fastapi-observer 1.4.0__tar.gz → 1.5.0__tar.gz

{fastapi_observer-1.4.0/src/fastapi_observer.egg-info → fastapi_observer-1.5.0}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.4
 Name: fastapi-observer
-Version: 1.4.0
+Version: 1.5.0
 Summary: Zero-glue FastAPI observability with security presets and runtime controls
 Author-email: Vitaee <opensource@vitaee.dev>
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/Vitaee/FastapiObserver
-Project-URL: Documentation, https://github.com/Vitaee/FastapiObserver#readme
+Project-URL: Documentation, https://vitaee.github.io/FastapiObserver/
 Project-URL: Repository, https://github.com/Vitaee/FastapiObserver.git
 Project-URL: Issues, https://github.com/Vitaee/FastapiObserver/issues
 Project-URL: Funding, https://buymeacoffee.com/FYbPCSu
@@ -14,7 +14,6 @@ Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
@@ -24,7 +23,7 @@ Classifier: Framework :: FastAPI
 Classifier: Topic :: System :: Logging
 Classifier: Topic :: System :: Monitoring
 Classifier: Typing :: Typed
-Requires-Python: <3.16,>=3.10
+Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: fastapi>=0.133.0
@@ -64,8 +63,7 @@ Requires-Dist: opentelemetry-instrumentation-requests>=0.66b1; extra == "all"
 Requires-Dist: opentelemetry-instrumentation-sqlalchemy>=0.66b1; extra == "all"
 Requires-Dist: cryptography>=50.0.0; extra == "all"
 Provides-Extra: dev
-Requires-Dist: httpx>=0.28.1; python_version < "3.11" and extra == "dev"
-Requires-Dist: httpx2>=2.16.0; python_version >= "3.11" and extra == "dev"
+Requires-Dist: httpx2>=2.16.0; extra == "dev"
 Requires-Dist: loguru>=0.7.3; extra == "dev"
 Requires-Dist: mypy>=2.4.1; extra == "dev"
 Requires-Dist: pip-audit>=2.10.1; extra == "dev"
@@ -85,7 +83,9 @@ Dynamic: license-file
 
 `fastapi-observer` gives you structured JSON logs, request correlation, Prometheus metrics, OpenTelemetry tracing, security redaction presets, and runtime controls in one install step and one function call.
 
-**Supported Python versions:** `3.10` to `3.15`
+**Documentation:** [vitaee.github.io/FastapiObserver](https://vitaee.github.io/FastapiObserver/)
+
+**Supported Python versions:** `3.11` and newer (CI-tested on `3.11` to `3.15`)
 
 ---
 
@@ -94,7 +94,7 @@ Dynamic: license-file
 
 | Component | Supported / Tested |
 |---|---|
-| Python | `3.10` to `3.15` (CI matrix) |
+| Python | `>=3.11` (CI matrix: `3.11` to `3.15`) |
 | FastAPI | `>=0.133.0` |
 | Starlette | `>=1.3.1` |
 | pydantic-settings | `>=2.10.1` |
@@ -233,17 +233,17 @@ To dramatically reduce boilerplate, you can use the `OBS_PROFILE` environment va
 
 ## Documentation Map
 
-For deep-dive documentation, read the `docs/` folder:
-- [Security & Presets](docs/security.md)
-- [Environment Variables](docs/configuration.md)
-- [Runtime Control](docs/runtime-control.md)
-- [OpenTelemetry](docs/opentelemetry.md)
-- [Logtail Sink](docs/logtail-sink.md)
-- [Audit Logging](docs/audit-logging.md)
-- [Database Tracing](docs/db-tracing.md)
-- [GraphQL Support](docs/graphql.md)
-- [Architecture & Operations](docs/architecture.md)
-- [Production Deployment](docs/deployment.md)
-- [Performance Tuning](docs/tuning.md)
-- [Advanced Operations](docs/advanced.md)
-- [Maintenance & Contributing](docs/contributing.md) (quality gates, release flow, runtime stress harness)
+Full documentation lives at [vitaee.github.io/FastapiObserver](https://vitaee.github.io/FastapiObserver/). Deep dives:
+- [Security & Presets](https://vitaee.github.io/FastapiObserver/security/)
+- [Environment Variables](https://vitaee.github.io/FastapiObserver/configuration/)
+- [Runtime Control](https://vitaee.github.io/FastapiObserver/runtime-control/)
+- [OpenTelemetry](https://vitaee.github.io/FastapiObserver/opentelemetry/)
+- [Logtail Sink](https://vitaee.github.io/FastapiObserver/logtail-sink/)
+- [Audit Logging](https://vitaee.github.io/FastapiObserver/audit-logging/)
+- [Database Tracing](https://vitaee.github.io/FastapiObserver/db-tracing/)
+- [GraphQL Support](https://vitaee.github.io/FastapiObserver/graphql/)
+- [Architecture & Operations](https://vitaee.github.io/FastapiObserver/architecture/)
+- [Production Deployment](https://vitaee.github.io/FastapiObserver/deployment/)
+- [Performance Tuning](https://vitaee.github.io/FastapiObserver/tuning/)
+- [Advanced Operations](https://vitaee.github.io/FastapiObserver/advanced/)
+- [Maintenance & Contributing](https://vitaee.github.io/FastapiObserver/contributing/) (quality gates, release flow, runtime stress harness)

{fastapi_observer-1.4.0 → fastapi_observer-1.5.0}/README.md

@@ -7,7 +7,9 @@
 
 `fastapi-observer` gives you structured JSON logs, request correlation, Prometheus metrics, OpenTelemetry tracing, security redaction presets, and runtime controls in one install step and one function call.
 
-**Supported Python versions:** `3.10` to `3.15`
+**Documentation:** [vitaee.github.io/FastapiObserver](https://vitaee.github.io/FastapiObserver/)
+
+**Supported Python versions:** `3.11` and newer (CI-tested on `3.11` to `3.15`)
 
 ---
 
@@ -16,7 +18,7 @@
 
 | Component | Supported / Tested |
 |---|---|
-| Python | `3.10` to `3.15` (CI matrix) |
+| Python | `>=3.11` (CI matrix: `3.11` to `3.15`) |
 | FastAPI | `>=0.133.0` |
 | Starlette | `>=1.3.1` |
 | pydantic-settings | `>=2.10.1` |
@@ -155,17 +157,17 @@ To dramatically reduce boilerplate, you can use the `OBS_PROFILE` environment va
 
 ## Documentation Map
 
-For deep-dive documentation, read the `docs/` folder:
-- [Security & Presets](docs/security.md)
-- [Environment Variables](docs/configuration.md)
-- [Runtime Control](docs/runtime-control.md)
-- [OpenTelemetry](docs/opentelemetry.md)
-- [Logtail Sink](docs/logtail-sink.md)
-- [Audit Logging](docs/audit-logging.md)
-- [Database Tracing](docs/db-tracing.md)
-- [GraphQL Support](docs/graphql.md)
-- [Architecture & Operations](docs/architecture.md)
-- [Production Deployment](docs/deployment.md)
-- [Performance Tuning](docs/tuning.md)
-- [Advanced Operations](docs/advanced.md)
-- [Maintenance & Contributing](docs/contributing.md) (quality gates, release flow, runtime stress harness)
+Full documentation lives at [vitaee.github.io/FastapiObserver](https://vitaee.github.io/FastapiObserver/). Deep dives:
+- [Security & Presets](https://vitaee.github.io/FastapiObserver/security/)
+- [Environment Variables](https://vitaee.github.io/FastapiObserver/configuration/)
+- [Runtime Control](https://vitaee.github.io/FastapiObserver/runtime-control/)
+- [OpenTelemetry](https://vitaee.github.io/FastapiObserver/opentelemetry/)
+- [Logtail Sink](https://vitaee.github.io/FastapiObserver/logtail-sink/)
+- [Audit Logging](https://vitaee.github.io/FastapiObserver/audit-logging/)
+- [Database Tracing](https://vitaee.github.io/FastapiObserver/db-tracing/)
+- [GraphQL Support](https://vitaee.github.io/FastapiObserver/graphql/)
+- [Architecture & Operations](https://vitaee.github.io/FastapiObserver/architecture/)
+- [Production Deployment](https://vitaee.github.io/FastapiObserver/deployment/)
+- [Performance Tuning](https://vitaee.github.io/FastapiObserver/tuning/)
+- [Advanced Operations](https://vitaee.github.io/FastapiObserver/advanced/)
+- [Maintenance & Contributing](https://vitaee.github.io/FastapiObserver/contributing/) (quality gates, release flow, runtime stress harness)

{fastapi_observer-1.4.0 → fastapi_observer-1.5.0}/pyproject.toml

@@ -7,7 +7,7 @@ name = "fastapi-observer"
 dynamic = ["version"]
 description = "Zero-glue FastAPI observability with security presets and runtime controls"
 readme = "README.md"
-requires-python = ">=3.10,<3.16"
+requires-python = ">=3.11"
 authors = [
     { name = "Vitaee", email = "opensource@vitaee.dev" },
 ]
@@ -16,7 +16,6 @@ classifiers = [
     "Intended Audience :: Developers",
     "Operating System :: OS Independent",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
@@ -38,7 +37,7 @@ dependencies = [
 
 [project.urls]
 Homepage = "https://github.com/Vitaee/FastapiObserver"
-Documentation = "https://github.com/Vitaee/FastapiObserver#readme"
+Documentation = "https://vitaee.github.io/FastapiObserver/"
 Repository = "https://github.com/Vitaee/FastapiObserver.git"
 Issues = "https://github.com/Vitaee/FastapiObserver/issues"
 Funding = "https://buymeacoffee.com/FYbPCSu"
@@ -87,8 +86,7 @@ all = [
     "cryptography>=50.0.0",
 ]
 dev = [
-    "httpx>=0.28.1; python_version < '3.11'",
-    "httpx2>=2.16.0; python_version >= '3.11'",
+    "httpx2>=2.16.0",
     "loguru>=0.7.3",
     "mypy>=2.4.1",
     "pip-audit>=2.10.1",
@@ -109,7 +107,7 @@ version = { attr = "fastapiobserver._version.__version__" }
 where = ["src"]
 
 [tool.ruff]
-target-version = "py310"
+target-version = "py311"
 line-length = 100
 src = ["src", "tests"]
 

{fastapi_observer-1.4.0 → fastapi_observer-1.5.0/src/fastapi_observer.egg-info}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.4
 Name: fastapi-observer
-Version: 1.4.0
+Version: 1.5.0
 Summary: Zero-glue FastAPI observability with security presets and runtime controls
 Author-email: Vitaee <opensource@vitaee.dev>
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/Vitaee/FastapiObserver
-Project-URL: Documentation, https://github.com/Vitaee/FastapiObserver#readme
+Project-URL: Documentation, https://vitaee.github.io/FastapiObserver/
 Project-URL: Repository, https://github.com/Vitaee/FastapiObserver.git
 Project-URL: Issues, https://github.com/Vitaee/FastapiObserver/issues
 Project-URL: Funding, https://buymeacoffee.com/FYbPCSu
@@ -14,7 +14,6 @@ Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
@@ -24,7 +23,7 @@ Classifier: Framework :: FastAPI
 Classifier: Topic :: System :: Logging
 Classifier: Topic :: System :: Monitoring
 Classifier: Typing :: Typed
-Requires-Python: <3.16,>=3.10
+Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: fastapi>=0.133.0
@@ -64,8 +63,7 @@ Requires-Dist: opentelemetry-instrumentation-requests>=0.66b1; extra == "all"
 Requires-Dist: opentelemetry-instrumentation-sqlalchemy>=0.66b1; extra == "all"
 Requires-Dist: cryptography>=50.0.0; extra == "all"
 Provides-Extra: dev
-Requires-Dist: httpx>=0.28.1; python_version < "3.11" and extra == "dev"
-Requires-Dist: httpx2>=2.16.0; python_version >= "3.11" and extra == "dev"
+Requires-Dist: httpx2>=2.16.0; extra == "dev"
 Requires-Dist: loguru>=0.7.3; extra == "dev"
 Requires-Dist: mypy>=2.4.1; extra == "dev"
 Requires-Dist: pip-audit>=2.10.1; extra == "dev"
@@ -85,7 +83,9 @@ Dynamic: license-file
 
 `fastapi-observer` gives you structured JSON logs, request correlation, Prometheus metrics, OpenTelemetry tracing, security redaction presets, and runtime controls in one install step and one function call.
 
-**Supported Python versions:** `3.10` to `3.15`
+**Documentation:** [vitaee.github.io/FastapiObserver](https://vitaee.github.io/FastapiObserver/)
+
+**Supported Python versions:** `3.11` and newer (CI-tested on `3.11` to `3.15`)
 
 ---
 
@@ -94,7 +94,7 @@ Dynamic: license-file
 
 | Component | Supported / Tested |
 |---|---|
-| Python | `3.10` to `3.15` (CI matrix) |
+| Python | `>=3.11` (CI matrix: `3.11` to `3.15`) |
 | FastAPI | `>=0.133.0` |
 | Starlette | `>=1.3.1` |
 | pydantic-settings | `>=2.10.1` |
@@ -233,17 +233,17 @@ To dramatically reduce boilerplate, you can use the `OBS_PROFILE` environment va
 
 ## Documentation Map
 
-For deep-dive documentation, read the `docs/` folder:
-- [Security & Presets](docs/security.md)
-- [Environment Variables](docs/configuration.md)
-- [Runtime Control](docs/runtime-control.md)
-- [OpenTelemetry](docs/opentelemetry.md)
-- [Logtail Sink](docs/logtail-sink.md)
-- [Audit Logging](docs/audit-logging.md)
-- [Database Tracing](docs/db-tracing.md)
-- [GraphQL Support](docs/graphql.md)
-- [Architecture & Operations](docs/architecture.md)
-- [Production Deployment](docs/deployment.md)
-- [Performance Tuning](docs/tuning.md)
-- [Advanced Operations](docs/advanced.md)
-- [Maintenance & Contributing](docs/contributing.md) (quality gates, release flow, runtime stress harness)
+Full documentation lives at [vitaee.github.io/FastapiObserver](https://vitaee.github.io/FastapiObserver/). Deep dives:
+- [Security & Presets](https://vitaee.github.io/FastapiObserver/security/)
+- [Environment Variables](https://vitaee.github.io/FastapiObserver/configuration/)
+- [Runtime Control](https://vitaee.github.io/FastapiObserver/runtime-control/)
+- [OpenTelemetry](https://vitaee.github.io/FastapiObserver/opentelemetry/)
+- [Logtail Sink](https://vitaee.github.io/FastapiObserver/logtail-sink/)
+- [Audit Logging](https://vitaee.github.io/FastapiObserver/audit-logging/)
+- [Database Tracing](https://vitaee.github.io/FastapiObserver/db-tracing/)
+- [GraphQL Support](https://vitaee.github.io/FastapiObserver/graphql/)
+- [Architecture & Operations](https://vitaee.github.io/FastapiObserver/architecture/)
+- [Production Deployment](https://vitaee.github.io/FastapiObserver/deployment/)
+- [Performance Tuning](https://vitaee.github.io/FastapiObserver/tuning/)
+- [Advanced Operations](https://vitaee.github.io/FastapiObserver/advanced/)
+- [Maintenance & Contributing](https://vitaee.github.io/FastapiObserver/contributing/) (quality gates, release flow, runtime stress harness)

{fastapi_observer-1.4.0 → fastapi_observer-1.5.0}/src/fastapi_observer.egg-info/requires.txt

@@ -20,6 +20,7 @@ cryptography>=50.0.0
 cryptography>=50.0.0
 
 [dev]
+httpx2>=2.16.0
 loguru>=0.7.3
 mypy>=2.4.1
 pip-audit>=2.10.1
@@ -29,12 +30,6 @@ ruff>=0.17.3
 cyclonedx-bom>=7.6.0
 uvicorn>=0.54.0
 
-[dev:python_version < "3.11"]
-httpx>=0.28.1
-
-[dev:python_version >= "3.11"]
-httpx2>=2.16.0
-
 [fast-json]
 orjson>=3.11.7
 

fastapi_observer-1.5.0/src/fastapiobserver/_version.py

@@ -0,0 +1 @@
+__version__ = "1.5.0"

{fastapi_observer-1.4.0 → fastapi_observer-1.5.0}/src/fastapiobserver/fastapi.py

@@ -126,6 +126,13 @@ def install_observability(
         metrics_backend,
     )
 
+    # --- 7. Uvicorn access log ---
+    # The middleware's `request.completed` line carries the same fields, so drop
+    # uvicorn's duplicate line the same way `uvicorn --no-access-log` does.
+    uvicorn_access_logger = logging.getLogger("uvicorn.access")
+    uvicorn_access_logger.handlers = []
+    uvicorn_access_logger.propagate = False
+
     # --- 8. Runtime control plane ---
     if runtime_control_settings and runtime_control_settings.enabled:
         mount_control_plane(app, runtime_control_settings)

fastapi_observer-1.5.0/src/fastapiobserver/logging/filters.py

@@ -0,0 +1,61 @@
+from __future__ import annotations
+
+import logging
+import sys
+
+from ..plugins import apply_log_filters
+from ..request_context import get_request_id, get_span_id, get_trace_id, get_user_context
+
+_LOGGER = logging.getLogger("fastapiobserver.logging")
+
+
+class RequestIdFilter(logging.Filter):
+    """Attach request ID and user context from context vars to every log record.
+
+    Records are formatted on the queue listener thread, where the request's
+    context vars are not visible, so they are captured here.
+    """
+
+    def filter(self, record: logging.LogRecord) -> bool:
+        if not getattr(record, "request_id", None):
+            record.request_id = get_request_id()
+        if not getattr(record, "user_context", None):
+            record.user_context = get_user_context()
+        return True
+
+
+class TraceContextFilter(logging.Filter):
+    """Attach OTel trace_id / span_id to every log record."""
+
+    def filter(self, record: logging.LogRecord) -> bool:
+        trace_id = get_trace_id()
+        span_id = get_span_id()
+
+        # No span can be active unless something already imported the OTel API.
+        # Looking it up avoids a failing import (a sys.path scan) on every record.
+        otel_trace = sys.modules.get("opentelemetry.trace")
+        if otel_trace is not None:
+            try:
+                span_context = otel_trace.get_current_span().get_span_context()
+                if span_context and span_context.is_valid:
+                    trace_id = f"{span_context.trace_id:032x}"
+                    span_id = f"{span_context.span_id:016x}"
+            except Exception:
+                _LOGGER.debug(
+                    "trace_context_filter.otel_lookup_failed",
+                    exc_info=True,
+                    extra={"_skip_enrichers": True},
+                )
+
+        if trace_id:
+            record.trace_id = trace_id  # type: ignore[attr-defined]
+        if span_id:
+            record.span_id = span_id  # type: ignore[attr-defined]
+        return True
+
+
+class PluginLogFilter(logging.Filter):
+    """Apply user-registered log filters with fault isolation."""
+
+    def filter(self, record: logging.LogRecord) -> bool:
+        return apply_log_filters(record)

{fastapi_observer-1.4.0 → fastapi_observer-1.5.0}/src/fastapiobserver/logging/formatter.py

@@ -52,7 +52,7 @@ class StructuredJsonFormatter(logging.Formatter):
 
     def format(self, record: logging.LogRecord) -> str:
         payload: dict[str, Any] = {
-            "timestamp": datetime.now(timezone.utc).isoformat(),
+            "timestamp": datetime.fromtimestamp(record.created, timezone.utc).isoformat(),
             "level": record.levelname,
             "logger": record.name,
             "message": record.getMessage(),
@@ -77,7 +77,7 @@ class StructuredJsonFormatter(logging.Formatter):
         if span_id:
             payload["span_id"] = span_id
 
-        user_context = get_user_context()
+        user_context = getattr(record, "user_context", None) or get_user_context()
         if user_context:
             payload["user_context"] = user_context
 
@@ -96,17 +96,22 @@ class StructuredJsonFormatter(logging.Formatter):
         else:
             candidate_payload = self._enrich_event(dict(payload))
             if isinstance(candidate_payload, Mapping):
-                enriched_payload = dict(candidate_payload)
+                enriched_payload = _as_dict(candidate_payload)
             else:
                 enriched_payload = payload
         sanitized_candidate = self._sanitize_payload(enriched_payload, self.security_policy)
         if isinstance(sanitized_candidate, Mapping):
-            sanitized_payload = dict(sanitized_candidate)
+            sanitized_payload = _as_dict(sanitized_candidate)
         else:
             sanitized_payload = enriched_payload
         return _json_dumps(sanitized_payload)
 
 
+def _as_dict(value: Mapping[str, Any]) -> dict[str, Any]:
+    # Both steps already return fresh dicts; only copy other mapping types.
+    return value if type(value) is dict else dict(value)
+
+
 def _json_dumps(payload: dict[str, Any]) -> str:
     if orjson is not None:
         return orjson.dumps(payload).decode("utf-8")

{fastapi_observer-1.4.0 → fastapi_observer-1.5.0}/src/fastapiobserver/logging/queueing.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import copy
 import logging
 import logging.handlers
 import queue
@@ -135,6 +136,16 @@ class OverflowPolicyQueueHandler(logging.handlers.QueueHandler):
         self.block_timeout_seconds = block_timeout_seconds
         self.telemetry = telemetry
 
+    def prepare(self, record: logging.LogRecord) -> logging.LogRecord:
+        # The stdlib version formats the record here and drops exc_info, which
+        # loses the structured `error` field. The queue stays in-process, so keep
+        # exc_info and leave formatting to the listener thread.
+        record = copy.copy(record)
+        record.message = record.getMessage()
+        record.msg = record.message
+        record.args = None
+        return record
+
     def enqueue(self, record: logging.LogRecord) -> None:
         try:
             self.queue.put_nowait(record)

{fastapi_observer-1.4.0 → fastapi_observer-1.5.0}/src/fastapiobserver/middleware/metrics.py

@@ -3,8 +3,8 @@ from __future__ import annotations
 import logging
 
 from ..config import ObservabilitySettings
-from ..metrics import MetricsBackend, collapse_dynamic_segments
-from ..plugins import emit_metric_hooks
+from ..metrics import MetricsBackend, NoopMetricsBackend, collapse_dynamic_segments
+from ..plugins import _METRIC_HOOKS, emit_metric_hooks
 from starlette.requests import Request
 from starlette.responses import Response
 from starlette.types import Scope
@@ -30,6 +30,8 @@ class _MetricsRecorder:
         duration_seconds: float,
         scope: Scope | None = None,
     ) -> None:
+        if isinstance(self.metrics_backend, NoopMetricsBackend):
+            return
         collapsed_path = collapse_dynamic_segments(path)
         excluded_urls = self.settings.metrics_exclude_paths
         
@@ -67,6 +69,8 @@ class _MetricsRecorder:
         status_code: int,
         duration_seconds: float,
     ) -> None:
+        if not _METRIC_HOOKS:
+            return
         request = Request(scope)
         response = Response(status_code=status_code)
         emit_metric_hooks(request, response, duration_seconds)

{fastapi_observer-1.4.0 → fastapi_observer-1.5.0}/src/fastapiobserver/middleware/request_logging.py

@@ -60,9 +60,8 @@ class RequestLoggingMiddleware:
         method = scope.get("method", "UNKNOWN")
         status_code = 500
         captured_error: Exception | None = None
-        request_content_type = _get_header(raw_headers, b"content-type")
         request_body_enabled = self.security_policy.log_request_body and is_body_capturable(
-            request_content_type,
+            _get_header(raw_headers, b"content-type"),
             self.security_policy,
         )
         request_body_capture = _BodyCapture(
@@ -102,7 +101,11 @@ class RequestLoggingMiddleware:
             await send(message)
 
         try:
-            await self.app(scope, receive_wrapper, send_wrapper)
+            await self.app(
+                scope,
+                receive_wrapper if request_body_enabled else receive,
+                send_wrapper,
+            )
         except Exception as exc:
             had_error = True
             captured_error = exc
@@ -137,26 +140,35 @@ class RequestLoggingMiddleware:
         had_error: bool,
     ) -> None:
         duration_seconds = max(0.0, time.perf_counter() - start)
-        error_type = _classify_error(status_code, captured_error)
-        safe_event = self.event_builder.build(
-            method=method,
-            path=path,
-            status_code=status_code,
-            duration_seconds=duration_seconds,
-            client_ip=client_ip,
-            request_body=request_body_capture.value,
-            response_body=response_body_capture.value,
-            error_type=error_type,
-            exception=captured_error,
-        )
         if had_error:
-            self.logger.exception("request.failed", extra={"event": safe_event})
+            level, message = logging.ERROR, "request.failed"
         elif status_code >= 500:
-            self.logger.error("request.server_error", extra={"event": safe_event})
+            level, message = logging.ERROR, "request.server_error"
         elif status_code >= 400:
-            self.logger.warning("request.client_error", extra={"event": safe_event})
+            level, message = logging.WARNING, "request.client_error"
         else:
-            self.logger.info("request.completed", extra={"event": safe_event})
+            level, message = logging.INFO, "request.completed"
+
+        # Building and redacting the event is the costliest step; skip it when
+        # the record would be dropped by the log level anyway.
+        if self.logger.isEnabledFor(level):
+            safe_event = self.event_builder.build(
+                method=method,
+                path=path,
+                status_code=status_code,
+                duration_seconds=duration_seconds,
+                client_ip=client_ip,
+                request_body=request_body_capture.value,
+                response_body=response_body_capture.value,
+                error_type=_classify_error(status_code, captured_error),
+                exception=captured_error,
+            )
+            self.logger.log(
+                level,
+                message,
+                exc_info=captured_error if had_error else None,
+                extra={"event": safe_event},
+            )
 
         # Prefer route template for bounded cardinality
         route_template = _extract_route_template(scope, path)

{fastapi_observer-1.4.0 → fastapi_observer-1.5.0}/src/fastapiobserver/otel/tracing.py

@@ -40,9 +40,6 @@ def install_otel(
     fastapi_instrumentor_module = import_otel_module(
         "opentelemetry.instrumentation.fastapi"
     )
-    logging_instrumentor_module = import_otel_module(
-        "opentelemetry.instrumentation.logging"
-    )
 
     set_trace_sampling_ratio(otel_settings.trace_sampling_ratio)
     current_provider = trace_api.get_tracer_provider()
@@ -122,17 +119,6 @@ def install_otel(
         app, **instrument_kwargs
     )
 
-    try:
-        logging_instrumentor_module.LoggingInstrumentor().instrument(
-            set_logging_format=False
-        )
-    except Exception:
-        _LOGGER.debug(
-            "otel.logging_instrumentor.failed",
-            exc_info=True,
-            extra={"_skip_enrichers": True},
-        )
-
     if provider_owned:
         register_shutdown_hook(
             key=f"otel.tracer_provider.{id(tracer_provider)}",

{fastapi_observer-1.4.0 → fastapi_observer-1.5.0}/src/fastapiobserver/plugins.py

@@ -74,6 +74,8 @@ def clear_plugins() -> None:
 
 
 def apply_log_enrichers(event: dict[str, object]) -> dict[str, object]:
+    if not _LOG_ENRICHERS:
+        return event
     with _LOCK:
         enrichers = list(_LOG_ENRICHERS.items())
 
@@ -92,7 +94,7 @@ def apply_log_enrichers(event: dict[str, object]) -> dict[str, object]:
 
 
 def apply_log_filters(record: logging.LogRecord) -> bool:
-    if getattr(record, "_skip_log_filters", False):
+    if not _LOG_FILTERS or getattr(record, "_skip_log_filters", False):
         return True
 
     with _LOCK:

{fastapi_observer-1.4.0 → fastapi_observer-1.5.0}/src/fastapiobserver/security/normalize.py

@@ -1,3 +1,7 @@
+import functools
+
+
+@functools.lru_cache(maxsize=1024)
 def _normalize_key(key: str) -> str:
     return key.strip().lower().replace("_", "-")
 

{fastapi_observer-1.4.0 → fastapi_observer-1.5.0}/src/fastapiobserver/security/proxies.py

@@ -35,15 +35,20 @@ def resolve_client_ip(
     if not is_trusted_client_ip(client_ip, policy):
         return client_ip
 
-    forwarded_for = None
-    for k, v in headers:
-        if k.lower() == b"x-forwarded-for":
-            forwarded_for = v.decode("latin1")
-            break
-
-    if not forwarded_for:
-        return client_ip
-    first_hop = forwarded_for.split(",")[0].strip()
-    return first_hop or client_ip
+    # Each proxy appends the address it received the request from, so only the
+    # right-hand entries can be trusted; the left ones are whatever the client sent.
+    # Walk right to left and return the first hop that is not a trusted proxy.
+    # Repeated header lines form one list.
+    hops = [
+        hop.strip()
+        for k, v in headers
+        if k.lower() == b"x-forwarded-for"
+        for hop in v.decode("latin1").split(",")
+        if hop.strip()
+    ]
+    for hop in reversed(hops):
+        if not is_trusted_client_ip(hop, policy):
+            return hop
+    return hops[0] if hops else client_ip
 
 __all__ = ["is_trusted_client_ip", "resolve_client_ip"]