httpbinx 1.12.0__tar.gz → 1.13.1__tar.gz

{httpbinx-1.12.0 → httpbinx-1.13.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: httpbinx
-Version: 1.12.0
+Version: 1.13.1
 Summary: HTTP Request & Response Service, written in Python + FastAPI.
 Author-Email: Leo <imleowoo@outlook.com>
 License: MIT License

{httpbinx-1.12.0 → httpbinx-1.13.1}/pyproject.toml

@@ -31,7 +31,7 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
     "License :: OSI Approved :: MIT License",
 ]
-version = "1.12.0"
+version = "1.13.1"
 
 [project.license]
 file = "LICENSE"

{httpbinx-1.12.0 → httpbinx-1.13.1}/src/httpbinx/__init__.py

@@ -2,6 +2,6 @@
 
 from .main import app
 
-__version__ = '1.12.0'
+__version__ = '1.13.1'
 
 app.version = __version__

{httpbinx-1.12.0 → httpbinx-1.13.1}/src/httpbinx/main.py

@@ -18,7 +18,6 @@ app = FastAPI(
 app.add_middleware(
     CORSMiddleware,  # type: ignore
     allow_origins=['*'],
-    allow_credentials=True,
     allow_methods=['*'],
     allow_headers=['*'],
 )

{httpbinx-1.12.0 → httpbinx-1.13.1}/src/httpbinx/routers/dynamicdata.py

@@ -3,6 +3,7 @@
 import asyncio
 import base64
 import binascii
+import math
 import random
 import uuid
 
@@ -18,6 +19,10 @@ from httpbinx.schemas import RequestInfo
 
 router = APIRouter(tags=['Dynamic data'])
 
+# Upper bound on the number of chunks /drip yields so large payloads keep a
+# meaningful pause between chunks instead of sleeping once per byte.
+DRIP_MAX_CHUNKS = 100
+
 
 class OctetStreamResponse(Response):
     """set response headers Content-Type: application/octet-stream"""
@@ -109,7 +114,7 @@ async def delay_response(*, delay: float = Path(..., ge=0, le=10, description='d
     response_description='A dripped response.',
 )
 async def drip(
-    duration: float = Query(default=2, description='The amount of time (in seconds) over which to drip each byte'),
+    duration: float = Query(default=2, description='The amount of time (in seconds) over which to drip the response'),
     numbytes: int = Query(
         default=10,
         gt=0,
@@ -120,12 +125,19 @@ async def drip(
     delay: float = Query(default=2, ge=0, description='The amount of time (in seconds) to delay before responding'),
 ):
     await asyncio.sleep(delay)
+    # Drip in chunks so large `numbytes` do not turn into a burst of zero-length
+    # sleeps. The whole payload is paced over `duration` regardless of `numbytes`.
+    chunk_size = max(1, math.ceil(numbytes / DRIP_MAX_CHUNKS))
+    num_chunks = math.ceil(numbytes / chunk_size)
     # Number of seconds to pause during each data generation
-    pause = int(duration / numbytes)
+    pause = duration / num_chunks
 
     async def generate_content():
-        for _ in range(numbytes):
-            yield b'*'
+        remaining = numbytes
+        while remaining > 0:
+            chunk = min(chunk_size, remaining)
+            remaining -= chunk
+            yield b'*' * chunk
             await asyncio.sleep(pause)
 
     return StreamingResponse(content=generate_content(), media_type='application/octet-stream', status_code=code)

{httpbinx-1.12.0 → httpbinx-1.13.1}/src/httpbinx/routers/inspection/response.py

@@ -1,7 +1,7 @@
 import uuid
 from email.utils import formatdate
 
-from fastapi import APIRouter, Path
+from fastapi import APIRouter, Path, Response
 from starlette import status
 from starlette.requests import Request
 
@@ -19,14 +19,13 @@ router = APIRouter(
     ' is present. Returns the same as a GET otherwise.',
     response_description='TODO',
 )
-async def cache(request: Request):
+async def cache(request: Request, response: Response):
     # https://developer.mozilla.org/zh-CN/docs/Web/HTTP/Headers/If-Modified-Since
     is_conditional = request.headers.get('If-Modified-Since') or request.headers.get('If-None-Match')
     if is_conditional is None:
-        response = await httpmethods.get(request)
         response.headers['Last-Modified'] = formatdate()
         response.headers['ETag'] = uuid.uuid4().hex
-        return response
+        return await httpmethods.get(request)
     else:
         return status_code_response(status.HTTP_304_NOT_MODIFIED)
 
@@ -34,17 +33,18 @@ async def cache(request: Request):
 @router.get(
     '/cache/{value}', summary='Sets a Cache-Control header for n seconds.', response_description='Cache control set'
 )
-async def cache_control(*, value: int = Path(..., title='Cache-Control max-age value'), request: Request):
-    response = await httpmethods.get(request)
+async def cache_control(
+    *, value: int = Path(..., title='Cache-Control max-age value'), request: Request, response: Response
+):
     response.headers['Cache-Control'] = f'public, max-age={value}'
-    return response
+    return await httpmethods.get(request)
 
 
 @router.get(
     '/etag/{etag}',
     summary='Assumes the resource has the given etag and responds to If-None-Match and If-Match headers appropriately.',
 )
-async def set_etag(*, etag: str = Path(..., title='ETag value'), request: Request):
+async def set_etag(*, etag: str = Path(..., title='ETag value'), request: Request, response: Response):
     # TODO set If-None-Match
     # https://developer.mozilla.org/zh-CN/docs/Web/HTTP/Headers/If-None-Match
     if_none_match = parse_multi_value_header(request.headers.get('If-None-Match'))
@@ -59,9 +59,8 @@ async def set_etag(*, etag: str = Path(..., title='ETag value'), request: Reques
         if etag not in if_match and '*' not in if_match:
             return status_code_response(status.HTTP_412_PRECONDITION_FAILED)
     # Special cases don't apply, return normal response
-    response = await httpmethods.get(request)
     response.headers['ETag'] = etag
-    return response
+    return await httpmethods.get(request)
 
 
 @router.api_route(

{httpbinx-1.12.0 → httpbinx-1.13.1}/src/httpbinx/routers/responseformats.py

@@ -134,14 +134,34 @@ async def json_endpoint():
 
 
 @router.get(
-    '/robot.txt',
+    '/legacy',
+    response_class=HTMLResponse,
+    summary='Returns the legacy landing page.',
+    response_description='An HTML page listing the available endpoints.',
+)
+async def legacy_page(request: Request, templates: Jinja2Templates = Depends(get_templates)):
+    schema = request.app.openapi()
+    endpoints = []
+    for path, methods in sorted(schema.get('paths', {}).items()):
+        for method, operation in methods.items():
+            if method.upper() not in {'GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'}:
+                continue
+            endpoints.append({'method': method.upper(), 'path': path, 'summary': operation.get('summary', '')})
+    return templates.TemplateResponse(
+        request,
+        'legacy.html',
+        context={'request': request, 'endpoints': endpoints},
+    )
+
+
+@router.get(
+    '/robots.txt',
     response_class=PlainTextResponse,
     summary='Returns some robots.txt rules.',
     response_description='Robots file',
 )
 async def robots_page():
-    response = PlainTextResponse(content=ROBOT_TXT)
-    return response
+    return PlainTextResponse(content=ROBOT_TXT)
 
 
 @router.get(

httpbinx-1.13.1/src/httpbinx/templates/legacy.html

@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>httpbinx - HTTP Request &amp; Response Service</title>
+</head>
+<body>
+  <h1>httpbinx</h1>
+  <p>HTTP Request &amp; Response Service, written in Python + FastAPI.</p>
+  <p>See the <a href="/">interactive API documentation</a> for details and examples.</p>
+  <h2>Endpoints</h2>
+  <ul>
+    {% for endpoint in endpoints %}
+    <li><a href="{{ endpoint.path }}"><code>{{ endpoint.method }} {{ endpoint.path }}</code></a> {{ endpoint.summary }}</li>
+    {% endfor %}
+  </ul>
+</body>
+</html>

httpbinx-1.13.1/tests/test_cors.py

@@ -0,0 +1,31 @@
+"""CORS configuration tests."""
+
+ORIGIN = 'https://evil.example.com'
+
+
+def test_wildcard_origin_is_returned_as_is(client):
+    """A wildcard allowlist is echoed literally, not per-request origin."""
+    response = client.get('/get', headers={'Origin': ORIGIN})
+
+    assert response.headers['access-control-allow-origin'] == '*'
+
+
+def test_credentials_are_not_allowed_for_any_origin(client):
+    """Credentials must not be combined with a wildcard origin allowlist."""
+    response = client.get('/get', headers={'Origin': ORIGIN})
+
+    assert 'access-control-allow-credentials' not in response.headers
+
+
+def test_preflight_does_not_allow_credentials(client):
+    """Preflight responses must not advertise credentialed cross-origin access."""
+    response = client.options(
+        '/get',
+        headers={
+            'Origin': ORIGIN,
+            'Access-Control-Request-Method': 'GET',
+        },
+    )
+
+    assert response.headers['access-control-allow-origin'] == '*'
+    assert 'access-control-allow-credentials' not in response.headers

{httpbinx-1.12.0 → httpbinx-1.13.1}/tests/test_dynamic_data.py

@@ -65,6 +65,45 @@ class TestDrip:
         assert response.status_code == status.HTTP_200_OK
         assert len(response.content) == 5
 
+    def test_respects_duration(self, client):
+        duration = 0.2
+        start = time.time()
+        response = client.get(f'/drip?duration={duration}&numbytes=10&delay=0')
+        elapsed = time.time() - start
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.content) == 10
+        assert elapsed >= duration
+
+    def test_large_numbytes_is_paced(self, client):
+        duration = 0.2
+        numbytes = 100_000
+        start = time.time()
+        response = client.get(f'/drip?duration={duration}&numbytes={numbytes}&delay=0')
+        elapsed = time.time() - start
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.content) == numbytes
+        assert elapsed >= duration
+
+    def test_large_numbytes_drips_without_per_byte_sleeps(self, client, monkeypatch):
+        import asyncio as asyncio_module
+        import types
+
+        from httpbinx.routers import dynamicdata
+
+        delays = []
+
+        async def fake_sleep(delay):
+            delays.append(delay)
+            await asyncio_module.sleep(0)
+
+        monkeypatch.setattr(dynamicdata, 'asyncio', types.SimpleNamespace(sleep=fake_sleep))
+
+        response = client.get('/drip?duration=1&numbytes=100_000&delay=0')
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.content) == 100_000
+        # One sleep for the initial delay plus a bounded number of chunk sleeps.
+        assert len(delays) <= 101
+
 
 class TestLinks:
     """Tests for the /links endpoint."""

{httpbinx-1.12.0 → httpbinx-1.13.1}/tests/test_response_formats.py

@@ -83,15 +83,34 @@ class TestJson:
         assert len(data['slides']) == 2
 
 
-class TestRobot:
-    """Tests for the /robot.txt endpoint."""
+class TestLegacy:
+    """Tests for the /legacy landing page endpoint."""
 
-    def test_content(self, client):
-        response = client.get('/robot.txt')
+    def test_ok_and_html(self, client):
+        response = client.get('/legacy')
+        assert response.status_code == status.HTTP_200_OK
+        assert response.headers['content-type'].startswith('text/html')
+
+    def test_lists_endpoints(self, client):
+        response = client.get('/legacy')
+        assert '/get' in response.text
+        assert '/robots.txt' in response.text
+
+
+class TestRobots:
+    """Tests for the /robots.txt endpoint."""
+
+    def test_canonical_route(self, client):
+        response = client.get('/robots.txt')
         assert response.status_code == status.HTTP_200_OK
+        assert response.headers['content-type'].startswith('text/plain')
         assert 'User-agent' in response.text
         assert 'Disallow' in response.text
 
+    def test_nonstandard_robot_txt_is_gone(self, client):
+        response = client.get('/robot.txt')
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+
 
 @pytest.mark.skip(reason='Endpoint uses CWD-relative path to templates (source bug)')
 def test_xml(client):

httpbinx-1.13.1/tests/test_response_inspection.py

@@ -0,0 +1,50 @@
+from email.utils import parsedate_to_datetime
+
+import pytest
+
+
+def test_cache_emits_validators_without_mutating_request_headers(client):
+    response = client.get('/cache?name=value', headers={'X-Probe': 'preserved'})
+    assert response.status_code == 200
+    assert parsedate_to_datetime(response.headers['Last-Modified'])
+    assert response.headers['ETag']
+    body = response.json()
+    assert body['args'] == {'name': 'value'}
+    assert body['headers']['x-probe'] == 'preserved'
+    assert 'Last-Modified' not in body['headers']
+    assert 'ETag' not in body['headers']
+    for header in ['If-Modified-Since', 'If-None-Match']:
+        conditional = client.get('/cache', headers={header: response.headers['ETag']})
+        assert conditional.status_code == 304
+        assert conditional.content == b''
+
+
+@pytest.mark.parametrize('seconds', [0, 60, 3600])
+def test_cache_control_is_an_http_header(client, seconds):
+    response = client.get(f'/cache/{seconds}', headers={'Cache-Control': 'no-cache'})
+    assert response.status_code == 200
+    assert response.headers['Cache-Control'] == f'public, max-age={seconds}'
+    assert response.json()['headers']['cache-control'] == 'no-cache'
+    assert 'Cache-Control' not in response.json()['headers']
+
+
+@pytest.mark.parametrize(
+    ('headers', 'status_code'),
+    [
+        ({}, 200),
+        ({'If-None-Match': 'other'}, 200),
+        ({'If-Match': 'probe'}, 200),
+        ({'If-None-Match': 'probe'}, 304),
+        ({'If-None-Match': '*'}, 304),
+        ({'If-Match': 'other'}, 412),
+    ],
+)
+def test_etag_response_header_and_existing_conditions(client, headers, status_code):
+    response = client.get('/etag/probe', headers=headers)
+    assert response.status_code == status_code
+    if status_code in [200, 304]:
+        assert response.headers['ETag'] == 'probe'
+    if status_code == 200:
+        assert 'ETag' not in response.json()['headers']
+    elif status_code == 304:
+        assert response.content == b''