fastapi-guard 7.2.0__tar.gz → 7.2.2__tar.gz

{fastapi_guard-7.2.0 → fastapi_guard-7.2.2}/.mike.yml

@@ -2,6 +2,8 @@ version_selector: true
 title_switch: true
 versions_file: docs/versions/versions.json
 versions:
+  - 7.2.2
+  - 7.2.1
   - 7.2.0
   - 7.1.1
   - 7.1.0
@@ -46,4 +48,4 @@ versions:
   - 0.3.2
   - latest
 aliases:
-  latest: 7.2.0
+  latest: 7.2.2

{fastapi_guard-7.2.0 → fastapi_guard-7.2.2}/CHANGELOG.md

@@ -3,6 +3,26 @@ Release Notes
 
 ___
 
+v7.2.2 (2026-07-01)
+-------------------
+
+include_router route resolution now descends the FastAPI wrapper (v7.2.2)
+------------------------------------------------------------------------
+
+- **Fixed** — Per-route decorator config now resolves on `include_router` routes under FastAPI >= 0.115. 7.2.1 resolved routes with `route.matches()` but stopped at FastAPI's `_IncludedRouter` wrapper: its `matches()` returns `Match.FULL` with an empty child-scope and the real routes nested inside. Older FastAPI flattened included routers onto the app (so `matches()` found the leaves directly and CI passed), but newer FastAPI keeps them inside the wrapper — so 7.2.1 resolved nothing there and every per-route decorator (`rate_limit`, `max_request_size`, `content_type_filter`, `custom_validation`, `detection_exclusion`, `suspicious_detection`, `usage_monitor`, `honeypot_detection`, behavioral rules) was still inert. Resolution now descends recursively into matched sub-routers/mounts (`.routes`, `original_router.routes`, `.app.routes`), so per-route config fires on `include_router` and path-parameter routes. Direct routes and single-level `include_router` (prefixed or not) are covered; deeply-nested prefixed routers remain a known limitation of the wrapper's child-scope handling. Supersedes the incomplete 7.2.1 fix.
+
+___
+
+v7.2.1 (2026-07-01)
+-------------------
+
+Per-route config resolves on parameterised and included routes (v7.2.1)
+-----------------------------------------------------------------------
+
+- **Fixed** — Per-route decorator config now resolves on routes with path parameters and routes added via `include_router`. `SecurityMiddleware` is a `BaseHTTPMiddleware`, so it runs before the router and `scope["route"]` is unset; it resolved the active route by exact-path string comparison (`r.path == request.url.path`), which never matches a templated path like `/items/{id}`. As a result every per-route decorator (`rate_limit`, `max_request_size`, `content_type_filter`, `custom_validation`, `detection_exclusion`, `suspicious_detection`, behavioral rules, …) silently did nothing on parameterised or router-included routes. Route resolution now replicates Starlette's own `route.matches(scope)` matching, so per-route config fires on those routes too. Static, non-parameterised routes are unaffected.
+
+___
+
 v7.2.0 (2026-06-23)
 -------------------
 

{fastapi_guard-7.2.0 → fastapi_guard-7.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi_guard
-Version: 7.2.0
+Version: 7.2.2
 Summary: Production-ready security middleware for FastAPI — IP filtering, rate limiting, penetration detection, and 20+ per-route security decorators.
 Project-URL: Homepage, https://guard-core.com
 Project-URL: Documentation, https://rennf93.github.io/fastapi-guard/latest/

{fastapi_guard-7.2.0 → fastapi_guard-7.2.2}/guard/middleware.py

@@ -28,6 +28,7 @@ from guard_core.utils import (
 )
 from starlette.middleware.base import BaseHTTPMiddleware
 from starlette.responses import Response as StarletteResponse
+from starlette.routing import Match
 from starlette.types import ASGIApp
 
 from guard.adapters import (
@@ -372,24 +373,54 @@ class SecurityMiddleware(BaseHTTPMiddleware):
         route = request.scope.get("route")
         if route:
             return route
-
         app = request.scope.get("app")
-        if not app or not hasattr(app, "routes"):
+        routes = getattr(app, "routes", None)
+        if not routes:
             return None
-
-        path = request.url.path
-        method = request.method
-        for r in app.routes:
-            if (
-                hasattr(r, "path")
-                and hasattr(r, "methods")
-                and r.path == path
-                and method in r.methods
-                and hasattr(r, "endpoint")
-            ):
+        return self._match_route(routes, request.scope, 0)
+
+    def _match_route(self, routes: Any, scope: Any, depth: int) -> Any:
+        # This middleware is a BaseHTTPMiddleware, so it runs before the router
+        # and scope["route"] is unset. Replicate Starlette's matching, descending
+        # into sub-routers / mounts (FastAPI's include_router inserts a wrapper
+        # route whose real routes are nested inside), so per-route decorator
+        # config resolves for path-parameter and include_router routes, not only
+        # routes flattened directly onto the app.
+        for r in routes:
+            matched, child = self._route_full_match(r, scope)
+            if not matched:
+                continue
+            if hasattr(r, "endpoint"):
                 return r
+            if depth >= 8:
+                continue
+            found = self._match_route(
+                self._sub_routes(r), {**scope, **child}, depth + 1
+            )
+            if found is not None:
+                return found
         return None
 
+    def _route_full_match(self, route: Any, scope: Any) -> tuple[bool, Any]:
+        matches = getattr(route, "matches", None)
+        if matches is None:
+            return False, {}
+        try:
+            match, child = matches(scope)
+        except Exception:
+            return False, {}
+        return match == Match.FULL, child
+
+    def _sub_routes(self, route: Any) -> Any:
+        included = getattr(route, "original_router", None)
+        mounted = getattr(route, "app", None)
+        return (
+            getattr(route, "routes", None)
+            or getattr(included, "routes", None)
+            or getattr(mounted, "routes", None)
+            or []
+        )
+
     def _populate_guard_state(
         self, guard_request: StarletteGuardRequest, request: Request
     ) -> None:

{fastapi_guard-7.2.0 → fastapi_guard-7.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fastapi_guard"
-version = "7.2.0"
+version = "7.2.2"
 description = "Production-ready security middleware for FastAPI — IP filtering, rate limiting, penetration detection, and 20+ per-route security decorators."
 authors = [
     {name = "Renzo Franceschini", email = "rennf93@users.noreply.github.com"}