fastapi-guard 7.2.1__tar.gz → 7.2.2__tar.gz

{fastapi_guard-7.2.1 → fastapi_guard-7.2.2}/.mike.yml

@@ -2,6 +2,7 @@ version_selector: true
 title_switch: true
 versions_file: docs/versions/versions.json
 versions:
+  - 7.2.2
   - 7.2.1
   - 7.2.0
   - 7.1.1
@@ -47,4 +48,4 @@ versions:
   - 0.3.2
   - latest
 aliases:
-  latest: 7.2.1
+  latest: 7.2.2

{fastapi_guard-7.2.1 → fastapi_guard-7.2.2}/CHANGELOG.md

@@ -3,6 +3,16 @@ Release Notes
 
 ___
 
+v7.2.2 (2026-07-01)
+-------------------
+
+include_router route resolution now descends the FastAPI wrapper (v7.2.2)
+------------------------------------------------------------------------
+
+- **Fixed** — Per-route decorator config now resolves on `include_router` routes under FastAPI >= 0.115. 7.2.1 resolved routes with `route.matches()` but stopped at FastAPI's `_IncludedRouter` wrapper: its `matches()` returns `Match.FULL` with an empty child-scope and the real routes nested inside. Older FastAPI flattened included routers onto the app (so `matches()` found the leaves directly and CI passed), but newer FastAPI keeps them inside the wrapper — so 7.2.1 resolved nothing there and every per-route decorator (`rate_limit`, `max_request_size`, `content_type_filter`, `custom_validation`, `detection_exclusion`, `suspicious_detection`, `usage_monitor`, `honeypot_detection`, behavioral rules) was still inert. Resolution now descends recursively into matched sub-routers/mounts (`.routes`, `original_router.routes`, `.app.routes`), so per-route config fires on `include_router` and path-parameter routes. Direct routes and single-level `include_router` (prefixed or not) are covered; deeply-nested prefixed routers remain a known limitation of the wrapper's child-scope handling. Supersedes the incomplete 7.2.1 fix.
+
+___
+
 v7.2.1 (2026-07-01)
 -------------------
 

{fastapi_guard-7.2.1 → fastapi_guard-7.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi_guard
-Version: 7.2.1
+Version: 7.2.2
 Summary: Production-ready security middleware for FastAPI — IP filtering, rate limiting, penetration detection, and 20+ per-route security decorators.
 Project-URL: Homepage, https://guard-core.com
 Project-URL: Documentation, https://rennf93.github.io/fastapi-guard/latest/

{fastapi_guard-7.2.1 → fastapi_guard-7.2.2}/guard/middleware.py

@@ -373,45 +373,54 @@ class SecurityMiddleware(BaseHTTPMiddleware):
         route = request.scope.get("route")
         if route:
             return route
-
         app = request.scope.get("app")
-        if not app or not hasattr(app, "routes"):
+        routes = getattr(app, "routes", None)
+        if not routes:
             return None
+        return self._match_route(routes, request.scope, 0)
 
+    def _match_route(self, routes: Any, scope: Any, depth: int) -> Any:
         # This middleware is a BaseHTTPMiddleware, so it runs before the router
-        # and scope["route"] is unset here. Replicate Starlette's own matching
-        # against the app's routes so per-route decorator config resolves for
-        # routes with path parameters (e.g. "/items/{id}") and routes added via
-        # include_router. A plain ``r.path == request.url.path`` comparison never
-        # matches a templated path, which silently drops per-route config on
-        # every parameterised route.
-        for r in app.routes:
-            if not hasattr(r, "endpoint"):
-                continue
-            matches = getattr(r, "matches", None)
-            if matches is None:
+        # and scope["route"] is unset. Replicate Starlette's matching, descending
+        # into sub-routers / mounts (FastAPI's include_router inserts a wrapper
+        # route whose real routes are nested inside), so per-route decorator
+        # config resolves for path-parameter and include_router routes, not only
+        # routes flattened directly onto the app.
+        for r in routes:
+            matched, child = self._route_full_match(r, scope)
+            if not matched:
                 continue
-            try:
-                match, _ = matches(request.scope)
-            except Exception:
-                continue
-            if match == Match.FULL:
-                return r
-
-        # Fallback for route objects that do not implement matches().
-        path = request.url.path
-        method = request.method
-        for r in app.routes:
-            if (
-                hasattr(r, "path")
-                and hasattr(r, "methods")
-                and r.path == path
-                and method in r.methods
-                and hasattr(r, "endpoint")
-            ):
+            if hasattr(r, "endpoint"):
                 return r
+            if depth >= 8:
+                continue
+            found = self._match_route(
+                self._sub_routes(r), {**scope, **child}, depth + 1
+            )
+            if found is not None:
+                return found
         return None
 
+    def _route_full_match(self, route: Any, scope: Any) -> tuple[bool, Any]:
+        matches = getattr(route, "matches", None)
+        if matches is None:
+            return False, {}
+        try:
+            match, child = matches(scope)
+        except Exception:
+            return False, {}
+        return match == Match.FULL, child
+
+    def _sub_routes(self, route: Any) -> Any:
+        included = getattr(route, "original_router", None)
+        mounted = getattr(route, "app", None)
+        return (
+            getattr(route, "routes", None)
+            or getattr(included, "routes", None)
+            or getattr(mounted, "routes", None)
+            or []
+        )
+
     def _populate_guard_state(
         self, guard_request: StarletteGuardRequest, request: Request
     ) -> None:

{fastapi_guard-7.2.1 → fastapi_guard-7.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fastapi_guard"
-version = "7.2.1"
+version = "7.2.2"
 description = "Production-ready security middleware for FastAPI — IP filtering, rate limiting, penetration detection, and 20+ per-route security decorators."
 authors = [
     {name = "Renzo Franceschini", email = "rennf93@users.noreply.github.com"}