fastapi-observer 1.4.1__tar.gz → 1.5.0__tar.gz

{fastapi_observer-1.4.1/src/fastapi_observer.egg-info → fastapi_observer-1.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-observer
-Version: 1.4.1
+Version: 1.5.0
 Summary: Zero-glue FastAPI observability with security presets and runtime controls
 Author-email: Vitaee <opensource@vitaee.dev>
 License-Expression: MIT
@@ -14,7 +14,6 @@ Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
@@ -24,7 +23,7 @@ Classifier: Framework :: FastAPI
 Classifier: Topic :: System :: Logging
 Classifier: Topic :: System :: Monitoring
 Classifier: Typing :: Typed
-Requires-Python: <3.16,>=3.10
+Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: fastapi>=0.133.0
@@ -64,8 +63,7 @@ Requires-Dist: opentelemetry-instrumentation-requests>=0.66b1; extra == "all"
 Requires-Dist: opentelemetry-instrumentation-sqlalchemy>=0.66b1; extra == "all"
 Requires-Dist: cryptography>=50.0.0; extra == "all"
 Provides-Extra: dev
-Requires-Dist: httpx>=0.28.1; python_version < "3.11" and extra == "dev"
-Requires-Dist: httpx2>=2.16.0; python_version >= "3.11" and extra == "dev"
+Requires-Dist: httpx2>=2.16.0; extra == "dev"
 Requires-Dist: loguru>=0.7.3; extra == "dev"
 Requires-Dist: mypy>=2.4.1; extra == "dev"
 Requires-Dist: pip-audit>=2.10.1; extra == "dev"
@@ -87,7 +85,7 @@ Dynamic: license-file
 
 **Documentation:** [vitaee.github.io/FastapiObserver](https://vitaee.github.io/FastapiObserver/)
 
-**Supported Python versions:** `3.10` to `3.15`
+**Supported Python versions:** `3.11` and newer (CI-tested on `3.11` to `3.15`)
 
 ---
 
@@ -96,7 +94,7 @@ Dynamic: license-file
 
 | Component | Supported / Tested |
 |---|---|
-| Python | `3.10` to `3.15` (CI matrix) |
+| Python | `>=3.11` (CI matrix: `3.11` to `3.15`) |
 | FastAPI | `>=0.133.0` |
 | Starlette | `>=1.3.1` |
 | pydantic-settings | `>=2.10.1` |

{fastapi_observer-1.4.1 → fastapi_observer-1.5.0}/README.md

@@ -9,7 +9,7 @@
 
 **Documentation:** [vitaee.github.io/FastapiObserver](https://vitaee.github.io/FastapiObserver/)
 
-**Supported Python versions:** `3.10` to `3.15`
+**Supported Python versions:** `3.11` and newer (CI-tested on `3.11` to `3.15`)
 
 ---
 
@@ -18,7 +18,7 @@
 
 | Component | Supported / Tested |
 |---|---|
-| Python | `3.10` to `3.15` (CI matrix) |
+| Python | `>=3.11` (CI matrix: `3.11` to `3.15`) |
 | FastAPI | `>=0.133.0` |
 | Starlette | `>=1.3.1` |
 | pydantic-settings | `>=2.10.1` |

{fastapi_observer-1.4.1 → fastapi_observer-1.5.0}/pyproject.toml

@@ -7,7 +7,7 @@ name = "fastapi-observer"
 dynamic = ["version"]
 description = "Zero-glue FastAPI observability with security presets and runtime controls"
 readme = "README.md"
-requires-python = ">=3.10,<3.16"
+requires-python = ">=3.11"
 authors = [
     { name = "Vitaee", email = "opensource@vitaee.dev" },
 ]
@@ -16,7 +16,6 @@ classifiers = [
     "Intended Audience :: Developers",
     "Operating System :: OS Independent",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
@@ -87,8 +86,7 @@ all = [
     "cryptography>=50.0.0",
 ]
 dev = [
-    "httpx>=0.28.1; python_version < '3.11'",
-    "httpx2>=2.16.0; python_version >= '3.11'",
+    "httpx2>=2.16.0",
     "loguru>=0.7.3",
     "mypy>=2.4.1",
     "pip-audit>=2.10.1",
@@ -109,7 +107,7 @@ version = { attr = "fastapiobserver._version.__version__" }
 where = ["src"]
 
 [tool.ruff]
-target-version = "py310"
+target-version = "py311"
 line-length = 100
 src = ["src", "tests"]
 

{fastapi_observer-1.4.1 → fastapi_observer-1.5.0/src/fastapi_observer.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-observer
-Version: 1.4.1
+Version: 1.5.0
 Summary: Zero-glue FastAPI observability with security presets and runtime controls
 Author-email: Vitaee <opensource@vitaee.dev>
 License-Expression: MIT
@@ -14,7 +14,6 @@ Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
@@ -24,7 +23,7 @@ Classifier: Framework :: FastAPI
 Classifier: Topic :: System :: Logging
 Classifier: Topic :: System :: Monitoring
 Classifier: Typing :: Typed
-Requires-Python: <3.16,>=3.10
+Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: fastapi>=0.133.0
@@ -64,8 +63,7 @@ Requires-Dist: opentelemetry-instrumentation-requests>=0.66b1; extra == "all"
 Requires-Dist: opentelemetry-instrumentation-sqlalchemy>=0.66b1; extra == "all"
 Requires-Dist: cryptography>=50.0.0; extra == "all"
 Provides-Extra: dev
-Requires-Dist: httpx>=0.28.1; python_version < "3.11" and extra == "dev"
-Requires-Dist: httpx2>=2.16.0; python_version >= "3.11" and extra == "dev"
+Requires-Dist: httpx2>=2.16.0; extra == "dev"
 Requires-Dist: loguru>=0.7.3; extra == "dev"
 Requires-Dist: mypy>=2.4.1; extra == "dev"
 Requires-Dist: pip-audit>=2.10.1; extra == "dev"
@@ -87,7 +85,7 @@ Dynamic: license-file
 
 **Documentation:** [vitaee.github.io/FastapiObserver](https://vitaee.github.io/FastapiObserver/)
 
-**Supported Python versions:** `3.10` to `3.15`
+**Supported Python versions:** `3.11` and newer (CI-tested on `3.11` to `3.15`)
 
 ---
 
@@ -96,7 +94,7 @@ Dynamic: license-file
 
 | Component | Supported / Tested |
 |---|---|
-| Python | `3.10` to `3.15` (CI matrix) |
+| Python | `>=3.11` (CI matrix: `3.11` to `3.15`) |
 | FastAPI | `>=0.133.0` |
 | Starlette | `>=1.3.1` |
 | pydantic-settings | `>=2.10.1` |

{fastapi_observer-1.4.1 → fastapi_observer-1.5.0}/src/fastapi_observer.egg-info/requires.txt

@@ -20,6 +20,7 @@ cryptography>=50.0.0
 cryptography>=50.0.0
 
 [dev]
+httpx2>=2.16.0
 loguru>=0.7.3
 mypy>=2.4.1
 pip-audit>=2.10.1
@@ -29,12 +30,6 @@ ruff>=0.17.3
 cyclonedx-bom>=7.6.0
 uvicorn>=0.54.0
 
-[dev:python_version < "3.11"]
-httpx>=0.28.1
-
-[dev:python_version >= "3.11"]
-httpx2>=2.16.0
-
 [fast-json]
 orjson>=3.11.7
 

fastapi_observer-1.5.0/src/fastapiobserver/_version.py

@@ -0,0 +1 @@
+__version__ = "1.5.0"

{fastapi_observer-1.4.1 → fastapi_observer-1.5.0}/src/fastapiobserver/fastapi.py

@@ -126,6 +126,13 @@ def install_observability(
         metrics_backend,
     )
 
+    # --- 7. Uvicorn access log ---
+    # The middleware's `request.completed` line carries the same fields, so drop
+    # uvicorn's duplicate line the same way `uvicorn --no-access-log` does.
+    uvicorn_access_logger = logging.getLogger("uvicorn.access")
+    uvicorn_access_logger.handlers = []
+    uvicorn_access_logger.propagate = False
+
     # --- 8. Runtime control plane ---
     if runtime_control_settings and runtime_control_settings.enabled:
         mount_control_plane(app, runtime_control_settings)

fastapi_observer-1.5.0/src/fastapiobserver/logging/filters.py

@@ -0,0 +1,61 @@
+from __future__ import annotations
+
+import logging
+import sys
+
+from ..plugins import apply_log_filters
+from ..request_context import get_request_id, get_span_id, get_trace_id, get_user_context
+
+_LOGGER = logging.getLogger("fastapiobserver.logging")
+
+
+class RequestIdFilter(logging.Filter):
+    """Attach request ID and user context from context vars to every log record.
+
+    Records are formatted on the queue listener thread, where the request's
+    context vars are not visible, so they are captured here.
+    """
+
+    def filter(self, record: logging.LogRecord) -> bool:
+        if not getattr(record, "request_id", None):
+            record.request_id = get_request_id()
+        if not getattr(record, "user_context", None):
+            record.user_context = get_user_context()
+        return True
+
+
+class TraceContextFilter(logging.Filter):
+    """Attach OTel trace_id / span_id to every log record."""
+
+    def filter(self, record: logging.LogRecord) -> bool:
+        trace_id = get_trace_id()
+        span_id = get_span_id()
+
+        # No span can be active unless something already imported the OTel API.
+        # Looking it up avoids a failing import (a sys.path scan) on every record.
+        otel_trace = sys.modules.get("opentelemetry.trace")
+        if otel_trace is not None:
+            try:
+                span_context = otel_trace.get_current_span().get_span_context()
+                if span_context and span_context.is_valid:
+                    trace_id = f"{span_context.trace_id:032x}"
+                    span_id = f"{span_context.span_id:016x}"
+            except Exception:
+                _LOGGER.debug(
+                    "trace_context_filter.otel_lookup_failed",
+                    exc_info=True,
+                    extra={"_skip_enrichers": True},
+                )
+
+        if trace_id:
+            record.trace_id = trace_id  # type: ignore[attr-defined]
+        if span_id:
+            record.span_id = span_id  # type: ignore[attr-defined]
+        return True
+
+
+class PluginLogFilter(logging.Filter):
+    """Apply user-registered log filters with fault isolation."""
+
+    def filter(self, record: logging.LogRecord) -> bool:
+        return apply_log_filters(record)

{fastapi_observer-1.4.1 → fastapi_observer-1.5.0}/src/fastapiobserver/logging/formatter.py

@@ -52,7 +52,7 @@ class StructuredJsonFormatter(logging.Formatter):
 
     def format(self, record: logging.LogRecord) -> str:
         payload: dict[str, Any] = {
-            "timestamp": datetime.now(timezone.utc).isoformat(),
+            "timestamp": datetime.fromtimestamp(record.created, timezone.utc).isoformat(),
             "level": record.levelname,
             "logger": record.name,
             "message": record.getMessage(),
@@ -77,7 +77,7 @@ class StructuredJsonFormatter(logging.Formatter):
         if span_id:
             payload["span_id"] = span_id
 
-        user_context = get_user_context()
+        user_context = getattr(record, "user_context", None) or get_user_context()
         if user_context:
             payload["user_context"] = user_context
 
@@ -96,17 +96,22 @@ class StructuredJsonFormatter(logging.Formatter):
         else:
             candidate_payload = self._enrich_event(dict(payload))
             if isinstance(candidate_payload, Mapping):
-                enriched_payload = dict(candidate_payload)
+                enriched_payload = _as_dict(candidate_payload)
             else:
                 enriched_payload = payload
         sanitized_candidate = self._sanitize_payload(enriched_payload, self.security_policy)
         if isinstance(sanitized_candidate, Mapping):
-            sanitized_payload = dict(sanitized_candidate)
+            sanitized_payload = _as_dict(sanitized_candidate)
         else:
             sanitized_payload = enriched_payload
         return _json_dumps(sanitized_payload)
 
 
+def _as_dict(value: Mapping[str, Any]) -> dict[str, Any]:
+    # Both steps already return fresh dicts; only copy other mapping types.
+    return value if type(value) is dict else dict(value)
+
+
 def _json_dumps(payload: dict[str, Any]) -> str:
     if orjson is not None:
         return orjson.dumps(payload).decode("utf-8")

{fastapi_observer-1.4.1 → fastapi_observer-1.5.0}/src/fastapiobserver/logging/queueing.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import copy
 import logging
 import logging.handlers
 import queue
@@ -135,6 +136,16 @@ class OverflowPolicyQueueHandler(logging.handlers.QueueHandler):
         self.block_timeout_seconds = block_timeout_seconds
         self.telemetry = telemetry
 
+    def prepare(self, record: logging.LogRecord) -> logging.LogRecord:
+        # The stdlib version formats the record here and drops exc_info, which
+        # loses the structured `error` field. The queue stays in-process, so keep
+        # exc_info and leave formatting to the listener thread.
+        record = copy.copy(record)
+        record.message = record.getMessage()
+        record.msg = record.message
+        record.args = None
+        return record
+
     def enqueue(self, record: logging.LogRecord) -> None:
         try:
             self.queue.put_nowait(record)

{fastapi_observer-1.4.1 → fastapi_observer-1.5.0}/src/fastapiobserver/middleware/metrics.py

@@ -3,8 +3,8 @@ from __future__ import annotations
 import logging
 
 from ..config import ObservabilitySettings
-from ..metrics import MetricsBackend, collapse_dynamic_segments
-from ..plugins import emit_metric_hooks
+from ..metrics import MetricsBackend, NoopMetricsBackend, collapse_dynamic_segments
+from ..plugins import _METRIC_HOOKS, emit_metric_hooks
 from starlette.requests import Request
 from starlette.responses import Response
 from starlette.types import Scope
@@ -30,6 +30,8 @@ class _MetricsRecorder:
         duration_seconds: float,
         scope: Scope | None = None,
     ) -> None:
+        if isinstance(self.metrics_backend, NoopMetricsBackend):
+            return
         collapsed_path = collapse_dynamic_segments(path)
         excluded_urls = self.settings.metrics_exclude_paths
         
@@ -67,6 +69,8 @@ class _MetricsRecorder:
         status_code: int,
         duration_seconds: float,
     ) -> None:
+        if not _METRIC_HOOKS:
+            return
         request = Request(scope)
         response = Response(status_code=status_code)
         emit_metric_hooks(request, response, duration_seconds)

{fastapi_observer-1.4.1 → fastapi_observer-1.5.0}/src/fastapiobserver/middleware/request_logging.py

@@ -60,9 +60,8 @@ class RequestLoggingMiddleware:
         method = scope.get("method", "UNKNOWN")
         status_code = 500
         captured_error: Exception | None = None
-        request_content_type = _get_header(raw_headers, b"content-type")
         request_body_enabled = self.security_policy.log_request_body and is_body_capturable(
-            request_content_type,
+            _get_header(raw_headers, b"content-type"),
             self.security_policy,
         )
         request_body_capture = _BodyCapture(
@@ -102,7 +101,11 @@ class RequestLoggingMiddleware:
             await send(message)
 
         try:
-            await self.app(scope, receive_wrapper, send_wrapper)
+            await self.app(
+                scope,
+                receive_wrapper if request_body_enabled else receive,
+                send_wrapper,
+            )
         except Exception as exc:
             had_error = True
             captured_error = exc
@@ -137,26 +140,35 @@ class RequestLoggingMiddleware:
         had_error: bool,
     ) -> None:
         duration_seconds = max(0.0, time.perf_counter() - start)
-        error_type = _classify_error(status_code, captured_error)
-        safe_event = self.event_builder.build(
-            method=method,
-            path=path,
-            status_code=status_code,
-            duration_seconds=duration_seconds,
-            client_ip=client_ip,
-            request_body=request_body_capture.value,
-            response_body=response_body_capture.value,
-            error_type=error_type,
-            exception=captured_error,
-        )
         if had_error:
-            self.logger.exception("request.failed", extra={"event": safe_event})
+            level, message = logging.ERROR, "request.failed"
         elif status_code >= 500:
-            self.logger.error("request.server_error", extra={"event": safe_event})
+            level, message = logging.ERROR, "request.server_error"
         elif status_code >= 400:
-            self.logger.warning("request.client_error", extra={"event": safe_event})
+            level, message = logging.WARNING, "request.client_error"
         else:
-            self.logger.info("request.completed", extra={"event": safe_event})
+            level, message = logging.INFO, "request.completed"
+
+        # Building and redacting the event is the costliest step; skip it when
+        # the record would be dropped by the log level anyway.
+        if self.logger.isEnabledFor(level):
+            safe_event = self.event_builder.build(
+                method=method,
+                path=path,
+                status_code=status_code,
+                duration_seconds=duration_seconds,
+                client_ip=client_ip,
+                request_body=request_body_capture.value,
+                response_body=response_body_capture.value,
+                error_type=_classify_error(status_code, captured_error),
+                exception=captured_error,
+            )
+            self.logger.log(
+                level,
+                message,
+                exc_info=captured_error if had_error else None,
+                extra={"event": safe_event},
+            )
 
         # Prefer route template for bounded cardinality
         route_template = _extract_route_template(scope, path)

{fastapi_observer-1.4.1 → fastapi_observer-1.5.0}/src/fastapiobserver/otel/tracing.py

@@ -40,9 +40,6 @@ def install_otel(
     fastapi_instrumentor_module = import_otel_module(
         "opentelemetry.instrumentation.fastapi"
     )
-    logging_instrumentor_module = import_otel_module(
-        "opentelemetry.instrumentation.logging"
-    )
 
     set_trace_sampling_ratio(otel_settings.trace_sampling_ratio)
     current_provider = trace_api.get_tracer_provider()
@@ -122,17 +119,6 @@ def install_otel(
         app, **instrument_kwargs
     )
 
-    try:
-        logging_instrumentor_module.LoggingInstrumentor().instrument(
-            set_logging_format=False
-        )
-    except Exception:
-        _LOGGER.debug(
-            "otel.logging_instrumentor.failed",
-            exc_info=True,
-            extra={"_skip_enrichers": True},
-        )
-
     if provider_owned:
         register_shutdown_hook(
             key=f"otel.tracer_provider.{id(tracer_provider)}",

{fastapi_observer-1.4.1 → fastapi_observer-1.5.0}/src/fastapiobserver/plugins.py

@@ -74,6 +74,8 @@ def clear_plugins() -> None:
 
 
 def apply_log_enrichers(event: dict[str, object]) -> dict[str, object]:
+    if not _LOG_ENRICHERS:
+        return event
     with _LOCK:
         enrichers = list(_LOG_ENRICHERS.items())
 
@@ -92,7 +94,7 @@ def apply_log_enrichers(event: dict[str, object]) -> dict[str, object]:
 
 
 def apply_log_filters(record: logging.LogRecord) -> bool:
-    if getattr(record, "_skip_log_filters", False):
+    if not _LOG_FILTERS or getattr(record, "_skip_log_filters", False):
         return True
 
     with _LOCK:

{fastapi_observer-1.4.1 → fastapi_observer-1.5.0}/src/fastapiobserver/security/normalize.py

@@ -1,3 +1,7 @@
+import functools
+
+
+@functools.lru_cache(maxsize=1024)
 def _normalize_key(key: str) -> str:
     return key.strip().lower().replace("_", "-")
 

{fastapi_observer-1.4.1 → fastapi_observer-1.5.0}/src/fastapiobserver/security/proxies.py

@@ -35,15 +35,20 @@ def resolve_client_ip(
     if not is_trusted_client_ip(client_ip, policy):
         return client_ip
 
-    forwarded_for = None
-    for k, v in headers:
-        if k.lower() == b"x-forwarded-for":
-            forwarded_for = v.decode("latin1")
-            break
-
-    if not forwarded_for:
-        return client_ip
-    first_hop = forwarded_for.split(",")[0].strip()
-    return first_hop or client_ip
+    # Each proxy appends the address it received the request from, so only the
+    # right-hand entries can be trusted; the left ones are whatever the client sent.
+    # Walk right to left and return the first hop that is not a trusted proxy.
+    # Repeated header lines form one list.
+    hops = [
+        hop.strip()
+        for k, v in headers
+        if k.lower() == b"x-forwarded-for"
+        for hop in v.decode("latin1").split(",")
+        if hop.strip()
+    ]
+    for hop in reversed(hops):
+        if not is_trusted_client_ip(hop, policy):
+            return hop
+    return hops[0] if hops else client_ip
 
 __all__ = ["is_trusted_client_ip", "resolve_client_ip"]

{fastapi_observer-1.4.1 → fastapi_observer-1.5.0}/src/fastapiobserver/security/redaction.py

@@ -1,10 +1,32 @@
+import functools
 import hashlib
-from typing import Any, Mapping
+from collections.abc import Mapping
+from typing import Any
 
 from .normalize import _normalize_key, _normalize_media_type
 from .policy import _DROP, SecurityPolicy
 
 MAX_SANITIZE_DEPTH = 32
+_SCALAR_TYPES = frozenset({str, int, float, bool})
+
+
+@functools.lru_cache(maxsize=64)
+def _policy_key_sets(
+    policy: SecurityPolicy,
+) -> tuple[frozenset[str], frozenset[str], frozenset[str] | None, frozenset[str] | None]:
+    # Policies are frozen, so the normalized lookup sets are built once per policy
+    # instead of once per log record.
+    def normalized(items: tuple[str, ...]) -> frozenset[str]:
+        return frozenset(_normalize_key(item) for item in items)
+
+    return (
+        normalized(policy.redacted_fields),
+        normalized(policy.redacted_headers),
+        normalized(policy.header_allowlist) if policy.header_allowlist is not None else None,
+        normalized(policy.event_key_allowlist)
+        if policy.event_key_allowlist is not None
+        else None,
+    )
 
 
 def _redact_value(value: Any, policy: SecurityPolicy) -> Any:
@@ -17,17 +39,8 @@ def _redact_value(value: Any, policy: SecurityPolicy) -> Any:
 
 
 def sanitize_event(data: dict[str, Any], policy: SecurityPolicy) -> dict[str, Any]:
-    sensitive_fields = {_normalize_key(item) for item in policy.redacted_fields}
-    sensitive_headers = {_normalize_key(item) for item in policy.redacted_headers}
-    header_allowlist = (
-        {_normalize_key(item) for item in policy.header_allowlist}
-        if policy.header_allowlist is not None
-        else None
-    )
-    event_key_allowlist = (
-        {_normalize_key(item) for item in policy.event_key_allowlist}
-        if policy.event_key_allowlist is not None
-        else None
+    sensitive_fields, sensitive_headers, header_allowlist, event_key_allowlist = (
+        _policy_key_sets(policy)
     )
     return _sanitize_mapping(
         data,
@@ -44,12 +57,12 @@ def sanitize_event(data: dict[str, Any], policy: SecurityPolicy) -> dict[str, An
 def _sanitize_mapping(
     data: Mapping[str, Any],
     policy: SecurityPolicy,
-    sensitive_fields: set[str],
-    sensitive_headers: set[str],
+    sensitive_fields: frozenset[str],
+    sensitive_headers: frozenset[str],
     parent_is_headers: bool,
     depth: int,
-    header_allowlist: set[str] | None,
-    event_key_allowlist: set[str] | None,
+    header_allowlist: frozenset[str] | None,
+    event_key_allowlist: frozenset[str] | None,
 ) -> dict[str, Any]:
     out: dict[str, Any] = {}
     for key, value in data.items():
@@ -72,6 +85,10 @@ def _sanitize_mapping(
                 out[str(key)] = redacted
             continue
 
+        if value is None or type(value) in _SCALAR_TYPES:
+            out[str(key)] = value
+            continue
+
         out[str(key)] = _sanitize_value(
             value,
             policy,
@@ -88,12 +105,12 @@ def _sanitize_mapping(
 def _sanitize_value(
     value: Any,
     policy: SecurityPolicy,
-    sensitive_fields: set[str],
-    sensitive_headers: set[str],
+    sensitive_fields: frozenset[str],
+    sensitive_headers: frozenset[str],
     parent_is_headers: bool,
     depth: int,
-    header_allowlist: set[str] | None,
-    event_key_allowlist: set[str] | None,
+    header_allowlist: frozenset[str] | None,
+    event_key_allowlist: frozenset[str] | None,
 ) -> Any:
     if depth > MAX_SANITIZE_DEPTH and isinstance(value, (Mapping, list, tuple)):
         # Too deep to inspect: mask rather than pass unchecked data through.

{fastapi_observer-1.4.1 → fastapi_observer-1.5.0}/tests/test_fastapi_install.py

@@ -32,6 +32,18 @@ def test_install_observability_adds_request_logging_middleware_once() -> None:
     assert count == 1
 
 
+def test_install_observability_drops_duplicate_uvicorn_access_log() -> None:
+    install_observability(
+        FastAPI(),
+        ObservabilitySettings(app_name="test", service="svc", environment="test"),
+        metrics_enabled=False,
+    )
+
+    # Uvicorn writes access lines only while this logger has somewhere to send them.
+    assert not logging.getLogger("uvicorn.access").hasHandlers()
+    assert logging.getLogger("uvicorn.error").hasHandlers()
+
+
 def test_install_observability_with_metrics_enabled_requires_extra() -> None:
     app = FastAPI()
     settings = ObservabilitySettings(

{fastapi_observer-1.4.1 → fastapi_observer-1.5.0}/tests/test_logging_schema_contract.py

@@ -116,6 +116,34 @@ def test_structured_formatter_supports_injected_dependencies() -> None:
     assert payload["sanitized_by"] == "custom"
 
 
+def test_queued_records_keep_exception_and_user_context() -> None:
+    class _CollectingHandler(logging.Handler):
+        def __init__(self) -> None:
+            super().__init__()
+            self.messages: list[str] = []
+
+        def emit(self, record: logging.LogRecord) -> None:
+            self.messages.append(self.format(record))
+
+    settings = ObservabilitySettings(app_name="test", service="test", environment="test")
+    collector = _CollectingHandler()
+    setup_logging(settings, force=True, logs_mode="otlp", extra_handlers=[collector])
+
+    set_user_context({"user_id": "42"})
+    try:
+        raise RuntimeError("boom")
+    except RuntimeError:
+        logging.getLogger("tests.queued").exception("request failed")
+    finally:
+        clear_user_context()
+    shutdown_logging()
+
+    payload = next(json.loads(m) for m in collector.messages if '"tests.queued"' in m)
+    assert payload["message"] == "request failed"
+    assert payload["error"]["type"] == "RuntimeError"
+    assert payload["user_context"] == {"user_id": "42"}
+
+
 def test_setup_logging_is_idempotent_with_force_mode() -> None:
     settings = ObservabilitySettings(app_name="test", service="test", environment="test")
     root = logging.getLogger()

{fastapi_observer-1.4.1 → fastapi_observer-1.5.0}/tests/test_otel_log_correlation.py

@@ -80,6 +80,13 @@ def test_trace_and_span_ids_are_correlated_in_logs(
         ),
     )
 
+    # OTel's LoggingInstrumentor would add its own root handler that bypasses
+    # the queue and redaction; tracing must not install one.
+    assert not any(
+        type(root_handler).__module__.startswith("opentelemetry")
+        for root_handler in logging.getLogger().handlers
+    )
+
     provider = trace_api.get_tracer_provider()
     if not hasattr(provider, "add_span_processor"):
         pytest.skip("Active tracer provider does not support span processors")

{fastapi_observer-1.4.1 → fastapi_observer-1.5.0}/tests/test_trust_boundary.py

@@ -6,7 +6,7 @@ from fastapi.testclient import TestClient
 from fastapiobserver import ObservabilitySettings, install_observability
 from fastapiobserver.middleware import _resolve_request_id
 from fastapiobserver.request_context import get_request_id
-from fastapiobserver.security import TrustedProxyPolicy
+from fastapiobserver.security import TrustedProxyPolicy, resolve_client_ip
 
 
 def _build_app(trusted_proxy_policy: TrustedProxyPolicy) -> FastAPI:
@@ -51,3 +51,24 @@ def test_resolve_request_id_accepts_only_trusted_valid_values() -> None:
     assert _resolve_request_id("request_123", True) == "request_123"
     assert _resolve_request_id("bad id with spaces", True) != "bad id with spaces"
     assert _resolve_request_id("request_123", False) != "request_123"
+
+
+def test_forwarded_for_uses_rightmost_hop_outside_trusted_proxies() -> None:
+    policy = TrustedProxyPolicy(honor_forwarded_headers=True)
+    proxy = "10.0.0.5"
+
+    def resolve(*values: bytes) -> str | None:
+        return resolve_client_ip(proxy, [(b"x-forwarded-for", v) for v in values], policy)
+
+    assert resolve(b"203.0.113.7") == "203.0.113.7"
+    # Proxies append to whatever the client sent, so leftmost entries are forgeable.
+    assert resolve(b"6.6.6.6, 203.0.113.7") == "203.0.113.7"
+    assert resolve(b"6.6.6.6", b"203.0.113.7") == "203.0.113.7"
+    assert resolve(b"203.0.113.7, 10.1.1.1") == "203.0.113.7"
+    # Every hop is a trusted proxy: fall back to the leftmost one.
+    assert resolve(b"10.2.2.2, 10.1.1.1") == "10.2.2.2"
+    assert resolve() == proxy
+    # Untrusted peers never get their forwarded headers honored.
+    assert resolve_client_ip("198.51.100.1", [(b"x-forwarded-for", b"6.6.6.6")], policy) == (
+        "198.51.100.1"
+    )

fastapi_observer-1.4.1/src/fastapiobserver/_version.py

@@ -1 +0,0 @@
-__version__ = "1.4.1"

fastapi_observer-1.4.1/src/fastapiobserver/logging/filters.py

@@ -1,53 +0,0 @@
-from __future__ import annotations
-
-import logging
-
-from ..plugins import apply_log_filters
-from ..request_context import get_request_id, get_span_id, get_trace_id
-
-_LOGGER = logging.getLogger("fastapiobserver.logging")
-
-
-class RequestIdFilter(logging.Filter):
-    """Attach request ID from context vars to every log record."""
-
-    def filter(self, record: logging.LogRecord) -> bool:
-        if not getattr(record, "request_id", None):
-            record.request_id = get_request_id()
-        return True
-
-
-class TraceContextFilter(logging.Filter):
-    """Attach OTel trace_id / span_id to every log record."""
-
-    def filter(self, record: logging.LogRecord) -> bool:
-        trace_id = get_trace_id()
-        span_id = get_span_id()
-
-        try:
-            from opentelemetry import trace as otel_trace  # type: ignore
-
-            span = otel_trace.get_current_span()
-            span_context = span.get_span_context()
-            if span_context and span_context.is_valid:
-                trace_id = f"{span_context.trace_id:032x}"
-                span_id = f"{span_context.span_id:016x}"
-        except Exception:
-            _LOGGER.debug(
-                "trace_context_filter.otel_lookup_failed",
-                exc_info=True,
-                extra={"_skip_enrichers": True},
-            )
-
-        if trace_id:
-            record.trace_id = trace_id  # type: ignore[attr-defined]
-        if span_id:
-            record.span_id = span_id  # type: ignore[attr-defined]
-        return True
-
-
-class PluginLogFilter(logging.Filter):
-    """Apply user-registered log filters with fault isolation."""
-
-    def filter(self, record: logging.LogRecord) -> bool:
-        return apply_log_filters(record)