mdb-engine 0.4.10__tar.gz → 0.4.12__tar.gz

{mdb_engine-0.4.10/mdb_engine.egg-info → mdb_engine-0.4.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mdb-engine
-Version: 0.4.10
+Version: 0.4.12
 Summary: MongoDB Engine
 Home-page: https://github.com/ranfysvalle02/mdb-engine
 Author: Fabian Valle

{mdb_engine-0.4.10 → mdb_engine-0.4.12}/mdb_engine/__init__.py

@@ -82,11 +82,11 @@ from .repositories import Entity, MongoRepository, Repository, UnitOfWork
 from .utils import clean_mongo_doc, clean_mongo_docs
 
 __version__ = (
-    "0.4.10"  # Fix: allow_credentials preserved in CORS config merge
-    # - Fixed bug where allow_credentials was set to False even when child apps require True
-    # - Dynamic CORS middleware reads from app.state.cors_config at request time
-    # - Merge logic now ensures if ANY child app has allow_credentials: True, parent gets True
-    # - Essential for SSO cookie-based authentication in WebSocket connections
+    "0.4.12"  # Fix CSRF middleware rejecting WebSocket connections
+    # - Skip CSRF middleware on child apps in multi-app setups (parent handles it)
+    # - Merge child app public routes into parent CSRF exempt list
+    # - WebSocket connections now work correctly in multi-app SSO setups
+    # - Security maintained: parent app CSRF middleware protects all routes
 )
 
 __all__ = [

{mdb_engine-0.4.10 → mdb_engine-0.4.12}/mdb_engine/auth/csrf.py

@@ -210,14 +210,15 @@ class CSRFMiddleware(BaseHTTPMiddleware):
         are registered on parent app), then falls back to request host.
         """
         try:
-            # Check current app's CORS config (parent app for WebSocket routes in multi-app)
+            # For WebSocket routes on parent app, request.app is parent app
+            # Parent app has merged CORS config from all child apps
             cors_config = getattr(request.app.state, "cors_config", None)
             if cors_config and cors_config.get("allow_origins"):
                 origins = cors_config["allow_origins"]
                 if origins:
                     return origins if isinstance(origins, list) else [origins]
-        except (AttributeError, TypeError, KeyError):
-            pass
+        except (AttributeError, TypeError, KeyError) as e:
+            logger.debug(f"Could not read CORS config from app.state: {e}")
 
         # Fallback: Check if this is a multi-app setup and try to find mounted app's CORS config
         try:
@@ -249,6 +250,7 @@ class CSRFMiddleware(BaseHTTPMiddleware):
                 origin = f"{scheme}://{host}"
             return [origin]
         except (AttributeError, TypeError):
+            # Return empty list if we can't determine origin (will reject)
             return []
 
     def _validate_websocket_origin(self, request: Request) -> bool:
@@ -275,9 +277,12 @@ class CSRFMiddleware(BaseHTTPMiddleware):
             if origin == allowed or origin.rstrip("/") == allowed.rstrip("/"):
                 return True
 
+        cors_config = getattr(request.app.state, "cors_config", None)
+        cors_enabled = cors_config.get("enabled", False) if cors_config else False
         logger.warning(
             f"WebSocket upgrade rejected - invalid Origin: {origin} "
             f"(allowed: {allowed_origins}, app: {getattr(request.app, 'title', 'unknown')}, "
+            f"path: {request.url.path}, CORS enabled: {cors_enabled}, "
             f"has_cors_config: {hasattr(request.app.state, 'cors_config')})"
         )
         return False

{mdb_engine-0.4.10 → mdb_engine-0.4.12}/mdb_engine/core/engine.py

@@ -1499,8 +1499,9 @@ class MongoDBEngine:
 
         # Add CSRF middleware (after auth - auto-enabled for shared mode)
         # CSRF protection is enabled by default for shared auth mode
+        # SKIP for sub-apps in multi-app setups - parent app handles CSRF
         csrf_config = auth_config.get("csrf_protection", True if auth_mode == "shared" else False)
-        if csrf_config:
+        if csrf_config and not is_sub_app:  # Don't add CSRF to child apps
             from ..auth.csrf import create_csrf_middleware
 
             csrf_middleware = create_csrf_middleware(
@@ -1508,6 +1509,11 @@ class MongoDBEngine:
             )
             app.add_middleware(csrf_middleware)
             logger.info(f"CSRFMiddleware added for '{slug}'")
+        elif csrf_config and is_sub_app:
+            logger.debug(
+                f"CSRFMiddleware skipped for child app '{slug}' - "
+                f"parent app handles CSRF protection for WebSocket routes"
+            )
 
         # Add security middleware (HSTS, headers)
         security_config = auth_config.get("security", {})
@@ -2127,17 +2133,33 @@ class MongoDBEngine:
                 "Path prefix validation failed:\n" + "\n".join(f"  - {e}" for e in errors)
             )
 
-        # Check if any app uses shared auth
+        # Check if any app uses shared auth and collect public routes for CSRF exemption
         has_shared_auth = False
+        all_public_routes = [
+            "/health",
+            "/docs",
+            "/openapi.json",
+            "/_mdb/routes",
+        ]  # Base exempt routes
         for app_config in apps:
             try:
                 manifest_path = app_config["manifest"]
+                path_prefix = app_config.get("path_prefix", f"/{app_config.get('slug')}")
                 with open(manifest_path) as f:
                     app_manifest_pre = json.load(f)
                 auth_config = app_manifest_pre.get("auth", {})
                 if auth_config.get("mode") == "shared":
                     has_shared_auth = True
-                    break
+                # Collect public routes with path prefix for CSRF exemption
+                child_public_routes = auth_config.get("public_routes", [])
+                for route in child_public_routes:
+                    # Add path prefix to make route absolute on parent app
+                    if route.startswith("/"):
+                        prefixed_route = f"{path_prefix.rstrip('/')}{route}"
+                    else:
+                        prefixed_route = f"{path_prefix.rstrip('/')}/{route}"
+                    if prefixed_route not in all_public_routes:
+                        all_public_routes.append(prefixed_route)
             except (FileNotFoundError, json.JSONDecodeError, KeyError) as e:
                 logger.warning(f"Could not check auth mode for app '{app_config.get('slug')}': {e}")
 
@@ -2212,7 +2234,18 @@ class MongoDBEngine:
                     # Merge allow_origins lists
                     child_origins = child_cors.get("allow_origins", [])
                     parent_origins = parent_cors.get("allow_origins", [])
-                    merged_origins = list(set(parent_origins + child_origins))
+
+                    # CRITICAL: Handle wildcard origins correctly
+                    # If any child or parent has wildcard, merged config gets wildcard
+                    if "*" in child_origins:
+                        merged_origins = ["*"]  # Wildcard takes precedence
+                    elif "*" in parent_origins:
+                        merged_origins = ["*"]  # Keep wildcard if already set
+                    else:
+                        # Merge unique origins
+                        merged_origins = list(set(parent_origins + child_origins))
+                        if not merged_origins:
+                            merged_origins = ["*"]  # Default to wildcard if empty
 
                     # CRITICAL: If ANY child app requires credentials, parent must allow them
                     # This is essential for SSO cookie-based authentication
@@ -2225,16 +2258,17 @@ class MongoDBEngine:
                     parent_app.state.cors_config = {
                         **parent_cors,
                         **child_cors,
-                        "allow_origins": merged_origins if merged_origins else ["*"],
+                        "allow_origins": merged_origins,
                         # If ANY child requires credentials, parent gets True (for SSO)
                         "allow_credentials": merged_allow_credentials,
                     }
                 else:
                     # Parent has no CORS config, use child's
                     parent_app.state.cors_config = child_cors
-                logger.debug(
-                    f"✅ Merged CORS config from child app '{slug}' to parent app "
-                    f"(allow_credentials={parent_app.state.cors_config.get('allow_credentials')})"
+                logger.info(
+                    f"✅ Merged CORS config from '{slug}': "
+                    f"origins={parent_app.state.cors_config.get('allow_origins')}, "
+                    f"credentials={parent_app.state.cors_config.get('allow_credentials')}"
                 )
 
         async def _register_websocket_routes(
@@ -2246,6 +2280,7 @@ class MongoDBEngine:
             """Register WebSocket routes on parent app for a child app."""
             websockets_config = child_manifest.get("websockets")
             if not websockets_config:
+                logger.debug(f"No WebSocket configuration found for app '{slug}'")
                 return
 
             try:
@@ -2253,6 +2288,9 @@ class MongoDBEngine:
 
                 from ..routing.websockets import create_websocket_endpoint
 
+                registered_count = 0
+                failed_count = 0
+
                 for endpoint_name, endpoint_config in websockets_config.items():
                     ws_path = endpoint_config.get("path", f"/{endpoint_name}")
                     # Combine mount prefix with WebSocket path
@@ -2273,24 +2311,65 @@ class MongoDBEngine:
 
                     ping_interval = endpoint_config.get("ping_interval", 30)
 
-                    # Create WebSocket handler
-                    handler = create_websocket_endpoint(
-                        app_slug=slug,
-                        path=ws_path,
-                        endpoint_name=endpoint_name,
-                        handler=None,
-                        require_auth=require_auth,
-                        ping_interval=ping_interval,
-                    )
+                    try:
+                        # Create WebSocket handler
+                        handler = create_websocket_endpoint(
+                            app_slug=slug,
+                            path=ws_path,
+                            endpoint_name=endpoint_name,
+                            handler=None,
+                            require_auth=require_auth,
+                            ping_interval=ping_interval,
+                        )
+
+                        # Register on parent app with full path
+                        ws_router = APIRouter()
+                        ws_router.websocket(full_ws_path)(handler)
+                        parent_app.include_router(ws_router)
 
-                    # Register on parent app with full path
-                    ws_router = APIRouter()
-                    ws_router.websocket(full_ws_path)(handler)
-                    parent_app.include_router(ws_router)
+                        logger.info(
+                            f"✅ Registered WebSocket route '{full_ws_path}' "
+                            f"for mounted app '{slug}' (mounted at '{path_prefix}', "
+                            f"auth: {require_auth}, ping: {ping_interval}s)"
+                        )
+
+                        # Verify route was actually registered
+                        registered_routes = [
+                            r
+                            for r in parent_app.routes
+                            if hasattr(r, "path") and full_ws_path in str(getattr(r, "path", ""))
+                        ]
+                        if registered_routes:
+                            registered_count += 1
+                            logger.debug(
+                                f"✅ Verified WebSocket route '{full_ws_path}' "
+                                f"registered for '{slug}'"
+                            )
+                        else:
+                            failed_count += 1
+                            logger.warning(
+                                f"⚠️  WebSocket route '{full_ws_path}' not found after registration "
+                                f"for '{slug}' - route may not be accessible"
+                            )
+                    except (ValueError, TypeError, AttributeError, RuntimeError) as e:
+                        failed_count += 1
+                        logger.error(
+                            f"Failed to register WebSocket route '{full_ws_path}' "
+                            f"for mounted app '{slug}': {e}",
+                            exc_info=True,
+                        )
 
+                # Summary logging
+                total_routes = len(websockets_config)
+                if registered_count > 0:
                     logger.info(
-                        f"✅ Registered WebSocket route '{full_ws_path}' "
-                        f"for mounted app '{slug}' (mounted at '{path_prefix}')"
+                        f"✅ WebSocket registration summary for '{slug}': "
+                        f"{registered_count}/{total_routes} routes registered successfully"
+                    )
+                if failed_count > 0:
+                    logger.warning(
+                        f"⚠️  WebSocket registration issues for '{slug}': "
+                        f"{failed_count}/{total_routes} routes failed to register"
                     )
             except ImportError:
                 logger.warning(
@@ -2668,6 +2747,38 @@ class MongoDBEngine:
             # This ensures the state reflects the final mounted_apps list
             app.state.mounted_apps = mounted_apps
 
+            # VERIFICATION: Log final configuration state
+            logger.info("=" * 60)
+            logger.info("MDB-Engine Multi-App Configuration Verification")
+            logger.info("=" * 60)
+
+            # Verify CORS config
+            cors_config = getattr(app.state, "cors_config", None)
+            if cors_config:
+                logger.info(
+                    f"✅ CORS Config: enabled={cors_config.get('enabled')}, "
+                    f"origins={cors_config.get('allow_origins')}, "
+                    f"credentials={cors_config.get('allow_credentials')}"
+                )
+            else:
+                logger.warning("⚠️  No CORS config found on parent app")
+
+            # Verify WebSocket routes
+            ws_routes = [
+                r for r in app.routes if hasattr(r, "path") and "/ws" in str(getattr(r, "path", ""))
+            ]
+            if ws_routes:
+                logger.info(f"✅ Found {len(ws_routes)} WebSocket route(s):")
+                for route in ws_routes:
+                    route_path = getattr(route, "path", "unknown")
+                    logger.info(f"   🔌 {route_path}")
+            else:
+                logger.warning(
+                    "⚠️  No WebSocket routes found - check manifest.json websockets config"
+                )
+
+            logger.info("=" * 60)
+
             yield
 
             # Shutdown is handled by parent app
@@ -2723,10 +2834,11 @@ class MongoDBEngine:
             from ..auth.csrf import create_csrf_middleware
 
             # Create CSRF middleware with default config (will use parent app's CORS config)
-            # Exempt routes that don't need CSRF (health checks, etc.)
+            # Exempt routes that don't need CSRF (health checks, public routes from child apps)
+            # all_public_routes includes base routes + child app public routes with path prefixes
             parent_csrf_config = {
                 "csrf_protection": True,
-                "public_routes": ["/health", "/docs", "/openapi.json", "/_mdb/routes"],
+                "public_routes": all_public_routes,
             }
             csrf_middleware = create_csrf_middleware(parent_csrf_config)
             parent_app.add_middleware(csrf_middleware)

{mdb_engine-0.4.10 → mdb_engine-0.4.12/mdb_engine.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mdb-engine
-Version: 0.4.10
+Version: 0.4.12
 Summary: MongoDB Engine
 Home-page: https://github.com/ranfysvalle02/mdb-engine
 Author: Fabian Valle

{mdb_engine-0.4.10 → mdb_engine-0.4.12}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mdb-engine"
-version = "0.4.10"
+version = "0.4.12"
 description = "MongoDB Engine"
 readme = "README.md"
 requires-python = ">=3.10"

{mdb_engine-0.4.10 → mdb_engine-0.4.12}/setup.py

@@ -14,7 +14,7 @@ if readme_file.exists():
 
 setup(
     name="mdb-engine",
-    version="0.4.8",
+    version="0.4.12",
     description="MongoDB Engine",
     long_description=long_description,
     long_description_content_type="text/markdown",