-src` at all. It's the one external origin left in `self_hosted_app.py`'s otherwise fully self-hosted CSP.
 
 ## Reference
 
@@ -206,8 +159,8 @@ Raises `RuntimeError` if `app.docs_url`/`app.redoc_url` is still set for the mod
 |-----------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------|
 | [`examples/assisted_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/assisted_app.py)             | `setup()` + CDN-hosted Swagger UI/ReDoc bundles, CSP header set via middleware.                    |
 | [`examples/self_hosted_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/self_hosted_app.py)       | Fully self-hosted docs (no CDN), manual wiring, vendor assets served from `examples/static/`.       |
-| [`examples/mounted_subapp_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/mounted_subapp_app.py) | `setup()` on a sub-app mounted under a prefix (`app.mount("/api", sub_app)`) — doc URLs resolve correctly via the ASGI `root_path`. |
-| [`examples/root_path_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/root_path_app.py)           | `setup()` on an app created with `FastAPI(root_path="/api")` — the reverse-proxy way of setting `root_path`, as opposed to mounting a sub-app. |
+| [`examples/mounted_subapp_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/mounted_subapp_app.py) | `setup()` on a sub-app mounted under a prefix (`app.mount("/api", sub_app)`), so doc URLs resolve correctly via the ASGI `root_path`. |
+| [`examples/root_path_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/root_path_app.py)           | `setup()` on an app created with `FastAPI(root_path="/api")`, the reverse-proxy way of setting `root_path`, as opposed to mounting a sub-app. |
 | [`examples/oauth2_redirect_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/oauth2_redirect_app.py) | OAuth2 "Authorize" flow with a real security scheme, exercising the `/docs/oauth2-redirect` endpoint `setup()` registers. |
 | [`examples/redoc_disable_search_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/redoc_disable_search_app.py) | `setup()` for Swagger UI + manual ReDoc wiring with `disable_search=True`, avoiding `worker-src 'self' blob:` entirely. |
 
@@ -217,4 +170,4 @@ See [RELEASE_NOTES.md](https://github.com/mat81black/fastapi-csp-docs/blob/main/
 
 ## License
 
-MIT — see [LICENSE](https://github.com/mat81black/fastapi-csp-docs/blob/main/LICENSE).
+MIT. See [LICENSE](https://github.com/mat81black/fastapi-csp-docs/blob/main/LICENSE).

{fastapi_csp_docs-0.1.0 → fastapi_csp_docs-0.1.2}/README.md

@@ -1,34 +1,21 @@
 # FastAPI CSP Docs
 
-[![PyPI version](https://img.shields.io/pypi/v/fastapi-csp-docs.svg)](https://pypi.org/project/fastapi-csp-docs/)
-[![Test](https://github.com/mat81black/fastapi-csp-docs/actions/workflows/test.yml/badge.svg)](https://github.com/mat81black/fastapi-csp-docs/actions/workflows/test.yml)
-[![Python versions](https://img.shields.io/pypi/pyversions/fastapi-csp-docs.svg)](https://pypi.org/project/fastapi-csp-docs/)
-[![License: MIT](https://img.shields.io/pypi/l/fastapi-csp-docs.svg)](https://github.com/mat81black/fastapi-csp-docs/blob/main/LICENSE)
-
-FastAPI's built-in `/docs`, `/redoc`, and OAuth2 redirect pages embed inline `<script>`/`<style>`
-tags, so they break under a Content-Security-Policy without `'unsafe-inline'`. Following FastAPI's
-own ["Custom Docs UI Static Assets"](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/)
-recipe only swaps the CDN URLs for local ones — it doesn't remove any inline content:
-`get_swagger_ui_html()` still embeds the Swagger UI bootstrap script inline, `get_redoc_html()`
-still embeds a `<style>` reset inline, and `get_swagger_ui_oauth2_redirect_html()` still embeds
-the OAuth2 redirect logic inline. `fastapi-csp-docs` replaces all three pages with versions that
-load every script and stylesheet from a separate endpoint, with no inline content anywhere.
+[![Build Status](https://github.com/mat81black/fastapi-csp-docs/workflows/Test/badge.svg)](https://github.com/mat81black/fastapi-csp-docs/actions)
+[![codecov](https://codecov.io/gh/mat81black/fastapi-csp-docs/graph/badge.svg)](https://codecov.io/gh/mat81black/fastapi-csp-docs)
+[![Package version](https://badge.fury.io/py/fastapi-csp-docs.svg)](https://pypi.org/project/fastapi-csp-docs/)
+[![Supported Python versions](https://img.shields.io/pypi/pyversions/fastapi-csp-docs.svg?color=%2334D058)](https://pypi.org/project/fastapi-csp-docs/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
+
+FastAPI's built-in `/docs`, `/redoc`, and OAuth2 redirect pages embed inline `<script>`/`<style>` tags, so they break under a Content-Security-Policy without `'unsafe-inline'`. Following FastAPI's own ["Custom Docs UI Static Assets"](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/) recipe only swaps the CDN URLs for local ones; it doesn't remove any inline content: `get_swagger_ui_html()` still embeds the Swagger UI bootstrap script inline, `get_redoc_html()` still embeds a `<style>` reset inline, and `get_swagger_ui_oauth2_redirect_html()` still embeds the OAuth2 redirect logic inline. `fastapi-csp-docs` replaces all three pages with versions that load every script and stylesheet from a separate endpoint, with no inline content anywhere.
 
 ## Features
 
-- **Drop-in `setup()`**: one call replaces FastAPI's built-in `/docs`, `/redoc`, and OAuth2
-  redirect wiring — no inline script or style left anywhere.
-- **Fails fast on misconfiguration**: raises `RuntimeError` if the app's built-in docs aren't
-  disabled first, instead of silently letting them shadow the CSP-safe routes.
-- **CDN or fully self-hosted**: works with the default jsdelivr CDN
-  (`script-src 'self' <cdn-host>`) or entirely offline with your own static assets
-  (`script-src 'self'`, zero external origins).
-- **Reverse-proxy / sub-app aware**: doc URLs include the ASGI `root_path` computed per request,
-  so mounting under a prefix (`app.mount("/api", sub_app)`) works out of the box.
-- **Independently configurable mount paths**: `docs_url`/`redoc_url` are explicit `setup()`
-  parameters, each can be disabled on its own by passing `None`.
-- **Content generators exported for manual wiring**: the same building blocks `setup()` uses
-  internally are public, for a fully self-hosted setup with no CDN at all.
+- **Drop-in `setup()`**: one call replaces FastAPI's built-in `/docs`, `/redoc`, and OAuth2 redirect wiring, with no inline script or style left anywhere.
+- **Fails fast on misconfiguration**: raises `RuntimeError` if the app's built-in docs aren't disabled first, instead of silently letting them shadow the CSP-safe routes.
+- **CDN or fully self-hosted**: works with the default jsdelivr CDN (`script-src 'self' <cdn-host>`) or entirely offline with your own static assets (`script-src 'self'`, zero external origins).
+- **Reverse-proxy / sub-app aware**: doc URLs include the ASGI `root_path` computed per request, so mounting under a prefix (`app.mount("/api", sub_app)`) works out of the box.
+- **Independently configurable mount paths**: `docs_url`/`redoc_url` are explicit `setup()` parameters, each can be disabled on its own by passing `None`.
+- **Content generators exported for manual wiring**: the same building blocks `setup()` uses internally are public, for a fully self-hosted setup with no CDN at all.
 
 ## Requirements
 
@@ -70,20 +57,13 @@ async def add_csp_header(request: Request, call_next) -> Response:
 fastapi_csp_docs.setup(app)
 ```
 
-`docs_url`/`redoc_url` must already be `None` on the app for whichever mode you're enabling —
-`setup()` raises `RuntimeError` otherwise, so FastAPI's built-in inline-script docs can't
-silently shadow the routes it registers.
+`docs_url`/`redoc_url` must already be `None` on the app for whichever mode you're enabling. `setup()` raises `RuntimeError` otherwise, so FastAPI's built-in inline-script docs can't silently shadow the routes it registers.
 
-Full runnable version:
-[`examples/assisted_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/assisted_app.py).
+Full runnable version: [`examples/assisted_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/assisted_app.py).
 
 ### Fully self-hosted mode (no CDN at all)
 
-For a CSP with zero external origins (`script-src 'self'`), skip `setup()` and wire the
-endpoints directly — same mechanics as FastAPI's own
-["Custom Docs UI Static Assets"](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/)
-recipe, but built from this package's content generators instead of `fastapi.openapi.docs`, so
-the OAuth2 redirect page stays script-free too:
+For a CSP with zero external origins (`script-src 'self'`), skip `setup()` and wire the endpoints directly, using the same mechanics as FastAPI's own ["Custom Docs UI Static Assets"](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/) recipe, but built from this package's content generators instead of `fastapi.openapi.docs`, so the OAuth2 redirect page stays script-free too:
 
 ```python
 from fastapi import FastAPI
@@ -105,46 +85,19 @@ async def swagger_ui_html():
     )
 ```
 
-Full runnable version, including the `swagger-initializer.js`/`redoc.css`/OAuth2 redirect
-endpoints and the vendor assets:
-[`examples/self_hosted_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/self_hosted_app.py).
+Full runnable version, including the `swagger-initializer.js`/`redoc.css`/OAuth2 redirect endpoints and the vendor assets: [`examples/self_hosted_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/self_hosted_app.py).
 
 ## ReDoc and Content-Security-Policy
 
-Beyond the inline `<script>`/`<style>` tags this package removes from FastAPI's own generated
-HTML, ReDoc's *own* runtime does three more things that need explicit CSP entries. Both
-examples above already handle these (`examples/_csp.py` for the CDN-based ones,
-`examples/self_hosted_app.py` for the fully self-hosted one) — this section explains why.
-
-**Inline styles (`style-src`)** — ReDoc is built with `styled-components`, which injects
-`<style>` tags into the page at runtime instead of shipping one static stylesheet. This is
-unrelated to the inline content `fastapi-csp-docs` removes — it's ReDoc's own rendering
-mechanism, and this package can't eliminate it. A CSP hash allowlist is used to allow them
-without `'unsafe-inline'`: open DevTools, note the exact `'sha256-...'` value(s) the browser
-reports as blocked, and add them to `style-src`. These hashes are tied to the exact ReDoc
-build, so they need to be recaptured whenever `redoc.standalone.js` is upgraded.
-
-**Web Worker (`worker-src`)** — ReDoc runs its search indexing in a Web Worker, instantiated
-from a `blob:` URL rather than a separate `.js` file: the worker's entire source is inlined as
-a string inside `redoc.standalone.js`, so there's no real file URL to point `worker-src` at
-instead. Worker instantiation is governed by `worker-src`, not `script-src` — without it set
-explicitly, browsers fall back to `script-src`, which never matches a `blob:` URL, so search
-breaks the first time it's used (`Creating a worker from 'blob:...' violates ... worker-src`).
-Two ways to fix it:
-- Allow it explicitly: `worker-src 'self' blob:` — what `assisted_app.py` and the other
-  `setup()`-based examples do, since `setup()` deliberately has no CSP-specific parameters (it
-  mirrors FastAPI's own `docs_url`/`redoc_url` surface, nothing more).
-- Or skip the worker (and the search box) entirely by not using `setup()` for the ReDoc route:
-  pass `redoc_url=None` to `setup()` and wire `/redoc` yourself with
-  `get_redoc_html(disable_search=True)` instead — no `blob:` needed in `worker-src` then. See
-  [`examples/redoc_disable_search_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/redoc_disable_search_app.py).
-
-**Logo image (`img-src`)** — ReDoc's "API docs by Redocly" attribution logo hardcodes an
-absolute `cdn.redoc.ly` URL, with no supported way to override it or point it at a local file.
-There's no CSP hash mechanism for images (hash-source only applies to `script-src`/`style-src`), so the only way to allow it is
-whitelisting that origin in `img-src` — both examples do this, since it's a small, non-code
-image request and doesn't weaken `script-src`/`style-src` at all. It's the one external origin
-left in `self_hosted_app.py`'s otherwise fully self-hosted CSP.
+Beyond the inline `<script>`/`<style>` tags this package removes from FastAPI's own generated HTML, ReDoc's *own* runtime does three more things that need explicit CSP entries. Both examples above already handle these (`examples/_csp.py` for the CDN-based ones, `examples/self_hosted_app.py` for the fully self-hosted one); this section explains why.
+
+**Inline styles (`style-src`)**: ReDoc is built with `styled-components`, which injects `<style>` tags into the page at runtime instead of shipping one static stylesheet. This is unrelated to the inline content `fastapi-csp-docs` removes: it's ReDoc's own rendering mechanism, and this package can't eliminate it. A CSP hash allowlist is used to allow them without `'unsafe-inline'`: open DevTools, note the exact `'sha256-...'` value(s) the browser reports as blocked, and add them to `style-src`. These hashes are tied to the exact ReDoc build, so they need to be recaptured whenever `redoc.standalone.js` is upgraded.
+
+**Web Worker (`worker-src`)**: ReDoc runs its search indexing in a Web Worker, instantiated from a `blob:` URL rather than a separate `.js` file: the worker's entire source is inlined as a string inside `redoc.standalone.js`, so there's no real file URL to point `worker-src` at instead. Worker instantiation is governed by `worker-src`, not `script-src`; without it set explicitly, browsers fall back to `script-src`, which never matches a `blob:` URL, so search breaks the first time it's used (`Creating a worker from 'blob:...' violates ... worker-src`). Two ways to fix it:
+- Allow it explicitly: `worker-src 'self' blob:`, which is what `assisted_app.py` and the other `setup()`-based examples do, since `setup()` deliberately has no CSP-specific parameters (it mirrors FastAPI's own `docs_url`/`redoc_url` surface, nothing more).
+- Or skip the worker (and the search box) entirely by not using `setup()` for the ReDoc route: pass `redoc_url=None` to `setup()` and wire `/redoc` yourself with `get_redoc_html(disable_search=True)` instead, so no `blob:` is needed in `worker-src`. See [`examples/redoc_disable_search_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/redoc_disable_search_app.py).
+
+**Logo image (`img-src`)**: ReDoc's "API docs by Redocly" attribution logo hardcodes an absolute `cdn.redoc.ly` URL, with no supported way to override it or point it at a local file. There's no CSP hash mechanism for images (hash-source only applies to `script-src`/`style-src`), so the only way to allow it is whitelisting that origin in `img-src`; both examples do this, since it's a small, non-code image request and doesn't weaken `script-src`/`style-src` at all. It's the one external origin left in `self_hosted_app.py`'s otherwise fully self-hosted CSP.
 
 ## Reference
 
@@ -175,8 +128,8 @@ Raises `RuntimeError` if `app.docs_url`/`app.redoc_url` is still set for the mod
 |-----------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------|
 | [`examples/assisted_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/assisted_app.py)             | `setup()` + CDN-hosted Swagger UI/ReDoc bundles, CSP header set via middleware.                    |
 | [`examples/self_hosted_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/self_hosted_app.py)       | Fully self-hosted docs (no CDN), manual wiring, vendor assets served from `examples/static/`.       |
-| [`examples/mounted_subapp_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/mounted_subapp_app.py) | `setup()` on a sub-app mounted under a prefix (`app.mount("/api", sub_app)`) — doc URLs resolve correctly via the ASGI `root_path`. |
-| [`examples/root_path_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/root_path_app.py)           | `setup()` on an app created with `FastAPI(root_path="/api")` — the reverse-proxy way of setting `root_path`, as opposed to mounting a sub-app. |
+| [`examples/mounted_subapp_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/mounted_subapp_app.py) | `setup()` on a sub-app mounted under a prefix (`app.mount("/api", sub_app)`), so doc URLs resolve correctly via the ASGI `root_path`. |
+| [`examples/root_path_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/root_path_app.py)           | `setup()` on an app created with `FastAPI(root_path="/api")`, the reverse-proxy way of setting `root_path`, as opposed to mounting a sub-app. |
 | [`examples/oauth2_redirect_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/oauth2_redirect_app.py) | OAuth2 "Authorize" flow with a real security scheme, exercising the `/docs/oauth2-redirect` endpoint `setup()` registers. |
 | [`examples/redoc_disable_search_app.py`](https://github.com/mat81black/fastapi-csp-docs/blob/main/examples/redoc_disable_search_app.py) | `setup()` for Swagger UI + manual ReDoc wiring with `disable_search=True`, avoiding `worker-src 'self' blob:` entirely. |
 
@@ -186,4 +139,4 @@ See [RELEASE_NOTES.md](https://github.com/mat81black/fastapi-csp-docs/blob/main/
 
 ## License
 
-MIT — see [LICENSE](https://github.com/mat81black/fastapi-csp-docs/blob/main/LICENSE).
+MIT. See [LICENSE](https://github.com/mat81black/fastapi-csp-docs/blob/main/LICENSE).

fastapi_csp_docs-0.1.2/RELEASE_NOTES.md

@@ -0,0 +1,30 @@
+# Release Notes
+
+## Latest Changes
+
+## 0.1.2 (2026-07-09)
+
+### Internal
+
+* 🔧 Integrate Codecov for coverage tracking and update README. PR [#10](https://github.com/mat81black/fastapi-csp-docs/pull/10) by [@mat81black](https://github.com/mat81black).
+
+## 0.1.1 (2026-07-08)
+
+### Docs
+
+* 📝 Update README badge styles and unwrap paragraphs. PR [#8](https://github.com/mat81black/fastapi-csp-docs/pull/8) by [@mat81black](https://github.com/mat81black).
+
+## 0.1.0 (2026-07-08)
+
+🚀 First official public release of **fastapi-csp-docs**.
+
+FastAPI's built-in `/docs`, `/redoc`, and OAuth2 redirect pages embed inline `<script>`/`<style>` tags, breaking any Content-Security-Policy without `'unsafe-inline'`. Even FastAPI's own ["Custom Docs UI Static Assets"](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/) recipe only swaps CDN URLs for local ones, without removing that inline content. `fastapi-csp-docs` replaces all three pages with versions that load every script and stylesheet from a separate endpoint.
+
+### Features
+
+* ✨ `setup(app, *, docs_url="/docs", redoc_url="/redoc")`: one call replaces FastAPI's built-in `/docs`, `/redoc`, and OAuth2 redirect wiring, with no inline script or style left anywhere.
+* ✨ Fails fast on misconfiguration: `setup()` raises `RuntimeError` if the app's built-in docs aren't disabled first, instead of silently letting them shadow the CSP-safe routes.
+* ✨ CDN or fully self-hosted: works with the default jsdelivr CDN (`script-src 'self' <cdn-host>`) or entirely offline with your own static assets (`script-src 'self'`, zero external origins).
+* ✨ Reverse-proxy / sub-app aware: doc URLs include the ASGI `root_path` computed per request, so mounting under a prefix (`app.mount("/api", sub_app)`) works out of the box.
+* ✨ Content generators (`get_swagger_ui_html`, `get_swagger_ui_init_js`, `get_redoc_html`, `get_redoc_css`, `get_swagger_ui_oauth2_redirect_html`, `get_swagger_ui_oauth2_redirect_js`) exported for manual wiring, enabling a fully self-hosted setup with no CDN at all.
+* ✨ `get_redoc_html(disable_search=True)`: disables ReDoc's client-side search box, avoiding the Web Worker it runs in, which otherwise needs `worker-src 'self' blob:` in the CSP, since the worker is instantiated from a `blob:` URL with no separate file to point at instead.

{fastapi_csp_docs-0.1.0 → fastapi_csp_docs-0.1.2}/fastapi_csp_docs/__init__.py

@@ -8,7 +8,7 @@ from fastapi_csp_docs.docs import (
 )
 from fastapi_csp_docs.setup import setup
 
-__version__ = "0.1.0"
+__version__ = "0.1.2"
 
 __all__ = [
     "get_redoc_css",

fastapi_csp_docs-0.1.0/RELEASE_NOTES.md

@@ -1,32 +0,0 @@
-# Release Notes
-
-## Latest Changes
-
-## 0.1.0 (2026-07-08)
-
-🚀 First official public release of **fastapi-csp-docs**.
-
-FastAPI's built-in `/docs`, `/redoc`, and OAuth2 redirect pages embed inline `<script>`/`<style>`
-tags, breaking any Content-Security-Policy without `'unsafe-inline'` — even FastAPI's own
-["Custom Docs UI Static Assets"](https://fastapi.tiangolo.com/how-to/custom-docs-ui-assets/)
-recipe only swaps CDN URLs for local ones, without removing that inline content.
-`fastapi-csp-docs` replaces all three pages with versions that load every script and stylesheet
-from a separate endpoint.
-
-### Features
-
-* ✨ `setup(app, *, docs_url="/docs", redoc_url="/redoc")`: one call replaces FastAPI's built-in
-  `/docs`, `/redoc`, and OAuth2 redirect wiring, with no inline script or style left anywhere.
-* ✨ Fails fast on misconfiguration: `setup()` raises `RuntimeError` if the app's built-in docs
-  aren't disabled first, instead of silently letting them shadow the CSP-safe routes.
-* ✨ CDN or fully self-hosted: works with the default jsdelivr CDN
-  (`script-src 'self' <cdn-host>`) or entirely offline with your own static assets
-  (`script-src 'self'`, zero external origins).
-* ✨ Reverse-proxy / sub-app aware: doc URLs include the ASGI `root_path` computed per request,
-  so mounting under a prefix (`app.mount("/api", sub_app)`) works out of the box.
-* ✨ Content generators (`get_swagger_ui_html`, `get_swagger_ui_init_js`, `get_redoc_html`,
-  `get_redoc_css`, `get_swagger_ui_oauth2_redirect_html`, `get_swagger_ui_oauth2_redirect_js`)
-  exported for manual wiring, enabling a fully self-hosted setup with no CDN at all.
-* ✨ `get_redoc_html(disable_search=True)`: disables ReDoc's client-side search box, avoiding
-  the Web Worker it runs in — which otherwise needs `worker-src 'self' blob:` in the CSP, since
-  the worker is instantiated from a `blob:` URL with no separate file to point at instead.