mdb-engine 0.4.9__tar.gz → 0.4.11__tar.gz

{mdb_engine-0.4.9/mdb_engine.egg-info → mdb_engine-0.4.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mdb-engine
-Version: 0.4.9
+Version: 0.4.11
 Summary: MongoDB Engine
 Home-page: https://github.com/ranfysvalle02/mdb-engine
 Author: Fabian Valle

{mdb_engine-0.4.9 → mdb_engine-0.4.11}/mdb_engine/__init__.py

@@ -82,11 +82,13 @@ from .repositories import Entity, MongoRepository, Repository, UnitOfWork
 from .utils import clean_mongo_doc, clean_mongo_docs
 
 __version__ = (
-    "0.4.9"  # Fix: WebSocket + CSRF + Multi-App architecture
-    # - CSRF middleware now added to parent app when child apps use shared auth
-    # - CORS config properly merged from child apps to parent app
-    # - WebSocket origin validation uses parent app's CORS config
-    # - Comprehensive integration tests added
+    "0.4.11"  # Automatic WebSocket support improvements
+    # - Improved CORS config merging with proper wildcard handling
+    # - WebSocket route verification after registration
+    # - Startup verification logging for CORS config and WebSocket routes
+    # - Enhanced CSRF middleware error messages with path and CORS status
+    # - Better logging throughout WebSocket registration process
+    # - All WebSocket multi-app SSO features now work automatically
 )
 
 __all__ = [

{mdb_engine-0.4.9 → mdb_engine-0.4.11}/mdb_engine/auth/csrf.py

@@ -210,14 +210,15 @@ class CSRFMiddleware(BaseHTTPMiddleware):
         are registered on parent app), then falls back to request host.
         """
         try:
-            # Check current app's CORS config (parent app for WebSocket routes in multi-app)
+            # For WebSocket routes on parent app, request.app is parent app
+            # Parent app has merged CORS config from all child apps
             cors_config = getattr(request.app.state, "cors_config", None)
             if cors_config and cors_config.get("allow_origins"):
                 origins = cors_config["allow_origins"]
                 if origins:
                     return origins if isinstance(origins, list) else [origins]
-        except (AttributeError, TypeError, KeyError):
-            pass
+        except (AttributeError, TypeError, KeyError) as e:
+            logger.debug(f"Could not read CORS config from app.state: {e}")
 
         # Fallback: Check if this is a multi-app setup and try to find mounted app's CORS config
         try:
@@ -249,6 +250,7 @@ class CSRFMiddleware(BaseHTTPMiddleware):
                 origin = f"{scheme}://{host}"
             return [origin]
         except (AttributeError, TypeError):
+            # Return empty list if we can't determine origin (will reject)
             return []
 
     def _validate_websocket_origin(self, request: Request) -> bool:
@@ -275,9 +277,12 @@ class CSRFMiddleware(BaseHTTPMiddleware):
             if origin == allowed or origin.rstrip("/") == allowed.rstrip("/"):
                 return True
 
+        cors_config = getattr(request.app.state, "cors_config", None)
+        cors_enabled = cors_config.get("enabled", False) if cors_config else False
         logger.warning(
             f"WebSocket upgrade rejected - invalid Origin: {origin} "
             f"(allowed: {allowed_origins}, app: {getattr(request.app, 'title', 'unknown')}, "
+            f"path: {request.url.path}, CORS enabled: {cors_enabled}, "
             f"has_cors_config: {hasattr(request.app.state, 'cors_config')})"
         )
         return False

{mdb_engine-0.4.9 → mdb_engine-0.4.11}/mdb_engine/core/engine.py

@@ -2212,16 +2212,42 @@ class MongoDBEngine:
                     # Merge allow_origins lists
                     child_origins = child_cors.get("allow_origins", [])
                     parent_origins = parent_cors.get("allow_origins", [])
-                    merged_origins = list(set(parent_origins + child_origins))
+
+                    # CRITICAL: Handle wildcard origins correctly
+                    # If any child or parent has wildcard, merged config gets wildcard
+                    if "*" in child_origins:
+                        merged_origins = ["*"]  # Wildcard takes precedence
+                    elif "*" in parent_origins:
+                        merged_origins = ["*"]  # Keep wildcard if already set
+                    else:
+                        # Merge unique origins
+                        merged_origins = list(set(parent_origins + child_origins))
+                        if not merged_origins:
+                            merged_origins = ["*"]  # Default to wildcard if empty
+
+                    # CRITICAL: If ANY child app requires credentials, parent must allow them
+                    # This is essential for SSO cookie-based authentication
+                    child_requires_credentials = child_cors.get("allow_credentials", False)
+                    parent_allows_credentials = parent_cors.get("allow_credentials", False)
+                    merged_allow_credentials = (
+                        child_requires_credentials or parent_allows_credentials
+                    )
+
                     parent_app.state.cors_config = {
                         **parent_cors,
                         **child_cors,
-                        "allow_origins": merged_origins if merged_origins else ["*"],
+                        "allow_origins": merged_origins,
+                        # If ANY child requires credentials, parent gets True (for SSO)
+                        "allow_credentials": merged_allow_credentials,
                     }
                 else:
                     # Parent has no CORS config, use child's
                     parent_app.state.cors_config = child_cors
-                logger.debug(f"✅ Merged CORS config from child app '{slug}' to parent app")
+                logger.info(
+                    f"✅ Merged CORS config from '{slug}': "
+                    f"origins={parent_app.state.cors_config.get('allow_origins')}, "
+                    f"credentials={parent_app.state.cors_config.get('allow_credentials')}"
+                )
 
         async def _register_websocket_routes(
             parent_app: "FastAPI",
@@ -2232,6 +2258,7 @@ class MongoDBEngine:
             """Register WebSocket routes on parent app for a child app."""
             websockets_config = child_manifest.get("websockets")
             if not websockets_config:
+                logger.debug(f"No WebSocket configuration found for app '{slug}'")
                 return
 
             try:
@@ -2239,6 +2266,9 @@ class MongoDBEngine:
 
                 from ..routing.websockets import create_websocket_endpoint
 
+                registered_count = 0
+                failed_count = 0
+
                 for endpoint_name, endpoint_config in websockets_config.items():
                     ws_path = endpoint_config.get("path", f"/{endpoint_name}")
                     # Combine mount prefix with WebSocket path
@@ -2259,24 +2289,65 @@ class MongoDBEngine:
 
                     ping_interval = endpoint_config.get("ping_interval", 30)
 
-                    # Create WebSocket handler
-                    handler = create_websocket_endpoint(
-                        app_slug=slug,
-                        path=ws_path,
-                        endpoint_name=endpoint_name,
-                        handler=None,
-                        require_auth=require_auth,
-                        ping_interval=ping_interval,
-                    )
+                    try:
+                        # Create WebSocket handler
+                        handler = create_websocket_endpoint(
+                            app_slug=slug,
+                            path=ws_path,
+                            endpoint_name=endpoint_name,
+                            handler=None,
+                            require_auth=require_auth,
+                            ping_interval=ping_interval,
+                        )
+
+                        # Register on parent app with full path
+                        ws_router = APIRouter()
+                        ws_router.websocket(full_ws_path)(handler)
+                        parent_app.include_router(ws_router)
 
-                    # Register on parent app with full path
-                    ws_router = APIRouter()
-                    ws_router.websocket(full_ws_path)(handler)
-                    parent_app.include_router(ws_router)
+                        logger.info(
+                            f"✅ Registered WebSocket route '{full_ws_path}' "
+                            f"for mounted app '{slug}' (mounted at '{path_prefix}', "
+                            f"auth: {require_auth}, ping: {ping_interval}s)"
+                        )
 
+                        # Verify route was actually registered
+                        registered_routes = [
+                            r
+                            for r in parent_app.routes
+                            if hasattr(r, "path") and full_ws_path in str(getattr(r, "path", ""))
+                        ]
+                        if registered_routes:
+                            registered_count += 1
+                            logger.debug(
+                                f"✅ Verified WebSocket route '{full_ws_path}' "
+                                f"registered for '{slug}'"
+                            )
+                        else:
+                            failed_count += 1
+                            logger.warning(
+                                f"⚠️  WebSocket route '{full_ws_path}' not found after registration "
+                                f"for '{slug}' - route may not be accessible"
+                            )
+                    except (ValueError, TypeError, AttributeError, RuntimeError) as e:
+                        failed_count += 1
+                        logger.error(
+                            f"Failed to register WebSocket route '{full_ws_path}' "
+                            f"for mounted app '{slug}': {e}",
+                            exc_info=True,
+                        )
+
+                # Summary logging
+                total_routes = len(websockets_config)
+                if registered_count > 0:
                     logger.info(
-                        f"✅ Registered WebSocket route '{full_ws_path}' "
-                        f"for mounted app '{slug}' (mounted at '{path_prefix}')"
+                        f"✅ WebSocket registration summary for '{slug}': "
+                        f"{registered_count}/{total_routes} routes registered successfully"
+                    )
+                if failed_count > 0:
+                    logger.warning(
+                        f"⚠️  WebSocket registration issues for '{slug}': "
+                        f"{failed_count}/{total_routes} routes failed to register"
                     )
             except ImportError:
                 logger.warning(
@@ -2654,6 +2725,38 @@ class MongoDBEngine:
             # This ensures the state reflects the final mounted_apps list
             app.state.mounted_apps = mounted_apps
 
+            # VERIFICATION: Log final configuration state
+            logger.info("=" * 60)
+            logger.info("MDB-Engine Multi-App Configuration Verification")
+            logger.info("=" * 60)
+
+            # Verify CORS config
+            cors_config = getattr(app.state, "cors_config", None)
+            if cors_config:
+                logger.info(
+                    f"✅ CORS Config: enabled={cors_config.get('enabled')}, "
+                    f"origins={cors_config.get('allow_origins')}, "
+                    f"credentials={cors_config.get('allow_credentials')}"
+                )
+            else:
+                logger.warning("⚠️  No CORS config found on parent app")
+
+            # Verify WebSocket routes
+            ws_routes = [
+                r for r in app.routes if hasattr(r, "path") and "/ws" in str(getattr(r, "path", ""))
+            ]
+            if ws_routes:
+                logger.info(f"✅ Found {len(ws_routes)} WebSocket route(s):")
+                for route in ws_routes:
+                    route_path = getattr(route, "path", "unknown")
+                    logger.info(f"   🔌 {route_path}")
+            else:
+                logger.warning(
+                    "⚠️  No WebSocket routes found - check manifest.json websockets config"
+                )
+
+            logger.info("=" * 60)
+
             yield
 
             # Shutdown is handled by parent app
@@ -2670,11 +2773,14 @@ class MongoDBEngine:
         # Set default CORS config on parent app for WebSocket origin validation
         # This ensures CSRF middleware can validate WebSocket origins even if child apps
         # don't configure CORS
+        # NOTE: allow_credentials defaults to False here, but will be set to True
+        # during merge if any child app requires it (essential for SSO cookie-based auth)
         from ..auth.config_helpers import CORS_DEFAULTS
 
         parent_app.state.cors_config = CORS_DEFAULTS.copy()
         parent_app.state.cors_config["enabled"] = True
         parent_app.state.cors_config["allow_origins"] = ["*"]  # Default to allow all for WebSocket
+        # Keep allow_credentials as False initially - will be merged from child apps
         logger.debug("Set default CORS config on parent app for WebSocket origin validation")
 
         # Store app reference in engine for get_mounted_apps()
@@ -2716,22 +2822,99 @@ class MongoDBEngine:
             logger.info("CSRFMiddleware added to parent app for WebSocket origin validation")
 
         # Add shared CORS middleware if configured
-        # (Individual apps can add their own CORS, but parent-level is useful)
+        # NOTE: We create a dynamic CORS middleware that reads from app.state.cors_config
+        # This allows the config to be updated after child apps are mounted and merged
         try:
-            from fastapi.middleware.cors import CORSMiddleware
-
-            # Use CORS config from parent app state (set above)
-            cors_origins = parent_app.state.cors_config.get("allow_origins", ["*"])
-            cors_credentials = parent_app.state.cors_config.get("allow_credentials", True)
-
-            parent_app.add_middleware(
-                CORSMiddleware,
-                allow_origins=cors_origins,
-                allow_credentials=cors_credentials,
-                allow_methods=["*"],
-                allow_headers=["*"],
+            from starlette.middleware.base import BaseHTTPMiddleware
+            from starlette.requests import Request
+            from starlette.responses import Response
+
+            class DynamicCORSMiddleware(BaseHTTPMiddleware):
+                """
+                Dynamic CORS middleware that reads config from app.state.cors_config.
+
+                This allows CORS config to be updated after child apps are mounted
+                and their configs are merged, which is essential for SSO multi-app
+                setups where allow_credentials must be True for cookie-based auth.
+                """
+
+                async def dispatch(self, request: Request, call_next):
+                    # Read CORS config from app.state (may have been merged from child apps)
+                    cors_config = getattr(request.app.state, "cors_config", {})
+
+                    if not cors_config.get("enabled", False):
+                        # CORS not enabled, pass through
+                        return await call_next(request)
+
+                    # Handle preflight OPTIONS request
+                    if request.method == "OPTIONS":
+                        origin = request.headers.get("origin")
+                        allowed_origins = cors_config.get("allow_origins", ["*"])
+                        allow_credentials = cors_config.get("allow_credentials", False)
+
+                        # Check if origin is allowed
+                        origin_allowed = False
+                        if "*" in allowed_origins:
+                            origin_allowed = True
+                        elif origin in allowed_origins:
+                            origin_allowed = True
+
+                        if origin_allowed:
+                            headers = {
+                                "Access-Control-Allow-Methods": ", ".join(
+                                    cors_config.get("allow_methods", ["*"])
+                                ),
+                                "Access-Control-Allow-Headers": ", ".join(
+                                    cors_config.get("allow_headers", ["*"])
+                                ),
+                                "Access-Control-Max-Age": str(cors_config.get("max_age", 3600)),
+                            }
+                            if allow_credentials:
+                                headers["Access-Control-Allow-Credentials"] = "true"
+                            if origin:
+                                headers["Access-Control-Allow-Origin"] = origin
+
+                            expose_headers = cors_config.get("expose_headers", [])
+                            if expose_headers:
+                                headers["Access-Control-Expose-Headers"] = ", ".join(expose_headers)
+
+                            return Response(status_code=200, headers=headers)
+                        else:
+                            return Response(status_code=403)
+
+                    # Handle actual request
+                    response = await call_next(request)
+
+                    # Add CORS headers to response
+                    origin = request.headers.get("origin")
+                    allowed_origins = cors_config.get("allow_origins", ["*"])
+                    allow_credentials = cors_config.get("allow_credentials", False)
+
+                    # Check if origin is allowed
+                    origin_allowed = False
+                    if "*" in allowed_origins:
+                        origin_allowed = True
+                    elif origin and origin in allowed_origins:
+                        origin_allowed = True
+
+                    if origin_allowed:
+                        if origin:
+                            response.headers["Access-Control-Allow-Origin"] = origin
+                        if allow_credentials:
+                            response.headers["Access-Control-Allow-Credentials"] = "true"
+
+                        expose_headers = cors_config.get("expose_headers", [])
+                        if expose_headers:
+                            response.headers["Access-Control-Expose-Headers"] = ", ".join(
+                                expose_headers
+                            )
+
+                    return response
+
+            parent_app.add_middleware(DynamicCORSMiddleware)
+            logger.debug(
+                "Dynamic CORS middleware added for parent app (reads from app.state.cors_config)"
             )
-            logger.debug("CORS middleware added for parent app")
         except ImportError:
             logger.warning("CORS middleware not available")
 

{mdb_engine-0.4.9 → mdb_engine-0.4.11/mdb_engine.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mdb-engine
-Version: 0.4.9
+Version: 0.4.11
 Summary: MongoDB Engine
 Home-page: https://github.com/ranfysvalle02/mdb-engine
 Author: Fabian Valle

{mdb_engine-0.4.9 → mdb_engine-0.4.11}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mdb-engine"
-version = "0.4.9"
+version = "0.4.11"
 description = "MongoDB Engine"
 readme = "README.md"
 requires-python = ">=3.10"

{mdb_engine-0.4.9 → mdb_engine-0.4.11}/setup.py

@@ -14,7 +14,7 @@ if readme_file.exists():
 
 setup(
     name="mdb-engine",
-    version="0.4.8",
+    version="0.4.11",
     description="MongoDB Engine",
     long_description=long_description,
     long_description_content_type="text/markdown",