mcp-security-framework 2.0.0__tar.gz → 2.0.1__tar.gz

{mcp_security_framework-2.0.0 → mcp_security_framework-2.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcp-security-framework
-Version: 2.0.0
+Version: 2.0.1
 Summary: Universal security framework for microservices with SSL/TLS, authentication, authorization, and rate limiting. Added extensible security adapter system for custom operation validation, structured audit logging, and operation context support. Comprehensive test coverage with 1104+ tests. Fully backward compatible. Requires cryptography>=42.0.0 for certificate operations.
 Author-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>
 Maintainer-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>

{mcp_security_framework-2.0.0 → mcp_security_framework-2.0.1}/mcp_security_framework/__init__.py

@@ -79,7 +79,7 @@ from mcp_security_framework.schemas.responses import (
 )
 
 # Version information
-__version__ = "2.0.0"
+__version__ = "2.0.1"
 __author__ = "Vasiliy Zdanovskiy"
 __email__ = "vasilyvz@gmail.com"
 __license__ = "MIT"

{mcp_security_framework-2.0.0 → mcp_security_framework-2.0.1}/mcp_security_framework/core/security_manager.py

@@ -738,7 +738,10 @@ class SecurityManager:
             return FastAPISecurityMiddleware(self)
         except ImportError as e:
             raise SecurityConfigurationError(
-                f"Failed to import FastAPI middleware: {str(e)}", error_code=-32007
+                "FastAPI middleware requires the 'fastapi' extra, which is not "
+                "installed. Install it with: "
+                f"pip install 'mcp-security-framework[fastapi]' ({e})",
+                error_code=-32007,
             )
         except Exception as e:
             raise SecurityConfigurationError(
@@ -783,7 +786,10 @@ class SecurityManager:
             return FlaskSecurityMiddleware(self, wsgi_app)
         except ImportError as e:
             raise SecurityConfigurationError(
-                f"Failed to import Flask middleware: {str(e)}", error_code=-32009
+                "Flask middleware requires the 'flask' extra, which is not "
+                "installed. Install it with: "
+                f"pip install 'mcp-security-framework[flask]' ({e})",
+                error_code=-32009,
             )
         except Exception as e:
             raise SecurityConfigurationError(

{mcp_security_framework-2.0.0 → mcp_security_framework-2.0.1}/mcp_security_framework/examples/adapter_example.py

@@ -114,6 +114,12 @@ class LegacyFtpAdapter:
     }
 
     def __init__(self) -> None:
+        """
+        Initialize the legacy FTP adapter.
+
+        Args:
+            None
+        """
         self.audit_trail: List[Dict[str, Any]] = []
 
     def validate_ftp_operation(

{mcp_security_framework-2.0.0 → mcp_security_framework-2.0.1}/mcp_security_framework/examples/fastapi_example.py

@@ -222,6 +222,15 @@ class FastAPISecurityExample:
 
     @staticmethod
     def _user_info(identity: AuthResult) -> Dict[str, Any]:
+        """Return a dict of the caller's username and roles for an API response.
+
+        Args:
+            identity: The authentication result containing user information.
+
+        Returns:
+            A dict with keys "username" and "roles" for inclusion in
+            response bodies.
+        """
         return {"username": identity.username, "roles": identity.roles}
 
     # -- routes -------------------------------------------------------------

{mcp_security_framework-2.0.0 → mcp_security_framework-2.0.1}/mcp_security_framework/examples/gateway_example.py

@@ -145,6 +145,10 @@ def build_app(security_manager: SecurityManager) -> FastAPI:
 
     @app.middleware("http")
     async def _security(request: Request, call_next):
+        """
+        HTTP middleware hook delegating to the framework's security
+        middleware for authentication, rate limiting, and header injection.
+        """
         return await security_middleware(request, call_next)
 
     return app

{mcp_security_framework-2.0.0 → mcp_security_framework-2.0.1}/mcp_security_framework/examples/microservice_example.py

@@ -165,6 +165,10 @@ def build_service_app(service_name: str, security_manager: SecurityManager) -> F
 
     @app.middleware("http")
     async def _security(request: Request, call_next):
+        """
+        HTTP middleware hook delegating to the framework's security
+        middleware for authentication, rate limiting, and header injection.
+        """
         return await security_middleware(request, call_next)
 
     return app

{mcp_security_framework-2.0.0 → mcp_security_framework-2.0.1}/mcp_security_framework/middleware/__init__.py

@@ -37,19 +37,137 @@ Not exported, and why:
     ``SecurityMiddleware`` and available directly through
     ``core.rate_limiter.RateLimiter``.
 
+Lazy framework binding, and why:
+    ``fastapi_middleware`` and ``flask_middleware`` import their web
+    framework unconditionally at module level, and ``pyproject.toml`` makes
+    both frameworks OPTIONAL extras (``mcp-security-framework[fastapi]``,
+    ``mcp-security-framework[flask]``) precisely so a consumer need not
+    install the one they do not use.  Importing either name eagerly here,
+    in this package's own ``__init__``, would defeat that: merely doing
+    ``import mcp_security_framework.middleware`` -- which happens before
+    any submodule of this package can be reached at all -- would require
+    BOTH frameworks to be installed, even for a consumer who asked for
+    neither or for only one.  That was exactly the shape of the 2.0.0
+    defect this module now avoids: installing ``[flask]`` alone still
+    raised ``ModuleNotFoundError: No module named 'fastapi'`` on the very
+    first import, three frames below anything the consumer wrote.
+
+    The fix is a module-level ``__getattr__`` (PEP 562): the names below
+    are resolved from their owning submodule only when actually looked up
+    (``middleware.FlaskSecurityMiddleware``, or the factory functions,
+    which resolve the same way), so the cost of a missing framework is
+    paid only by a consumer who asks for that framework, and paid as a
+    clear ``ImportError`` naming the extra to install -- never as a bare,
+    unattributed ``ModuleNotFoundError`` surfacing from package import.
+    ``__all__`` is unchanged: it still names everything this package
+    offers, whether or not the backing framework is installed right now.
+
 Author: MCP Security Team
 Version: 1.0.0
 License: MIT
 """
 
-from typing import Callable, Optional
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Callable, Optional
 
 from ..core.security_manager import SecurityManager
 from .auth_middleware import AuthMiddleware, AuthMiddlewareError
-from .fastapi_middleware import FastAPIMiddlewareError, FastAPISecurityMiddleware
-from .flask_middleware import FlaskMiddlewareError, FlaskSecurityMiddleware
 from .security_middleware import SecurityMiddleware, SecurityMiddlewareError
 
+if TYPE_CHECKING:
+    # Only for static type checkers/linters resolving the annotations below.
+    # Never executed at runtime, so it carries none of the eager-import
+    # defect this module fixes -- a type checker already has both
+    # frameworks' stubs or is told to ignore missing ones, but a real
+    # consumer at import time never reaches this branch.
+    from .fastapi_middleware import FastAPISecurityMiddleware
+    from .flask_middleware import FlaskSecurityMiddleware
+
+# Names resolved lazily by ``__getattr__`` below, and the submodule each is
+# imported from on first access. Kept out of the module namespace until
+# then so that importing this package -- or the OTHER framework's names
+# from it -- never requires a framework the consumer did not ask for.
+_LAZY_ATTRS = {
+    "FastAPISecurityMiddleware": (
+        ".fastapi_middleware",
+        "FastAPISecurityMiddleware",
+        "fastapi",
+    ),
+    "FastAPIMiddlewareError": (
+        ".fastapi_middleware",
+        "FastAPIMiddlewareError",
+        "fastapi",
+    ),
+    "FlaskSecurityMiddleware": (
+        ".flask_middleware",
+        "FlaskSecurityMiddleware",
+        "flask",
+    ),
+    "FlaskMiddlewareError": (
+        ".flask_middleware",
+        "FlaskMiddlewareError",
+        "flask",
+    ),
+}
+
+
+def _import_lazy_attr(name: str):
+    """
+    Import and return one of ``_LAZY_ATTRS`` on first access.
+
+    Args:
+        name (str): Attribute name being resolved, e.g.
+            ``"FlaskSecurityMiddleware"``.
+
+    Returns:
+        The requested class or exception type, imported from its owning
+        submodule.
+
+    Raises:
+        ImportError: If the submodule cannot be imported because the web
+            framework it wraps is not installed. The message names the
+            extra to install rather than letting the framework's own
+            ``ModuleNotFoundError`` propagate unattributed.
+    """
+    module_name, attr_name, extra = _LAZY_ATTRS[name]
+    try:
+        module = __import__(f"{__name__}{module_name}", fromlist=[attr_name])
+    except ImportError as exc:
+        raise ImportError(
+            f"{name} requires the '{extra}' extra, which is not installed. "
+            f"Install it with: pip install 'mcp-security-framework[{extra}]'"
+        ) from exc
+    return getattr(module, attr_name)
+
+
+def __getattr__(name: str):
+    """
+    Module-level attribute resolution (PEP 562) for framework-specific
+    names, deferring their import until something actually asks for them.
+
+    Args:
+        name (str): Attribute being looked up on this module.
+
+    Returns:
+        The resolved attribute.
+
+    Raises:
+        AttributeError: If ``name`` is not one this module defines.
+        ImportError: If ``name`` needs a web framework that is not
+            installed; see :func:`_import_lazy_attr`.
+    """
+    if name in _LAZY_ATTRS:
+        value = _import_lazy_attr(name)
+        globals()[name] = value
+        return value
+    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
+
+
+def __dir__():
+    """Include lazily-resolved names in ``dir()`` output."""
+    return sorted(set(globals()) | set(_LAZY_ATTRS))
+
 
 def create_fastapi_security_middleware(
     security_manager: SecurityManager,
@@ -77,7 +195,7 @@ def create_fastapi_security_middleware(
         >>> middleware = create_fastapi_security_middleware(security_manager)
         >>> app.add_middleware(middleware)
     """
-    return FastAPISecurityMiddleware(security_manager)
+    return _import_lazy_attr("FastAPISecurityMiddleware")(security_manager)
 
 
 def create_flask_security_middleware(
@@ -115,7 +233,7 @@ def create_flask_security_middleware(
         ...     security_manager, app.wsgi_app
         ... )
     """
-    return FlaskSecurityMiddleware(security_manager, wsgi_app)
+    return _import_lazy_attr("FlaskSecurityMiddleware")(security_manager, wsgi_app)
 
 
 def create_auth_middleware(

{mcp_security_framework-2.0.0 → mcp_security_framework-2.0.1}/mcp_security_framework/middleware/fastapi_middleware.py

@@ -74,6 +74,13 @@ def require_permissions(*permissions: str) -> Any:
     """
 
     def _required_permissions_marker() -> None:
+        """
+        Carry the declared permissions; it is never called for its result.
+
+        FastAPI resolves this as a dependency, which is what puts it on the
+        route. The middleware finds it there and reads ``__permissions__``
+        off it before the handler runs.
+        """
         return None
 
     _required_permissions_marker.__permissions__ = list(permissions)

{mcp_security_framework-2.0.0 → mcp_security_framework-2.0.1}/mcp_security_framework.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcp-security-framework
-Version: 2.0.0
+Version: 2.0.1
 Summary: Universal security framework for microservices with SSL/TLS, authentication, authorization, and rate limiting. Added extensible security adapter system for custom operation validation, structured audit logging, and operation context support. Comprehensive test coverage with 1104+ tests. Fully backward compatible. Requires cryptography>=42.0.0 for certificate operations.
 Author-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>
 Maintainer-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>

{mcp_security_framework-2.0.0 → mcp_security_framework-2.0.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mcp-security-framework"
-version = "2.0.0"
+version = "2.0.1"
 description = "Universal security framework for microservices with SSL/TLS, authentication, authorization, and rate limiting. Added extensible security adapter system for custom operation validation, structured audit logging, and operation context support. Comprehensive test coverage with 1104+ tests. Fully backward compatible. Requires cryptography>=42.0.0 for certificate operations."
 readme = "README.md"
 license = {text = "MIT"}