mdb-engine 0.1.6__py3-none-any.whl → 0.4.12__py3-none-any.whl

mdb_engine/core/manifest.py

@@ -32,21 +32,27 @@ For Scale:
 import asyncio
 import hashlib
 import logging
-from typing import Any, Awaitable, Callable, Dict, List, Optional, Tuple
+from collections.abc import Awaitable, Callable
+from typing import Any
 
 from jsonschema import SchemaError, ValidationError, validate
 
-from ..constants import (CURRENT_SCHEMA_VERSION, DEFAULT_SCHEMA_VERSION,
-                         MAX_TTL_SECONDS, MAX_VECTOR_DIMENSIONS,
-                         MIN_TTL_SECONDS, MIN_VECTOR_DIMENSIONS)
+from ..constants import (
+    CURRENT_SCHEMA_VERSION,
+    DEFAULT_SCHEMA_VERSION,
+    MAX_TTL_SECONDS,
+    MAX_VECTOR_DIMENSIONS,
+    MIN_TTL_SECONDS,
+    MIN_VECTOR_DIMENSIONS,
+)
 
 logger = logging.getLogger(__name__)
 
 # Schema registry: maps version -> schema definition
-SCHEMA_REGISTRY: Dict[str, Dict[str, Any]] = {}
+SCHEMA_REGISTRY: dict[str, dict[str, Any]] = {}
 
 # Validation cache: maps (manifest_hash, version) -> validation_result
-_validation_cache: Dict[str, Tuple[bool, Optional[str], Optional[List[str]]]] = {}
+_validation_cache: dict[str, tuple[bool, str | None, list[str] | None]] = {}
 _cache_lock = asyncio.Lock()
 
 
@@ -81,15 +87,13 @@ def _convert_tuples_to_lists(obj: Any) -> Any:
         return obj
 
 
-def _get_manifest_hash(manifest_data: Dict[str, Any]) -> str:
+def _get_manifest_hash(manifest_data: dict[str, Any]) -> str:
     """Generate a hash for manifest caching."""
     import json
 
     # Normalize manifest by removing metadata fields that don't affect validation
     normalized = {
-        k: v
-        for k, v in manifest_data.items()
-        if k not in ["_id", "_updated", "_created", "url"]
+        k: v for k, v in manifest_data.items() if k not in ["_id", "_updated", "_created", "url"]
     }
     normalized_str = json.dumps(normalized, sort_keys=True)
     return hashlib.sha256(normalized_str.encode()).hexdigest()[:16]
@@ -137,6 +141,70 @@ MANIFEST_SCHEMA_V2 = {
         "auth": {
             "type": "object",
             "properties": {
+                "mode": {
+                    "type": "string",
+                    "enum": ["app", "shared"],
+                    "default": "app",
+                    "description": (
+                        "Authentication mode: 'app' for per-app tokens "
+                        "(isolated auth per app, default), 'shared' for "
+                        "shared user pool with SSO across all apps. "
+                        "Modes are mutually exclusive."
+                    ),
+                },
+                "roles": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": (
+                        "Available roles for this app (shared mode only). "
+                        "Example: ['viewer', 'editor', 'admin']"
+                    ),
+                },
+                "default_role": {
+                    "type": "string",
+                    "description": (
+                        "Default role assigned to new users for this app "
+                        "(shared mode only). Must be one of the defined roles."
+                    ),
+                },
+                "require_role": {
+                    "type": "string",
+                    "description": (
+                        "Minimum role required to access this app "
+                        "(shared mode only). Users without this role "
+                        "will be denied access."
+                    ),
+                },
+                "public_routes": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": (
+                        "Routes that don't require authentication. "
+                        "Supports wildcards, e.g., ['/health', '/api/public/*']. "
+                        "Works in both auth modes."
+                    ),
+                },
+                "auth_hub_url": {
+                    "type": "string",
+                    "format": "uri",
+                    "description": (
+                        "URL of the authentication hub for SSO apps (shared mode only). "
+                        "Used for redirecting unauthenticated users to login. "
+                        "Example: 'http://localhost:8000' or 'https://auth.example.com'. "
+                        "Can be overridden via AUTH_HUB_URL environment variable."
+                    ),
+                },
+                "related_apps": {
+                    "type": "object",
+                    "additionalProperties": {"type": "string", "format": "uri"},
+                    "description": (
+                        "Map of related app slugs to their URLs for cross-app navigation "
+                        "(useful in shared auth mode). Keys are app slugs, values are URLs. "
+                        "Example: {'dashboard': 'http://localhost:8001', "
+                        "'click_tracker': 'http://localhost:8000'}. "
+                        "Can be overridden via {APP_SLUG_UPPER}_URL environment variables."
+                    ),
+                },
                 "policy": {
                     "type": "object",
                     "properties": {
@@ -254,24 +322,44 @@ MANIFEST_SCHEMA_V2 = {
                                 "initial_policies": {
                                     "type": "array",
                                     "items": {
-                                        "type": "object",
-                                        "properties": {
-                                            "role": {"type": "string"},
-                                            "resource": {
-                                                "type": "string",
-                                                "default": "documents",
+                                        "oneOf": [
+                                            {
+                                                "type": "array",
+                                                "items": {"type": "string"},
+                                                "minItems": 3,
+                                                "maxItems": 3,
+                                                "description": (
+                                                    "Casbin policy as array: "
+                                                    '["role", "resource", "action"]'
+                                                ),
                                             },
-                                            "action": {"type": "string"},
-                                        },
-                                        "required": ["role", "action"],
-                                        "additionalProperties": False,
+                                            {
+                                                "type": "object",
+                                                "properties": {
+                                                    "role": {"type": "string"},
+                                                    "resource": {
+                                                        "type": "string",
+                                                        "default": "documents",
+                                                    },
+                                                    "action": {"type": "string"},
+                                                },
+                                                "required": ["role", "action"],
+                                                "additionalProperties": False,
+                                                "description": (
+                                                    "OSO policy as object: "
+                                                    '{"role": "admin", "resource": "documents", '
+                                                    '"action": "read"}'
+                                                ),
+                                            },
+                                        ],
                                     },
                                     "description": (
-                                        "Initial permission policies to set up "
-                                        "in OSO Cloud on startup. Only used "
-                                        "when provider is 'oso'. Example: "
-                                        '[{"role": "admin", "resource": '
-                                        '"documents", "action": "read"}]'
+                                        "Initial permission policies to set up on startup. "
+                                        "For Casbin provider: use arrays like "
+                                        '["admin", "clicks", "read"]. '
+                                        "For OSO Cloud provider: use objects like "
+                                        '{"role": "admin", "resource": "documents", '
+                                        '"action": "read"}.'
                                     ),
                                 },
                             },
@@ -484,8 +572,7 @@ MANIFEST_SCHEMA_V2 = {
                                         "type": "string",
                                         "default": "user",
                                         "description": (
-                                            "Role for demo user in app "
-                                            "(default: 'user')"
+                                            "Role for demo user in app " "(default: 'user')"
                                         ),
                                     },
                                     "auto_create": {
@@ -567,6 +654,292 @@ MANIFEST_SCHEMA_V2 = {
                         "independent of platform authentication."
                     ),
                 },
+                "rate_limits": {
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "object",
+                        "properties": {
+                            "max_attempts": {
+                                "type": "integer",
+                                "minimum": 1,
+                                "default": 5,
+                                "description": (
+                                    "Maximum attempts allowed in the time window " "(default: 5)."
+                                ),
+                            },
+                            "window_seconds": {
+                                "type": "integer",
+                                "minimum": 1,
+                                "default": 300,
+                                "description": (
+                                    "Time window in seconds for rate limiting "
+                                    "(default: 300 = 5 minutes)."
+                                ),
+                            },
+                        },
+                        "additionalProperties": False,
+                    },
+                    "description": (
+                        "Rate limiting configuration for auth endpoints. "
+                        "Keys are endpoint paths (e.g., '/login', '/register'). "
+                        "Example: {'/login': {'max_attempts': 5, 'window_seconds': 300}}"
+                    ),
+                },
+                "audit": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "default": True,
+                            "description": (
+                                "Enable audit logging for authentication events "
+                                "(default: true for shared auth mode)."
+                            ),
+                        },
+                        "retention_days": {
+                            "type": "integer",
+                            "minimum": 1,
+                            "default": 90,
+                            "description": (
+                                "Number of days to retain audit logs " "(default: 90 days)."
+                            ),
+                        },
+                    },
+                    "additionalProperties": False,
+                    "description": (
+                        "Audit logging configuration for authentication events. "
+                        "Logs are stored in MongoDB with automatic TTL cleanup."
+                    ),
+                },
+                "csrf_protection": {
+                    "oneOf": [
+                        {"type": "boolean"},
+                        {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean",
+                                    "default": True,
+                                    "description": (
+                                        "Enable CSRF protection "
+                                        "(default: true for shared auth mode)."
+                                    ),
+                                },
+                                "exempt_routes": {
+                                    "type": "array",
+                                    "items": {"type": "string"},
+                                    "description": (
+                                        "Routes exempt from CSRF validation. "
+                                        "Supports wildcards (e.g., '/api/*'). "
+                                        "Defaults to public_routes if not specified."
+                                    ),
+                                },
+                                "rotate_tokens": {
+                                    "type": "boolean",
+                                    "default": False,
+                                    "description": (
+                                        "Rotate CSRF token on each request "
+                                        "(more secure, less convenient). Default: false."
+                                    ),
+                                },
+                                "token_ttl": {
+                                    "type": "integer",
+                                    "minimum": 60,
+                                    "default": 3600,
+                                    "description": (
+                                        "CSRF token TTL in seconds " "(default: 3600 = 1 hour)."
+                                    ),
+                                },
+                            },
+                            "additionalProperties": False,
+                        },
+                    ],
+                    "default": True,
+                    "description": (
+                        "CSRF protection configuration. Auto-enabled for shared "
+                        "auth mode. Set to false to disable, or provide object "
+                        "for detailed configuration. Uses double-submit cookie "
+                        "pattern with SameSite=Lax cookies."
+                    ),
+                },
+                "security": {
+                    "type": "object",
+                    "properties": {
+                        "hsts": {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean",
+                                    "default": True,
+                                    "description": (
+                                        "Enable HSTS header in production " "(default: true)."
+                                    ),
+                                },
+                                "max_age": {
+                                    "type": "integer",
+                                    "minimum": 0,
+                                    "default": 31536000,
+                                    "description": (
+                                        "HSTS max-age in seconds " "(default: 31536000 = 1 year)."
+                                    ),
+                                },
+                                "include_subdomains": {
+                                    "type": "boolean",
+                                    "default": True,
+                                    "description": (
+                                        "Include subdomains in HSTS policy " "(default: true)."
+                                    ),
+                                },
+                                "preload": {
+                                    "type": "boolean",
+                                    "default": False,
+                                    "description": (
+                                        "Add preload directive for HSTS preload "
+                                        "list submission (default: false). Only "
+                                        "enable if you're ready for permanent HTTPS."
+                                    ),
+                                },
+                            },
+                            "additionalProperties": False,
+                            "description": (
+                                "HTTP Strict Transport Security configuration. "
+                                "Forces HTTPS connections in production."
+                            ),
+                        },
+                    },
+                    "additionalProperties": False,
+                    "description": (
+                        "Security settings including HSTS, headers, and other " "security controls."
+                    ),
+                },
+                "jwt": {
+                    "type": "object",
+                    "properties": {
+                        "algorithm": {
+                            "type": "string",
+                            "enum": ["HS256", "RS256", "ES256"],
+                            "default": "HS256",
+                            "description": (
+                                "JWT signing algorithm. HS256 (HMAC, default) "
+                                "uses symmetric secret. RS256 (RSA) and ES256 "
+                                "(ECDSA) use asymmetric key pairs for better "
+                                "security in distributed systems."
+                            ),
+                        },
+                        "token_expiry_hours": {
+                            "type": "integer",
+                            "minimum": 1,
+                            "default": 24,
+                            "description": ("JWT token expiry in hours (default: 24)."),
+                        },
+                    },
+                    "additionalProperties": False,
+                    "description": (
+                        "JWT configuration for shared auth mode. "
+                        "Controls algorithm and token lifetime."
+                    ),
+                },
+                "password_policy": {
+                    "type": "object",
+                    "properties": {
+                        "min_length": {
+                            "type": "integer",
+                            "minimum": 6,
+                            "default": 12,
+                            "description": ("Minimum password length (default: 12)."),
+                        },
+                        "min_entropy_bits": {
+                            "type": "integer",
+                            "minimum": 0,
+                            "default": 50,
+                            "description": (
+                                "Minimum password entropy in bits "
+                                "(default: 50). Set to 0 to disable."
+                            ),
+                        },
+                        "require_uppercase": {
+                            "type": "boolean",
+                            "default": True,
+                            "description": (
+                                "Require at least one uppercase letter " "(default: true)."
+                            ),
+                        },
+                        "require_lowercase": {
+                            "type": "boolean",
+                            "default": True,
+                            "description": (
+                                "Require at least one lowercase letter " "(default: true)."
+                            ),
+                        },
+                        "require_numbers": {
+                            "type": "boolean",
+                            "default": True,
+                            "description": ("Require at least one number " "(default: true)."),
+                        },
+                        "require_special": {
+                            "type": "boolean",
+                            "default": False,
+                            "description": (
+                                "Require at least one special character " "(default: false)."
+                            ),
+                        },
+                        "check_common_passwords": {
+                            "type": "boolean",
+                            "default": True,
+                            "description": (
+                                "Check against common password list " "(default: true)."
+                            ),
+                        },
+                        "check_breaches": {
+                            "type": "boolean",
+                            "default": False,
+                            "description": (
+                                "Check against HaveIBeenPwned breach database "
+                                "(default: false). Requires network access."
+                            ),
+                        },
+                    },
+                    "additionalProperties": False,
+                    "description": (
+                        "Password policy configuration for shared auth mode. "
+                        "Enforces password strength requirements."
+                    ),
+                },
+                "session_binding": {
+                    "type": "object",
+                    "properties": {
+                        "bind_ip": {
+                            "type": "boolean",
+                            "default": False,
+                            "description": (
+                                "Bind sessions to IP address. Strict mode: "
+                                "reject if IP changes (default: false)."
+                            ),
+                        },
+                        "bind_fingerprint": {
+                            "type": "boolean",
+                            "default": True,
+                            "description": (
+                                "Bind sessions to device fingerprint. Soft mode: "
+                                "log warning if fingerprint changes (default: true)."
+                            ),
+                        },
+                        "allow_ip_change_with_reauth": {
+                            "type": "boolean",
+                            "default": True,
+                            "description": (
+                                "Allow IP change if user re-authenticates "
+                                "(default: true). Only applies when bind_ip=true."
+                            ),
+                        },
+                    },
+                    "additionalProperties": False,
+                    "description": (
+                        "Session binding configuration. Ties sessions to client "
+                        "characteristics for additional security against session "
+                        "hijacking."
+                    ),
+                },
             },
             "additionalProperties": False,
             "description": (
@@ -590,17 +963,13 @@ MANIFEST_SCHEMA_V2 = {
                     "type": "integer",
                     "minimum": 60,
                     "default": 900,
-                    "description": (
-                        "Access token TTL in seconds " "(default: 900 = 15 minutes)."
-                    ),
+                    "description": ("Access token TTL in seconds " "(default: 900 = 15 minutes)."),
                 },
                 "refresh_token_ttl": {
                     "type": "integer",
                     "minimum": 3600,
                     "default": 604800,
-                    "description": (
-                        "Refresh token TTL in seconds " "(default: 604800 = 7 days)."
-                    ),
+                    "description": ("Refresh token TTL in seconds " "(default: 604800 = 7 days)."),
                 },
                 "token_rotation": {
                     "type": "boolean",
@@ -615,8 +984,7 @@ MANIFEST_SCHEMA_V2 = {
                     "minimum": 1,
                     "default": 10,
                     "description": (
-                        "Maximum number of concurrent sessions per user "
-                        "(default: 10)."
+                        "Maximum number of concurrent sessions per user " "(default: 10)."
                     ),
                 },
                 "session_inactivity_timeout": {
@@ -635,8 +1003,7 @@ MANIFEST_SCHEMA_V2 = {
                             "type": "boolean",
                             "default": False,
                             "description": (
-                                "Require HTTPS in production "
-                                "(default: false, auto-detected)."
+                                "Require HTTPS in production " "(default: false, auto-detected)."
                             ),
                         },
                         "cookie_secure": {
@@ -718,9 +1085,7 @@ MANIFEST_SCHEMA_V2 = {
                                 },
                             },
                             "additionalProperties": False,
-                            "description": (
-                                "Rate limiting configuration per endpoint type."
-                            ),
+                            "description": ("Rate limiting configuration per endpoint type."),
                         },
                         "password_policy": {
                             "type": "object",
@@ -747,9 +1112,7 @@ MANIFEST_SCHEMA_V2 = {
                                 "require_lowercase": {
                                     "type": "boolean",
                                     "default": True,
-                                    "description": (
-                                        "Require lowercase letters " "(default: true)"
-                                    ),
+                                    "description": ("Require lowercase letters " "(default: true)"),
                                 },
                                 "require_numbers": {
                                     "type": "boolean",
@@ -774,24 +1137,21 @@ MANIFEST_SCHEMA_V2 = {
                                     "type": "boolean",
                                     "default": True,
                                     "description": (
-                                        "Enable session fingerprinting "
-                                        "(default: true)"
+                                        "Enable session fingerprinting " "(default: true)"
                                     ),
                                 },
                                 "validate_on_login": {
                                     "type": "boolean",
                                     "default": True,
                                     "description": (
-                                        "Validate fingerprint on login "
-                                        "(default: true)"
+                                        "Validate fingerprint on login " "(default: true)"
                                     ),
                                 },
                                 "validate_on_refresh": {
                                     "type": "boolean",
                                     "default": True,
                                     "description": (
-                                        "Validate fingerprint on token refresh "
-                                        "(default: true)"
+                                        "Validate fingerprint on token refresh " "(default: true)"
                                     ),
                                 },
                                 "validate_on_request": {
@@ -837,8 +1197,7 @@ MANIFEST_SCHEMA_V2 = {
                                     "minimum": 1,
                                     "default": 900,
                                     "description": (
-                                        "Lockout duration in seconds "
-                                        "(default: 900 = 15 minutes)"
+                                        "Lockout duration in seconds " "(default: 900 = 15 minutes)"
                                     ),
                                 },
                                 "reset_on_success": {
@@ -860,8 +1219,7 @@ MANIFEST_SCHEMA_V2 = {
                                     "type": "boolean",
                                     "default": False,
                                     "description": (
-                                        "Enable IP address validation "
-                                        "(default: false)"
+                                        "Enable IP address validation " "(default: false)"
                                     ),
                                 },
                                 "strict": {
@@ -876,8 +1234,7 @@ MANIFEST_SCHEMA_V2 = {
                                     "type": "boolean",
                                     "default": True,
                                     "description": (
-                                        "Allow IP address changes during session "
-                                        "(default: true)"
+                                        "Allow IP address changes during session " "(default: true)"
                                     ),
                                 },
                             },
@@ -897,9 +1254,7 @@ MANIFEST_SCHEMA_V2 = {
                                 "bind_to_device": {
                                     "type": "boolean",
                                     "default": True,
-                                    "description": (
-                                        "Bind tokens to device ID " "(default: true)"
-                                    ),
+                                    "description": ("Bind tokens to device ID " "(default: true)"),
                                 },
                             },
                             "additionalProperties": False,
@@ -913,8 +1268,7 @@ MANIFEST_SCHEMA_V2 = {
                     "type": "boolean",
                     "default": True,
                     "description": (
-                        "Automatically set up token management on app startup "
-                        "(default: true)."
+                        "Automatically set up token management on app startup " "(default: true)."
                     ),
                 },
             },
@@ -946,9 +1300,7 @@ MANIFEST_SCHEMA_V2 = {
         },
         "collection_settings": {
             "type": "object",
-            "patternProperties": {
-                "^[a-zA-Z0-9_]+$": {"$ref": "#/definitions/collectionSettings"}
-            },
+            "patternProperties": {"^[a-zA-Z0-9_]+$": {"$ref": "#/definitions/collectionSettings"}},
             "description": "Collection name -> collection settings",
         },
         "websockets": {
@@ -996,8 +1348,7 @@ MANIFEST_SCHEMA_V2 = {
                         "description": {
                             "type": "string",
                             "description": (
-                                "Description of what this WebSocket endpoint "
-                                "is used for"
+                                "Description of what this WebSocket endpoint " "is used for"
                             ),
                         },
                         "ping_interval": {
@@ -1210,8 +1561,7 @@ MANIFEST_SCHEMA_V2 = {
                     "type": "boolean",
                     "default": False,
                     "description": (
-                        "Allow credentials (cookies, authorization headers) "
-                        "in CORS requests"
+                        "Allow credentials (cookies, authorization headers) " "in CORS requests"
                     ),
                 },
                 "allow_methods": {
@@ -1256,6 +1606,40 @@ MANIFEST_SCHEMA_V2 = {
             "additionalProperties": False,
             "description": "CORS (Cross-Origin Resource Sharing) configuration for web apps",
         },
+        "data_access": {
+            "type": "object",
+            "properties": {
+                "read_scopes": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": (
+                        "List of app slugs this app can read from. "
+                        "Defaults to [app_slug] if not specified."
+                    ),
+                },
+                "write_scope": {
+                    "type": "string",
+                    "description": (
+                        "App slug this app writes to. " "Defaults to app_slug if not specified."
+                    ),
+                },
+                "cross_app_policy": {
+                    "type": "string",
+                    "enum": ["explicit", "deny_all"],
+                    "default": "explicit",
+                    "description": (
+                        "Policy for cross-app access. 'explicit' allows access "
+                        "to apps listed in read_scopes. 'deny_all' blocks all "
+                        "cross-app access regardless of read_scopes."
+                    ),
+                },
+            },
+            "additionalProperties": False,
+            "description": (
+                "Data access configuration defining which apps this app can "
+                "read from and write to. Used for cross-app data access control."
+            ),
+        },
         "observability": {
             "type": "object",
             "properties": {
@@ -1295,8 +1679,7 @@ MANIFEST_SCHEMA_V2 = {
                             "type": "boolean",
                             "default": True,
                             "description": (
-                                "Collect operation-level metrics "
-                                "(duration, errors, etc.)"
+                                "Collect operation-level metrics " "(duration, errors, etc.)"
                             ),
                         },
                         "collect_performance_metrics": {
@@ -1349,6 +1732,99 @@ MANIFEST_SCHEMA_V2 = {
             "additionalProperties": False,
             "description": "Observability configuration (health checks, metrics, logging)",
         },
+        "multi_app": {
+            "type": "object",
+            "properties": {
+                "enabled": {
+                    "type": "boolean",
+                    "default": False,
+                    "description": "Enable multi-app mounting mode",
+                },
+                "apps": {
+                    "type": "array",
+                    "items": {
+                        "type": "object",
+                        "properties": {
+                            "slug": {
+                                "type": "string",
+                                "pattern": "^[a-z0-9_-]+$",
+                                "description": (
+                                    "App slug (lowercase alphanumeric, underscores, hyphens)"
+                                ),
+                            },
+                            "manifest": {
+                                "type": "string",
+                                "description": (
+                                    "Path to manifest.json file "
+                                    "(relative to multi_app manifest or absolute)"
+                                ),
+                            },
+                            "path_prefix": {
+                                "type": "string",
+                                "pattern": "^/.*",
+                                "default": "/{slug}",
+                                "description": (
+                                    "Path prefix for mounting (defaults to /{slug}). "
+                                    "Must start with '/' and be unique across all apps."
+                                ),
+                            },
+                            "on_startup": {
+                                "type": "string",
+                                "description": (
+                                    "Optional: Python function path for startup callback "
+                                    "(e.g., 'module.function_name'). "
+                                    "Not yet supported in manifest-based config."
+                                ),
+                            },
+                            "on_shutdown": {
+                                "type": "string",
+                                "description": (
+                                    "Optional: Python function path for shutdown callback "
+                                    "(e.g., 'module.function_name'). "
+                                    "Not yet supported in manifest-based config."
+                                ),
+                            },
+                        },
+                        "required": ["slug", "manifest"],
+                        "additionalProperties": False,
+                    },
+                    "minItems": 1,
+                    "description": "List of apps to mount in multi-app mode",
+                },
+                "shared_middleware": {
+                    "type": "object",
+                    "properties": {
+                        "cors": {
+                            "type": "boolean",
+                            "default": True,
+                            "description": "Enable CORS middleware at parent level (default: true)",
+                        },
+                        "rate_limiting": {
+                            "type": "boolean",
+                            "default": True,
+                            "description": (
+                                "Enable rate limiting middleware at parent level (default: true)"
+                            ),
+                        },
+                        "health_checks": {
+                            "type": "boolean",
+                            "default": True,
+                            "description": (
+                                "Enable unified health check endpoint at /health (default: true)"
+                            ),
+                        },
+                    },
+                    "additionalProperties": False,
+                    "description": "Shared middleware configuration for parent app",
+                },
+            },
+            "additionalProperties": False,
+            "description": (
+                "Multi-app mounting configuration. When enabled, allows mounting "
+                "multiple FastAPI apps under a single parent app with path prefixes. "
+                "Useful for deploying multiple apps (e.g., SSO apps) on a single service."
+            ),
+        },
         "initial_data": {
             "type": "object",
             "patternProperties": {
@@ -1456,8 +1932,7 @@ MANIFEST_SCHEMA_V2 = {
                 "definition": {
                     "type": "object",
                     "description": (
-                        "Index definition (required for vectorSearch and "
-                        "search indexes)"
+                        "Index definition (required for vectorSearch and " "search indexes)"
                     ),
                 },
                 "hybrid": {
@@ -1470,8 +1945,7 @@ MANIFEST_SCHEMA_V2 = {
                                     "type": "string",
                                     "pattern": "^[a-zA-Z0-9_]+$",
                                     "description": (
-                                        "Name for the vector index "
-                                        "(defaults to '{name}_vector')"
+                                        "Name for the vector index " "(defaults to '{name}_vector')"
                                     ),
                                 },
                                 "definition": {
@@ -1493,8 +1967,7 @@ MANIFEST_SCHEMA_V2 = {
                                     "type": "string",
                                     "pattern": "^[a-zA-Z0-9_]+$",
                                     "description": (
-                                        "Name for the text index "
-                                        "(defaults to '{name}_text')"
+                                        "Name for the text index " "(defaults to '{name}_text')"
                                     ),
                                 },
                                 "definition": {
@@ -1575,9 +2048,7 @@ MANIFEST_SCHEMA_V2 = {
                     "then": {"required": ["keys", "options"]},
                     "else": {
                         "properties": {
-                            "options": {
-                                "not": {"required": ["partialFilterExpression"]}
-                            }
+                            "options": {"not": {"required": ["partialFilterExpression"]}}
                         }
                     },
                 },
@@ -1727,7 +2198,7 @@ SCHEMA_REGISTRY["default"] = MANIFEST_SCHEMA_V2
 MANIFEST_SCHEMA = MANIFEST_SCHEMA_V2  # Backward compatibility
 
 
-def get_schema_version(manifest_data: Dict[str, Any]) -> str:
+def get_schema_version(manifest_data: dict[str, Any]) -> str:
     """
     Detect schema version from manifest.
 
@@ -1740,7 +2211,7 @@ def get_schema_version(manifest_data: Dict[str, Any]) -> str:
     Raises:
         ValueError: If schema version format is invalid
     """
-    version: Optional[str] = manifest_data.get("schema_version")
+    version: str | None = manifest_data.get("schema_version")
     if version:
         # Validate version format
         if not isinstance(version, str) or not version.replace(".", "").isdigit():
@@ -1762,8 +2233,8 @@ def get_schema_version(manifest_data: Dict[str, Any]) -> str:
 
 
 def migrate_manifest(
-    manifest_data: Dict[str, Any], target_version: str = CURRENT_SCHEMA_VERSION
-) -> Dict[str, Any]:
+    manifest_data: dict[str, Any], target_version: str = CURRENT_SCHEMA_VERSION
+) -> dict[str, Any]:
     """
     Migrate manifest from one schema version to another.
 
@@ -1803,9 +2274,7 @@ def migrate_manifest(
 
         # No data transformation needed - V2.0 is backward compatible
         # New fields (auth, etc.) are optional
-        logger.debug(
-            f"Migrated manifest from 1.0 to 2.0: {migrated.get('slug', 'unknown')}"
-        )
+        logger.debug(f"Migrated manifest from 1.0 to 2.0: {migrated.get('slug', 'unknown')}")
 
     # Future: Add more migration paths as needed
     # Example: 2.0 -> 3.0, etc.
@@ -1814,7 +2283,7 @@ def migrate_manifest(
     return migrated
 
 
-def get_schema_for_version(version: str) -> Dict[str, Any]:
+def get_schema_for_version(version: str) -> dict[str, Any]:
     """
     Get schema definition for a specific version.
 
@@ -1841,15 +2310,14 @@ def get_schema_for_version(version: str) -> Dict[str, Any]:
 
     # Fallback to current
     logger.warning(
-        f"Schema version {version} not found, using current version "
-        f"{CURRENT_SCHEMA_VERSION}"
+        f"Schema version {version} not found, using current version " f"{CURRENT_SCHEMA_VERSION}"
     )
     return SCHEMA_REGISTRY[CURRENT_SCHEMA_VERSION]
 
 
 async def _validate_manifest_async(
-    manifest_data: Dict[str, Any], use_cache: bool = True
-) -> Tuple[bool, Optional[str], Optional[List[str]]]:
+    manifest_data: dict[str, Any], use_cache: bool = True
+) -> tuple[bool, str | None, list[str] | None]:
     """
     Validate a manifest against the JSON Schema with versioning and caching support.
 
@@ -1873,12 +2341,11 @@ async def _validate_manifest_async(
           Use validate_manifest_with_db() for database validation.
     """
     # Check cache first
+    cache_key = None
     if use_cache:
-        cache_key = (
-            _get_manifest_hash(manifest_data) + "_" + get_schema_version(manifest_data)
-        )
-    if cache_key in _validation_cache:
-        return _validation_cache[cache_key]
+        cache_key = _get_manifest_hash(manifest_data) + "_" + get_schema_version(manifest_data)
+        if cache_key in _validation_cache:
+            return _validation_cache[cache_key]
 
     try:
         # Get schema version
@@ -1935,11 +2402,7 @@ async def _validate_manifest_async(
         error_message = f"Invalid schema definition: {e.message}"
         result = (False, error_message, ["schema"])
         if use_cache:
-            cache_key = (
-                _get_manifest_hash(manifest_data)
-                + "_"
-                + get_schema_version(manifest_data)
-            )
+            cache_key = _get_manifest_hash(manifest_data) + "_" + get_schema_version(manifest_data)
             _validation_cache[cache_key] = result
 
         return result
@@ -1949,9 +2412,7 @@ async def _validate_manifest_async(
         error_paths = []
         error_messages = []
         if isinstance(e, ValidationError):
-            error_paths = [
-                f".{'.'.join(str(p) for p in error.path)}" for error in e.context or [e]
-            ]
+            error_paths = [f".{'.'.join(str(p) for p in error.path)}" for error in e.context or [e]]
             error_messages = [error.message for error in e.context or [e]]
         else:
             error_messages = [str(e)]
@@ -1959,11 +2420,7 @@ async def _validate_manifest_async(
         error_message = "; ".join(error_messages) if error_messages else str(e)
         result = (False, error_message, error_paths if error_paths else None)
         if use_cache:
-            cache_key = (
-                _get_manifest_hash(manifest_data)
-                + "_"
-                + get_schema_version(manifest_data)
-            )
+            cache_key = _get_manifest_hash(manifest_data) + "_" + get_schema_version(manifest_data)
             _validation_cache[cache_key] = result
 
         return result
@@ -1973,11 +2430,7 @@ async def _validate_manifest_async(
         logger.exception("Unexpected error during manifest validation")
         result = (False, error_message, None)
         if use_cache:
-            cache_key = (
-                _get_manifest_hash(manifest_data)
-                + "_"
-                + get_schema_version(manifest_data)
-            )
+            cache_key = _get_manifest_hash(manifest_data) + "_" + get_schema_version(manifest_data)
             _validation_cache[cache_key] = result
 
         return result
@@ -1991,8 +2444,8 @@ def clear_validation_cache():
 
 
 async def validate_manifests_parallel(
-    manifests: List[Dict[str, Any]], use_cache: bool = True
-) -> List[Tuple[bool, Optional[str], Optional[List[str]], Optional[str]]]:
+    manifests: list[dict[str, Any]], use_cache: bool = True
+) -> list[tuple[bool, str | None, list[str] | None, str | None]]:
     """
     Validate multiple manifests in parallel for scale.
 
@@ -2006,27 +2459,21 @@ async def validate_manifests_parallel(
     """
 
     async def validate_one(
-        manifest: Dict[str, Any]
-    ) -> Tuple[bool, Optional[str], Optional[List[str]], Optional[str]]:
+        manifest: dict[str, Any],
+    ) -> tuple[bool, str | None, list[str] | None, str | None]:
         slug = manifest.get("slug", "unknown")
-        is_valid, error, paths = await _validate_manifest_async(
-            manifest, use_cache=use_cache
-        )
+        is_valid, error, paths = await _validate_manifest_async(manifest, use_cache=use_cache)
         return (is_valid, error, paths, slug)
 
     # Run validations in parallel
-    results = await asyncio.gather(
-        *[validate_one(m) for m in manifests], return_exceptions=True
-    )
+    results = await asyncio.gather(*[validate_one(m) for m in manifests], return_exceptions=True)
 
     # Handle exceptions
     validated_results = []
     for i, result in enumerate(results):
         if isinstance(result, Exception):
             slug = manifests[i].get("slug", "unknown")
-            validated_results.append(
-                (False, f"Validation error: {str(result)}", None, slug)
-            )
+            validated_results.append((False, f"Validation error: {str(result)}", None, slug))
         else:
             validated_results.append(result)
 
@@ -2034,8 +2481,8 @@ async def validate_manifests_parallel(
 
 
 async def validate_developer_id(
-    developer_id: str, db_validator: Optional[Callable[[str], Awaitable[bool]]] = None
-) -> Tuple[bool, Optional[str]]:
+    developer_id: str, db_validator: Callable[[str], Awaitable[bool]] | None = None
+) -> tuple[bool, str | None]:
     """
     Validate that a developer_id exists in the system and has developer role.
 
@@ -2072,19 +2519,17 @@ async def validate_developer_id(
                     f"developer_id '{developer_id}' does not exist or does not have developer role",
                 )
         except (ValueError, TypeError, AttributeError) as e:
-            logger.exception(
-                f"Validation error validating developer_id '{developer_id}'"
-            )
+            logger.exception(f"Validation error validating developer_id '{developer_id}'")
             return False, f"Error validating developer_id: {e}"
 
     return True, None
 
 
 async def validate_manifest_with_db(
-    manifest_data: Dict[str, Any],
+    manifest_data: dict[str, Any],
     db_validator: Callable[[str], Awaitable[bool]],
     use_cache: bool = True,
-) -> Tuple[bool, Optional[str], Optional[List[str]]]:
+) -> tuple[bool, str | None, list[str] | None]:
     """
     Validate a manifest against the JSON Schema (with versioning) and check
     developer_id exists in system.
@@ -2125,8 +2570,8 @@ async def validate_manifest_with_db(
 # Public API: Synchronous wrapper for backward compatibility
 # Most callers use this synchronously, so we provide a sync wrapper
 def validate_manifest(
-    manifest_data: Dict[str, Any], use_cache: bool = True
-) -> Tuple[bool, Optional[str], Optional[List[str]]]:
+    manifest_data: dict[str, Any], use_cache: bool = True
+) -> tuple[bool, str | None, list[str] | None]:
     """
     Validate a manifest against the JSON Schema with versioning and caching
     support (synchronous wrapper).
@@ -2154,23 +2599,19 @@ def validate_manifest(
 
             with concurrent.futures.ThreadPoolExecutor() as executor:
                 future = executor.submit(
-                    lambda: asyncio.run(
-                        _validate_manifest_async(manifest_data, use_cache)
-                    )
+                    lambda: asyncio.run(_validate_manifest_async(manifest_data, use_cache))
                 )
                 return future.result()
         else:
-            return loop.run_until_complete(
-                _validate_manifest_async(manifest_data, use_cache)
-            )
+            return loop.run_until_complete(_validate_manifest_async(manifest_data, use_cache))
     except RuntimeError:
         # No event loop, create one
         return asyncio.run(_validate_manifest_async(manifest_data, use_cache))
 
 
 def _validate_regular_index(
-    index_def: Dict[str, Any], collection_name: str, index_name: str
-) -> Tuple[bool, Optional[str]]:
+    index_def: dict[str, Any], collection_name: str, index_name: str
+) -> tuple[bool, str | None]:
     """Validate a regular index definition."""
     if "keys" not in index_def:
         return (
@@ -2186,8 +2627,7 @@ def _validate_regular_index(
     ):
         return (
             False,
-            f"Regular index '{index_name}' in collection "
-            f"'{collection_name}' has empty 'keys'",
+            f"Regular index '{index_name}' in collection " f"'{collection_name}' has empty 'keys'",
         )
 
     # Check for _id index
@@ -2208,14 +2648,13 @@ def _validate_regular_index(
 
 
 def _validate_ttl_index(
-    index_def: Dict[str, Any], collection_name: str, index_name: str
-) -> Tuple[bool, Optional[str]]:
+    index_def: dict[str, Any], collection_name: str, index_name: str
+) -> tuple[bool, str | None]:
     """Validate a TTL index definition."""
     if "keys" not in index_def:
         return (
             False,
-            f"TTL index '{index_name}' in collection '{collection_name}' "
-            f"requires 'keys' field",
+            f"TTL index '{index_name}' in collection '{collection_name}' " f"requires 'keys' field",
         )
     options = index_def.get("options", {})
     if "expireAfterSeconds" not in options:
@@ -2243,8 +2682,8 @@ def _validate_ttl_index(
 
 
 def _validate_partial_index(
-    index_def: Dict[str, Any], collection_name: str, index_name: str
-) -> Tuple[bool, Optional[str]]:
+    index_def: dict[str, Any], collection_name: str, index_name: str
+) -> tuple[bool, str | None]:
     """Validate a partial index definition."""
     if "keys" not in index_def:
         return (
@@ -2264,8 +2703,8 @@ def _validate_partial_index(
 
 
 def _validate_text_index(
-    index_def: Dict[str, Any], collection_name: str, index_name: str
-) -> Tuple[bool, Optional[str]]:
+    index_def: dict[str, Any], collection_name: str, index_name: str
+) -> tuple[bool, str | None]:
     """Validate a text index definition."""
     if "keys" not in index_def:
         return (
@@ -2290,8 +2729,8 @@ def _validate_text_index(
 
 
 def _validate_geospatial_index(
-    index_def: Dict[str, Any], collection_name: str, index_name: str
-) -> Tuple[bool, Optional[str]]:
+    index_def: dict[str, Any], collection_name: str, index_name: str
+) -> tuple[bool, str | None]:
     """Validate a geospatial index definition."""
     if "keys" not in index_def:
         return (
@@ -2305,9 +2744,7 @@ def _validate_geospatial_index(
     if isinstance(keys, dict):
         has_geo = any(v in ["2dsphere", "2d", "geoHaystack"] for v in keys.values())
     elif isinstance(keys, list):
-        has_geo = any(
-            len(k) >= 2 and k[1] in ["2dsphere", "2d", "geoHaystack"] for k in keys
-        )
+        has_geo = any(len(k) >= 2 and k[1] in ["2dsphere", "2d", "geoHaystack"] for k in keys)
     if not has_geo:
         return (
             False,
@@ -2319,8 +2756,8 @@ def _validate_geospatial_index(
 
 
 def _validate_vector_search_index(
-    index_def: Dict[str, Any], collection_name: str, index_name: str, index_type: str
-) -> Tuple[bool, Optional[str]]:
+    index_def: dict[str, Any], collection_name: str, index_name: str, index_type: str
+) -> tuple[bool, str | None]:
     """Validate a vectorSearch or search index definition."""
     if "definition" not in index_def:
         return (
@@ -2367,8 +2804,8 @@ def _validate_vector_search_index(
 
 
 def _validate_hybrid_index(
-    index_def: Dict[str, Any], collection_name: str, index_name: str
-) -> Tuple[bool, Optional[str]]:
+    index_def: dict[str, Any], collection_name: str, index_name: str
+) -> tuple[bool, str | None]:
     """Validate a hybrid index definition."""
     if "hybrid" not in index_def:
         return (
@@ -2431,8 +2868,8 @@ def _validate_hybrid_index(
 
 
 def validate_index_definition(
-    index_def: Dict[str, Any], collection_name: str, index_name: str
-) -> Tuple[bool, Optional[str]]:
+    index_def: dict[str, Any], collection_name: str, index_name: str
+) -> tuple[bool, str | None]:
     """
     Validate a single index definition with context-specific checks.
 
@@ -2448,8 +2885,7 @@ def validate_index_definition(
     if not index_type:
         return (
             False,
-            f"Index '{index_name}' in collection '{collection_name}' "
-            f"is missing 'type' field",
+            f"Index '{index_name}' in collection '{collection_name}' " f"is missing 'type' field",
         )
 
     # Type-specific validation
@@ -2464,9 +2900,7 @@ def validate_index_definition(
     elif index_type == "geospatial":
         return _validate_geospatial_index(index_def, collection_name, index_name)
     elif index_type in ("vectorSearch", "search"):
-        return _validate_vector_search_index(
-            index_def, collection_name, index_name, index_type
-        )
+        return _validate_vector_search_index(index_def, collection_name, index_name, index_type)
     elif index_type == "hybrid":
         return _validate_hybrid_index(index_def, collection_name, index_name)
     else:
@@ -2478,8 +2912,8 @@ def validate_index_definition(
 
 
 def validate_managed_indexes(
-    managed_indexes: Dict[str, List[Dict[str, Any]]]
-) -> Tuple[bool, Optional[str]]:
+    managed_indexes: dict[str, list[dict[str, Any]]],
+) -> tuple[bool, str | None]:
     """
     Validate all managed indexes with collection and index context.
 
@@ -2516,9 +2950,7 @@ def validate_managed_indexes(
                 )
 
             index_name = index_def.get("name", f"index_{idx}")
-            is_valid, error_msg = validate_index_definition(
-                index_def, collection_name, index_name
-            )
+            is_valid, error_msg = validate_index_definition(index_def, collection_name, index_name)
             if not is_valid:
                 return False, error_msg
 
@@ -2549,8 +2981,8 @@ class ManifestValidator:
 
     @staticmethod
     def validate(
-        manifest: Dict[str, Any], use_cache: bool = True
-    ) -> Tuple[bool, Optional[str], Optional[List[str]]]:
+        manifest: dict[str, Any], use_cache: bool = True
+    ) -> tuple[bool, str | None, list[str] | None]:
         """
         Validate manifest against schema.
 
@@ -2565,8 +2997,8 @@ class ManifestValidator:
 
     @staticmethod
     async def validate_async(
-        manifest: Dict[str, Any], use_cache: bool = True
-    ) -> Tuple[bool, Optional[str], Optional[List[str]]]:
+        manifest: dict[str, Any], use_cache: bool = True
+    ) -> tuple[bool, str | None, list[str] | None]:
         """
         Validate manifest asynchronously.
 
@@ -2585,10 +3017,10 @@ class ManifestValidator:
 
     @staticmethod
     async def validate_with_db(
-        manifest: Dict[str, Any],
+        manifest: dict[str, Any],
         db_validator: Callable[[str], Awaitable[bool]],
         use_cache: bool = True,
-    ) -> Tuple[bool, Optional[str], Optional[List[str]]]:
+    ) -> tuple[bool, str | None, list[str] | None]:
         """
         Validate manifest and check developer_id exists in database.
 
@@ -2600,14 +3032,12 @@ class ManifestValidator:
         Returns:
             Tuple of (is_valid, error_message, error_paths)
         """
-        return await validate_manifest_with_db(
-            manifest, db_validator, use_cache=use_cache
-        )
+        return await validate_manifest_with_db(manifest, db_validator, use_cache=use_cache)
 
     @staticmethod
     def validate_managed_indexes(
-        managed_indexes: Dict[str, List[Dict[str, Any]]]
-    ) -> Tuple[bool, Optional[str]]:
+        managed_indexes: dict[str, list[dict[str, Any]]],
+    ) -> tuple[bool, str | None]:
         """
         Validate managed indexes configuration.
 
@@ -2621,8 +3051,8 @@ class ManifestValidator:
 
     @staticmethod
     def validate_index_definition(
-        index_def: Dict[str, Any], collection_name: str, index_name: str
-    ) -> Tuple[bool, Optional[str]]:
+        index_def: dict[str, Any], collection_name: str, index_name: str
+    ) -> tuple[bool, str | None]:
         """
         Validate a single index definition.
 
@@ -2637,7 +3067,7 @@ class ManifestValidator:
         return validate_index_definition(index_def, collection_name, index_name)
 
     @staticmethod
-    def get_schema_version(manifest: Dict[str, Any]) -> str:
+    def get_schema_version(manifest: dict[str, Any]) -> str:
         """
             Get schema version from manifest.
 
@@ -2651,8 +3081,8 @@ class ManifestValidator:
 
     @staticmethod
     def migrate(
-        manifest: Dict[str, Any], target_version: str = CURRENT_SCHEMA_VERSION
-    ) -> Dict[str, Any]:
+        manifest: dict[str, Any], target_version: str = CURRENT_SCHEMA_VERSION
+    ) -> dict[str, Any]:
         """
         Migrate manifest to target schema version.
 
@@ -2679,7 +3109,7 @@ class ManifestParser:
     with automatic validation and migration.
     """
 
-    def __init__(self, validator: Optional[ManifestValidator] = None):
+    def __init__(self, validator: ManifestValidator | None = None):
         """
         Initialize parser.
 
@@ -2689,7 +3119,7 @@ class ManifestParser:
         self.validator = validator or ManifestValidator()
 
     @staticmethod
-    async def load_from_file(path: Any, validate: bool = True) -> Dict[str, Any]:
+    async def load_from_file(path: Any, validate: bool = True) -> dict[str, Any]:
         """
         Load and validate manifest from file.
 
@@ -2720,17 +3150,13 @@ class ManifestParser:
         if validate:
             is_valid, error, paths = ManifestValidator.validate(manifest_data)
             if not is_valid:
-                error_path_str = (
-                    f" (errors in: {', '.join(paths[:3])})" if paths else ""
-                )
+                error_path_str = f" (errors in: {', '.join(paths[:3])})" if paths else ""
                 raise ValueError(f"Manifest validation failed: {error}{error_path_str}")
 
         return manifest_data
 
     @staticmethod
-    async def load_from_dict(
-        data: Dict[str, Any], validate: bool = True
-    ) -> Dict[str, Any]:
+    async def load_from_dict(data: dict[str, Any], validate: bool = True) -> dict[str, Any]:
         """
         Load and validate manifest from dictionary.
 
@@ -2748,15 +3174,13 @@ class ManifestParser:
         if validate:
             is_valid, error, paths = ManifestValidator.validate(data)
             if not is_valid:
-                error_path_str = (
-                    f" (errors in: {', '.join(paths[:3])})" if paths else ""
-                )
+                error_path_str = f" (errors in: {', '.join(paths[:3])})" if paths else ""
                 raise ValueError(f"Manifest validation failed: {error}{error_path_str}")
 
         return data.copy()
 
     @staticmethod
-    async def load_from_string(content: str, validate: bool = True) -> Dict[str, Any]:
+    async def load_from_string(content: str, validate: bool = True) -> dict[str, Any]:
         """
         Load and validate manifest from JSON string.
 
@@ -2778,8 +3202,8 @@ class ManifestParser:
 
     @staticmethod
     async def load_and_migrate(
-        manifest: Dict[str, Any], target_version: str = CURRENT_SCHEMA_VERSION
-    ) -> Dict[str, Any]:
+        manifest: dict[str, Any], target_version: str = CURRENT_SCHEMA_VERSION
+    ) -> dict[str, Any]:
         """
         Load manifest and migrate to target version.