fastapi-observer 1.13.0__tar.gz → 1.14.0__tar.gz

{fastapi_observer-1.13.0/src/fastapi_observer.egg-info → fastapi_observer-1.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-observer
-Version: 1.13.0
+Version: 1.14.0
 Summary: Zero-glue FastAPI observability with security presets and runtime controls
 Author-email: Vitaee <opensource@vitaee.dev>
 License-Expression: MIT

{fastapi_observer-1.13.0 → fastapi_observer-1.14.0/src/fastapi_observer.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-observer
-Version: 1.13.0
+Version: 1.14.0
 Summary: Zero-glue FastAPI observability with security presets and runtime controls
 Author-email: Vitaee <opensource@vitaee.dev>
 License-Expression: MIT

fastapi_observer-1.14.0/src/fastapiobserver/_version.py

@@ -0,0 +1 @@
+__version__ = "1.14.0"

{fastapi_observer-1.13.0 → fastapi_observer-1.14.0}/src/fastapiobserver/fastapi.py

@@ -148,6 +148,21 @@ def install_observability(
     if runtime_control_settings and runtime_control_settings.enabled:
         mount_control_plane(app, runtime_control_settings, trusted_proxy_policy)
 
+    if security_policy.redaction_mode == "hash" and security_policy.hash_key is None:
+        _LOGGER.warning(
+            "observability.redaction.hash_key_missing",
+            extra={
+                "event": {
+                    "message": (
+                        "Hashed values use a random key picked at startup, so they differ "
+                        "between processes and after a restart. Set OBS_REDACTION_HASH_KEY "
+                        "to keep them stable."
+                    ),
+                },
+                "_skip_enrichers": True,
+            },
+        )
+
     # --- 9. One line with the settings that took effect ---
     _LOGGER.info(
         "observability.configured",

{fastapi_observer-1.13.0 → fastapi_observer-1.14.0}/src/fastapiobserver/logging/formatter.py

@@ -3,8 +3,9 @@ from __future__ import annotations
 import hashlib
 import json
 import logging
-import re
+import traceback
 from datetime import datetime, timezone
+from types import TracebackType
 from typing import Any, Callable, Mapping
 
 from .._version import __version__
@@ -144,11 +145,11 @@ def _build_structured_error(
             "stacktrace": "",
         }
 
-    exc_type, exc_value, _exc_tb = exc_info
+    exc_type, exc_value, exc_tb = exc_info
     error_type = exc_type.__name__ if exc_type is not None else "Exception"
     error_message = str(exc_value) if exc_value is not None else ""
     stacktrace = formatter.formatException(exc_info)
-    fingerprint = _generate_error_fingerprint(error_type, stacktrace)
+    fingerprint = _generate_error_fingerprint(error_type, exc_tb)
 
     return {
         "type": error_type,
@@ -158,16 +159,13 @@ def _build_structured_error(
     }
 
 
-def _generate_error_fingerprint(error_type: str, stacktrace: str) -> str:
-    """Hash stack trace after stripping out environment-specific noise."""
-    if not stacktrace:
-        return hashlib.sha256(error_type.encode("utf-8")).hexdigest()[:32]
+def _generate_error_fingerprint(error_type: str, exc_tb: TracebackType | None) -> str:
+    """Hash the exception type and the file, function and source of each frame.
 
-    # Strip hexadecimal memory addresses
-    sanitized = re.sub(r"0x[0-9a-fA-F]+", "0x<ptr>", stacktrace)
-    # Strip exact line numbers to survive minor file refactoring
-    sanitized = re.sub(r"line \d+", "line <N>", sanitized)
-    
-    # Combine error type and sanitized trace to ensure distinct groupings
-    payload = f"{error_type}:{sanitized}"
-    return hashlib.sha256(payload.encode("utf-8")).hexdigest()[:32]
+    The message is left out, since it often holds IDs that differ each time the
+    same bug is hit, and so are line numbers, which shift with unrelated edits.
+    """
+    frames = "".join(
+        f"{frame.filename}:{frame.name}:{frame.line}\n" for frame in traceback.extract_tb(exc_tb)
+    )
+    return hashlib.sha256(f"{error_type}\n{frames}".encode("utf-8")).hexdigest()[:32]

{fastapi_observer-1.13.0 → fastapi_observer-1.14.0}/src/fastapiobserver/logging/setup.py

@@ -4,6 +4,7 @@ import atexit
 import logging
 import logging.handlers
 import queue
+import threading
 from typing import Literal, cast
 
 from ..config import ObservabilitySettings
@@ -289,22 +290,16 @@ def _restart_queue_listener_in_child() -> None:
 
     listener = state._QUEUE_LISTENER
     if listener is not None:
-        # The inherited queue's Condition lock might be held by the parent
-        # or left in an inconsistent state across the fork. To reliably resume
-        # processing, we must create a fresh queue. We explicitly drain and 
-        # DROP inherited records because the parent process's listener thread 
-        # is already processing those same records in the parent process. 
-        # Re-queuing them here causes deterministic duplicate logs.
+        # Another thread of the parent may have held any lock at the moment of
+        # the fork, and no thread in the child will release it. So don't touch
+        # the inherited queue, not even to drain it: its records are the
+        # parent's to write. Give the child fresh locks and a fresh queue.
+        _LOG_QUEUE_TELEMETRY._lock = threading.Lock()
+        for breaker in state._SINK_CIRCUIT_BREAKERS:
+            breaker._lock = threading.Lock()
         old_queue = cast(queue.Queue[logging.LogRecord], listener.queue)
         new_queue: queue.Queue[logging.LogRecord] = queue.Queue(maxsize=old_queue.maxsize)
 
-        while not old_queue.empty():
-            try:
-                # Discard the record to prevent pre-fork replay duplication
-                _ = old_queue.get_nowait()
-            except queue.Empty:
-                break
-
         # Re-attach the new queue to the OverflowPolicyQueueHandler if present
         for handler in state._MANAGED_HANDLERS:
             from .queueing import OverflowPolicyQueueHandler

{fastapi_observer-1.13.0 → fastapi_observer-1.14.0}/src/fastapiobserver/middleware/request_logging.py

@@ -4,6 +4,7 @@ import logging
 import re
 import time
 
+from anyio import get_cancelled_exc_class
 from starlette.types import ASGIApp, Message, Receive, Scope, Send
 
 from ..config import ObservabilitySettings
@@ -86,6 +87,8 @@ class RequestLoggingMiddleware:
             max_length=self.security_policy.max_body_length,
         )
         had_error = False
+        cancelled = False
+        response_started = False
 
         async def receive_wrapper() -> Message:
             message = await receive()
@@ -93,8 +96,9 @@ class RequestLoggingMiddleware:
             return message
 
         async def send_wrapper(message: Message) -> None:
-            nonlocal status_code
+            nonlocal status_code, response_started
             if message["type"] == "http.response.start":
+                response_started = True
                 status_code = int(message.get("status", 500))
                 resp_headers = message.get("headers", [])
                 if self.security_policy.log_response_body:
@@ -124,6 +128,13 @@ class RequestLoggingMiddleware:
             captured_error = exc
             status_code = 500
             raise
+        except get_cancelled_exc_class():
+            # The client left, the server is shutting down or a timeout fired.
+            # Not a server error: without a response, use nginx's 499.
+            cancelled = True
+            if not response_started:
+                status_code = 499
+            raise
         finally:
             self._finalize_request(
                 scope=scope,
@@ -136,6 +147,7 @@ class RequestLoggingMiddleware:
                 response_body_capture=response_body_capture,
                 captured_error=captured_error,
                 had_error=had_error,
+                cancelled=cancelled,
             )
 
     def _finalize_request(
@@ -150,10 +162,13 @@ class RequestLoggingMiddleware:
         response_body_capture: _BodyCapture,
         captured_error: Exception | None,
         had_error: bool,
+        cancelled: bool,
     ) -> None:
         duration_seconds = max(0.0, time.perf_counter() - start)
         if had_error:
             level, message = logging.ERROR, "request.failed"
+        elif cancelled:
+            level, message = logging.WARNING, "request.cancelled"
         elif status_code >= 500:
             level, message = logging.ERROR, "request.server_error"
         elif status_code >= 400:

{fastapi_observer-1.13.0 → fastapi_observer-1.14.0}/src/fastapiobserver/security/policy.py

@@ -1,7 +1,7 @@
 import os
 from typing import Any, Literal
 
-from pydantic import BaseModel, ConfigDict, Field, ValidationInfo, field_validator
+from pydantic import BaseModel, ConfigDict, Field, SecretStr, ValidationInfo, field_validator
 from pydantic_settings import BaseSettings
 
 from ..utils import EnvLoadable, InternalSettingsBase, parse_csv
@@ -88,6 +88,7 @@ _SECURITY_POLICY_ENV_MAP = {
     "redacted_headers": "OBS_REDACTED_HEADERS",
     "redaction_mode": "OBS_REDACTION_MODE",
     "mask_text": "OBS_MASK_TEXT",
+    "hash_key": "OBS_REDACTION_HASH_KEY",
     "log_request_body": "OBS_LOG_REQUEST_BODY",
     "log_response_body": "OBS_LOG_RESPONSE_BODY",
     "max_body_length": "OBS_MAX_BODY_LENGTH",
@@ -112,6 +113,9 @@ class SecurityPolicy(EnvLoadable, BaseModel):
     redacted_headers: tuple[str, ...] = DEFAULT_REDACTED_HEADERS
     redaction_mode: RedactionMode = "mask"
     mask_text: str = "***"
+    # HMAC key for the hash mode. Without one, a random key is picked at import,
+    # so the same value hashes differently in other processes and after a restart.
+    hash_key: SecretStr | None = None
     log_request_body: bool = False
     log_response_body: bool = False
     max_body_length: int = Field(default=256, gt=0)
@@ -233,6 +237,7 @@ class _SecurityPolicySettings(InternalSettingsBase):
         validation_alias="OBS_REDACTION_MODE",
     )
     mask_text: str | None = Field(default=None, validation_alias="OBS_MASK_TEXT")
+    hash_key: SecretStr | None = Field(default=None, validation_alias="OBS_REDACTION_HASH_KEY")
     log_request_body: bool | None = Field(
         default=None,
         validation_alias="OBS_LOG_REQUEST_BODY",

{fastapi_observer-1.13.0 → fastapi_observer-1.14.0}/src/fastapiobserver/security/redaction.py

@@ -1,5 +1,7 @@
 import functools
 import hashlib
+import hmac
+import secrets
 from collections.abc import Mapping
 from typing import Any
 
@@ -8,6 +10,7 @@ from .policy import _DROP, SecurityPolicy
 
 MAX_SANITIZE_DEPTH = 32
 _SCALAR_TYPES = frozenset({str, int, float, bool})
+_PROCESS_KEY = secrets.token_bytes(32)  # for policies without a hash_key
 
 
 @functools.lru_cache(maxsize=64)
@@ -33,8 +36,11 @@ def _redact_value(value: Any, policy: SecurityPolicy) -> Any:
     if policy.redaction_mode == "drop":
         return _DROP
     if policy.redaction_mode == "hash":
-        digest = hashlib.sha256(str(value).encode("utf-8")).hexdigest()
-        return f"sha256:{digest}"
+        # Keyed: a plain hash of an email or phone number is reversed by
+        # hashing candidates until one matches.
+        key = policy.hash_key.get_secret_value().encode() if policy.hash_key else _PROCESS_KEY
+        digest = hmac.new(key, str(value).encode("utf-8"), hashlib.sha256).hexdigest()
+        return f"hmac-sha256:{digest}"
     return policy.mask_text
 
 

{fastapi_observer-1.13.0 → fastapi_observer-1.14.0}/tests/test_fork_queue_listener.py

@@ -1,12 +1,14 @@
 import logging
 import queue
+import threading
 from unittest.mock import Mock
 from fastapiobserver.logging.setup import _restart_queue_listener_in_child
 import fastapiobserver.logging.state as state
-from fastapiobserver.logging.queueing import OverflowPolicyQueueHandler
+from fastapiobserver.logging.circuit_breaker import SinkCircuitBreakerHandler
+from fastapiobserver.logging.queueing import _LOG_QUEUE_TELEMETRY, OverflowPolicyQueueHandler
 
 
-def test_restart_queue_listener_in_child_drains_and_recreates_queue():
+def test_restart_queue_listener_in_child_recreates_queue():
     # Setup mock state
     old_queue = queue.Queue(maxsize=10)
     old_queue.put_nowait(
@@ -36,8 +38,6 @@ def test_restart_queue_listener_in_child_drains_and_recreates_queue():
         _restart_queue_listener_in_child()
 
         # Assertions
-        assert old_queue.empty()
-        
         # Verify the new listener was created and started
         new_listener = state._QUEUE_LISTENER
         assert new_listener is not mock_listener
@@ -58,3 +58,36 @@ def test_restart_queue_listener_in_child_drains_and_recreates_queue():
             
         state._QUEUE_LISTENER = original_listener
         state._MANAGED_HANDLERS = original_handlers
+
+
+def test_restart_in_child_ignores_locks_held_at_fork():
+    # In the parent, the listener or a request thread can hold these locks at the
+    # moment of the fork. Nothing in the child releases them.
+    old_queue = queue.Queue(maxsize=10)
+    breaker = SinkCircuitBreakerHandler(
+        sink_name="stdout",
+        delegate=logging.NullHandler(),
+        failure_threshold=1,
+        recovery_timeout_seconds=1,
+    )
+    held = [old_queue.mutex, _LOG_QUEUE_TELEMETRY._lock, breaker._lock]
+    listener = Mock(queue=old_queue, handlers=[], respect_handler_level=True)
+    saved = (state._QUEUE_LISTENER, state._SINK_CIRCUIT_BREAKERS, _LOG_QUEUE_TELEMETRY._lock)
+    state._QUEUE_LISTENER = listener
+    state._SINK_CIRCUIT_BREAKERS = [breaker]
+    for lock in held:
+        lock.acquire()
+    try:
+        child = threading.Thread(target=_restart_queue_listener_in_child, daemon=True)
+        child.start()
+        child.join(timeout=2)
+
+        assert not child.is_alive()
+        assert not _LOG_QUEUE_TELEMETRY._lock.locked()
+        assert not breaker._lock.locked()
+    finally:
+        for lock in held:
+            lock.release()
+        if isinstance(state._QUEUE_LISTENER, logging.handlers.QueueListener):
+            state._QUEUE_LISTENER.stop()
+        state._QUEUE_LISTENER, state._SINK_CIRCUIT_BREAKERS, _LOG_QUEUE_TELEMETRY._lock = saved

{fastapi_observer-1.13.0 → fastapi_observer-1.14.0}/tests/test_logging_schema_contract.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import json
 import logging
 import logging.config
+import sys
 import time
 
 import pytest
@@ -285,40 +286,26 @@ def test_structured_formatter_emits_structured_error_payload() -> None:
     assert "fingerprint" in payload["error"]
 
 
-def test_error_fingerprint_is_stable_across_transient_noise() -> None:
-    settings = ObservabilitySettings(app_name="test", service="test", environment="test")
+def test_error_fingerprint_groups_by_where_it_was_raised_not_by_message() -> None:
+    formatter = StructuredJsonFormatter(
+        ObservabilitySettings(app_name="test", service="test", environment="test")
+    )
 
-    def _simulated_error(noise: str) -> logging.LogRecord:
+    def fingerprint(user_id: int, other_site: bool = False) -> str:
         try:
-            # The line number and this arbitrary noise will be stripped by the fingerprinter
-            raise ValueError(f"Some business logic failed {noise}")
-        except ValueError as e:
-            # We purposely monkeypatch the exception string to inject fake memory addresses
-            # to simulate two different object lifetimes.
-            fake_tb = f'File "app.py", line 42, in <module>\n  <MyObject object at {noise}>'
-            exc_info = (e.__class__, e, e.__traceback__)
+            if other_site:
+                raise LookupError(f"user {user_id} not found")
+            raise LookupError(f"user {user_id} not found at 0x{id(object()):x}")
+        except LookupError:
             record = logging.LogRecord(
                 name="test", level=logging.ERROR, pathname="", lineno=0,
-                msg="error", args=(), exc_info=exc_info
+                msg="error", args=(), exc_info=sys.exc_info(),
             )
-            # Override the traceback formatting via a mock class for the test
-            class MockFormatter(StructuredJsonFormatter):
-                def formatException(self, exc_info):
-                    return fake_tb
-
-            mock_formatter = MockFormatter(settings)
-
-            payload = json.loads(mock_formatter.format(record))
-            return payload["error"]["fingerprint"]
-
-    # Even though the simulated memory addresses differ completely, the fingerprint
-    # must remain identical since it's the same error type and file location.
-    fingerprint_a = _simulated_error("0x10a2b3c4d")
-    fingerprint_b = _simulated_error("0x7f8e9d0c1b2a")
+        return str(json.loads(formatter.format(record))["error"]["fingerprint"])
 
-    assert fingerprint_a == fingerprint_b
-    assert isinstance(fingerprint_a, str)
-    assert len(fingerprint_a) == 32  # MD5 hex length
+    assert fingerprint(1) == fingerprint(2)
+    assert fingerprint(1) != fingerprint(1, other_site=True)
+    assert len(fingerprint(1)) == 32
 
 def test_request_id_filter_standalone() -> None:
     from fastapiobserver.logging import RequestIdFilter

{fastapi_observer-1.13.0 → fastapi_observer-1.14.0}/tests/test_middleware.py

@@ -202,3 +202,41 @@ def test_extract_route_template_contract() -> None:
         "route": type("Route", (), {"path": "/users/{user_id}"})(),
     }
     assert _extract_route_template(scope, "/raw", 404) == "/users/{user_id}"
+
+
+def test_cancelled_request_is_logged_as_cancelled_not_as_a_server_error(caplog) -> None:
+    import asyncio
+
+    from fastapiobserver.middleware import RequestLoggingMiddleware
+
+    async def cancelled_before_response(scope, receive, send) -> None:
+        raise asyncio.CancelledError()
+
+    async def cancelled_mid_stream(scope, receive, send) -> None:
+        await send({"type": "http.response.start", "status": 200, "headers": []})
+        raise asyncio.CancelledError()
+
+    async def no_op_send(message) -> None:
+        pass
+
+    async def run(app) -> None:
+        middleware = RequestLoggingMiddleware(
+            app, ObservabilitySettings(app_name="test", service="svc", environment="test")
+        )
+        scope = {"type": "http", "method": "GET", "path": "/slow", "headers": []}
+        with pytest.raises(asyncio.CancelledError):
+            await middleware(scope, None, no_op_send)
+
+    with caplog.at_level(logging.INFO, logger="fastapiobserver.middleware"):
+        asyncio.run(run(cancelled_before_response))
+        asyncio.run(run(cancelled_mid_stream))
+
+    lines = [
+        (record.getMessage(), record.levelno, record.event["status_code"])
+        for record in caplog.records
+        if record.name == "fastapiobserver.middleware"
+    ]
+    assert lines == [
+        ("request.cancelled", logging.WARNING, 499),
+        ("request.cancelled", logging.WARNING, 200),
+    ]

{fastapi_observer-1.13.0 → fastapi_observer-1.14.0}/tests/test_redaction_presets.py

@@ -1,5 +1,8 @@
 from __future__ import annotations
 
+import hashlib
+import hmac
+
 import pytest
 
 import fastapiobserver
@@ -49,9 +52,9 @@ def test_gdpr_preset_hashes_pii_fields() -> None:
 
     sanitized = sanitize_event(payload, policy)
 
-    assert sanitized["email"].startswith("sha256:")
-    assert sanitized["phone"].startswith("sha256:")
-    assert sanitized["address"].startswith("sha256:")
+    assert sanitized["email"].startswith("hmac-sha256:")
+    assert sanitized["phone"].startswith("hmac-sha256:")
+    assert sanitized["address"].startswith("hmac-sha256:")
 
 
 def test_preset_can_be_overridden_by_env(monkeypatch: pytest.MonkeyPatch) -> None:
@@ -69,3 +72,18 @@ def test_preset_constants_are_available_in_public_api() -> None:
     assert "strict" in fastapiobserver.SECURITY_POLICY_PRESETS
     assert fastapiobserver.PCI_REDACTED_FIELDS
     assert fastapiobserver.GDPR_REDACTED_FIELDS
+
+
+def test_hash_mode_is_keyed_so_values_cannot_be_recovered_by_guessing(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    phone = "+1234567890"
+    monkeypatch.setenv("OBS_REDACTION_PRESET", "gdpr")
+    monkeypatch.setenv("OBS_REDACTION_HASH_KEY", "k1")
+    from_env = sanitize_event({"phone": phone}, SecurityPolicy.from_env())["phone"]
+    keyed = hmac.new(b"k1", phone.encode(), hashlib.sha256).hexdigest()
+
+    assert from_env == f"hmac-sha256:{keyed}"
+    assert hashlib.sha256(phone.encode()).hexdigest() not in from_env
+    other_key = SecurityPolicy(redaction_mode="hash", redacted_fields=("phone",), hash_key="k2")
+    assert sanitize_event({"phone": phone}, other_key)["phone"] != from_env

{fastapi_observer-1.13.0 → fastapi_observer-1.14.0}/tests/test_security_audit_fixes.py

@@ -28,7 +28,7 @@ def test_gdpr_preset_redacts_client_ip() -> None:
     policy = SecurityPolicy.from_preset("gdpr")
     event = {"client_ip": "203.0.113.42", "method": "GET"}
     sanitized = sanitize_event(event, policy)
-    assert sanitized["client_ip"].startswith("sha256:")
+    assert sanitized["client_ip"].startswith("hmac-sha256:")
     assert sanitized["method"] == "GET"
 
 
@@ -36,7 +36,7 @@ def test_gdpr_preset_redacts_client_ip_inside_nested_dict() -> None:
     policy = SecurityPolicy.from_preset("gdpr")
     event = {"nested": {"client_ip": "10.0.0.1"}}
     sanitized = sanitize_event(event, policy)
-    assert sanitized["nested"]["client_ip"].startswith("sha256:")
+    assert sanitized["nested"]["client_ip"].startswith("hmac-sha256:")
 
 
 # ---------------------------------------------------------------------------

fastapi_observer-1.13.0/src/fastapiobserver/_version.py

@@ -1 +0,0 @@
-__version__ = "1.13.0"