keepup-http 0.5.0__tar.gz → 0.7.0__tar.gz

{keepup_http-0.5.0 → keepup_http-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keepup-http
-Version: 0.5.0
+Version: 0.7.0
 Summary: The way into the application over HTTP: the application, its routes and its middleware.
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown

{keepup_http-0.5.0 → keepup_http-0.7.0}/keepup_http/__init__.py

@@ -10,7 +10,7 @@ route wrapper; they move in one slice at a time, and the base answers their old
 names through the compatibility layer for one release (keepup-122).
 """
 
-__version__ = "0.5.0"
+__version__ = "0.7.0"
 
 __all__ = ["HttpPlugin", "SERVICE_HTTP", "register_api_documentation",
            "register_event_api_routes"]

{keepup_http-0.5.0 → keepup_http-0.7.0}/keepup_http/factory.py

@@ -43,6 +43,7 @@ from keepup_audit.events import init_event_manager
 from keepup_http.events_api import register_event_api_routes
 from keepup.instance import get_instance_id
 from keepup_http.lock_routes import register_lock_routes
+from keepup_http.routes import register_declared_routes, register_declared_sockets
 from keepup_metrics.api import register_metrics_routes
 from keepup_modules.catalogue import register_module_routes
 from keepup.plugins.registry import (
@@ -168,6 +169,11 @@ def apply_settings(settings: KeepupSettings) -> None:
         favicon_file=settings.favicon_file,
     )
     auth_dependencies.configure_panel_gate(pending=settings.pending_documents)
+    # The panel's cookies carry the application's name, so several keepup
+    # applications on one host do not overwrite each other's session (0.7.0).
+    panel_session.configure(
+        settings.cookie_prefix if settings.cookie_prefix is not None
+        else settings.project_name)
     if not settings.database_dialect:
         # The framework's configuration is the default; naming the dialect lets
         # the kernel choose a driver without importing a database (keepup-123).
@@ -314,6 +320,19 @@ def _build_lifespan(settings: KeepupSettings):
         if manager is not None:
             await initialize_plugins(app, manager, config_path=settings.plugins_config_path)
 
+        # What the kernel's plugins declared is bound here (keepup-121): an
+        # application that named only `plugins_dir` used to get no route of its
+        # own, because only a PluginManager of the 0.3.0 path ever bound them.
+        # The manager above registered its declarations a moment ago; a route the
+        # application already answers is skipped rather than answered twice.
+        if kernel is not None:
+            mounted = kernel.mount({
+                "routes": lambda items, runtime=None: register_declared_routes(app, items),
+                "sockets": lambda items, runtime=None: register_declared_sockets(app, items),
+            })
+            if mounted:
+                logger.info("Mounted what the plugins declared: %s", mounted)
+
         # The log handlers the running capabilities contribute -- the shipping
         # one, when a collector is named (keepup-118). A deployment that
         # installs none attaches nothing.

{keepup_http-0.5.0 → keepup_http-0.7.0}/keepup_http/routes.py

@@ -40,6 +40,8 @@ from keepup.plugins import route_mask
 __all__ = [
     "accepted_params",
     "raw_request_wrapper",
+    "register_declared_routes",
+    "register_declared_sockets",
     "register_plugin_routes",
 ]
 
@@ -335,10 +337,9 @@ def create_wrapper(handler, path, methods, require_auth: bool = True,
 
     async def call(request: Request, current_user):
         """One call of a plugin route, from the audit's first row to its last."""
-        request_data = {
-            'user_id': current_user.get('id') if current_user else None,
-            'username': current_user.get('username') if current_user else 'anonymous',
-        }
+        # The actor is not part of request_data: that is redacted whole, and a
+        # row that cannot name who called is not an audit (keepup-172).
+        request_data = {}
         if has_path_params:
             request_data['path_params'] = dict(request.path_params)
         request_data['query_params'] = dict(request.query_params)
@@ -353,7 +354,8 @@ def create_wrapper(handler, path, methods, require_auth: bool = True,
                 method=method_name,
                 endpoint=path,
                 host='plugin_api',
-                request_data=request_data
+                request_data=request_data,
+                actor=current_user
         ) as request_id:
             try:
                 response = await invoke(request, current_user)
@@ -413,95 +415,223 @@ async def register_plugin_routes(app, manager):
     logger.info(f"Found {len(routes)} plugin routes to register")
 
     for route in routes:
-        handler = route['handler']
-        path = route['path']
-        methods = route['methods']
-        require_auth = route.get('require_auth', True)
-        is_upload = route.get('is_upload', False)
-        permission = route.get('permission')
-        audit = route.get('audit', True)
-        response_media_type = route.get('response_media_type')
-        if response_media_type is not None and (
-                not isinstance(response_media_type, str) or not response_media_type.strip()):
-            raise ValueError(
-                f"{path}: response_media_type is a media type, like 'text/plain'")
-        if response_media_type is not None and route.get('raw_request'):
-            raise ValueError(
-                f"{path}: a raw_request route answers with a Response of its own; "
-                "response_media_type would be ignored. Drop one of the two.")
-        if permission is not None:
-            # A right needs somebody to hold it: on a route nobody signs in to,
-            # or one that signs itself in, it would be a check that never runs.
-            if not isinstance(permission, str) or not permission.strip():
-                raise ValueError(f"{path}: permission must be a non-empty string")
-            if route.get('raw_request') or not require_auth:
-                raise ValueError(
-                    f"{path}: a route that declares a permission must be signed in by "
-                    "the framework -- drop require_auth: false or raw_request, or the "
-                    "permission")
-
-        logger.info(
-            f"Registering route {path} - methods: {methods}, auth: {require_auth}, upload: {is_upload}")
-
-        # The kernel parsed and checked the mask when it collected the route,
-        # for every transport there will ever be (keepup-102); a route that
-        # reaches here without one was declared by something else, and is
-        # checked the same way rather than trusted.
-        mask = route.get('_mask')
-        if mask is None:
-            try:
-                mask = route_mask.parse(route.get(route_mask.MASK_FIELD), path)
-                route_mask.check_signature(handler, mask)
-            except route_mask.MaskError as error:
-                # The same loudness as the raw_request check below: a mask naming
-                # a parameter the handler does not take is a typo, and finding it
-                # on a request would mean hearing about it from a user.
-                raise ValueError(f"{path}: {error}")
-
-        if route.get('raw_request'):
-            # A raw route authenticates inside the handler -- it is handed the
-            # Request and nothing else. Declaring require_auth on it therefore
-            # promises a check the framework does not make, and the start-up
-            # line used to print auth=True over an open route (keepup-12).
-            if route.get('require_auth') is True:
-                raise ValueError(
-                    f"{path}: a raw_request route cannot also declare "
-                    "require_auth -- the handler receives the Request and "
-                    "authenticates itself. Drop one of the two.")
-            require_auth = False
-            wrapper = raw_request_wrapper(handler)
-        else:
-            wrapper = create_wrapper(handler, path, methods, require_auth, is_upload, mask,
-                                     permission, audit=audit,
-                                     response_media_type=response_media_type)
-
-        # What the route says about its body: its own limit, or that it reads
-        # the body itself (keepup/body_limit.py).
-        declare_limit(wrapper, route)
-
-        app.add_api_route(
-            path,
-            wrapper,
-            methods=methods,
-            include_in_schema=route.get('include_in_schema', True)
-        )
-
-        logger.info(
-            f"Registered plugin route: {path} - {methods} (auth={require_auth}, upload={is_upload})")
+        _mount_route(app, route)
 
     websocket_routes = manager.get_all_websocket_routes()
     logger.info(f"Found {len(websocket_routes)} WebSocket plugin routes to register")
 
     for ws_route in websocket_routes:
-        path = ws_route['path']
-        handler = ws_route['handler']
-        # Off by default, unlike HTTP routes: sockets of agents and guests carry
-        # tokens of their own and would be refused by the panel's sign-in rule.
-        if ws_route.get('require_auth', False):
-            handler = signed_in_websocket(handler)
-        _register_websocket(app, path, handler)
-        logger.info(f"Registered WebSocket plugin route: {path} "
-                    f"(auth={bool(ws_route.get('require_auth', False))})")
+        _mount_socket(app, ws_route)
+
+
+def register_declared_routes(app, declarations) -> int:
+    """Mount the routes the kernel collected from the plugins (keepup-121).
+
+    The kernel resolves, loads and initialises the plugins, and what they
+    declared is the runtime's, transport-neutral: this is the HTTP half of that
+    seam, the call ``runtime.mount`` hands to a registrar. Until it existed an
+    application that named only ``plugins_dir`` got no route of its own, because
+    only a PluginManager of the 0.3.0 path ever bound them.
+
+    What the application already answers is left alone: the framework's own
+    routes are registered before the kernel starts, and an application that
+    passes a manager has its declarations bound by `register_plugin_routes` --
+    so one declaration never becomes two endpoints.
+
+    Args:
+        app: the FastAPI application.
+        declarations: the route declarations the kernel collected, each tagged
+            with ``_plugin_id`` and, because the collector does it once for every
+            transport, a parsed ``_mask``.
+
+    Returns:
+        How many declarations were mounted.
+    """
+    mounted = 0
+    for declaration in declarations:
+        path = declaration["path"]
+        methods = tuple(declaration.get("methods") or ())
+        if _already_mounted(app, path, methods):
+            logger.info("Route %s %s already answers: the kernel's declaration is "
+                        "not mounted twice", path, list(methods))
+            continue
+        _mount_route(app, declaration)
+        mounted += 1
+    return mounted
+
+
+def register_declared_sockets(app, declarations) -> int:
+    """Mount the sockets the kernel collected from the plugins (keepup-121).
+
+    The same seam as `register_declared_routes`, for the other thing a plugin
+    declares. A socket the application already answers is left alone.
+
+    Args:
+        app: the FastAPI application.
+        declarations: the socket declarations the kernel collected.
+
+    Returns:
+        How many declarations were mounted.
+    """
+    mounted = 0
+    for declaration in declarations:
+        path = declaration["path"]
+        if _already_mounted(app, path):
+            logger.info("Socket %s already answers: the kernel's declaration is not "
+                        "mounted twice", path)
+            continue
+        _mount_socket(app, declaration)
+        mounted += 1
+    return mounted
+
+
+def _mount_route(app, declaration):
+    """Turn one declared route into an endpoint, having checked it first.
+
+    One implementation for every declaration, whatever collected it -- the
+    manager of the 0.3.0 path or the kernel's catalogue (keepup-21, keepup-121).
+    A declaration the route runtime refuses -- a permission on a route nobody
+    signs in to, a mask naming a parameter the handler does not take -- is a
+    mistake found at the start, rather than a route that quietly goes missing
+    (keepup-102).
+
+    Args:
+        app: the FastAPI application.
+        declaration: the route as the plugin declared it. The kernel's collector
+            leaves a parsed ``_mask`` on it; a declaration from anywhere else is
+            checked here instead of trusted.
+
+    Raises:
+        ValueError: when the declaration is one the runtime refuses.
+    """
+    route = declaration
+    handler = route['handler']
+    path = route['path']
+    methods = route['methods']
+    require_auth = route.get('require_auth', True)
+    is_upload = route.get('is_upload', False)
+    permission = route.get('permission')
+    audit = route.get('audit', True)
+    response_media_type = route.get('response_media_type')
+    if response_media_type is not None and (
+            not isinstance(response_media_type, str) or not response_media_type.strip()):
+        raise ValueError(
+            f"{path}: response_media_type is a media type, like 'text/plain'")
+    if response_media_type is not None and route.get('raw_request'):
+        raise ValueError(
+            f"{path}: a raw_request route answers with a Response of its own; "
+            "response_media_type would be ignored. Drop one of the two.")
+    if permission is not None:
+        # A right needs somebody to hold it: on a route nobody signs in to,
+        # or one that signs itself in, it would be a check that never runs.
+        if not isinstance(permission, str) or not permission.strip():
+            raise ValueError(f"{path}: permission must be a non-empty string")
+        if route.get('raw_request') or not require_auth:
+            raise ValueError(
+                f"{path}: a route that declares a permission must be signed in by "
+                "the framework -- drop require_auth: false or raw_request, or the "
+                "permission")
+
+    logger.info(
+        f"Registering route {path} - methods: {methods}, auth: {require_auth}, upload: {is_upload}")
+
+    # The kernel parsed and checked the mask when it collected the route,
+    # for every transport there will ever be (keepup-102); a route that
+    # reaches here without one was declared by something else, and is
+    # checked the same way rather than trusted.
+    mask = route.get('_mask')
+    if mask is None:
+        try:
+            mask = route_mask.parse(route.get(route_mask.MASK_FIELD), path)
+            route_mask.check_signature(handler, mask)
+        except route_mask.MaskError as error:
+            # The same loudness as the raw_request check below: a mask naming
+            # a parameter the handler does not take is a typo, and finding it
+            # on a request would mean hearing about it from a user.
+            raise ValueError(f"{path}: {error}")
+
+    if route.get('raw_request'):
+        # A raw route authenticates inside the handler -- it is handed the
+        # Request and nothing else. Declaring require_auth on it therefore
+        # promises a check the framework does not make, and the start-up
+        # line used to print auth=True over an open route (keepup-12).
+        if route.get('require_auth') is True:
+            raise ValueError(
+                f"{path}: a raw_request route cannot also declare "
+                "require_auth -- the handler receives the Request and "
+                "authenticates itself. Drop one of the two.")
+        require_auth = False
+        wrapper = raw_request_wrapper(handler)
+    else:
+        wrapper = create_wrapper(handler, path, methods, require_auth, is_upload, mask,
+                                 permission, audit=audit,
+                                 response_media_type=response_media_type)
+
+    # What the route says about its body: its own limit, or that it reads
+    # the body itself (keepup/body_limit.py).
+    declare_limit(wrapper, route)
+
+    app.add_api_route(
+        path,
+        wrapper,
+        methods=methods,
+        include_in_schema=route.get('include_in_schema', True)
+    )
+
+    logger.info(
+        f"Registered plugin route: {path} - {methods} (auth={require_auth}, upload={is_upload})")
+
+
+def _mount_socket(app, declaration):
+    """Turn one declared socket into a route on the application.
+
+    The other half of the same seam: the kernel collects what a plugin declared,
+    and this is where HTTP binds it. Kept beside `_mount_route` because one
+    declaration should have one way in, whatever collected it.
+
+    Args:
+        app: the FastAPI application.
+        declaration: the socket as the plugin declared it.
+    """
+    ws_route = declaration
+    path = ws_route['path']
+    handler = ws_route['handler']
+    # Off by default, unlike HTTP routes: sockets of agents and guests carry
+    # tokens of their own and would be refused by the panel's sign-in rule.
+    if ws_route.get('require_auth', False):
+        handler = signed_in_websocket(handler)
+    _register_websocket(app, path, handler)
+    logger.info(f"Registered WebSocket plugin route: {path} "
+                f"(auth={bool(ws_route.get('require_auth', False))})")
+
+
+def _already_mounted(app, path, methods=None) -> bool:
+    """Whether the application already answers this address, and these verbs.
+
+    Asked before a kernel-collected declaration is mounted: the framework's own
+    routes and the ones a PluginManager bound are registered first, and a path
+    registered twice is an application that answers twice. A socket is asked
+    about by path alone -- it has no methods of its own.
+
+    Args:
+        app: the FastAPI application.
+        path: the address.
+        methods: the verbs, or None for a socket.
+
+    Returns:
+        True when the application already has it.
+    """
+    for route in getattr(app, "routes", ()):
+        if getattr(route, "path", None) != path:
+            continue
+        existing = getattr(route, "methods", None)
+        if methods is None:
+            if not existing:
+                return True
+            continue
+        if tuple(sorted(existing or ())) == tuple(sorted(methods)):
+            return True
+    return False
 
 
 def _register_websocket(app, path, handler):

{keepup_http-0.5.0 → keepup_http-0.7.0}/keepup_http/static/css/main_nebula.css

@@ -47,6 +47,28 @@
     --nav-item-bg-active: rgba(6, 182, 212, 0.24);
     --nav-item-icon-gap: 0.75rem;
 
+    /* The menu's search (keepup-179). A translucent field on a translucent
+       sidebar reads as a hole in it, so this theme gives the field a border of
+       its own and the focus ring the accent colour of the buttons. */
+    --nav-search-bg: rgba(255, 255, 255, 0.05);
+    --nav-search-bg-focus: rgba(6, 182, 212, 0.12);
+    --nav-search-border: rgba(148, 163, 184, 0.22);
+    --nav-search-border-focus: rgba(6, 182, 212, 0.6);
+    --nav-search-radius: 10px;
+    --nav-search-fg: var(--nebula-text-dim);
+    --nav-search-value: #ffffff;
+    --nav-search-placeholder: var(--nebula-text-dim);
+    --nav-item-search-base: 1.25rem;
+    --nav-item-search-step: 1rem;
+
+    /* The match and the keyboard's row (keepup-181). The mark borrows the
+       theme's cyan rather than the default amber: on this sidebar the amber
+       reads as a warning, and the cyan is what a control here looks like. */
+    --nav-search-hit-bg: rgba(6, 182, 212, 0.9);
+    --nav-search-hit-fg: #04121c;
+    --nav-search-current-bg: rgba(6, 182, 212, 0.2);
+    --nav-search-current-ring: rgba(6, 182, 212, 0.7);
+
     --modules-nav-max-height: calc(100vh - 200px);
     --modules-nav-padding: 8px 10px 16px;
     --sidebar-scrollbar-track: rgba(255, 255, 255, 0.04);

{keepup_http-0.5.0 → keepup_http-0.7.0}/keepup_http/static/css/main_new.css

@@ -35,6 +35,29 @@
     --nav-item-bg-active: #1e40af;
     --nav-item-icon-gap: 0.75rem;
 
+    /* The search of the menu (keepup-179). A field sits above the entries and
+       a match that is a submodule is pushed right by its depth, so a result
+       shown without its parent still reads as a sub-item. */
+    --nav-search-bg: rgba(255, 255, 255, 0.12);
+    --nav-search-bg-focus: rgba(255, 255, 255, 0.2);
+    --nav-search-border: rgba(255, 255, 255, 0.16);
+    --nav-search-border-focus: rgba(255, 255, 255, 0.5);
+    --nav-search-radius: 10px;
+    --nav-search-fg: rgba(255, 255, 255, 0.75);
+    --nav-search-value: #ffffff;
+    --nav-search-placeholder: rgba(255, 255, 255, 0.6);
+    --nav-item-search-base: 1.5rem;
+    --nav-item-search-step: 1.1rem;
+
+    /* The match inside a result, and the row the arrow keys are on
+       (keepup-181). The mark is a colour pair of its own so it reads on the
+       sidebar; the current row is a ring rather than a fill, because hover has
+       already claimed the fill. */
+    --nav-search-hit-bg: #fde68a;
+    --nav-search-hit-fg: #1e3a8a;
+    --nav-search-current-bg: rgba(255, 255, 255, 0.2);
+    --nav-search-current-ring: rgba(255, 255, 255, 0.55);
+
     /* Adaptive layout. --layout-breakpoint is the single source of the
        narrow/wide boundary: main_new.js reads it off :root, drives a
        matchMedia off it and keeps the .is-narrow class on <html>, and the
@@ -224,6 +247,148 @@
     transition: margin 0.3s ease;
 }
 
+/* The field above the menu (keepup-179). Chrome, so it is declared here and a
+   section must not restate it. It sits outside #modules-nav-container on
+   purpose: the entries scroll under it, the field stays where it was put. */
+.nav-search {
+    display: flex;
+    align-items: center;
+    margin: 0.25rem 0.75rem 0.5rem;
+    padding: 0 0.75rem;
+    border: 1px solid var(--nav-search-border, rgba(255, 255, 255, 0.16));
+    border-radius: var(--nav-search-radius, 10px);
+    background-color: var(--nav-search-bg, rgba(255, 255, 255, 0.12));
+    transition: var(--chrome-transition, all 0.3s ease);
+}
+
+.nav-search:focus-within {
+    border-color: var(--nav-search-border-focus, rgba(255, 255, 255, 0.5));
+    background-color: var(--nav-search-bg-focus, rgba(255, 255, 255, 0.2));
+}
+
+.nav-search-icon {
+    flex: 0 0 auto;
+    width: 1rem;
+    height: 1rem;
+    color: var(--nav-search-fg, rgba(255, 255, 255, 0.75));
+    stroke-width: 2;
+}
+
+.nav-search-input {
+    flex: 1 1 auto;
+    min-width: 0;
+    width: 100%;
+    padding: 0.55rem 0.5rem;
+    border: 0;
+    background: transparent;
+    color: var(--nav-search-value, #ffffff);
+    font: inherit;
+    font-size: 0.875rem;
+    outline: none;
+    -webkit-appearance: none;
+    appearance: none;
+}
+
+.nav-search-input::placeholder {
+    color: var(--nav-search-placeholder, rgba(255, 255, 255, 0.6));
+}
+
+/* The field carries its own clear button: the browser's would be a second one
+   with a different look, and on some engines it cannot be styled at all. */
+.nav-search-input::-webkit-search-cancel-button,
+.nav-search-input::-webkit-search-decoration {
+    -webkit-appearance: none;
+    appearance: none;
+}
+
+.nav-search-clear {
+    flex: 0 0 auto;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 1.5rem;
+    height: 1.5rem;
+    padding: 0;
+    border: 0;
+    border-radius: 9999px;
+    background: transparent;
+    color: var(--nav-search-fg, rgba(255, 255, 255, 0.75));
+    cursor: pointer;
+}
+
+.nav-search-clear:hover,
+.nav-search-clear:focus-visible {
+    color: var(--nav-search-value, #ffffff);
+    background-color: var(--nav-search-bg-focus, rgba(255, 255, 255, 0.2));
+    outline: none;
+}
+
+.nav-search-clear[hidden] {
+    display: none;
+}
+
+.nav-search-clear-icon {
+    width: 0.85rem;
+    height: 0.85rem;
+    stroke-width: 2.5;
+}
+
+.nav-search-empty {
+    margin: 0.25rem 1.5rem 0.5rem;
+    color: var(--nav-search-placeholder, rgba(255, 255, 255, 0.6));
+    font-size: 0.8rem;
+    line-height: 1.35;
+}
+
+.nav-search-empty[hidden] {
+    display: none;
+}
+
+/* What the search leaves on screen: an entry that does not match goes, an entry
+   the match lives inside stays so the result keeps its path. */
+.nav-item.nav-search-hidden {
+    display: none !important;
+}
+
+/* A matched submodule is indented by its depth: shown without its parent it
+   would otherwise look like a section of its own. The dot is the second cue, so
+   the depth reads even when the two items sit far from the menu's edge. */
+.nav-item.nav-search-match {
+    padding-left: calc(
+        var(--nav-item-search-base, 1.5rem)
+        + var(--nav-search-depth, 0) * var(--nav-item-search-step, 1.1rem)
+    );
+}
+
+.nav-item.nav-search-nested::before {
+    content: "";
+    flex: 0 0 auto;
+    width: 4px;
+    height: 4px;
+    margin-right: 0.5rem;
+    border-radius: 9999px;
+    background-color: currentColor;
+    opacity: 0.55;
+}
+
+/* The substring that matched is marked in place, so the eye lands on it before
+   it reads the rest of the label. The mark's colours are the theme's: on a
+   saturated sidebar the text alone is not enough of a cue. */
+.nav-search-hit {
+    padding: 0 2px;
+    border-radius: 3px;
+    background-color: var(--nav-search-hit-bg, #fde68a);
+    color: var(--nav-search-hit-fg, #1e3a8a);
+    font-weight: 600;
+}
+
+/* Where the arrow keys are. It is not hover -- the pointer may be elsewhere --
+   so it gets a ring that survives the row's own hover and active colours. */
+.nav-item.nav-search-current {
+    background-color: var(--nav-search-current-bg, rgba(255, 255, 255, 0.2));
+    box-shadow: inset 0 0 0 1px var(--nav-search-current-ring, rgba(255, 255, 255, 0.55));
+}
+
 /* Collapsed sidebar. Declared once, for the whole panel, and only for the wide
    layout: below the breakpoint the panel is a drawer, so a collapsed flag saved
    on a desktop would narrow the drawer and shift the content 64px to the right
@@ -238,6 +403,14 @@
     display: none;
 }
 
+/* The field belongs to the wide menu: collapsed, there is no room for it and
+   nothing to type into. The script clears the filter on the way down, so no
+   section is left hidden behind a field nobody can see. */
+:root:not(.is-narrow) .sidebar-collapsed .nav-search,
+:root:not(.is-narrow) .sidebar-collapsed .nav-search-empty {
+    display: none;
+}
+
 :root:not(.is-narrow) .sidebar-collapsed .logo-text {
     display: none;
 }