fastapi-observer 0.4.0__tar.gz → 0.4.1__tar.gz

{fastapi_observer-0.4.0/src/fastapi_observer.egg-info → fastapi_observer-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-observer
-Version: 0.4.0
+Version: 0.4.1
 Summary: Zero-glue FastAPI observability with security presets and runtime controls
 Author-email: Vitaee <opensource@vitaee.dev>
 License-Expression: MIT
@@ -704,6 +704,9 @@ The library supports configuration from code and env vars. Below are the most re
 | `METRICS_EXEMPLARS_ENABLED` | `false` | Enable exemplars where supported |
 | `METRICS_FORMAT` | `negotiate` | `prometheus`, `openmetrics`, or `negotiate` |
 
+> [!CAUTION]
+> The `/metrics` endpoint is **unauthenticated by default**. In production it should be restricted to internal networks (e.g. behind a Kubernetes `NetworkPolicy`, VPC security group, or ingress rule that only allows your Prometheus scraper). Exposing it publicly leaks service topology, error rates, and request patterns.
+
 ### Security and trust boundary
 
 | Variable | Default | Description |
@@ -1041,8 +1044,8 @@ Repository integration tests include:
 
 Reproducible benchmark harness and methodology:
 - Guide: [`benchmarks.md`](benchmarks.md)
-- Apps: `examples/benchmarks/plain_fastapi.py` and `examples/benchmarks/observer_fastapi.py`
-- Runner: `examples/benchmarks/run_local_benchmark.sh`
+- Apps: `examples/benchmarks/app.py`
+- Runner: `examples/benchmarks/harness.py`
 
 ---
 
@@ -1053,7 +1056,7 @@ Reproducible benchmark harness and methodology:
 - `0.3.x`: package modularization, sink/metrics hardening, and performance reliability updates
 - `1.0.0`: dynamic runtime controls and plugin stability
 
-Current release version: `0.4.0`
+Current release version: `0.4.1`
 
 ## Changelog Policy
 

{fastapi_observer-0.4.0 → fastapi_observer-0.4.1}/README.md

@@ -634,6 +634,9 @@ The library supports configuration from code and env vars. Below are the most re
 | `METRICS_EXEMPLARS_ENABLED` | `false` | Enable exemplars where supported |
 | `METRICS_FORMAT` | `negotiate` | `prometheus`, `openmetrics`, or `negotiate` |
 
+> [!CAUTION]
+> The `/metrics` endpoint is **unauthenticated by default**. In production it should be restricted to internal networks (e.g. behind a Kubernetes `NetworkPolicy`, VPC security group, or ingress rule that only allows your Prometheus scraper). Exposing it publicly leaks service topology, error rates, and request patterns.
+
 ### Security and trust boundary
 
 | Variable | Default | Description |
@@ -971,8 +974,8 @@ Repository integration tests include:
 
 Reproducible benchmark harness and methodology:
 - Guide: [`benchmarks.md`](benchmarks.md)
-- Apps: `examples/benchmarks/plain_fastapi.py` and `examples/benchmarks/observer_fastapi.py`
-- Runner: `examples/benchmarks/run_local_benchmark.sh`
+- Apps: `examples/benchmarks/app.py`
+- Runner: `examples/benchmarks/harness.py`
 
 ---
 
@@ -983,7 +986,7 @@ Reproducible benchmark harness and methodology:
 - `0.3.x`: package modularization, sink/metrics hardening, and performance reliability updates
 - `1.0.0`: dynamic runtime controls and plugin stability
 
-Current release version: `0.4.0`
+Current release version: `0.4.1`
 
 ## Changelog Policy
 

{fastapi_observer-0.4.0 → fastapi_observer-0.4.1/src/fastapi_observer.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-observer
-Version: 0.4.0
+Version: 0.4.1
 Summary: Zero-glue FastAPI observability with security presets and runtime controls
 Author-email: Vitaee <opensource@vitaee.dev>
 License-Expression: MIT
@@ -704,6 +704,9 @@ The library supports configuration from code and env vars. Below are the most re
 | `METRICS_EXEMPLARS_ENABLED` | `false` | Enable exemplars where supported |
 | `METRICS_FORMAT` | `negotiate` | `prometheus`, `openmetrics`, or `negotiate` |
 
+> [!CAUTION]
+> The `/metrics` endpoint is **unauthenticated by default**. In production it should be restricted to internal networks (e.g. behind a Kubernetes `NetworkPolicy`, VPC security group, or ingress rule that only allows your Prometheus scraper). Exposing it publicly leaks service topology, error rates, and request patterns.
+
 ### Security and trust boundary
 
 | Variable | Default | Description |
@@ -1041,8 +1044,8 @@ Repository integration tests include:
 
 Reproducible benchmark harness and methodology:
 - Guide: [`benchmarks.md`](benchmarks.md)
-- Apps: `examples/benchmarks/plain_fastapi.py` and `examples/benchmarks/observer_fastapi.py`
-- Runner: `examples/benchmarks/run_local_benchmark.sh`
+- Apps: `examples/benchmarks/app.py`
+- Runner: `examples/benchmarks/harness.py`
 
 ---
 
@@ -1053,7 +1056,7 @@ Reproducible benchmark harness and methodology:
 - `0.3.x`: package modularization, sink/metrics hardening, and performance reliability updates
 - `1.0.0`: dynamic runtime controls and plugin stability
 
-Current release version: `0.4.0`
+Current release version: `0.4.1`
 
 ## Changelog Policy
 

{fastapi_observer-0.4.0 → fastapi_observer-0.4.1}/src/fastapi_observer.egg-info/SOURCES.txt

@@ -74,6 +74,7 @@ src/fastapiobserver/sinks/logtail/handler.py
 src/fastapiobserver/sinks/logtail/sink.py
 tests/test_body_media_allowlist.py
 tests/test_config_settings.py
+tests/test_dx_parity.py
 tests/test_excluded_url_precedence.py
 tests/test_fastapi_install.py
 tests/test_graphql_integrations.py
@@ -97,6 +98,7 @@ tests/test_propagation.py
 tests/test_redaction_presets.py
 tests/test_route_template_cardinality.py
 tests/test_runtime_control_auth.py
+tests/test_security_audit_fixes.py
 tests/test_security_redaction.py
 tests/test_sink_circuit_breaker.py
 tests/test_sinks.py

fastapi_observer-0.4.1/src/fastapiobserver/_version.py

@@ -0,0 +1 @@
+__version__ = "0.4.1"

{fastapi_observer-0.4.0 → fastapi_observer-0.4.1}/src/fastapiobserver/logging/formatter.py

@@ -145,7 +145,7 @@ def _build_structured_error(
 def _generate_error_fingerprint(error_type: str, stacktrace: str) -> str:
     """Hash stack trace after stripping out environment-specific noise."""
     if not stacktrace:
-        return hashlib.md5(error_type.encode("utf-8")).hexdigest()
+        return hashlib.sha256(error_type.encode("utf-8")).hexdigest()[:32]
 
     # Strip hexadecimal memory addresses
     sanitized = re.sub(r"0x[0-9a-fA-F]+", "0x<ptr>", stacktrace)
@@ -154,4 +154,4 @@ def _generate_error_fingerprint(error_type: str, stacktrace: str) -> str:
     
     # Combine error type and sanitized trace to ensure distinct groupings
     payload = f"{error_type}:{sanitized}"
-    return hashlib.md5(payload.encode("utf-8")).hexdigest()
+    return hashlib.sha256(payload.encode("utf-8")).hexdigest()[:32]

{fastapi_observer-0.4.0 → fastapi_observer-0.4.1}/src/fastapiobserver/middleware/events.py

@@ -1,11 +1,19 @@
 from __future__ import annotations
 
+import re
 from typing import Any
 from starlette.exceptions import HTTPException as StarletteHTTPException
 from starlette.types import Scope
 
 from ..security import SecurityPolicy, sanitize_event
 
+_CREDENTIAL_RE = re.compile(r"://[^:]+:[^@]+@")
+
+
+def _sanitize_exception_message(msg: str, *, max_length: int = 512) -> str:
+    """Strip credential patterns (e.g. ``://user:pass@``) from exception text."""
+    return _CREDENTIAL_RE.sub("://***:***@", msg)[:max_length]
+
 class _RequestEventBuilder:
     def __init__(self, policy: SecurityPolicy) -> None:
         self.policy = policy
@@ -41,7 +49,7 @@ class _RequestEventBuilder:
             event["response_body"] = response_body
         if exception is not None:
             event["exception_class"] = exception.__class__.__name__
-            event["exception_message"] = str(exception)
+            event["exception_message"] = _sanitize_exception_message(str(exception))
         return sanitize_event(event, self.policy)
 
 
@@ -78,4 +86,5 @@ def _extract_route_template(scope: Scope, raw_path: str) -> str:
             return template
     return raw_path
 
-__all__ = ["_RequestEventBuilder", "_classify_error", "_extract_route_template"]
+__all__ = ["_RequestEventBuilder", "_classify_error", "_extract_route_template", 
+           "_sanitize_exception_message"]

{fastapi_observer-0.4.0 → fastapi_observer-0.4.1}/src/fastapiobserver/middleware/ip.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+import logging
+
 from starlette.types import Scope
 
 from ..security import (
@@ -8,6 +10,8 @@ from ..security import (
     resolve_client_ip,
 )
 
+_LOGGER = logging.getLogger("fastapiobserver.security")
+
 
 def _extract_scope_client_ip(scope: Scope) -> str | None:
     client = scope.get("client")
@@ -22,6 +26,19 @@ def _extract_scope_client_ip(scope: Scope) -> str | None:
 class _IpResolver:
     def __init__(self, policy: TrustedProxyPolicy) -> None:
         self.policy = policy
+        if policy.honor_forwarded_headers:
+            _LOGGER.warning(
+                "security.forwarded_headers.enabled",
+                extra={
+                    "event": {
+                        "message": (
+                            "X-Forwarded-For trust is enabled. "
+                            "Ensure trusted_cidrs is locked to your proxy IPs only."
+                        ),
+                    },
+                    "_skip_enrichers": True,
+                },
+            )
 
     def resolve(
         self,

{fastapi_observer-0.4.0 → fastapi_observer-0.4.1}/src/fastapiobserver/security/policy.py

@@ -57,6 +57,7 @@ GDPR_REDACTED_FIELDS = (
     "date-of-birth",
     "ssn",
     "ip-address",
+    "client-ip",
     "first-name",
     "last-name",
     "full-name",

{fastapi_observer-0.4.0 → fastapi_observer-0.4.1}/src/fastapiobserver/security/redaction.py

@@ -4,6 +4,8 @@ from typing import Any, Mapping
 from .normalize import _normalize_key, _normalize_media_type
 from .policy import _DROP, SecurityPolicy
 
+MAX_SANITIZE_DEPTH = 32
+
 
 def _redact_value(value: Any, policy: SecurityPolicy) -> Any:
     if policy.redaction_mode == "drop":
@@ -49,6 +51,8 @@ def _sanitize_mapping(
     header_allowlist: set[str] | None,
     event_key_allowlist: set[str] | None,
 ) -> dict[str, Any]:
+    if depth > MAX_SANITIZE_DEPTH:
+        return dict(data)
     out: dict[str, Any] = {}
     for key, value in data.items():
         normalized_key = _normalize_key(str(key))

fastapi_observer-0.4.1/tests/test_dx_parity.py

@@ -0,0 +1,79 @@
+import logging
+
+import pytest
+from fastapi.testclient import TestClient
+
+from examples.time_saved.the_hard_way import app as hard_app
+from examples.time_saved.the_easy_way import app as easy_app
+
+
+@pytest.fixture
+def hard_client() -> TestClient:
+    return TestClient(hard_app)
+
+
+@pytest.fixture
+def easy_client() -> TestClient:
+    return TestClient(easy_app)
+
+
+def test_dx_parity_metrics_and_logs(
+    hard_client: TestClient, easy_client: TestClient, caplog: pytest.LogCaptureFixture
+) -> None:
+    caplog.set_level(logging.INFO)
+    
+    # 1. Fire identical requests
+    hard_resp = hard_client.get("/hello/world")
+    easy_resp = easy_client.get("/hello/world")
+
+    assert hard_resp.status_code == 200
+    assert easy_resp.status_code == 200
+
+    # 2. Check JSON Logs
+    # Note: Because the 'hard' way uses a custom JSONFormatter that dumps
+    # strings, we need to inspect the formatted messages or the test log
+    # output. Fortunately, caplog captures records directly!
+    # Let's inspect the Raw capout
+    records = caplog.records
+    assert len(records) >= 4, "Both apps should have emitted log records"
+    
+    # Check "hard way" request log
+    hard_request_logs = [r for r in records if getattr(r, "request_info", None)]
+    assert len(hard_request_logs) == 1
+    
+    # Check "easy way" request log
+    easy_request_logs = [
+        r for r in records
+        if r.name == "fastapiobserver.middleware" and r.message == "request.completed"
+    ]
+    assert len(easy_request_logs) == 1
+
+    # In JSON rendering, these produce identical keys
+    # (trace_id, span_id, request_id, event/request...)
+    # The true test of parity is the presence of the contextual fields
+    assert hasattr(hard_request_logs[0], "request_info")
+    assert hasattr(easy_request_logs[0], "event")
+
+    # 3. Check Prometheus Metrics Parity
+    hard_metrics = hard_client.get("/metrics")
+    easy_metrics = easy_client.get("/metrics")
+
+    assert hard_metrics.status_code == 200
+    assert easy_metrics.status_code == 200
+
+    hard_text = hard_metrics.text
+    easy_text = easy_metrics.text
+
+    # Both should have successfully routed the GET /hello/{name} 
+    # and prevented cardinality explosion via templating.
+    # The 'hard_way' hand-rolled labels looks like:
+    # `http_requests_total{method="GET",path="/hello/{name}",status="200"}`
+    # The 'easy_way' uses standard fastapiobserver prometheus conventions:
+    # `http_server_requests_total{...,path="/hello/{name}",status_code="200"}`
+    
+    assert 'path="/hello/{name}"' in hard_text
+    assert 'path="/hello/{name}"' in easy_text 
+    
+    assert 'status="200"' in hard_text
+    assert 'status_code="200"' in easy_text
+

fastapi_observer-0.4.1/tests/test_security_audit_fixes.py

@@ -0,0 +1,161 @@
+"""Tests for security audit fixes.
+
+Covers:
+- GDPR preset redacts `client_ip` event key
+- Exception message credential sanitization
+- Recursion depth limit in sanitize_event
+- Forwarded-headers startup warning log
+"""
+from __future__ import annotations
+
+import logging
+
+import pytest
+
+from fastapiobserver.middleware.events import (
+    _RequestEventBuilder,
+    _sanitize_exception_message,
+)
+from fastapiobserver.security import SecurityPolicy, sanitize_event
+from fastapiobserver.security.redaction import MAX_SANITIZE_DEPTH
+
+
+# ---------------------------------------------------------------------------
+# P0: GDPR preset redacts `client_ip`
+# ---------------------------------------------------------------------------
+
+def test_gdpr_preset_redacts_client_ip() -> None:
+    policy = SecurityPolicy.from_preset("gdpr")
+    event = {"client_ip": "203.0.113.42", "method": "GET"}
+    sanitized = sanitize_event(event, policy)
+    assert sanitized["client_ip"].startswith("sha256:")
+    assert sanitized["method"] == "GET"
+
+
+def test_gdpr_preset_redacts_client_ip_inside_nested_dict() -> None:
+    policy = SecurityPolicy.from_preset("gdpr")
+    event = {"nested": {"client_ip": "10.0.0.1"}}
+    sanitized = sanitize_event(event, policy)
+    assert sanitized["nested"]["client_ip"].startswith("sha256:")
+
+
+# ---------------------------------------------------------------------------
+# P0: Exception message credential sanitization
+# ---------------------------------------------------------------------------
+
+class TestSanitizeExceptionMessage:
+    def test_strips_basic_credential_url(self) -> None:
+        msg = "Cannot connect to postgres://admin:s3cret@db.example.com:5432/prod"
+        result = _sanitize_exception_message(msg)
+        assert "s3cret" not in result
+        assert "://***:***@" in result
+        assert "db.example.com:5432/prod" in result
+
+    def test_strips_redis_credential_url(self) -> None:
+        msg = "redis://default:my_password@redis.local:6379/0"
+        result = _sanitize_exception_message(msg)
+        assert "my_password" not in result
+        assert "://***:***@" in result
+
+    def test_strips_multiple_credentials(self) -> None:
+        msg = (
+            "DB: postgres://u1:p1@host1/db "
+            "Cache: redis://u2:p2@host2/0"
+        )
+        result = _sanitize_exception_message(msg)
+        assert "p1" not in result
+        assert "p2" not in result
+        assert result.count("://***:***@") == 2
+
+    def test_truncates_long_messages(self) -> None:
+        msg = "x" * 1000
+        result = _sanitize_exception_message(msg, max_length=256)
+        assert len(result) == 256
+
+    def test_preserves_safe_messages(self) -> None:
+        msg = "Connection refused on port 8080"
+        assert _sanitize_exception_message(msg) == msg
+
+    def test_event_builder_sanitizes_exception(self) -> None:
+        builder = _RequestEventBuilder(SecurityPolicy())
+        error = ConnectionError(
+            "Failed: postgres://admin:secret123@db.prod.internal:5432/mydb"
+        )
+        event = builder.build(
+            method="GET",
+            path="/test",
+            status_code=500,
+            duration_seconds=0.1,
+            client_ip=None,
+            request_body=None,
+            response_body=None,
+            error_type="server_error",
+            exception=error,
+        )
+        assert "secret123" not in event["exception_message"]
+        assert "://***:***@" in event["exception_message"]
+
+
+# ---------------------------------------------------------------------------
+# P1: Recursion depth limit
+# ---------------------------------------------------------------------------
+
+def test_sanitize_event_handles_deeply_nested_payload() -> None:
+    """Ensure sanitize_event doesn't RecursionError on extreme nesting."""
+    depth = MAX_SANITIZE_DEPTH + 20  # well beyond the limit
+    data: dict = {"leaf": "value"}
+    for _ in range(depth):
+        data = {"nested": data}
+    # Must not raise RecursionError
+    result = sanitize_event(data, SecurityPolicy())
+    assert isinstance(result, dict)
+
+
+def test_sanitize_event_still_redacts_within_depth_limit() -> None:
+    """Normal nesting (within limit) still redacts correctly."""
+    data: dict = {"password": "secret"}
+    for _ in range(5):
+        data = {"nested": data}
+    result = sanitize_event(data, SecurityPolicy())
+    # Walk to the innermost level
+    inner = result
+    for _ in range(5):
+        inner = inner["nested"]
+    assert inner["password"] == "***"
+
+
+# ---------------------------------------------------------------------------
+# P1: Forwarded-headers startup warning
+# ---------------------------------------------------------------------------
+
+def test_ip_resolver_warns_when_forwarded_headers_enabled(caplog: pytest.LogCaptureFixture) -> None:
+    from fastapiobserver.middleware.ip import _IpResolver
+    from fastapiobserver.security import TrustedProxyPolicy
+
+    policy = TrustedProxyPolicy(
+        enabled=True,
+        honor_forwarded_headers=True,
+    )
+    with caplog.at_level(logging.WARNING, logger="fastapiobserver.security"):
+        _IpResolver(policy)
+
+    assert any(
+        "security.forwarded_headers.enabled" in record.message
+        for record in caplog.records
+    )
+
+
+def test_ip_resolver_no_warning_when_forwarded_headers_disabled(
+        caplog: pytest.LogCaptureFixture
+    ) -> None:
+    from fastapiobserver.middleware.ip import _IpResolver
+    from fastapiobserver.security import TrustedProxyPolicy
+
+    policy = TrustedProxyPolicy(enabled=True, honor_forwarded_headers=False)
+    with caplog.at_level(logging.WARNING, logger="fastapiobserver.security"):
+        _IpResolver(policy)
+
+    assert not any(
+        "X-Forwarded-For trust is enabled" in record.message
+        for record in caplog.records
+    )

fastapi_observer-0.4.0/src/fastapiobserver/_version.py

@@ -1 +0,0 @@
-__version__ = "0.4.0"