httpbinx 1.13.0__tar.gz → 1.13.1__tar.gz

{httpbinx-1.13.0 → httpbinx-1.13.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: httpbinx
-Version: 1.13.0
+Version: 1.13.1
 Summary: HTTP Request & Response Service, written in Python + FastAPI.
 Author-Email: Leo <imleowoo@outlook.com>
 License: MIT License

{httpbinx-1.13.0 → httpbinx-1.13.1}/pyproject.toml

@@ -31,7 +31,7 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
     "License :: OSI Approved :: MIT License",
 ]
-version = "1.13.0"
+version = "1.13.1"
 
 [project.license]
 file = "LICENSE"

{httpbinx-1.13.0 → httpbinx-1.13.1}/src/httpbinx/__init__.py

@@ -2,6 +2,6 @@
 
 from .main import app
 
-__version__ = '1.13.0'
+__version__ = '1.13.1'
 
 app.version = __version__

{httpbinx-1.13.0 → httpbinx-1.13.1}/src/httpbinx/main.py

@@ -18,7 +18,6 @@ app = FastAPI(
 app.add_middleware(
     CORSMiddleware,  # type: ignore
     allow_origins=['*'],
-    allow_credentials=True,
     allow_methods=['*'],
     allow_headers=['*'],
 )

{httpbinx-1.13.0 → httpbinx-1.13.1}/src/httpbinx/routers/responseformats.py

@@ -134,14 +134,34 @@ async def json_endpoint():
 
 
 @router.get(
-    '/robot.txt',
+    '/legacy',
+    response_class=HTMLResponse,
+    summary='Returns the legacy landing page.',
+    response_description='An HTML page listing the available endpoints.',
+)
+async def legacy_page(request: Request, templates: Jinja2Templates = Depends(get_templates)):
+    schema = request.app.openapi()
+    endpoints = []
+    for path, methods in sorted(schema.get('paths', {}).items()):
+        for method, operation in methods.items():
+            if method.upper() not in {'GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'}:
+                continue
+            endpoints.append({'method': method.upper(), 'path': path, 'summary': operation.get('summary', '')})
+    return templates.TemplateResponse(
+        request,
+        'legacy.html',
+        context={'request': request, 'endpoints': endpoints},
+    )
+
+
+@router.get(
+    '/robots.txt',
     response_class=PlainTextResponse,
     summary='Returns some robots.txt rules.',
     response_description='Robots file',
 )
 async def robots_page():
-    response = PlainTextResponse(content=ROBOT_TXT)
-    return response
+    return PlainTextResponse(content=ROBOT_TXT)
 
 
 @router.get(

httpbinx-1.13.1/src/httpbinx/templates/legacy.html

@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>httpbinx - HTTP Request &amp; Response Service</title>
+</head>
+<body>
+  <h1>httpbinx</h1>
+  <p>HTTP Request &amp; Response Service, written in Python + FastAPI.</p>
+  <p>See the <a href="/">interactive API documentation</a> for details and examples.</p>
+  <h2>Endpoints</h2>
+  <ul>
+    {% for endpoint in endpoints %}
+    <li><a href="{{ endpoint.path }}"><code>{{ endpoint.method }} {{ endpoint.path }}</code></a> {{ endpoint.summary }}</li>
+    {% endfor %}
+  </ul>
+</body>
+</html>

httpbinx-1.13.1/tests/test_cors.py

@@ -0,0 +1,31 @@
+"""CORS configuration tests."""
+
+ORIGIN = 'https://evil.example.com'
+
+
+def test_wildcard_origin_is_returned_as_is(client):
+    """A wildcard allowlist is echoed literally, not per-request origin."""
+    response = client.get('/get', headers={'Origin': ORIGIN})
+
+    assert response.headers['access-control-allow-origin'] == '*'
+
+
+def test_credentials_are_not_allowed_for_any_origin(client):
+    """Credentials must not be combined with a wildcard origin allowlist."""
+    response = client.get('/get', headers={'Origin': ORIGIN})
+
+    assert 'access-control-allow-credentials' not in response.headers
+
+
+def test_preflight_does_not_allow_credentials(client):
+    """Preflight responses must not advertise credentialed cross-origin access."""
+    response = client.options(
+        '/get',
+        headers={
+            'Origin': ORIGIN,
+            'Access-Control-Request-Method': 'GET',
+        },
+    )
+
+    assert response.headers['access-control-allow-origin'] == '*'
+    assert 'access-control-allow-credentials' not in response.headers

{httpbinx-1.13.0 → httpbinx-1.13.1}/tests/test_response_formats.py

@@ -83,15 +83,34 @@ class TestJson:
         assert len(data['slides']) == 2
 
 
-class TestRobot:
-    """Tests for the /robot.txt endpoint."""
+class TestLegacy:
+    """Tests for the /legacy landing page endpoint."""
 
-    def test_content(self, client):
-        response = client.get('/robot.txt')
+    def test_ok_and_html(self, client):
+        response = client.get('/legacy')
+        assert response.status_code == status.HTTP_200_OK
+        assert response.headers['content-type'].startswith('text/html')
+
+    def test_lists_endpoints(self, client):
+        response = client.get('/legacy')
+        assert '/get' in response.text
+        assert '/robots.txt' in response.text
+
+
+class TestRobots:
+    """Tests for the /robots.txt endpoint."""
+
+    def test_canonical_route(self, client):
+        response = client.get('/robots.txt')
         assert response.status_code == status.HTTP_200_OK
+        assert response.headers['content-type'].startswith('text/plain')
         assert 'User-agent' in response.text
         assert 'Disallow' in response.text
 
+    def test_nonstandard_robot_txt_is_gone(self, client):
+        response = client.get('/robot.txt')
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+
 
 @pytest.mark.skip(reason='Endpoint uses CWD-relative path to templates (source bug)')
 def test_xml(client):