mdb-engine 0.4.8__tar.gz → 0.4.10__tar.gz

{mdb_engine-0.4.8/mdb_engine.egg-info → mdb_engine-0.4.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mdb-engine
-Version: 0.4.8
+Version: 0.4.10
 Summary: MongoDB Engine
 Home-page: https://github.com/ranfysvalle02/mdb-engine
 Author: Fabian Valle

{mdb_engine-0.4.8 → mdb_engine-0.4.10}/mdb_engine/__init__.py

@@ -82,8 +82,11 @@ from .repositories import Entity, MongoRepository, Repository, UnitOfWork
 from .utils import clean_mongo_doc, clean_mongo_docs
 
 __version__ = (
-    "0.4.8"  # Fix: WebSocket routes now work correctly with mounted apps
-    # WebSocket routes are registered on parent app with full mount path prefix
+    "0.4.10"  # Fix: allow_credentials preserved in CORS config merge
+    # - Fixed bug where allow_credentials was set to False even when child apps require True
+    # - Dynamic CORS middleware reads from app.state.cors_config at request time
+    # - Merge logic now ensures if ANY child app has allow_credentials: True, parent gets True
+    # - Essential for SSO cookie-based authentication in WebSocket connections
 )
 
 __all__ = [

{mdb_engine-0.4.8 → mdb_engine-0.4.10}/mdb_engine/auth/csrf.py

@@ -190,6 +190,8 @@ class CSRFMiddleware(BaseHTTPMiddleware):
 
     def _is_exempt(self, path: str) -> bool:
         """Check if a path is exempt from CSRF validation."""
+        # WebSocket upgrade requests are handled separately in dispatch()
+        # Don't exempt them here - they need origin validation
         for pattern in self.exempt_routes:
             if fnmatch.fnmatch(path, pattern):
                 return True
@@ -201,14 +203,42 @@ class CSRFMiddleware(BaseHTTPMiddleware):
         return upgrade_header == "websocket"
 
     def _get_allowed_origins(self, request: Request) -> list[str]:
-        """Get allowed origins from app state (CORS config) or use request host as fallback."""
+        """
+        Get allowed origins from app state (CORS config) or use request host as fallback.
+
+        For multi-app setups, checks parent app's CORS config first (since WebSocket routes
+        are registered on parent app), then falls back to request host.
+        """
         try:
+            # Check current app's CORS config (parent app for WebSocket routes in multi-app)
             cors_config = getattr(request.app.state, "cors_config", None)
             if cors_config and cors_config.get("allow_origins"):
-                return cors_config["allow_origins"]
+                origins = cors_config["allow_origins"]
+                if origins:
+                    return origins if isinstance(origins, list) else [origins]
         except (AttributeError, TypeError, KeyError):
             pass
 
+        # Fallback: Check if this is a multi-app setup and try to find mounted app's CORS config
+        try:
+            if hasattr(request.app.state, "mounted_apps"):
+                # This is a parent app in multi-app setup
+                # Try to find which mounted app this request is for
+                path = request.url.path
+                mounted_apps = request.app.state.mounted_apps
+
+                # Find matching mounted app by path prefix
+                for app_info in mounted_apps:
+                    path_prefix = app_info.get("path_prefix", "")
+                    if path_prefix and path.startswith(path_prefix):
+                        # Try to get child app's CORS config if available
+                        # Note: Child app might not be directly accessible, so we rely on
+                        # parent app's merged CORS config (set during mounting)
+                        break
+        except (AttributeError, TypeError, KeyError):
+            pass
+
+        # Final fallback: Use request host
         try:
             host = request.url.hostname
             scheme = request.url.scheme
@@ -247,7 +277,8 @@ class CSRFMiddleware(BaseHTTPMiddleware):
 
         logger.warning(
             f"WebSocket upgrade rejected - invalid Origin: {origin} "
-            f"(allowed: {allowed_origins})"
+            f"(allowed: {allowed_origins}, app: {getattr(request.app, 'title', 'unknown')}, "
+            f"has_cors_config: {hasattr(request.app.state, 'cors_config')})"
         )
         return False
 
@@ -262,12 +293,22 @@ class CSRFMiddleware(BaseHTTPMiddleware):
         path = request.url.path
         method = request.method
 
+        # CRITICAL: Handle WebSocket upgrade requests BEFORE other CSRF checks
+        # WebSocket upgrades don't use CSRF tokens, but need origin validation
         if self._is_websocket_upgrade(request):
+            # Validate origin for WebSocket connections (CSWSH protection)
             if not self._validate_websocket_origin(request):
+                logger.warning(
+                    f"WebSocket origin validation failed for {path}: "
+                    f"origin={request.headers.get('origin')}, "
+                    f"allowed={self._get_allowed_origins(request)}"
+                )
                 return JSONResponse(
                     status_code=status.HTTP_403_FORBIDDEN,
                     content={"detail": "Invalid origin for WebSocket connection"},
                 )
+            # Origin validated - allow WebSocket upgrade to proceed
+            # No CSRF token check needed for WebSocket upgrades
             return await call_next(request)
 
         if self._is_exempt(path):

{mdb_engine-0.4.8 → mdb_engine-0.4.10}/mdb_engine/core/engine.py

@@ -2179,6 +2179,130 @@ class MongoDBEngine:
                     return entry
             return None
 
+        async def _merge_cors_config_to_parent(
+            parent_app: "FastAPI",
+            child_app: "FastAPI",
+            child_manifest: dict[str, Any],
+            slug: str,
+        ) -> None:
+            """Merge CORS config from child app to parent app."""
+            child_cors = None
+            if hasattr(child_app.state, "cors_config"):
+                child_cors = child_app.state.cors_config
+            else:
+                # CORS config might not be set yet (lifespan runs asynchronously)
+                # Get it from manifest directly
+                cors_config_from_manifest = child_manifest.get("cors", {})
+                if cors_config_from_manifest:
+                    from ..auth.config_helpers import (
+                        CORS_DEFAULTS,
+                        merge_config_with_defaults,
+                    )
+
+                    child_cors = merge_config_with_defaults(
+                        cors_config_from_manifest, CORS_DEFAULTS
+                    )
+                    # Also set it on child app state for future reference
+                    child_app.state.cors_config = child_cors
+
+            if child_cors:
+                if hasattr(parent_app.state, "cors_config"):
+                    # Merge child CORS into parent (child takes precedence for its routes)
+                    parent_cors = parent_app.state.cors_config
+                    # Merge allow_origins lists
+                    child_origins = child_cors.get("allow_origins", [])
+                    parent_origins = parent_cors.get("allow_origins", [])
+                    merged_origins = list(set(parent_origins + child_origins))
+
+                    # CRITICAL: If ANY child app requires credentials, parent must allow them
+                    # This is essential for SSO cookie-based authentication
+                    child_requires_credentials = child_cors.get("allow_credentials", False)
+                    parent_allows_credentials = parent_cors.get("allow_credentials", False)
+                    merged_allow_credentials = (
+                        child_requires_credentials or parent_allows_credentials
+                    )
+
+                    parent_app.state.cors_config = {
+                        **parent_cors,
+                        **child_cors,
+                        "allow_origins": merged_origins if merged_origins else ["*"],
+                        # If ANY child requires credentials, parent gets True (for SSO)
+                        "allow_credentials": merged_allow_credentials,
+                    }
+                else:
+                    # Parent has no CORS config, use child's
+                    parent_app.state.cors_config = child_cors
+                logger.debug(
+                    f"✅ Merged CORS config from child app '{slug}' to parent app "
+                    f"(allow_credentials={parent_app.state.cors_config.get('allow_credentials')})"
+                )
+
+        async def _register_websocket_routes(
+            parent_app: "FastAPI",
+            child_manifest: dict[str, Any],
+            slug: str,
+            path_prefix: str,
+        ) -> None:
+            """Register WebSocket routes on parent app for a child app."""
+            websockets_config = child_manifest.get("websockets")
+            if not websockets_config:
+                return
+
+            try:
+                from fastapi import APIRouter
+
+                from ..routing.websockets import create_websocket_endpoint
+
+                for endpoint_name, endpoint_config in websockets_config.items():
+                    ws_path = endpoint_config.get("path", f"/{endpoint_name}")
+                    # Combine mount prefix with WebSocket path
+                    full_ws_path = f"{path_prefix.rstrip('/')}{ws_path}"
+
+                    # Handle auth configuration
+                    auth_config = endpoint_config.get("auth", {})
+                    if isinstance(auth_config, dict) and "required" in auth_config:
+                        require_auth = auth_config.get("required", True)
+                    elif "require_auth" in endpoint_config:
+                        require_auth = endpoint_config.get("require_auth", True)
+                    else:
+                        # Use app's auth_policy if available
+                        if "auth_policy" in child_manifest:
+                            require_auth = child_manifest["auth_policy"].get("required", True)
+                        else:
+                            require_auth = True
+
+                    ping_interval = endpoint_config.get("ping_interval", 30)
+
+                    # Create WebSocket handler
+                    handler = create_websocket_endpoint(
+                        app_slug=slug,
+                        path=ws_path,
+                        endpoint_name=endpoint_name,
+                        handler=None,
+                        require_auth=require_auth,
+                        ping_interval=ping_interval,
+                    )
+
+                    # Register on parent app with full path
+                    ws_router = APIRouter()
+                    ws_router.websocket(full_ws_path)(handler)
+                    parent_app.include_router(ws_router)
+
+                    logger.info(
+                        f"✅ Registered WebSocket route '{full_ws_path}' "
+                        f"for mounted app '{slug}' (mounted at '{path_prefix}')"
+                    )
+            except ImportError:
+                logger.warning(
+                    f"WebSocket support not available - skipping WebSocket routes "
+                    f"for mounted app '{slug}'"
+                )
+            except (ValueError, TypeError, AttributeError, RuntimeError) as e:
+                logger.error(
+                    f"Failed to register WebSocket routes for mounted app '{slug}': {e}",
+                    exc_info=True,
+                )
+
         @asynccontextmanager
         async def lifespan(app: FastAPI):
             """Lifespan context manager for parent app."""
@@ -2376,71 +2500,11 @@ class MongoDBEngine:
                     # Mount child app at path prefix
                     app.mount(path_prefix, child_app)
 
-                    # CRITICAL FIX: Register WebSocket routes on parent app with full path
-                    # FastAPI's app.mount() doesn't handle WebSocket routes correctly,
-                    # so we need to register them on the parent app with the mount prefix
-                    # Get WebSocket config from manifest directly (app registration happens
-                    # asynchronously in lifespan, so config may not be available yet)
-                    websockets_config = app_manifest_data.get("websockets")
-                    if websockets_config:
-                        try:
-                            from fastapi import APIRouter
-
-                            from ..routing.websockets import create_websocket_endpoint
-
-                            for endpoint_name, endpoint_config in websockets_config.items():
-                                ws_path = endpoint_config.get("path", f"/{endpoint_name}")
-                                # Combine mount prefix with WebSocket path
-                                full_ws_path = f"{path_prefix.rstrip('/')}{ws_path}"
-
-                                # Handle auth configuration
-                                auth_config = endpoint_config.get("auth", {})
-                                if isinstance(auth_config, dict) and "required" in auth_config:
-                                    require_auth = auth_config.get("required", True)
-                                elif "require_auth" in endpoint_config:
-                                    require_auth = endpoint_config.get("require_auth", True)
-                                else:
-                                    # Use app's auth_policy if available
-                                    if "auth_policy" in app_manifest_data:
-                                        require_auth = app_manifest_data["auth_policy"].get(
-                                            "required", True
-                                        )
-                                    else:
-                                        require_auth = True
-
-                                ping_interval = endpoint_config.get("ping_interval", 30)
-
-                                # Create WebSocket handler
-                                # Use original path for handler (mount handled internally)
-                                handler = create_websocket_endpoint(
-                                    app_slug=slug,
-                                    path=ws_path,
-                                    endpoint_name=endpoint_name,
-                                    handler=None,
-                                    require_auth=require_auth,
-                                    ping_interval=ping_interval,
-                                )
+                    # CRITICAL FIX: Merge CORS config from child app to parent app
+                    await _merge_cors_config_to_parent(app, child_app, app_manifest_data, slug)
 
-                                # Register on parent app with full path
-                                ws_router = APIRouter()
-                                ws_router.websocket(full_ws_path)(handler)
-                                app.include_router(ws_router)
-
-                                logger.info(
-                                    f"✅ Registered WebSocket route '{full_ws_path}' "
-                                    f"for mounted app '{slug}' (mounted at '{path_prefix}')"
-                                )
-                        except ImportError:
-                            logger.warning(
-                                f"WebSocket support not available - skipping WebSocket routes "
-                                f"for mounted app '{slug}'"
-                            )
-                        except (ValueError, TypeError, AttributeError, RuntimeError) as e:
-                            logger.error(
-                                f"Failed to register WebSocket routes for mounted app "
-                                f"'{slug}': {e}",
-                                exc_info=True,
-                            )
+                    # CRITICAL FIX: Register WebSocket routes on parent app with full path
+                    await _register_websocket_routes(app, app_manifest_data, slug, path_prefix)
 
                     # Update existing entry instead of appending
                     entry = _find_mounted_app_entry(slug)
@@ -2617,6 +2681,19 @@ class MongoDBEngine:
         parent_app.state.is_multi_app = True
         parent_app.state.engine = engine
 
+        # Set default CORS config on parent app for WebSocket origin validation
+        # This ensures CSRF middleware can validate WebSocket origins even if child apps
+        # don't configure CORS
+        # NOTE: allow_credentials defaults to False here, but will be set to True
+        # during merge if any child app requires it (essential for SSO cookie-based auth)
+        from ..auth.config_helpers import CORS_DEFAULTS
+
+        parent_app.state.cors_config = CORS_DEFAULTS.copy()
+        parent_app.state.cors_config["enabled"] = True
+        parent_app.state.cors_config["allow_origins"] = ["*"]  # Default to allow all for WebSocket
+        # Keep allow_credentials as False initially - will be merged from child apps
+        logger.debug("Set default CORS config on parent app for WebSocket origin validation")
+
         # Store app reference in engine for get_mounted_apps()
         engine._multi_app_instance = parent_app
 
@@ -2639,19 +2716,116 @@ class MongoDBEngine:
         parent_app.add_middleware(RequestScopeMiddleware)
         logger.debug("RequestScopeMiddleware added for parent app")
 
+        # CRITICAL: Add CSRF middleware to parent app if any child app uses shared auth
+        # WebSocket routes are registered on parent app, so parent app middleware runs first
+        # CSRF middleware on parent app validates WebSocket origin using parent app's CORS config
+        if has_shared_auth:
+            from ..auth.csrf import create_csrf_middleware
+
+            # Create CSRF middleware with default config (will use parent app's CORS config)
+            # Exempt routes that don't need CSRF (health checks, etc.)
+            parent_csrf_config = {
+                "csrf_protection": True,
+                "public_routes": ["/health", "/docs", "/openapi.json", "/_mdb/routes"],
+            }
+            csrf_middleware = create_csrf_middleware(parent_csrf_config)
+            parent_app.add_middleware(csrf_middleware)
+            logger.info("CSRFMiddleware added to parent app for WebSocket origin validation")
+
         # Add shared CORS middleware if configured
-        # (Individual apps can add their own CORS, but parent-level is useful)
+        # NOTE: We create a dynamic CORS middleware that reads from app.state.cors_config
+        # This allows the config to be updated after child apps are mounted and merged
         try:
-            from fastapi.middleware.cors import CORSMiddleware
-
-            parent_app.add_middleware(
-                CORSMiddleware,
-                allow_origins=["*"],  # Can be configured via manifest later
-                allow_credentials=True,
-                allow_methods=["*"],
-                allow_headers=["*"],
+            from starlette.middleware.base import BaseHTTPMiddleware
+            from starlette.requests import Request
+            from starlette.responses import Response
+
+            class DynamicCORSMiddleware(BaseHTTPMiddleware):
+                """
+                Dynamic CORS middleware that reads config from app.state.cors_config.
+
+                This allows CORS config to be updated after child apps are mounted
+                and their configs are merged, which is essential for SSO multi-app
+                setups where allow_credentials must be True for cookie-based auth.
+                """
+
+                async def dispatch(self, request: Request, call_next):
+                    # Read CORS config from app.state (may have been merged from child apps)
+                    cors_config = getattr(request.app.state, "cors_config", {})
+
+                    if not cors_config.get("enabled", False):
+                        # CORS not enabled, pass through
+                        return await call_next(request)
+
+                    # Handle preflight OPTIONS request
+                    if request.method == "OPTIONS":
+                        origin = request.headers.get("origin")
+                        allowed_origins = cors_config.get("allow_origins", ["*"])
+                        allow_credentials = cors_config.get("allow_credentials", False)
+
+                        # Check if origin is allowed
+                        origin_allowed = False
+                        if "*" in allowed_origins:
+                            origin_allowed = True
+                        elif origin in allowed_origins:
+                            origin_allowed = True
+
+                        if origin_allowed:
+                            headers = {
+                                "Access-Control-Allow-Methods": ", ".join(
+                                    cors_config.get("allow_methods", ["*"])
+                                ),
+                                "Access-Control-Allow-Headers": ", ".join(
+                                    cors_config.get("allow_headers", ["*"])
+                                ),
+                                "Access-Control-Max-Age": str(cors_config.get("max_age", 3600)),
+                            }
+                            if allow_credentials:
+                                headers["Access-Control-Allow-Credentials"] = "true"
+                            if origin:
+                                headers["Access-Control-Allow-Origin"] = origin
+
+                            expose_headers = cors_config.get("expose_headers", [])
+                            if expose_headers:
+                                headers["Access-Control-Expose-Headers"] = ", ".join(expose_headers)
+
+                            return Response(status_code=200, headers=headers)
+                        else:
+                            return Response(status_code=403)
+
+                    # Handle actual request
+                    response = await call_next(request)
+
+                    # Add CORS headers to response
+                    origin = request.headers.get("origin")
+                    allowed_origins = cors_config.get("allow_origins", ["*"])
+                    allow_credentials = cors_config.get("allow_credentials", False)
+
+                    # Check if origin is allowed
+                    origin_allowed = False
+                    if "*" in allowed_origins:
+                        origin_allowed = True
+                    elif origin and origin in allowed_origins:
+                        origin_allowed = True
+
+                    if origin_allowed:
+                        if origin:
+                            response.headers["Access-Control-Allow-Origin"] = origin
+                        if allow_credentials:
+                            response.headers["Access-Control-Allow-Credentials"] = "true"
+
+                        expose_headers = cors_config.get("expose_headers", [])
+                        if expose_headers:
+                            response.headers["Access-Control-Expose-Headers"] = ", ".join(
+                                expose_headers
+                            )
+
+                    return response
+
+            parent_app.add_middleware(DynamicCORSMiddleware)
+            logger.debug(
+                "Dynamic CORS middleware added for parent app (reads from app.state.cors_config)"
             )
-            logger.debug("CORS middleware added for parent app")
         except ImportError:
             logger.warning("CORS middleware not available")
 

{mdb_engine-0.4.8 → mdb_engine-0.4.10/mdb_engine.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mdb-engine
-Version: 0.4.8
+Version: 0.4.10
 Summary: MongoDB Engine
 Home-page: https://github.com/ranfysvalle02/mdb-engine
 Author: Fabian Valle

{mdb_engine-0.4.8 → mdb_engine-0.4.10}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mdb-engine"
-version = "0.4.8"
+version = "0.4.10"
 description = "MongoDB Engine"
 readme = "README.md"
 requires-python = ">=3.10"