plain 0.79.0__tar.gz → 0.81.0__tar.gz

{plain-0.79.0 → plain-0.81.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plain
-Version: 0.79.0
+Version: 0.81.0
 Summary: A web framework for building products with Python.
 Author-email: Dave Gaeddert <dave.gaeddert@dropseed.dev>
 License-File: LICENSE

{plain-0.79.0 → plain-0.81.0}/plain/CHANGELOG.md

@@ -1,5 +1,27 @@
 # plain changelog
 
+## [0.81.0](https://github.com/dropseed/plain/releases/plain@0.81.0) (2025-10-22)
+
+### What's changed
+
+- Removed support for category-specific error template fallbacks like `4xx.html` and `5xx.html` ([9513f7c4fa](https://github.com/dropseed/plain/commit/9513f7c4fa))
+
+### Upgrade instructions
+
+- If you have `4xx.html` or `5xx.html` error templates, rename them to specific status code templates (e.g., `404.html`, `500.html`) or remove them if you prefer the plain HTTP response fallback
+
+## [0.80.0](https://github.com/dropseed/plain/releases/plain@0.80.0) (2025-10-22)
+
+### What's changed
+
+- CSRF failures now raise `SuspiciousOperation` (HTTP 400) instead of `PermissionDenied` (HTTP 403) ([ad146bde3e](https://github.com/dropseed/plain/commit/ad146bde3e))
+- Error templates can now use category-specific fallbacks like `4xx.html` or `5xx.html` instead of the generic `error.html` ([716cfa3cfc](https://github.com/dropseed/plain/commit/716cfa3cfc))
+- Updated error template documentation with best practices for self-contained `500.html` templates ([55cea3b522](https://github.com/dropseed/plain/commit/55cea3b522))
+
+### Upgrade instructions
+
+- If you have a `templates/error.html` template, instead create specific error templates for each status code you want to customize (e.g., `400.html`, `403.html`, `404.html`, `500.html`). You can also create category-specific templates like `4xx.html` or `5xx.html` for broader coverage.
+
 ## [0.79.0](https://github.com/dropseed/plain/releases/plain@0.79.0) (2025-10-22)
 
 ### What's changed

{plain-0.79.0 → plain-0.81.0}/plain/csrf/middleware.py

@@ -5,7 +5,7 @@ from collections.abc import Callable
 from typing import TYPE_CHECKING
 from urllib.parse import urlparse
 
-from plain.exceptions import PermissionDenied
+from plain.exceptions import SuspiciousOperation
 from plain.http import HttpMiddleware
 from plain.runtime import settings
 
@@ -34,7 +34,7 @@ class CsrfViewMiddleware(HttpMiddleware):
         allowed, reason = self.should_allow_request(request)
 
         if not allowed:
-            raise PermissionDenied(reason)
+            raise SuspiciousOperation(reason)
 
         return self.get_response(request)
 

{plain-0.79.0 → plain-0.81.0}/plain/views/README.md

@@ -251,16 +251,17 @@ class ExampleView(DetailView):
 
 ## Error views
 
-HTTP errors are automatically rendered using templates. Create a template named `<status_code>.html` in your templates directory to customize the error page for that status code.
-
-For example:
+HTTP errors are rendered using templates. Create templates for the errors users actually see:
 
 - `templates/404.html` - Page not found
 - `templates/403.html` - Forbidden
 - `templates/500.html` - Server error
-- `templates/error.html` - Generic fallback for all errors
 
-The templates receive a context with `status_code` and `exception` variables.
+Plain looks for `{status_code}.html` templates, then returns a plain HTTP response if not found. Most apps only need the three specific templates above.
+
+Templates receive `status_code` and `exception` in context.
+
+**Note:** `500.html` should be self-contained - avoid extending base templates or accessing database/session, since server errors can occur during middleware or template rendering. `404.html` and `403.html` can safely extend base templates since they occur during view execution after middleware runs.
 
 ## Redirect views
 

{plain-0.79.0 → plain-0.81.0}/plain/views/errors.py

@@ -29,7 +29,8 @@ class ErrorView(TemplateView):
         return context
 
     def get_template_names(self) -> list[str]:
-        return [f"{self.status_code}.html", "error.html"]
+        # Try specific status code template (e.g. "404.html")
+        return [f"{self.status_code}.html"]
 
     def get_request_handler(self) -> Callable[[], Any]:
         return self.get  # All methods (post, patch, etc.) will use the get()

{plain-0.79.0 → plain-0.81.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "plain"
-version = "0.79.0"
+version = "0.81.0"
 description = "A web framework for building products with Python."
 authors = [{name = "Dave Gaeddert", email = "dave.gaeddert@dropseed.dev"}]
 readme = "README.md"

{plain-0.79.0 → plain-0.81.0}/tests/test_csrf.py

@@ -315,10 +315,10 @@ def test_request_factory_naturally_bypasses_csrf():
 
 
 def test_middleware_integration_rejected_request():
-    """Rejected requests should raise PermissionDenied without calling next."""
+    """Rejected requests should raise SuspiciousOperation without calling next."""
     from unittest.mock import Mock
 
-    from plain.exceptions import PermissionDenied
+    from plain.exceptions import SuspiciousOperation
 
     rf = RequestFactory()
     mock_get_response = Mock()
@@ -326,8 +326,8 @@ def test_middleware_integration_rejected_request():
 
     request = rf.post("/test/", headers={"Origin": "https://attacker.com"})
 
-    # Should raise PermissionDenied
-    with pytest.raises(PermissionDenied) as exc_info:
+    # Should raise SuspiciousOperation
+    with pytest.raises(SuspiciousOperation) as exc_info:
         csrf_middleware.process_request(request)
 
     # Should not call next middleware