py-app-runner 0.5.49.dev0__tar.gz → 0.5.50.dev0__tar.gz

py_app_runner-0.5.50.dev0/.version

@@ -0,0 +1 @@
+0.5.50.dev0

{py_app_runner-0.5.49.dev0/src/py_app_runner.egg-info → py_app_runner-0.5.50.dev0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: py_app_runner
-Version: 0.5.49.dev0
+Version: 0.5.50.dev0
 Summary: Async service framework: Tornado HTTP/WS bridge, service loader, Redis WS connection manager
 Author-email: Gints Murans <gm@gm.lv>
 License-Expression: MIT

{py_app_runner-0.5.49.dev0 → py_app_runner-0.5.50.dev0}/src/py_app_runner/request_handler/handlers.py

@@ -153,25 +153,15 @@ class RequestHandlerBase(web.RequestHandler):
         )
 
     def get_request_data(self, force_action: str | None = None) -> dict[str, Any]:
-        query_params = self.request.query_arguments
-        decoded_params: dict[str, Any] = {}
+        """The JSON body is the request. The URL may only name the action - anything else
+        in the query string would end up in access logs and caches as service input."""
+        request_data: dict[str, Any] = dict(self.json_args or {})
 
-        for k, v in query_params.items():
-            # Check if there's only one item in the list
-            if len(v) == 1:
-                decoded_params[k] = v[0].decode("utf-8")
-            else:
-                # Decode each item in the list
-                decoded_params[k] = [item.decode("utf-8") for item in v]
-
-        request_body = {}
-        if hasattr(self, "json_args") and self.json_args:
-            request_body = self.json_args
+        action = force_action or request_data.get("action") or self.get_query_argument("action", None)
+        if action:
+            request_data["action"] = action
 
-        if force_action:
-            request_body["action"] = force_action
-
-        return {**decoded_params, **request_body}
+        return request_data
 
     def error(
         self,
@@ -232,7 +222,7 @@ class RequestHandlerBase(web.RequestHandler):
             method,
             path,
             body_len,
-            args if isinstance(args, dict) else "<n/a>",  # type: ignore
+            redact_headers(args) if isinstance(args, dict) else "<n/a>",
         )
 
         # details go at DEBUG unless we're already warning/error, then use same level
@@ -270,12 +260,12 @@ class RequestHandlerBase(web.RequestHandler):
             await res
 
         # Debug
-        headers = dict(self.request.headers)
-        headers.pop("Authorization", None)
-
         self.logger.debug(f"Request: {self.request}")
-        self.logger.debug(f"Headers: {headers}")
-        self.logger.debug(f"Body: {self.request.body!r}")
+        self.logger.debug("Headers: %s", redact_headers(dict(self.request.headers)))
+        self.logger.debug(
+            "Body: %s",
+            format_body_for_log(self.request.body, max_chars=4000, shrink_strings_to=256, cap_list_items=50),
+        )
         self.logger.debug(f"Arguments: {self.request.arguments.keys()}")
 
         self._ensure_content_type()
@@ -458,9 +448,6 @@ class RequestHandlerApiKeys(RequestHandlerBase):
 
     async def has_valid_api_key(self, custom_api_key: str | None = None) -> str | Literal[True]:
         api_key: str | None = custom_api_key or self.request.headers.get("X-API-Key", None)  # type: ignore
-        if api_key is None:
-            api_key = self.get_argument("api_key", None)
-
         if api_key is None:
             return "API key is missing"
 

{py_app_runner-0.5.49.dev0 → py_app_runner-0.5.50.dev0}/src/py_app_runner/utils.py

@@ -278,15 +278,29 @@ async def run_blocking(fn: Callable[P, R], *args: P.args, **kwargs: P.kwargs) ->
     return await loop.run_in_executor(None, partial(fn, *args, **kwargs))
 
 
+SENSITIVE_KEY_MARKERS = (
+    "authorization",
+    "cookie",
+    "password",
+    "passwd",
+    "secret",
+    "token",
+    "api-key",
+    "api_key",
+    "apikey",
+    "credential",
+)
+
+
+def is_sensitive_key(name: Any) -> bool:
+    """Substring match on header names and JSON keys, so `X-Auth-Token`, `auth_token`,
+    `refresh_token` and `client_secret` are all caught without listing each one."""
+    lowered = str(name).lower()
+    return any(marker in lowered for marker in SENSITIVE_KEY_MARKERS)
+
+
 def redact_headers(headers: dict[str, Any]) -> dict[str, Any]:
-    redacted: dict[str, Any] = {}
-    for k, v in (headers or {}).items():
-        kl = str(k).lower()
-        if kl in ("authorization", "proxy-authorization", "cookie", "set-cookie", "x-api-key"):
-            redacted[k] = "<redacted>"
-        else:
-            redacted[k] = v
-    return redacted
+    return {k: ("<redacted>" if is_sensitive_key(k) else v) for k, v in (headers or {}).items()}
 
 
 def sha1_prefix(b: bytes, n: int = 12) -> str:
@@ -300,13 +314,16 @@ def sha256_hash(s: str) -> str:
 def shrink_json(obj: Any, *, max_string: int, max_items: int) -> Any:
     """
     Traverse JSON-like structures and:
+      - redact values under credential-looking keys (see is_sensitive_key),
       - truncate any string longer than max_string (base64-aware summary),
       - cap lists to max_items with a "… N more items" marker,
       - leave numbers/bools/None untouched.
-    No key-based assumptions.
     """
     if isinstance(obj, dict):
-        return {k: shrink_json(v, max_string=max_string, max_items=max_items) for k, v in obj.items()}
+        return {
+            k: ("<redacted>" if is_sensitive_key(k) else shrink_json(v, max_string=max_string, max_items=max_items))
+            for k, v in obj.items()
+        }
     if isinstance(obj, list):
         trimmed = [shrink_json(x, max_string=max_string, max_items=max_items) for x in obj[:max_items]]
         if len(obj) > max_items:

{py_app_runner-0.5.49.dev0 → py_app_runner-0.5.50.dev0/src/py_app_runner.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: py_app_runner
-Version: 0.5.49.dev0
+Version: 0.5.50.dev0
 Summary: Async service framework: Tornado HTTP/WS bridge, service loader, Redis WS connection manager
 Author-email: Gints Murans <gm@gm.lv>
 License-Expression: MIT

{py_app_runner-0.5.49.dev0 → py_app_runner-0.5.50.dev0}/src/py_app_runner.egg-info/SOURCES.txt

@@ -78,6 +78,7 @@ src/py_app_runner/wbcm/device_connections.py
 src/py_app_runner/wbcm/factory.py
 src/py_app_runner/wbcm/wb_connection_manager.py
 src/py_app_runner/wbcm/ws_interface.py
+tests/test_api_handler.py
 tests/test_api_keys.py
 tests/test_audit_diff.py
 tests/test_audit_store.py

py_app_runner-0.5.50.dev0/tests/test_api_handler.py

@@ -0,0 +1,68 @@
+from tornado.testing import AsyncHTTPTestCase
+from tornado.web import Application
+
+from py_app_runner.http_exception import HTTPException
+from py_app_runner.registry import AppRegistry
+from py_app_runner.utils import json_encode
+
+from .api_harness import FakeService, make_api_app
+
+API_KEY = "top-secret-key"
+
+
+class TestApiHandlerInput(AsyncHTTPTestCase):
+    def get_app(self) -> Application:
+        AppRegistry.configure(
+            config={"environment": "test", "debug": False, "api": {"key": API_KEY}, "jwt": {"secret": "jwt-secret"}},
+            users_model=object,
+            api_keys_model=object,
+        )
+        self.echo = FakeService(result={"status": "ok"})
+        self.guarded = FakeService(result={"status": "ok"}, requires_api_key=None)
+        self.rejecting = FakeService(error=HTTPException("bad credentials", code=-401, http_status=401))
+        return make_api_app({"echo": self.echo, "guarded": self.guarded, "rejecting": self.rejecting})
+
+    def test_credentials_never_reach_the_logs(self):
+        # Every HTTPException logs the headers and the full body at WARNING, so a failed
+        # login would otherwise write the password and the caller's tokens to the log.
+        body = {
+            "action": "login",
+            "auth_token": "token-in-body",
+            "data": {"email": "a@b.c", "password": "hunter2"},
+        }
+        headers = {
+            "Content-Type": "application/json",
+            "Authorization": "Bearer token-in-authorization",
+            "X-Auth-Token": "token-in-custom-header",
+            "X-Api-Secret": "secret-in-custom-header",
+            "X-API-Key": API_KEY,
+        }
+        with self.assertLogs("py_app_runner", level="DEBUG") as captured:
+            response = self.fetch("/api/rejecting", method="POST", body=json_encode(body), headers=headers)
+
+        assert response.code == 401
+        logged = "\n".join(captured.output)
+        for secret in (
+            "hunter2",
+            "token-in-body",
+            "token-in-authorization",
+            "token-in-custom-header",
+            "secret-in-custom-header",
+            API_KEY,
+        ):
+            assert secret not in logged, secret
+        # Redaction is targeted, not a blanket suppression of the body.
+        assert "login" in logged
+
+    def test_api_key_is_read_from_the_header_only(self):
+        # A key in the query string lands in proxy access logs and Referer headers.
+        assert self.fetch(f"/api/guarded?action=go&api_key={API_KEY}").code == 401
+        assert self.fetch("/api/guarded?action=go", headers={"X-API-Key": API_KEY}).code == 200
+
+    def test_query_parameters_are_not_service_input(self):
+        # Only the JSON body feeds the service. A `data` from the URL is a bare string
+        # that no handler expecting a dict can use, and URLs get logged and cached.
+        response = self.fetch("/api/echo?action=go&data=from-url&extra=1")
+
+        assert response.code == 200
+        assert self.echo.calls == [("go", {})]

{py_app_runner-0.5.49.dev0 → py_app_runner-0.5.50.dev0}/tests/test_error_envelope.py

@@ -7,6 +7,9 @@ from py_app_runner.http_exception import HTTPException
 from py_app_runner.registry import AppRegistry
 from py_app_runner.utils import json_decode
 
+from .api_harness import FakeService
+from .api_harness import make_api_app as _make_api_app
+
 
 def make_app() -> Application:
     from py_app_runner.request_handler.handlers import WebHandlerBase
@@ -32,39 +35,15 @@ def make_app() -> Application:
     )
 
 
-class FakeService:
-    """Stands in for a services.<name>._service_pybridge module."""
-
-    requires_api_key = False
-
-    def __init__(self, result: Any = None, error: Exception | None = None):
-        self.result = result
-        self.error = error
-
-    async def bridge_request(self, action: str, request_data: dict[str, Any], bridge_handler: Any) -> Any:
-        if self.error is not None:
-            raise self.error
-        return self.result
-
-
 def make_api_app() -> Application:
-    from py_app_runner.bridge.api import ApiHandler
-    from py_app_runner.pybridge import PyBridge
-    from py_app_runner.request_handler.handlers import WebApplicationBase
-
-    class ApiApplication(WebApplicationBase):
-        pass
-
-    app = ApiApplication([(r"/api/([^/]+)", ApiHandler)])
-
-    pybridge = PyBridge()
-    pybridge.cache_service("boom", FakeService(error=RuntimeError("service exploded")))
-    pybridge.cache_service("known", FakeService(error=HTTPException("nope", code=-7, http_status=403)))
-    pybridge.cache_service("fine", FakeService(result={"status": "ok"}))
-    pybridge.cache_service("silent", FakeService(result=None))
-    app.set_pybridge(pybridge)
-
-    return app
+    return _make_api_app(
+        {
+            "boom": FakeService(error=RuntimeError("service exploded")),
+            "known": FakeService(error=HTTPException("nope", code=-7, http_status=403)),
+            "fine": FakeService(result={"status": "ok"}),
+            "silent": FakeService(result=None),
+        }
+    )
 
 
 class TestApiHandlerStatus(AsyncHTTPTestCase):

py_app_runner-0.5.49.dev0/.version

@@ -1 +0,0 @@
-0.5.49.dev0