py2http 0.1.62__tar.gz → 0.1.63__tar.gz

{py2http-0.1.62 → py2http-0.1.63}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: py2http
-Version: 0.1.62
+Version: 0.1.63
 Summary: Declarative HTTP service entry point.
 Home-page: https://github.com/i2mint/py2http
 License: MIT

{py2http-0.1.62 → py2http-0.1.63}/py2http/service.py

@@ -16,6 +16,9 @@ Python functions, enabling developers to easily expose their functions as remote
 with minimal setup."""
 
 import inspect
+from collections import OrderedDict
+from collections.abc import MutableMapping
+from types import ModuleType
 from uuid import uuid4
 from aiohttp import web
 import asyncio
@@ -53,7 +56,146 @@ from py2http.schema_tools import (
 from py2http.util import TypeAsserter
 from py2http.constants import JSON_CONTENT_TYPE
 
-obj_store = {}
+# Maximum number of objects a class endpoint keeps alive; the least recently used
+# one is evicted beyond that. Pass ``obj_store=...`` in a handler to change it.
+# Note: this bounds the number of objects, not their size, and object ids are the
+# only access control (any client holding an id can use the object).
+DFLT_OBJ_STORE_MAX_SIZE = 1000
+
+
+class LRUObjStore(MutableMapping):
+    """A mapping that keeps at most ``max_size`` items, evicting the least recently
+    used one when a new key would exceed it.
+
+    Used as the default store of objects created through a class endpoint, so that
+    clients cannot grow server memory without bound by creating objects.
+
+    >>> s = LRUObjStore(max_size=2)
+    >>> s['a'], s['b'] = 1, 2
+    >>> _ = s['a']  # 'a' is now the most recently used
+    >>> s['c'] = 3
+    >>> sorted(s)
+    ['a', 'c']
+    """
+
+    def __init__(self, *, max_size: int = DFLT_OBJ_STORE_MAX_SIZE):
+        if max_size < 1:
+            raise ValueError(f"max_size must be at least 1, got {max_size}")
+        self.max_size = max_size
+        self._data = OrderedDict()
+
+    def __getitem__(self, k):
+        v = self._data[k]
+        self._data.move_to_end(k)
+        return v
+
+    def __setitem__(self, k, v):
+        self._data[k] = v
+        self._data.move_to_end(k)
+        while len(self._data) > self.max_size:
+            self._data.popitem(last=False)
+
+    def __delitem__(self, k):
+        del self._data[k]
+
+    def __iter__(self):
+        return iter(self._data)
+
+    def __len__(self):
+        return len(self._data)
+
+
+def public_attr(obj, attr_name: str) -> bool:
+    """The attribute policy ``attr_names='*'`` stands for: only public methods.
+
+    A name is dispatchable if it does not start with ``_`` and
+
+    - for a module: it is a function that the module defines (or lists in its
+      ``__all__``), never something it merely imports, nor plain data;
+    - otherwise: it is a plain Python function, ``staticmethod``,
+      ``classmethod`` or ``property`` defined in the object's class (or a base
+      class), and the instance does not shadow it.
+
+    This keeps private helpers, dunders (``__dict__``, ``__init__``, ...),
+    per-instance state (``__dict__`` entries, ``__slots__``, dataclass and
+    namedtuple fields) and callables merely assigned as class attributes
+    (``opener = open``) out of reach of HTTP clients.
+
+    Note that every public method is exposed, inherited ones included (e.g. a
+    pydantic model's ``model_dump``). For anything holding secrets, or a mapping
+    whose mutators should stay private (``MutableMapping`` mixins such as
+    ``clear`` and ``pop`` are plain functions), list the names explicitly instead.
+
+    >>> class A:
+    ...     data = 0
+    ...     opener = open
+    ...     def f(self): ...
+    ...     def _g(self): ...
+    ...     def __init__(self): self.secret = 1
+    >>> [public_attr(A(), name)
+    ...  for name in ('f', '_g', '__init__', '__dict__', 'secret', 'data', 'opener')]
+    [True, False, False, False, False, False, False]
+    """
+    if not isinstance(attr_name, str) or attr_name.startswith("_"):
+        return False
+    if isinstance(obj, ModuleType):
+        return _is_public_module_function(obj, attr_name)
+    try:  # (bypassing any class-level ``__dict__`` attribute)
+        instance_dict = object.__getattribute__(obj, "__dict__")
+    except AttributeError:
+        instance_dict = {}
+    if attr_name in instance_dict:
+        return False  # instance state, or an instance attribute shadowing a method
+    # Look in the class's MRO dicts only (not the metaclass: ``mro``, ...), and at
+    # the raw class attribute, not what the instance would return for it
+    for klass in type(obj).__mro__:
+        if attr_name in vars(klass):
+            return _is_method_like(vars(klass)[attr_name])
+    return False
+
+
+def _is_method_like(class_attr) -> bool:
+    if isinstance(class_attr, (staticmethod, classmethod)):
+        class_attr = class_attr.__func__
+    return isinstance(class_attr, (FunctionType, property))
+
+
+def _is_public_module_function(module: ModuleType, attr_name: str) -> bool:
+    value = vars(module).get(attr_name)
+    if not inspect.isfunction(value):
+        return False
+    exported = getattr(module, "__all__", None)
+    if exported is not None:
+        return attr_name in exported
+    return value.__module__ == module.__name__
+
+
+def unsafe_any_attr(obj, attr_name: str) -> bool:
+    """Dispatch ANY attribute of the object, including private ones and dunders.
+
+    This was the behaviour of ``attr_names='*'`` before ``public_attr``: it lets a
+    client read ``__dict__``, call ``__init__`` with arguments of its choosing, and so
+    on. Use ``attr_names=unsafe_any_attr`` only when every client is trusted.
+    """
+    return isinstance(attr_name, str) and hasattr(obj, attr_name)
+
+
+def _attr_name_policy(attr_names) -> Callable[[Any, str], bool]:
+    """Normalize a handler's ``attr_names`` into a ``(obj, attr_name) -> bool``
+    predicate: ``'*'`` means ``public_attr``, a callable is used as is, and an
+    iterable of names is an explicit allow-list (dunders included, if listed).
+    """
+    if attr_names == "*":
+        return public_attr
+    if callable(attr_names):
+        return attr_names
+    if isinstance(attr_names, str):
+        allowed = {attr_names}
+    else:
+        allowed = set(attr_names)
+    return lambda obj, attr_name: (
+        isinstance(attr_name, str) and attr_name in allowed and hasattr(obj, attr_name)
+    )
 
 
 def method_not_found(method_name):
@@ -617,8 +759,12 @@ def _get_func_to_dispatch_handler(handler):
         return endpoint
         # was return endpoint, but then the output didn't get the __name__ = name
         # func = endpoint
+    is_dispatchable = _attr_name_policy(attr_names)
     if inspect.isclass(endpoint):
         cls = endpoint
+        obj_store = handler.get("obj_store")
+        if obj_store is None:
+            obj_store = LRUObjStore()
 
         def func(_obj_id=None, _attr_name=None, **kwargs):
             if _obj_id is None:
@@ -628,25 +774,24 @@ def _get_func_to_dispatch_handler(handler):
                 new_id = str(uuid4())
                 obj_store[new_id] = new_obj
                 return new_id
-            obj = obj_store.get(_obj_id)
-            if not obj:
+            obj = obj_store.get(_obj_id) if isinstance(_obj_id, str) else None
+            if obj is None:
                 raise InputError(f"No object found with id {_obj_id}")
             if _attr_name is None:
                 raise InputError("_attr_name must be provided when _obj_id is not None")
-            return _get_attr_value(obj, _attr_name, attr_names, **kwargs)
+            return _get_attr_value(obj, _attr_name, is_dispatchable, **kwargs)
 
     else:
 
         def func(_attr_name=None, **kwargs):
-            return _get_attr_value(endpoint, _attr_name, attr_names, **kwargs)
+            return _get_attr_value(endpoint, _attr_name, is_dispatchable, **kwargs)
 
     func.__name__ = name
     return func
 
 
-def _get_attr_value(obj, attr_name, valid_attr_names, **kwargs):
-    valid_attr_names = [attr_name] if valid_attr_names == "*" else valid_attr_names
-    if attr_name not in valid_attr_names or not hasattr(obj, attr_name):
+def _get_attr_value(obj, attr_name, is_dispatchable, /, **kwargs):
+    if not is_dispatchable(obj, attr_name):
         raise InputError(
             f"No attribute found with name {attr_name} or it is not dispatched"
         )

py2http-0.1.63/py2http/tests/test_attr_dispatch.py

@@ -0,0 +1,284 @@
+"""Object/attribute dispatch (``attr_names``) only exposes what was meant to be exposed."""
+
+import pytest
+from i2.errors import InputError
+
+from py2http.service import (
+    LRUObjStore,
+    _get_func_to_dispatch_handler,
+    public_attr,
+    unsafe_any_attr,
+)
+
+
+class Counter:
+    def __init__(self, start: int = 0):
+        self.count = start
+        self._secret = "s3cr3t"
+
+    def incr(self, by: int = 1):
+        self.count += by
+        return self.count
+
+    def _reset(self):
+        self.count = 0
+
+
+def _dispatcher(endpoint, attr_names, **handler_extras):
+    return _get_func_to_dispatch_handler(
+        dict(endpoint=endpoint, name="ep", attr_names=attr_names, **handler_extras)
+    )
+
+
+@pytest.mark.parametrize(
+    "attr_name", ["_reset", "_secret", "__dict__", "__init__", "__class__", "count"]
+)
+def test_star_refuses_private_dunder_and_instance_attrs(attr_name):
+    obj = Counter(5)
+    func = _dispatcher(obj, "*")
+    with pytest.raises(InputError):
+        func(_attr_name=attr_name)
+    assert obj.count == 5
+
+
+def test_star_allows_public_methods():
+    func = _dispatcher(Counter(5), "*")
+    assert func(_attr_name="incr", by=2) == 7
+
+
+def test_star_on_class_endpoint():
+    func = _dispatcher(Counter, "*")
+    obj_id = func(start=3)
+    assert func(_obj_id=obj_id, _attr_name="incr") == 4
+    for attr_name in ("__init__", "__dict__", "_secret", "mro"):
+        with pytest.raises(InputError):
+            func(_obj_id=obj_id, _attr_name=attr_name)
+
+
+def test_explicit_list_unaffected():
+    """An explicit allow-list may name dunders on purpose (see examples/object_dispatch)."""
+
+    class Store(dict):
+        def __getitem__(self, key):
+            return super().__getitem__(key)
+
+    d = Store(a=1)
+    func = _dispatcher(d, ["__getitem__", "__len__"])
+    assert func(_attr_name="__getitem__", key="a") == 1
+    assert func(_attr_name="__len__") == 1
+    with pytest.raises(InputError):
+        func(_attr_name="clear")
+    with pytest.raises(InputError):
+        func(_attr_name="__dict__")
+    assert d == {"a": 1}
+
+
+def test_unsafe_any_attr_opt_in_restores_old_behaviour():
+    obj = Counter(5)
+    func = _dispatcher(obj, unsafe_any_attr)
+    func(_attr_name="_reset")
+    assert obj.count == 0
+
+
+def test_custom_predicate():
+    func = _dispatcher(Counter(1), lambda obj, name: name == "incr")
+    assert func(_attr_name="incr") == 2
+
+
+def test_public_attr_on_module():
+    import json
+
+    assert public_attr(json, "dumps")
+    assert not public_attr(json, "_default_encoder")
+    assert not public_attr(json, "__loader__")
+
+
+def test_obj_store_is_bounded():
+    store = LRUObjStore(max_size=2)
+    func = _dispatcher(Counter, "*", obj_store=store)
+    ids = [func(start=i) for i in range(3)]
+    assert len(store) == 2
+    with pytest.raises(InputError, match="No object found"):
+        func(_obj_id=ids[0], _attr_name="incr")
+    assert func(_obj_id=ids[2], _attr_name="incr") == 3
+
+
+def test_obj_store_default_is_bounded_lru():
+    func = _dispatcher(Counter, "*")
+    obj_id = func()
+    assert func(_obj_id=obj_id, _attr_name="incr") == 1
+
+
+def test_falsy_object_is_still_found():
+    func = _dispatcher(list, ["append", "__len__"])
+    obj_id = func()  # an empty list is falsy
+    assert func(_obj_id=obj_id, _attr_name="__len__") == 0
+
+
+def test_lru_obj_store_rejects_bad_size():
+    with pytest.raises(ValueError):
+        LRUObjStore(max_size=0)
+
+
+# --- shapes found by the adversarial review: instance state must stay private ---
+
+from dataclasses import dataclass
+from types import ModuleType
+from typing import NamedTuple
+
+
+class Slotted:
+    __slots__ = ("token",)
+
+    def __init__(self):
+        self.token = "TOK"
+
+    def ping(self):
+        return "pong"
+
+
+@dataclass
+class DC:
+    token: str = "default"
+
+    def ping(self):
+        return "pong"
+
+
+class NT(NamedTuple):
+    token: str
+
+    def ping(self):
+        return "pong"
+
+
+class Odd:
+    count = 0
+    opener = open
+    Nested = dict
+
+    def __init__(self):
+        self.count = 42
+        self.incr = lambda: "shadowed"
+
+    def incr(self):
+        return "real"
+
+    @staticmethod
+    def s():
+        return "static"
+
+    @classmethod
+    def c(cls):
+        return "class"
+
+    @property
+    def p(self):
+        return "prop"
+
+
+@pytest.mark.parametrize(
+    "obj", [Slotted(), DC(token="TOK"), NT(token="TOK")], ids=["slots", "dc", "nt"]
+)
+def test_star_refuses_fields(obj):
+    func = _dispatcher(obj, "*")
+    with pytest.raises(InputError):
+        func(_attr_name="token")
+    assert func(_attr_name="ping") == "pong"
+
+
+@pytest.mark.parametrize("attr_name", ["count", "opener", "Nested", "incr"])
+def test_star_refuses_data_shadowed_and_assigned_callables(attr_name):
+    func = _dispatcher(Odd(), "*")
+    with pytest.raises(InputError):
+        func(_attr_name=attr_name)
+
+
+def test_star_allows_static_class_methods_and_properties():
+    func = _dispatcher(Odd(), "*")
+    assert [func(_attr_name=n) for n in ("s", "c", "p")] == ["static", "class", "prop"]
+
+
+def test_star_refuses_builtin_mapping_mutators():
+    class Store(dict):
+        def keys_list(self):
+            return list(self)
+
+    d = Store(a=1)
+    func = _dispatcher(d, "*")
+    with pytest.raises(InputError):
+        func(_attr_name="clear")
+    assert func(_attr_name="keys_list") == ["a"] and d == {"a": 1}
+
+
+def _mk_module(name, *, all_=None):
+    mod = ModuleType(name)
+    exec(
+        "from os import listdir\nfrom json import dumps\nimport os\nAPI_KEY = 'k-123'\n"
+        "def hello():\n    return 'hi'\n",
+        vars(mod),
+    )
+    if all_ is not None:
+        mod.__all__ = all_
+    return mod
+
+
+@pytest.mark.parametrize("attr_name", ["listdir", "dumps", "os", "API_KEY"])
+def test_star_on_module_refuses_imports_and_data(attr_name):
+    func = _dispatcher(_mk_module("some_service"), "*")
+    with pytest.raises(InputError):
+        func(_attr_name=attr_name)
+    assert func(_attr_name="hello") == "hi"
+
+
+def test_star_on_module_honours_all():
+    mod = _mk_module("some_service", all_=["dumps", "listdir"])
+    assert public_attr(mod, "dumps")  # a re-export listed in __all__
+    assert not public_attr(mod, "listdir")  # listed, but not a Python function
+    assert not public_attr(mod, "hello")  # not listed
+
+
+@pytest.mark.parametrize("bad", [["x"], {"a": 1}, 3, None])
+def test_non_str_names_and_ids_are_input_errors(bad):
+    func = _dispatcher({"x": 1}, ["x", "__len__"])
+    if bad is not None:
+        with pytest.raises(InputError):
+            func(_attr_name=bad)
+    cls_func = _dispatcher(Counter, "*")
+    with pytest.raises(InputError):
+        cls_func(_obj_id=bad if bad is not None else [], _attr_name="incr")
+
+
+def test_method_params_named_like_dispatch_internals():
+    class A:
+        def f(self, obj, attr_name, is_dispatchable):
+            return [obj, attr_name, is_dispatchable]
+
+    func = _dispatcher(A(), "*")
+    assert func(_attr_name="f", obj=1, attr_name=2, is_dispatchable=3) == [1, 2, 3]
+
+
+def test_star_exposes_mutable_mapping_mixins_as_documented():
+    """Inherited public Python methods ARE dispatched: use an explicit list for stores."""
+    from collections.abc import MutableMapping
+
+    class MM(MutableMapping):
+        def __init__(self):
+            self._d = {"a": 1}
+
+        def __getitem__(self, k):
+            return self._d[k]
+
+        def __setitem__(self, k, v):
+            self._d[k] = v
+
+        def __delitem__(self, k):
+            del self._d[k]
+
+        def __iter__(self):
+            return iter(self._d)
+
+        def __len__(self):
+            return len(self._d)
+
+    assert public_attr(MM(), "clear")

{py2http-0.1.62 → py2http-0.1.63}/py2http.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: py2http
-Version: 0.1.62
+Version: 0.1.63
 Summary: Declarative HTTP service entry point.
 Home-page: https://github.com/i2mint/py2http
 License: MIT

{py2http-0.1.62 → py2http-0.1.63}/py2http.egg-info/SOURCES.txt

@@ -33,6 +33,7 @@ py2http/tests/__init__.py
 py2http/tests/example_service_test.py
 py2http/tests/objects_for_testing.py
 py2http/tests/simple_run_process_test.py
+py2http/tests/test_attr_dispatch.py
 py2http/tests/test_binary_req.py
 py2http/tests/test_decorators.py
 py2http/tests/test_flask.py

{py2http-0.1.62 → py2http-0.1.63}/setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 name = py2http
-version = 0.1.62
+version = 0.1.63
 url = https://github.com/i2mint/py2http
 root_url = https://github.com/i2mint
 platforms = any