insider-python 0.1.2__tar.gz → 0.1.3__tar.gz

{insider_python-0.1.2 → insider_python-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: insider-python
-Version: 0.1.2
+Version: 0.1.3
 Summary: Python SDK for Insider — ship Beacons to your Insider server.
 Author: Insider
 License-Expression: MIT
@@ -24,6 +24,7 @@ Provides-Extra: dev
 Requires-Dist: pytest>=8; extra == "dev"
 Requires-Dist: pytest-django>=4.8; extra == "dev"
 Requires-Dist: django>=4.2; extra == "dev"
+Requires-Dist: djangorestframework>=3.14; extra == "dev"
 
 # insider-python
 
@@ -68,26 +69,31 @@ insider.capture_message("cache miss spiked", level="warning")
 
 ### Django
 
-Add the integration to `INSTALLED_APPS` and configure via settings:
+Initialize in `wsgi.py` (or `asgi.py`) before `get_wsgi_application()`:
 
 ```python
-INSTALLED_APPS = [
-    # ...
-    "insider.contrib.django",
-]
-
-MIDDLEWARE = [
-    # ...
-    "insider.contrib.django.middleware.InsiderMiddleware",
-]
-
-INSIDER_DSN = "https://<beacon_token>@insider.example.com/<project_uuid>"
-INSIDER_ENVIRONMENT = "production"
-INSIDER_RELEASE = "1.2.3"
+import os
+import insider
+from insider.integrations.django import DjangoIntegration
+
+insider.init(
+    dsn=os.environ.get("INSIDER_DSN"),
+    environment="production",
+    release="1.2.3",
+    integrations=[DjangoIntegration()],
+)
+
+from django.core.wsgi import get_wsgi_application
+application = get_wsgi_application()
 ```
 
-That's the whole setup. Every unhandled exception in a view is now a
-Beacon in your dashboard.
+That's the whole setup. Every unhandled exception in a view — including
+Django REST Framework API views — is now a Beacon in your dashboard.
+No middleware, no `INSTALLED_APPS`, and no `EXCEPTION_HANDLER` wiring.
+
+**Legacy setup** (still supported): add `insider.contrib.django` to
+`INSTALLED_APPS` and `InsiderMiddleware` to `MIDDLEWARE`. Prefer the
+`wsgi.py` pattern for new projects.
 
 ## Configuration
 

{insider_python-0.1.2 → insider_python-0.1.3}/README.md

@@ -41,26 +41,31 @@ insider.capture_message("cache miss spiked", level="warning")
 
 ### Django
 
-Add the integration to `INSTALLED_APPS` and configure via settings:
+Initialize in `wsgi.py` (or `asgi.py`) before `get_wsgi_application()`:
 
 ```python
-INSTALLED_APPS = [
-    # ...
-    "insider.contrib.django",
-]
-
-MIDDLEWARE = [
-    # ...
-    "insider.contrib.django.middleware.InsiderMiddleware",
-]
-
-INSIDER_DSN = "https://<beacon_token>@insider.example.com/<project_uuid>"
-INSIDER_ENVIRONMENT = "production"
-INSIDER_RELEASE = "1.2.3"
+import os
+import insider
+from insider.integrations.django import DjangoIntegration
+
+insider.init(
+    dsn=os.environ.get("INSIDER_DSN"),
+    environment="production",
+    release="1.2.3",
+    integrations=[DjangoIntegration()],
+)
+
+from django.core.wsgi import get_wsgi_application
+application = get_wsgi_application()
 ```
 
-That's the whole setup. Every unhandled exception in a view is now a
-Beacon in your dashboard.
+That's the whole setup. Every unhandled exception in a view — including
+Django REST Framework API views — is now a Beacon in your dashboard.
+No middleware, no `INSTALLED_APPS`, and no `EXCEPTION_HANDLER` wiring.
+
+**Legacy setup** (still supported): add `insider.contrib.django` to
+`INSTALLED_APPS` and `InsiderMiddleware` to `MIDDLEWARE`. Prefer the
+`wsgi.py` pattern for new projects.
 
 ## Configuration
 

{insider_python-0.1.2 → insider_python-0.1.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "insider-python"
-version = "0.1.2"
+version = "0.1.3"
 description = "Python SDK for Insider — ship Beacons to your Insider server."
 readme = "README.md"
 requires-python = ">=3.8"
@@ -32,6 +32,7 @@ dev = [
     "pytest>=8",
     "pytest-django>=4.8",
     "django>=4.2",
+    "djangorestframework>=3.14",
 ]
 
 [project.urls]

{insider_python-0.1.2 → insider_python-0.1.3}/src/insider/_version.py

@@ -5,4 +5,4 @@ lookup on every beacon. Bump this and `[project].version` together when
 cutting a release.
 """
 
-__version__ = "0.1.2"
+__version__ = "0.1.3"

{insider_python-0.1.2 → insider_python-0.1.3}/src/insider/client.py

@@ -18,7 +18,7 @@ import atexit
 import os
 import subprocess
 import threading
-from typing import Any, Callable, Dict, Iterable, List, Optional
+from typing import Any, Callable, Dict, Iterable, List, Optional, Sequence, Union
 
 from ._envelope import build_envelope, enforce_size_budget
 from ._version import __version__
@@ -33,6 +33,16 @@ from .transport import BackgroundTransport
 VALID_KINDS = {"error", "perf", "log", "custom"}
 VALID_LEVELS = {"debug", "info", "warning", "error", "fatal"}
 
+IntegrationLike = Union[Any, type]
+
+
+def _setup_integrations(integrations: Sequence[IntegrationLike]) -> None:
+    for integration in integrations:
+        instance = integration() if isinstance(integration, type) else integration
+        setup_once = getattr(instance, "setup_once", None)
+        if callable(setup_once):
+            setup_once()
+
 
 # ---------------------------------------------------------------------------
 # DSN resolution
@@ -259,6 +269,8 @@ def _set_active(client: Optional[Client]) -> None:
 @safe
 def init(
     dsn: Optional[str] = None,
+    *,
+    integrations: Optional[Sequence[IntegrationLike]] = None,
     **kwargs: Any,
 ) -> Optional[Client]:
     """
@@ -268,6 +280,9 @@ def init(
     Calling `init` a second time is allowed but logs a warning and
     closes the previous client first. The new client becomes the
     process-global one.
+
+    Pass framework integrations via `integrations=[...]`. Each integration's
+    `setup_once()` runs after the client is active.
     """
     global _active_client
     raw = _resolve_dsn_string(dsn)
@@ -280,6 +295,8 @@ def init(
         debug(f"invalid DSN: {exc}; entering disabled mode")
         return None
 
+    integration_list = list(integrations or [])
+
     with _init_lock:
         if _active_client is not None:
             debug("re-initializing; closing previous client")
@@ -290,6 +307,7 @@ def init(
         client = Client(parsed, **kwargs)
         _set_active(client)
 
+    _setup_integrations(integration_list)
     atexit.register(_atexit_close)
     return client
 

{insider_python-0.1.2 → insider_python-0.1.3}/src/insider/contrib/django/apps.py

@@ -13,6 +13,7 @@ from typing import Any, Dict
 from django.apps import AppConfig
 
 from ... import init
+from ...integrations.django import DjangoIntegration
 from ...safety import debug
 
 
@@ -57,4 +58,4 @@ class InsiderConfig(AppConfig):
         # env-var fallback in `init` still applies if Django's settings
         # didn't define it.
         dsn = kwargs.pop("dsn", None)
-        init(dsn, **kwargs)
+        init(dsn, integrations=[DjangoIntegration()], **kwargs)

insider_python-0.1.3/src/insider/contrib/django/middleware.py

@@ -0,0 +1,65 @@
+"""
+InsiderMiddleware: attach request context to the SDK scope, and
+auto-capture any unhandled exception that escapes a view.
+
+The middleware is a no-op when the SDK is in disabled mode.
+
+Prefer the Sentry-style integration instead — see
+`insider.integrations.django.DjangoIntegration` and `wsgi.py` init.
+This middleware remains for backward compatibility.
+
+What we attach to the scope:
+
+  - method, path, route (URL name if available), query_string
+  - headers (post-scrubbing — note that scrubbing happens at envelope
+    build time, not here, so headers go on as-is and get masked just
+    before transport)
+  - body and user.id ONLY when `send_default_pii=True` in init()
+
+What we never touch:
+
+  - request.session
+  - file uploads
+  - anything from request.META not on the allowlist
+
+`process_exception` is Django's hook for "an exception escaped a view
+without being handled". We call `capture_exception` and then return
+None so Django continues its normal 500 handling.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Callable
+
+from ...client import _client
+from ...integrations.django.capture import capture_request_exception
+from ...integrations.django.request import build_request_ctx
+from ...safety import safe
+
+
+class InsiderMiddleware:
+    """
+    Django middleware. Installs request context on the SDK scope, then
+    captures any unhandled exception with that context attached.
+    """
+
+    def __init__(self, get_response: Callable[[Any], Any]) -> None:
+        self.get_response = get_response
+
+    @safe
+    def __call__(self, request: Any) -> Any:
+        client = _client()
+        if client is None:
+            return self.get_response(request)
+
+        ctx = build_request_ctx(request, client.send_default_pii)
+        client.scope.set_request(ctx)
+        try:
+            return self.get_response(request)
+        finally:
+            client.scope.clear_request()
+
+    @safe
+    def process_exception(self, request: Any, exception: BaseException) -> None:
+        capture_request_exception(request, exception)
+        return None

insider_python-0.1.3/src/insider/integrations/__init__.py

@@ -0,0 +1,20 @@
+"""
+Framework integrations for Insider.
+
+Each integration exposes a `setup_once()` hook that patches into the host
+framework exactly once per process. Pass instances to `insider.init`:
+
+    insider.init(dsn=..., integrations=[DjangoIntegration()])
+"""
+
+from __future__ import annotations
+
+from typing import Protocol, runtime_checkable
+
+
+@runtime_checkable
+class Integration(Protocol):
+    """Minimal integration contract."""
+
+    def setup_once(self) -> None:
+        """Install hooks into the host framework. Idempotent."""

insider_python-0.1.3/src/insider/integrations/django/__init__.py

@@ -0,0 +1,50 @@
+"""
+Sentry-style Django integration.
+
+Install with `insider.init(..., integrations=[DjangoIntegration()])` in
+`wsgi.py` / `asgi.py` before `get_wsgi_application()`. No middleware or
+`INSTALLED_APPS` wiring required.
+
+Hooks installed (each once per process):
+
+  - `got_request_exception` → auto-capture unhandled view errors
+  - `BaseHandler.get_response` → request context on the SDK scope
+  - `WSGIHandler.__call__` → capture catastrophic escapes
+  - `APIView.initial` (when DRF is present) → DRF request body access
+"""
+
+from __future__ import annotations
+
+import threading
+
+from ...safety import debug, safe
+from . import drf, handler, signals, wsgi
+
+
+class DjangoIntegration:
+    """Patch Django's request/exception path for automatic error capture."""
+
+    identifier = "django"
+
+    _lock = threading.Lock()
+    _installed = False
+
+    @safe
+    def setup_once(self) -> None:
+        cls = type(self)
+        with cls._lock:
+            if cls._installed:
+                return
+            cls._installed = True
+
+        try:
+            import django  # noqa: F401
+        except ImportError:
+            debug("DjangoIntegration: django is not installed")
+            cls._installed = False
+            return
+
+        signals.install()
+        handler.install()
+        wsgi.install()
+        drf.install()

insider_python-0.1.3/src/insider/integrations/django/capture.py

@@ -0,0 +1,43 @@
+"""
+Shared request-exception capture with de-duplication.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from ... import capture_exception
+from ...client import _client
+from ...safety import safe
+from .request import build_request_ctx
+
+_CAPTURED_ATTR = "_insider_exception_captured"
+
+
+@safe
+def capture_request_exception(request: Any, exception: BaseException) -> None:
+    """
+    Capture an unhandled request exception once per request.
+
+    Middleware `process_exception` and Django's `got_request_exception`
+    signal can both fire for the same failure; the request flag prevents
+    double-beaming.
+    """
+    if getattr(request, _CAPTURED_ATTR, False):
+        return
+    setattr(request, _CAPTURED_ATTR, True)
+
+    client = _client()
+    if client is None:
+        return
+
+    # Scope may already be set by middleware or the get_response patch.
+    if client.scope.current_request() is None:
+        ctx = build_request_ctx(request, client.send_default_pii)
+        client.scope.set_request(ctx)
+        try:
+            capture_exception(exception)
+        finally:
+            client.scope.clear_request()
+    else:
+        capture_exception(exception)

insider_python-0.1.3/src/insider/integrations/django/drf.py

@@ -0,0 +1,40 @@
+"""
+Optional DRF patch: link DRF Request objects for accurate body reads.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from ...safety import debug, safe
+from .request import attach_drf_request_backref
+
+_patched = False
+
+
+def install() -> None:
+    global _patched
+    if _patched:
+        return
+    try:
+        from rest_framework.views import APIView
+    except ImportError:
+        return
+
+    old_initial = APIView.initial
+
+    @safe
+    def patched_initial(
+        self: Any,
+        request: Any,
+        *args: Any,
+        **kwargs: Any,
+    ) -> Any:
+        try:
+            attach_drf_request_backref(request._request, request)
+        except Exception as exc:
+            debug(f"drf initial backref failed: {exc}")
+        return old_initial(self, request, *args, **kwargs)
+
+    APIView.initial = patched_initial  # type: ignore[method-assign]
+    _patched = True

insider_python-0.1.3/src/insider/integrations/django/handler.py

@@ -0,0 +1,42 @@
+"""
+Patch `BaseHandler.get_response` to attach request context for the request lifetime.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Callable
+
+from ...client import _client
+from ...safety import debug, safe
+from .request import build_request_ctx
+
+_patched = False
+
+
+def install() -> None:
+    global _patched
+    if _patched:
+        return
+    try:
+        from django.core.handlers.base import BaseHandler
+    except ImportError:
+        debug("django BaseHandler unavailable; skipping get_response patch")
+        return
+
+    old_get_response = BaseHandler.get_response
+
+    @safe
+    def patched_get_response(self: Any, request: Any) -> Any:
+        client = _client()
+        if client is None:
+            return old_get_response(self, request)
+
+        ctx = build_request_ctx(request, client.send_default_pii)
+        client.scope.set_request(ctx)
+        try:
+            return old_get_response(self, request)
+        finally:
+            client.scope.clear_request()
+
+    BaseHandler.get_response = patched_get_response  # type: ignore[method-assign]
+    _patched = True

insider_python-0.1.3/src/insider/integrations/django/request.py

@@ -0,0 +1,140 @@
+"""
+Build Insider request-context dicts from Django (and DRF) request objects.
+"""
+
+from __future__ import annotations
+
+import weakref
+from typing import Any, Dict, Optional
+
+from ...safety import debug
+
+# Request headers that are safe to forward to the dashboard. We keep an
+# allow-list rather than a deny-list because there are too many possible
+# custom headers to enumerate scary ones. Scrubbing further masks names
+# matching the default deny-list (Authorization, Cookie, etc.) at envelope
+# build time.
+_SAFE_HEADERS = {
+    "accept",
+    "accept-encoding",
+    "accept-language",
+    "content-type",
+    "content-length",
+    "host",
+    "referer",
+    "user-agent",
+    "x-forwarded-for",
+    "x-real-ip",
+    "x-request-id",
+}
+
+_DRF_BACKREF_ATTR = "_insider_drf_request_backref"
+
+
+def attach_drf_request_backref(django_request: Any, drf_request: Any) -> None:
+    """Link a DRF Request to its wrapped Django request for body reads."""
+    try:
+        setattr(django_request, _DRF_BACKREF_ATTR, weakref.ref(drf_request))
+    except Exception as exc:
+        debug(f"drf request backref failed: {exc}")
+
+
+def build_request_ctx(request: Any, send_default_pii: bool) -> Dict[str, Any]:
+    try:
+        request = _resolve_drf_request(request)
+
+        method = getattr(request, "method", None)
+        path = getattr(request, "path", None)
+        meta = getattr(request, "META", {})
+        query = meta.get("QUERY_STRING") or None
+        route = None
+        try:
+            match = getattr(request, "resolver_match", None)
+            if match is not None:
+                route = match.view_name
+        except Exception:
+            pass
+
+        headers = _extract_headers(meta)
+
+        ctx: Dict[str, Any] = {
+            "method": method,
+            "path": path,
+            "query_string": query,
+            "route": route,
+            "headers": headers,
+        }
+
+        if send_default_pii:
+            ctx["body"] = _read_body(request)
+            user = getattr(request, "user", None)
+            user_id = getattr(user, "id", None) if user is not None else None
+            if user_id is not None:
+                ctx["user"] = {"id": user_id}
+
+        return ctx
+    except Exception as exc:
+        debug(f"request ctx build failed: {exc}")
+        return {}
+
+
+def _resolve_drf_request(request: Any) -> Any:
+    """Prefer the DRF Request when a weak backref was attached in `initial`."""
+    try:
+        backref = getattr(request, _DRF_BACKREF_ATTR, None)
+        if backref is not None:
+            drf_request = backref()
+            if drf_request is not None:
+                return drf_request
+    except Exception:
+        pass
+    return request
+
+
+def _extract_headers(meta: Dict[str, Any]) -> Dict[str, str]:
+    """Convert Django's META dict into a real headers dict, allow-listed."""
+    headers: Dict[str, str] = {}
+    for key, value in meta.items():
+        if not key.startswith("HTTP_") and key not in (
+            "CONTENT_TYPE",
+            "CONTENT_LENGTH",
+        ):
+            continue
+        name = key
+        if key.startswith("HTTP_"):
+            name = key[len("HTTP_") :]
+        name = name.replace("_", "-").lower()
+        if name not in _SAFE_HEADERS:
+            if len(str(value)) > 4096:
+                continue
+        try:
+            headers[name] = str(value)
+        except Exception:
+            pass
+    return headers
+
+
+def _read_body(request: Any) -> Optional[str]:
+    """
+    Return a string version of the request body, or None.
+    We don't consume `request.body` if it hasn't been read yet, to avoid
+    breaking downstream views; if it's accessible, we take it.
+    """
+    try:
+        data = getattr(request, "data", None)
+        if data is not None and not isinstance(data, (str, bytes)):
+            try:
+                import json
+
+                return json.dumps(data)
+            except Exception:
+                return str(data)
+
+        raw = getattr(request, "body", None)
+        if raw is None:
+            return None
+        if isinstance(raw, bytes):
+            return raw.decode("utf-8", errors="replace")
+        return str(raw)
+    except Exception:
+        return None

insider_python-0.1.3/src/insider/integrations/django/signals.py

@@ -0,0 +1,39 @@
+"""
+Connect Django's `got_request_exception` signal to Insider capture.
+"""
+
+from __future__ import annotations
+
+import sys
+from typing import Any
+
+from ...safety import debug, safe
+from .capture import capture_request_exception
+
+_connected = False
+
+
+def install() -> None:
+    global _connected
+    if _connected:
+        return
+    try:
+        from django.core import signals
+    except ImportError:
+        debug("django signals unavailable; skipping got_request_exception hook")
+        return
+
+    signals.got_request_exception.connect(_on_got_request_exception)
+    _connected = True
+
+
+@safe
+def _on_got_request_exception(
+    sender: Any,
+    request: Any,
+    **kwargs: Any,
+) -> None:
+    exc = sys.exc_info()[1]
+    if exc is None:
+        return
+    capture_request_exception(request, exc)

insider_python-0.1.3/src/insider/integrations/django/wsgi.py

@@ -0,0 +1,43 @@
+"""
+Patch `WSGIHandler.__call__` to capture exceptions that escape Django entirely.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Callable
+
+from ... import capture_exception
+from ...client import _client
+from ...safety import debug, safe
+
+_patched = False
+
+
+def install() -> None:
+    global _patched
+    if _patched:
+        return
+    try:
+        from django.core.handlers.wsgi import WSGIHandler
+    except ImportError:
+        debug("django WSGIHandler unavailable; skipping WSGI patch")
+        return
+
+    old_call: Callable[..., Any] = WSGIHandler.__call__
+
+    @safe
+    def patched_call(
+        self: Any,
+        environ: Any,
+        start_response: Any,
+    ) -> Any:
+        if _client() is None:
+            return old_call(self, environ, start_response)
+        try:
+            return old_call(self, environ, start_response)
+        except BaseException as exc:
+            capture_exception(exc)
+            raise
+
+    WSGIHandler.__call__ = patched_call  # type: ignore[method-assign]
+    _patched = True

{insider_python-0.1.2 → insider_python-0.1.3}/src/insider_python.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: insider-python
-Version: 0.1.2
+Version: 0.1.3
 Summary: Python SDK for Insider — ship Beacons to your Insider server.
 Author: Insider
 License-Expression: MIT
@@ -24,6 +24,7 @@ Provides-Extra: dev
 Requires-Dist: pytest>=8; extra == "dev"
 Requires-Dist: pytest-django>=4.8; extra == "dev"
 Requires-Dist: django>=4.2; extra == "dev"
+Requires-Dist: djangorestframework>=3.14; extra == "dev"
 
 # insider-python
 
@@ -68,26 +69,31 @@ insider.capture_message("cache miss spiked", level="warning")
 
 ### Django
 
-Add the integration to `INSTALLED_APPS` and configure via settings:
+Initialize in `wsgi.py` (or `asgi.py`) before `get_wsgi_application()`:
 
 ```python
-INSTALLED_APPS = [
-    # ...
-    "insider.contrib.django",
-]
-
-MIDDLEWARE = [
-    # ...
-    "insider.contrib.django.middleware.InsiderMiddleware",
-]
-
-INSIDER_DSN = "https://<beacon_token>@insider.example.com/<project_uuid>"
-INSIDER_ENVIRONMENT = "production"
-INSIDER_RELEASE = "1.2.3"
+import os
+import insider
+from insider.integrations.django import DjangoIntegration
+
+insider.init(
+    dsn=os.environ.get("INSIDER_DSN"),
+    environment="production",
+    release="1.2.3",
+    integrations=[DjangoIntegration()],
+)
+
+from django.core.wsgi import get_wsgi_application
+application = get_wsgi_application()
 ```
 
-That's the whole setup. Every unhandled exception in a view is now a
-Beacon in your dashboard.
+That's the whole setup. Every unhandled exception in a view — including
+Django REST Framework API views — is now a Beacon in your dashboard.
+No middleware, no `INSTALLED_APPS`, and no `EXCEPTION_HANDLER` wiring.
+
+**Legacy setup** (still supported): add `insider.contrib.django` to
+`INSTALLED_APPS` and `InsiderMiddleware` to `MIDDLEWARE`. Prefer the
+`wsgi.py` pattern for new projects.
 
 ## Configuration
 

{insider_python-0.1.2 → insider_python-0.1.3}/src/insider_python.egg-info/SOURCES.txt

@@ -15,6 +15,14 @@ src/insider/contrib/__init__.py
 src/insider/contrib/django/__init__.py
 src/insider/contrib/django/apps.py
 src/insider/contrib/django/middleware.py
+src/insider/integrations/__init__.py
+src/insider/integrations/django/__init__.py
+src/insider/integrations/django/capture.py
+src/insider/integrations/django/drf.py
+src/insider/integrations/django/handler.py
+src/insider/integrations/django/request.py
+src/insider/integrations/django/signals.py
+src/insider/integrations/django/wsgi.py
 src/insider_python.egg-info/PKG-INFO
 src/insider_python.egg-info/SOURCES.txt
 src/insider_python.egg-info/dependency_links.txt
@@ -22,6 +30,8 @@ src/insider_python.egg-info/requires.txt
 src/insider_python.egg-info/top_level.txt
 tests/test_capture.py
 tests/test_django.py
+tests/test_django_integration.py
+tests/test_drf_integration.py
 tests/test_dsn.py
 tests/test_envelope.py
 tests/test_never_crash.py

{insider_python-0.1.2 → insider_python-0.1.3}/src/insider_python.egg-info/requires.txt

@@ -4,6 +4,7 @@ urllib3>=1.26
 pytest>=8
 pytest-django>=4.8
 django>=4.2
+djangorestframework>=3.14
 
 [django]
 django>=4.2

insider_python-0.1.3/tests/test_django_integration.py

@@ -0,0 +1,58 @@
+"""
+DjangoIntegration tests — Sentry-style hooks without middleware.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from insider.client import _set_active
+from insider.integrations.django import DjangoIntegration
+
+
+@pytest.fixture(autouse=True)
+def _integration_env(settings, sdk_client):
+    settings.INSTALLED_APPS = [
+        "django.contrib.contenttypes",
+        "django.contrib.auth",
+    ]
+    settings.MIDDLEWARE = []
+    settings.ROOT_URLCONF = "tests.django_integration_urls"
+    DjangoIntegration().setup_once()
+    yield
+    _set_active(None)
+
+
+@pytest.fixture(autouse=True)
+def _no_raise_on_500(client):
+    client.raise_request_exception = False
+
+
+@pytest.mark.django_db
+def test_integration_captures_view_exception(client, fake_transport):
+    response = client.get("/boom/?foo=bar", HTTP_USER_AGENT="pytest-ua")
+    assert response.status_code == 500
+    assert len(fake_transport.envelopes) == 1
+    env = fake_transport.envelopes[0]
+    assert env["kind"] == "error"
+    assert env["message"] == "intentional explosion"
+    request_ctx = env["payload"]["request"]
+    assert request_ctx["method"] == "GET"
+    assert request_ctx["path"] == "/boom/"
+    assert request_ctx["query_string"] == "foo=bar"
+    assert request_ctx["headers"]["user-agent"] == "pytest-ua"
+
+
+@pytest.mark.django_db
+def test_integration_clean_request_does_not_capture(client, fake_transport):
+    response = client.get("/ok/")
+    assert response.status_code == 200
+    assert fake_transport.envelopes == []
+
+
+@pytest.mark.django_db
+def test_integration_disabled_mode_is_noop(client, fake_transport):
+    _set_active(None)
+    response = client.get("/boom/")
+    assert response.status_code == 500
+    assert fake_transport.envelopes == []

insider_python-0.1.3/tests/test_drf_integration.py

@@ -0,0 +1,59 @@
+"""
+DRF tests for DjangoIntegration — no middleware, no EXCEPTION_HANDLER wiring.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from insider.client import _set_active
+from insider.integrations.django import DjangoIntegration
+
+drf = pytest.importorskip("rest_framework")
+
+
+@pytest.fixture(autouse=True)
+def _drf_integration_env(settings, sdk_client):
+    settings.INSTALLED_APPS = [
+        "django.contrib.contenttypes",
+        "django.contrib.auth",
+        "rest_framework",
+    ]
+    settings.MIDDLEWARE = []
+    settings.ROOT_URLCONF = "tests.django_drf_urls"
+    DjangoIntegration().setup_once()
+    yield
+    _set_active(None)
+
+
+@pytest.fixture(autouse=True)
+def _no_raise_on_500(client):
+    client.raise_request_exception = False
+
+
+@pytest.mark.django_db
+def test_drf_unhandled_exception_is_captured(client, fake_transport):
+    response = client.get("/api/boom/", HTTP_USER_AGENT="pytest-drf")
+    assert response.status_code == 500
+    assert len(fake_transport.envelopes) == 1
+    env = fake_transport.envelopes[0]
+    assert env["kind"] == "error"
+    assert env["message"] == "drf intentional explosion"
+    request_ctx = env["payload"]["request"]
+    assert request_ctx["method"] == "GET"
+    assert request_ctx["path"] == "/api/boom/"
+    assert request_ctx["headers"]["user-agent"] == "pytest-drf"
+
+
+@pytest.mark.django_db
+def test_drf_handled_api_exception_is_not_captured(client, fake_transport):
+    response = client.get("/api/bad-request/")
+    assert response.status_code == 400
+    assert fake_transport.envelopes == []
+
+
+@pytest.mark.django_db
+def test_drf_clean_request_does_not_capture(client, fake_transport):
+    response = client.get("/api/ok/")
+    assert response.status_code == 200
+    assert fake_transport.envelopes == []

insider_python-0.1.2/src/insider/contrib/django/middleware.py

@@ -1,164 +0,0 @@
-"""
-InsiderMiddleware: attach request context to the SDK scope, and
-auto-capture any unhandled exception that escapes a view.
-
-The middleware is a no-op when the SDK is in disabled mode.
-
-What we attach to the scope:
-
-  - method, path, route (URL name if available), query_string
-  - headers (post-scrubbing — note that scrubbing happens at envelope
-    build time, not here, so headers go on as-is and get masked just
-    before transport)
-  - body and user.id ONLY when `send_default_pii=True` in init()
-
-What we never touch:
-
-  - request.session
-  - file uploads
-  - anything from request.META not on the allowlist
-
-`process_exception` is Django's hook for "an exception escaped a view
-without being handled". We call `capture_exception` and then return
-None so Django continues its normal 500 handling.
-"""
-
-from __future__ import annotations
-
-from typing import Any, Callable, Dict, Optional
-
-from ... import capture_exception
-from ...client import _client
-from ...safety import debug, safe
-
-
-# Request headers that are safe to forward to the dashboard. We keep an
-# allow-list rather than a deny-list because there are too many possible
-# custom headers to enumerate scary ones. Scrubbing further masks names
-# matching the default deny-list (Authorization, Cookie, etc.) at envelope
-# build time.
-_SAFE_HEADERS = {
-    "accept",
-    "accept-encoding",
-    "accept-language",
-    "content-type",
-    "content-length",
-    "host",
-    "referer",
-    "user-agent",
-    "x-forwarded-for",
-    "x-real-ip",
-    "x-request-id",
-}
-
-
-class InsiderMiddleware:
-    """
-    Django middleware. Installs request context on the SDK scope, then
-    captures any unhandled exception with that context attached.
-    """
-
-    def __init__(self, get_response: Callable[[Any], Any]) -> None:
-        self.get_response = get_response
-
-    @safe
-    def __call__(self, request: Any) -> Any:
-        client = _client()
-        if client is None:
-            return self.get_response(request)
-
-        ctx = self._build_request_ctx(request, client.send_default_pii)
-        client.scope.set_request(ctx)
-        try:
-            return self.get_response(request)
-        finally:
-            client.scope.clear_request()
-
-    @safe
-    def process_exception(self, request: Any, exception: BaseException) -> None:
-        # Scope's already set in __call__; capture inherits the request ctx.
-        capture_exception(exception)
-        return None  # let Django render the 500
-
-    # ------------------------------------------------------------------
-
-    @staticmethod
-    def _build_request_ctx(request: Any, send_default_pii: bool) -> Dict[str, Any]:
-        try:
-            method = getattr(request, "method", None)
-            path = getattr(request, "path", None)
-            query = getattr(request, "META", {}).get("QUERY_STRING") or None
-            route = None
-            try:
-                # ResolverMatch is set after urls resolve; in middleware
-                # __call__ before view, it's usually None. We still try.
-                match = getattr(request, "resolver_match", None)
-                if match is not None:
-                    route = match.view_name
-            except Exception:
-                pass
-
-            headers = _extract_headers(getattr(request, "META", {}))
-
-            ctx: Dict[str, Any] = {
-                "method": method,
-                "path": path,
-                "query_string": query,
-                "route": route,
-                "headers": headers,
-            }
-
-            if send_default_pii:
-                ctx["body"] = _read_body(request)
-                user = getattr(request, "user", None)
-                user_id = getattr(user, "id", None) if user is not None else None
-                if user_id is not None:
-                    ctx["user"] = {"id": user_id}
-
-            return ctx
-        except Exception as exc:
-            debug(f"request ctx build failed: {exc}")
-            return {}
-
-
-def _extract_headers(meta: Dict[str, Any]) -> Dict[str, str]:
-    """Convert Django's META dict into a real headers dict, allow-listed."""
-    headers: Dict[str, str] = {}
-    for key, value in meta.items():
-        if not key.startswith("HTTP_") and key not in (
-            "CONTENT_TYPE",
-            "CONTENT_LENGTH",
-        ):
-            continue
-        name = key
-        if key.startswith("HTTP_"):
-            name = key[len("HTTP_") :]
-        name = name.replace("_", "-").lower()
-        if name not in _SAFE_HEADERS:
-            # We still include unknown headers; the scrubber will mask any
-            # whose name is in the deny-list. But we cap obviously huge or
-            # weird ones here.
-            if len(str(value)) > 4096:
-                continue
-        try:
-            headers[name] = str(value)
-        except Exception:
-            pass
-    return headers
-
-
-def _read_body(request: Any) -> Optional[str]:
-    """
-    Return a string version of the request body, or None.
-    We don't consume `request.body` if it hasn't been read yet, to avoid
-    breaking downstream views; if it's accessible, we take it.
-    """
-    try:
-        raw = getattr(request, "body", None)
-        if raw is None:
-            return None
-        if isinstance(raw, bytes):
-            return raw.decode("utf-8", errors="replace")
-        return str(raw)
-    except Exception:
-        return None