metaobjects 1.2.0__tar.gz → 1.2.1__tar.gz

{metaobjects-1.2.0 → metaobjects-1.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: metaobjects
-Version: 1.2.0
+Version: 1.2.1
 Summary: Cross-language metadata standard: declare typed entities once, generate idiomatic drift-checked code across languages — Python port.
 Project-URL: Homepage, https://metaobjects.dev
 Project-URL: Repository, https://github.com/metaobjectsdev/metaobjects

{metaobjects-1.2.0 → metaobjects-1.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "metaobjects"
-version = "1.2.0"
+version = "1.2.1"
 description = "Cross-language metadata standard: declare typed entities once, generate idiomatic drift-checked code across languages — Python port."
 readme = "README.md"
 requires-python = ">=3.11"

{metaobjects-1.2.0 → metaobjects-1.2.1}/src/metaobjects/codegen/KNOWN_GAPS.md

@@ -36,9 +36,9 @@ The generated router takes `dto: dict[str, Any]` for `POST` / `PATCH` /
 (`from .<Entity> import <Entity>, <Entity>Patch`) and constructs them to enforce
 field constraints over HTTP — POST validates `<Entity>(**dto)`, PATCH validates
 the all-optional `<Entity>Patch(**dto)` (present values only) → `400 {"error":"validation"}`.
-The repository seam still receives the original `dict` (preserving the FR-035
-present-key tristate + wire values), so the strong-typing simplification below
-remains for the repo/response types; only the validation import was added.
+The repository seam receives only the keys the input model validated, as a `dict`
+(the FR-035 present-key tristate + wire values are kept), so the strong-typing
+simplification below remains for the repo/response types.
 
 This keeps the router module decoupled from sibling generated files
 (the entity-model generator emits one `@dataclass`/Pydantic model per

{metaobjects-1.2.0 → metaobjects-1.2.1}/src/metaobjects/codegen/generators/router_generator.py

@@ -434,10 +434,9 @@ def _frozen_names(entity: MetaObject) -> list[str]:
 
     ADR-0045: the OUTERMOST generated write artifact enforces the mode, and for
     FastAPI that is the ROUTER, not the ``<Entity>Patch`` model — the handler binds
-    ``dto`` (the raw body as a dict) and passes THAT to the repository, so a
-    field merely absent from the patch model still reaches the row. @autoSet gets
-    away with it because the router OVERWRITES its key server-side; a writeOnce
-    field has no server value to overwrite, so it must be popped explicitly."""
+    ``dto`` as a dict. Since 1.2.1 the router hands the repository only the keys the
+    patch model validated (:func:`_validated_input_lines`), which already drops these;
+    the explicit pop stays as the FR-037 seam an owned router edits."""
     return [
         f.name
         for f in entity.fields()
@@ -461,6 +460,49 @@ def _frozen_strip_lines(entity: MetaObject, indent: str = "    ") -> list[str]:
     ]
 
 
+#: 1.2.1 security fix. The request body cut down to what the input model validated, emitted
+#: once per writable router. 1.2.0 validated the body and then handed the RAW body to the
+#: repository, so a client-sent server-generated id, a ``readOnly`` field or a name the entity
+#: does not declare (an ``isAdmin``) reached the write. Pydantic ignores a key a model does not
+#: declare, and the input models leave out every field a client may not set, so keeping only
+#: the keys the model validated (at every depth: a nested value object included) drops all of
+#: them silently, as the TypeScript routes do. The values stay the body's own (decimal-exact)
+#: values, so a repository receives the same value types as in 1.2.0.
+_VALIDATED_INPUT_LINES: list[str] = [
+    "def _validated_input(valid: BaseModel, raw: dict[str, Any]) -> dict[str, Any]:",
+    '    """GENERATED — *raw* cut down to the keys *valid* validated, at every depth. A key the',
+    "    input model does not declare (an undeclared name, a server-generated id, a readOnly field)",
+    '    is dropped silently and never reaches the repository; values stay the body\'s own."""',
+    "    return {_k: _validated_value(getattr(valid, _k), raw[_k]) for _k in valid.model_fields_set}",
+    "",
+    "",
+    "def _validated_value(valid: Any, raw: Any) -> Any:",
+    "    if isinstance(valid, BaseModel) and isinstance(raw, dict):",
+    "        return _validated_input(valid, raw)",
+    "    if isinstance(valid, list) and isinstance(raw, list):",
+    "        return [_validated_value(v, r) for v, r in zip(valid, raw)]",
+    "    if isinstance(valid, dict) and isinstance(raw, dict):",
+    "        return {k: _validated_value(v, raw[k]) for k, v in valid.items() if k in raw}",
+    "    return raw",
+]
+
+
+def _validated_input_lines(model: str, *comment: str) -> list[str]:
+    """Validate ``dto`` against the input *model*, then rebind it to what the model validated
+    (see :data:`_VALIDATED_INPUT_LINES`): the repository never sees any other key."""
+    return [
+        *(f"    # {line}" for line in comment),
+        "    try:",
+        f"        _valid = {model}(**dto)",
+        "    except ValidationError:",
+        '        return JSONResponse(status_code=400, content={"error": "validation"})',
+        "    # SECURITY (1.2.1): only what the input model validated reaches the repository. A key",
+        "    # it does not declare (an undeclared name, a server-generated id, a readOnly or derived",
+        "    # field, a frozen one on update) is dropped silently, never 400'd.",
+        "    dto = _validated_input(_valid, dto)",
+    ]
+
+
 def _auto_set_split(entity: MetaObject) -> tuple[list[MetaField], list[MetaField]]:
     """The entity's ``@autoSet`` temporal fields split into ``(onCreate, onUpdate)``.
 
@@ -1083,12 +1125,11 @@ class RouterGenerator:
                 ") -> Any:",
                 *_DECIMAL_COERCE,
                 *denied_strip,
-                "    # FR-036: run the generated field constraints (length / pattern /",
-                "    # numeric bounds) before persisting; a violation is the cross-port 400.",
-                "    try:",
-                f"        {model_name}(**dto)",
-                "    except ValidationError:",
-                '        return JSONResponse(status_code=400, content={"error": "validation"})',
+                *_validated_input_lines(
+                    model_name,
+                    "FR-036: run the generated field constraints (length / pattern /",
+                    "numeric bounds) before persisting; a violation is the cross-port 400.",
+                ),
                 # #203/ADR-0045: the generated router (the API surface) stamps @autoSet columns
                 # ABOVE the consumer repo seam — onCreate + onUpdate both stamped from one instant
                 # (a fresh row's createdAt == updatedAt), ignoring any caller-supplied value.
@@ -1114,12 +1155,11 @@ class RouterGenerator:
                 "    for _k in _REQUIRED_FIELDS:",
                 "        if _k in dto and dto[_k] is None:",
                 '            return JSONResponse(status_code=400, content={"error": "validation"})',
-                "    # FR-036: validate PRESENT, non-null values with the create rules (the",
-                "    # all-optional patch model never fires required-checks on ABSENT fields).",
-                "    try:",
-                f"        {patch_model}(**dto)",
-                "    except ValidationError:",
-                '        return JSONResponse(status_code=400, content={"error": "validation"})',
+                *_validated_input_lines(
+                    patch_model,
+                    "FR-036: validate PRESENT, non-null values with the create rules (the",
+                    "all-optional patch model never fires required-checks on ABSENT fields).",
+                ),
                 # #203/ADR-0045: bump onUpdate @autoSet columns (server-owned) on EVERY patch,
                 # above the repo seam — a server-inserted present key (compatible with the PATCH
                 # present-key tristate); onCreate columns are never touched here.
@@ -1468,6 +1508,9 @@ class RouterGenerator:
         parts.extend(_JSON_BODY_LINES)
         parts.append("")
         parts.append("")
+        parts.extend(_VALIDATED_INPUT_LINES)
+        parts.append("")
+        parts.append("")
         # FR-037 R1 — the names a PATCH must never write. Emitted even when EMPTY so
         # the generated module always carries the seam (an entity that later gains a
         # writeOnce field changes one literal, not the module's shape).
@@ -1547,11 +1590,9 @@ class RouterGenerator:
             parts.append(") -> Any:")
             parts.extend(_DECIMAL_COERCE)
             parts.extend(denied_strip_tph)
-            parts.append("    # FR-036: run the subtype's field constraints before persisting.")
-            parts.append("    try:")
-            parts.append(f"        {sub}Create(**dto)")
-            parts.append("    except ValidationError:")
-            parts.append('        return JSONResponse(status_code=400, content={"error": "validation"})')
+            parts.extend(_validated_input_lines(
+                f"{sub}Create", "FR-036: run the subtype's field constraints before persisting."
+            ))
             # #203/ADR-0045: stamp @autoSet columns ABOVE the repo seam (empty for a
             # non-@autoSet hierarchy — byte-identical output).
             parts.extend(create_autoset)
@@ -1584,11 +1625,9 @@ class RouterGenerator:
             parts.append("    for _k in _REQUIRED_FIELDS:")
             parts.append("        if _k in dto and dto[_k] is None:")
             parts.append('            return JSONResponse(status_code=400, content={"error": "validation"})')
-            parts.append("    # FR-036: validate PRESENT, non-null values with the subtype's create rules.")
-            parts.append("    try:")
-            parts.append(f"        {sub}Patch(**dto)")
-            parts.append("    except ValidationError:")
-            parts.append('        return JSONResponse(status_code=400, content={"error": "validation"})')
+            parts.extend(_validated_input_lines(
+                f"{sub}Patch", "FR-036: validate PRESENT, non-null values with the subtype's create rules."
+            ))
             # #203/ADR-0045: pop the write-once onCreate column(s), bump onUpdate — ABOVE
             # the repo seam (empty for a non-@autoSet hierarchy — byte-identical output).
             parts.extend(update_autoset)
@@ -1857,6 +1896,9 @@ class RouterGenerator:
         parts.extend(_JSON_BODY_LINES)
         parts.append("")
         parts.append("")
+        parts.extend(_VALIDATED_INPUT_LINES)
+        parts.append("")
+        parts.append("")
         # FR-037 R1 — the names a PATCH must never write. Emitted even when EMPTY so
         # the generated module always carries the seam (an entity that later gains a
         # writeOnce field changes one literal, not the module's shape).
@@ -1892,8 +1934,8 @@ class RouterGenerator:
             create_autoset=create_autoset,
             update_autoset=update_autoset,
             # FR-037 R1 — ADR-0045: the ROUTER is the outermost write artifact for
-            # FastAPI (the handler binds the RAW body dict and hands THAT to the
-            # repository), so the strip has to live here, not in <Entity>Patch.
+            # FastAPI (the handler binds the body as a dict), so the strip lives here,
+            # not in <Entity>Patch.
             frozen_strip=_frozen_strip_lines(entity),
             denied_strip=_denied_strip_lines(denied_names),
         )

metaobjects-1.2.1/tests/integration/test_generated_router_validated_input.py

@@ -0,0 +1,272 @@
+"""1.2.1 security fix: a generated create / update hands the repository ONLY the validated input.
+
+The 1.2.0 router validated the request body against ``<Entity>Create`` / ``<Entity>Patch`` and
+then passed the RAW body to the repository. Pydantic ignores a key a model does not declare, and
+the input models leave out the server-owned fields, so a client-sent ``id``, a ``readOnly`` field
+and a made-up ``isAdmin`` all reached the write. Now the repository receives only what the input
+model validated, at every depth, as with the TypeScript routes: a name the entity does not
+declare, a server-generated id, a ``readOnly`` field and the id on update are all dropped
+silently. None of them is a 400: a client that sends an extra harmless field keeps working.
+
+The model is generated with the real Python codegen (``run_gen``: entity + filter-allowlist +
+routes), the emitted package is imported unmodified, and the only hand-written piece is a
+repository that records what it was handed. No database: the router is the artifact, as in the
+other generated-router lanes.
+"""
+from __future__ import annotations
+
+import importlib
+import json
+import sys
+import tempfile
+import uuid
+from pathlib import Path
+from typing import Any
+
+import pytest
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+from metaobjects import MetaDataLoader
+from metaobjects.codegen.config import GenConfig
+from metaobjects.codegen.generators.entity_model import entity_model
+from metaobjects.codegen.generators.filter_allowlist_generator import filter_allowlist_generator
+from metaobjects.codegen.generators.router_generator import router_generator
+from metaobjects.codegen.runner import run_gen
+
+from .generated_tph_app import build_generated_tph_app
+
+_META = {
+    "metadata.root": {
+        "package": "acme::secfix",
+        "children": [
+            {"object.value": {
+                "name": "Address",
+                "children": [
+                    {"field.string": {"name": "city", "@maxLength": 40}},
+                ],
+            }},
+            {"object.entity": {
+                "name": "Member",
+                "children": [
+                    {"source.rdb": {"@table": "members"}},
+                    {"field.long": {"name": "id"}},
+                    {"field.string": {"name": "name", "@required": True, "@maxLength": 80}},
+                    {"field.string": {"name": "role", "@maxLength": 20, "@mutability": "readOnly"}},
+                    {"field.string": {"name": "tenant", "@maxLength": 20, "@mutability": "writeOnce"}},
+                    {"field.object": {"name": "address", "@objectRef": "Address", "@storage": "jsonb"}},
+                    {"field.timestamp": {"name": "createdAt", "@autoSet": "onCreate"}},
+                    {"identity.primary": {"name": "id", "@fields": "id", "@generation": "increment"}},
+                ],
+            }},
+            {"object.entity": {
+                "name": "Account",
+                "children": [
+                    {"source.rdb": {"@table": "accounts"}},
+                    {"field.string": {"name": "code", "@maxLength": 20}},
+                    {"field.string": {"name": "label", "@maxLength": 80}},
+                    {"identity.primary": {"name": "code", "@fields": "code"}},
+                ],
+            }},
+        ],
+    }
+}
+
+
+class _RecordingRepo:
+    """The generated repository seam, recording every write it is handed."""
+
+    def __init__(self, pk: str) -> None:
+        self.pk = pk
+        self.writes: list[tuple[str, dict[str, Any]]] = []
+
+    def create(self, dto: Any) -> Any:
+        self.writes.append(("create", dict(dto)))
+        return {self.pk: 1, **dto}
+
+    def update(self, id: Any, dto: Any) -> Any | None:
+        self.writes.append(("update", dict(dto)))
+        return {self.pk: id, **dto}
+
+
+def _generate_package() -> str:
+    """Run the real Python codegen for ``_META`` into a temp package; return its name."""
+    meta_dir = Path(tempfile.mkdtemp(prefix="secfix-meta-"))
+    (meta_dir / "meta.json").write_text(json.dumps(_META))
+    loaded = MetaDataLoader.from_directory(str(meta_dir))
+    assert not loaded.errors, "; ".join(f"{e.code}: {e.message}" for e in loaded.errors)
+    pkg = f"secfix_{uuid.uuid4().hex[:8]}"
+    root = Path(tempfile.mkdtemp(prefix="secfix-gen-"))
+    run_gen(
+        GenConfig(out_dir=str(root / pkg)),
+        loaded.root,
+        generators=[entity_model(), filter_allowlist_generator(), router_generator()],
+    )
+    sys.path.insert(0, str(root))
+    return pkg
+
+
+_PKG = _generate_package()
+
+
+def _client(router_module: str, pk: str) -> tuple[TestClient, _RecordingRepo, str]:
+    mod = importlib.import_module(f"{_PKG}.{router_module}")
+    repo = _RecordingRepo(pk)
+    app = FastAPI()
+    app.include_router(mod.router)
+    app.dependency_overrides[mod.get_repository] = lambda: repo
+    return TestClient(app), repo, mod.router.prefix
+
+
+@pytest.fixture()
+def member() -> tuple[TestClient, _RecordingRepo, str]:
+    return _client("member_router", "id")
+
+
+@pytest.fixture()
+def account() -> tuple[TestClient, _RecordingRepo, str]:
+    return _client("account_router", "code")
+
+
+# --- the reported defect: a client-sent id and a made-up isAdmin reach the repository -------
+
+
+def test_create_never_hands_the_repository_a_client_id_or_an_undeclared_field(member) -> None:
+    client, repo, base = member
+    resp = client.post(base, json={"id": 999, "name": "Mallory", "isAdmin": True})
+    assert resp.status_code == 201, resp.text
+    [(op, written)] = repo.writes
+    assert op == "create"
+    assert set(written) == {"name", "createdAt"}  # createdAt is the router's own stamp
+    assert written["name"] == "Mallory"
+
+
+@pytest.mark.parametrize("method", ["PATCH", "PUT"])
+def test_update_never_hands_the_repository_an_undeclared_field(member, method: str) -> None:
+    client, repo, base = member
+    resp = client.request(method, f"{base}/1", json={"name": "M", "isAdmin": True})
+    assert resp.status_code == 200, resp.text
+    assert repo.writes == [("update", {"name": "M"})]
+
+
+def test_an_undeclared_key_inside_a_value_object_never_reaches_the_repository(member) -> None:
+    client, repo, base = member
+    resp = client.post(base, json={"name": "Mallory", "address": {"city": "Oslo", "isAdmin": True}})
+    assert resp.status_code == 201, resp.text
+    [(_op, written)] = repo.writes
+    assert written["address"] == {"city": "Oslo"}
+
+
+def test_a_malformed_value_on_a_settable_field_is_still_a_400(member) -> None:
+    client, repo, base = member
+    resp = client.post(base, json={"name": "x" * 81, "isAdmin": True})
+    assert resp.status_code == 400, resp.text
+    assert resp.json() == {"error": "validation"}
+    assert repo.writes == []
+
+
+# --- declared but not settable: dropped, never 400'd, and never handed to the repository ----
+
+
+def test_create_strips_the_client_id_and_a_read_only_field(member) -> None:
+    client, repo, base = member
+    resp = client.post(
+        base,
+        json={"id": 999, "name": "Mallory", "role": "admin", "tenant": "t1",
+              "address": {"city": "Oslo"}},
+    )
+    assert resp.status_code == 201, resp.text
+    [(op, written)] = repo.writes
+    assert op == "create"
+    # The server generates the id and owns `role`; `createdAt` is the router's own stamp.
+    assert set(written) == {"name", "tenant", "address", "createdAt"}
+    assert written["name"] == "Mallory"
+    assert written["tenant"] == "t1"  # writeOnce is settable on create
+    assert written["address"] == {"city": "Oslo"}
+
+
+@pytest.mark.parametrize("method", ["PATCH", "PUT"])
+def test_update_never_hands_the_repository_the_id_or_a_frozen_field(member, method: str) -> None:
+    client, repo, base = member
+    resp = client.request(
+        method,
+        f"{base}/1",
+        json={"id": 999, "name": "M2", "role": "admin", "tenant": "t2", "createdAt": "2000-01-01T00:00:00Z"},
+    )
+    assert resp.status_code == 200, resp.text
+    assert repo.writes == [("update", {"name": "M2"})]
+
+
+def test_update_passes_a_present_null_through_as_a_clear(member) -> None:
+    """The PATCH present-key tristate is unchanged: an explicit null on a nullable field clears it."""
+    client, repo, base = member
+    resp = client.patch(f"{base}/1", json={"address": None})
+    assert resp.status_code == 200, resp.text
+    assert repo.writes == [("update", {"address": None})]
+
+
+def test_an_assigned_key_is_still_the_callers_on_create_and_route_owned_on_update(account) -> None:
+    client, repo, base = account
+    created = client.post(base, json={"code": "ACME", "label": "Acme"})
+    assert created.status_code == 201, created.text
+    updated = client.patch(f"{base}/ACME", json={"code": "EVIL", "label": "Acme 2"})
+    assert updated.status_code == 200, updated.text
+    assert repo.writes == [
+        ("create", {"code": "ACME", "label": "Acme"}),
+        ("update", {"label": "Acme 2"}),
+    ]
+
+
+# --- TPH: the per-subtype create / update handlers are a separate code path -----------------
+
+
+def _find_tph_dir() -> Path:
+    cur = Path(__file__).resolve()
+    while cur != cur.parent:
+        candidate = cur / "fixtures" / "api-contract-conformance" / "tph"
+        if candidate.is_dir():
+            return candidate
+        cur = cur.parent
+    raise RuntimeError("fixtures/api-contract-conformance/tph not found")
+
+
+@pytest.fixture()
+def tph() -> tuple[TestClient, list[tuple[str, str, dict[str, Any]]]]:
+    app, repo = build_generated_tph_app(_find_tph_dir())
+    writes: list[tuple[str, str, dict[str, Any]]] = []
+    create, update = repo.create, repo.update
+
+    def recording_create(subtype: str, dto: Any) -> Any:
+        writes.append(("create", subtype, dict(dto)))
+        return create(subtype, dto)
+
+    def recording_update(subtype: str, id: int, dto: Any) -> Any:
+        writes.append(("update", subtype, dict(dto)))
+        return update(subtype, id, dto)
+
+    repo.create, repo.update = recording_create, recording_update
+    return TestClient(app), writes
+
+
+def test_tph_subtype_create_drops_the_client_id_and_an_undeclared_field(tph) -> None:
+    client, writes = tph
+    resp = client.post(
+        "/api/auths/bridge", json={"id": 999, "reference": "R-1", "quantity": 2, "isAdmin": True}
+    )
+    assert resp.status_code == 201, resp.text
+    [(op, subtype, written)] = writes
+    assert (op, subtype) == ("create", "Bridge")
+    assert "id" not in written
+    assert "isAdmin" not in written
+    assert {"reference", "quantity"} <= set(written)
+
+
+def test_tph_subtype_update_drops_the_id_and_an_undeclared_field(tph) -> None:
+    client, writes = tph
+    # The store is unseeded, so the answer is a 404; what matters is what the write was handed.
+    client.patch("/api/auths/bridge/1", json={"id": 999, "quantity": 3, "isAdmin": True})
+    [(op, subtype, written)] = writes
+    assert (op, subtype) == ("update", "Bridge")
+    assert "id" not in written
+    assert "isAdmin" not in written
+    assert written["quantity"] == 3

{metaobjects-1.2.0 → metaobjects-1.2.1}/uv.lock

@@ -399,7 +399,7 @@ wheels = [
 
 [[package]]
 name = "metaobjects"
-version = "1.2.0"
+version = "1.2.1"
 source = { editable = "." }
 dependencies = [
     { name = "pyyaml" },