python-ddd-framework 0.7.2__tar.gz → 0.8.0__tar.gz

{python_ddd_framework-0.7.2 → python_ddd_framework-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-ddd-framework
-Version: 0.7.2
+Version: 0.8.0
 Summary: Modular DDD application framework with project CLI and bundled templates
 License-Expression: LicenseRef-Proprietary
 License-File: LICENSE
@@ -169,6 +169,8 @@ Open **http://127.0.0.1:8000/docs**. Use the generated `identity.seed_admin_user
 
 The empty `orders` skeleton contributes no business routes. The independent [order-management example](examples/order_management/README.md) supplies `/api/orders`, approval and queued approval, file transfer, and an authenticated WebSocket at `/ws/orders`; use its initializer when you want to explore those capabilities.
 
+For C++ computation, the independent [native integration example](examples/native_integration/README.md) demonstrates an installed nanobind package, typed application-service consumption, cancellation cleanup, source rebuilds, and artifact delivery. It is outside the runtime wheel and does not change the CLI or default templates. Verified platforms and remaining limits are recorded in [status](docs/status.md#c-原生接入样例).
+
 The default business API prefix is `/api`. Liveness and readiness are exposed at `/health/live` and `/health/ready`; readiness describes application lifecycle state, not continuous database or Redis health.
 
 ## CLI reference
@@ -312,12 +314,26 @@ New `ddd` modules contain the full responsibility directories and necessary comp
 
 See the [migration guide](docs/development.md#数据库聚合与迁移) and [verification record](docs/status.md#http-回收与迁移来源判定未发布).
 
+## Settings policies (0.8.0)
+
+`SettingDefinition` now accepts `allowed_sources`, `management_access`, `read_permission`, and `write_permission`. Existing definitions retain their source order and management visibility. Generic update/reset now also require `settings.read`, in addition to `settings.write` and any declared per-setting permissions, because their responses contain the saved setting snapshot. Update roles that previously held only write permission.
+
+Before excluding `CONFIGURATION` for a setting, remove its entries from YAML, environment variables, dotenv, CLI, explicit configuration and module configuration defaults: composition rejects forbidden inputs even when another value masks them. `HIDDEN` and `READ_ONLY` restrict generic management; internal readers and dedicated application services can still use the existing Provider/Manager subject to source, type and version rules. Defining a per-setting permission does not grant it to existing users or roles; update grants through the application's authorization system. No database migration or dependency change is required for this extension.
+
+Version 0.8.0 includes these policies. Follow [Settings setup and usage](docs/development.md#settings-策略与使用) for definition discovery, permission declarations, internal Provider/Manager calls, and HTTP update/reset with version tokens. The [contract](docs/architecture.md#typed-cache-与-settings) owns the rules; [validation evidence](docs/status.md#settings-最小策略扩展) separates implementation results from the later read-only review.
+
 ## Invocation performance (0.7.2)
 
 Function calls avoid regenerating DI wrappers, empty extension chains skip unnecessary work, and completed filter/interceptor chains release execution references sooner. Managed declaration checks continue to detect dynamic method and policy changes.
 
 Public APIs, DI scopes, authorization, validation, Unit of Work, exception and cancellation behavior are unchanged. No application-code, configuration or data migration is required. Follow the existing [upgrade procedure](#upgrading); validation evidence and performance limits are recorded in [release status](docs/status.md#当前发布).
 
+## Native C++ integration example (0.7.3)
+
+The repository's [native integration example](examples/native_integration/README.md) demonstrates a separately installed nanobind package, Eigen computation, typed service/HTTP consumption, cancellation cleanup, and wheel/sdist and Docker delivery. Its development entry rebuilds declared native path dependencies before starting the existing Host. The example and its native binaries are maintained outside the framework runtime wheel.
+
+Existing applications need no code, configuration, dependency or data migration. Adopt the example from the source checkout when adding native computation; the CLI, default templates and framework lifecycle contracts are unchanged. Platform evidence and remaining limits are recorded in [release status](docs/status.md#当前发布).
+
 <a id="streaming-and-access-migration-07-unreleased"></a>
 
 ## Streaming and access migration (0.7)

{python_ddd_framework-0.7.2 → python_ddd_framework-0.8.0}/README.md

@@ -125,6 +125,8 @@ Open **http://127.0.0.1:8000/docs**. Use the generated `identity.seed_admin_user
 
 The empty `orders` skeleton contributes no business routes. The independent [order-management example](examples/order_management/README.md) supplies `/api/orders`, approval and queued approval, file transfer, and an authenticated WebSocket at `/ws/orders`; use its initializer when you want to explore those capabilities.
 
+For C++ computation, the independent [native integration example](examples/native_integration/README.md) demonstrates an installed nanobind package, typed application-service consumption, cancellation cleanup, source rebuilds, and artifact delivery. It is outside the runtime wheel and does not change the CLI or default templates. Verified platforms and remaining limits are recorded in [status](docs/status.md#c-原生接入样例).
+
 The default business API prefix is `/api`. Liveness and readiness are exposed at `/health/live` and `/health/ready`; readiness describes application lifecycle state, not continuous database or Redis health.
 
 ## CLI reference
@@ -268,12 +270,26 @@ New `ddd` modules contain the full responsibility directories and necessary comp
 
 See the [migration guide](docs/development.md#数据库聚合与迁移) and [verification record](docs/status.md#http-回收与迁移来源判定未发布).
 
+## Settings policies (0.8.0)
+
+`SettingDefinition` now accepts `allowed_sources`, `management_access`, `read_permission`, and `write_permission`. Existing definitions retain their source order and management visibility. Generic update/reset now also require `settings.read`, in addition to `settings.write` and any declared per-setting permissions, because their responses contain the saved setting snapshot. Update roles that previously held only write permission.
+
+Before excluding `CONFIGURATION` for a setting, remove its entries from YAML, environment variables, dotenv, CLI, explicit configuration and module configuration defaults: composition rejects forbidden inputs even when another value masks them. `HIDDEN` and `READ_ONLY` restrict generic management; internal readers and dedicated application services can still use the existing Provider/Manager subject to source, type and version rules. Defining a per-setting permission does not grant it to existing users or roles; update grants through the application's authorization system. No database migration or dependency change is required for this extension.
+
+Version 0.8.0 includes these policies. Follow [Settings setup and usage](docs/development.md#settings-策略与使用) for definition discovery, permission declarations, internal Provider/Manager calls, and HTTP update/reset with version tokens. The [contract](docs/architecture.md#typed-cache-与-settings) owns the rules; [validation evidence](docs/status.md#settings-最小策略扩展) separates implementation results from the later read-only review.
+
 ## Invocation performance (0.7.2)
 
 Function calls avoid regenerating DI wrappers, empty extension chains skip unnecessary work, and completed filter/interceptor chains release execution references sooner. Managed declaration checks continue to detect dynamic method and policy changes.
 
 Public APIs, DI scopes, authorization, validation, Unit of Work, exception and cancellation behavior are unchanged. No application-code, configuration or data migration is required. Follow the existing [upgrade procedure](#upgrading); validation evidence and performance limits are recorded in [release status](docs/status.md#当前发布).
 
+## Native C++ integration example (0.7.3)
+
+The repository's [native integration example](examples/native_integration/README.md) demonstrates a separately installed nanobind package, Eigen computation, typed service/HTTP consumption, cancellation cleanup, and wheel/sdist and Docker delivery. Its development entry rebuilds declared native path dependencies before starting the existing Host. The example and its native binaries are maintained outside the framework runtime wheel.
+
+Existing applications need no code, configuration, dependency or data migration. Adopt the example from the source checkout when adding native computation; the CLI, default templates and framework lifecycle contracts are unchanged. Platform evidence and remaining limits are recorded in [release status](docs/status.md#当前发布).
+
 <a id="streaming-and-access-migration-07-unreleased"></a>
 
 ## Streaming and access migration (0.7)

{python_ddd_framework-0.7.2 → python_ddd_framework-0.8.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "python-ddd-framework"
-version = "0.7.2"
+version = "0.8.0"
 description = "Modular DDD application framework with project CLI and bundled templates"
 readme = "README.md"
 license = "LicenseRef-Proprietary"

{python_ddd_framework-0.7.2 → python_ddd_framework-0.8.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "python-ddd-framework"
-version = "0.7.2"
+version = "0.8.0"
 description = "Modular DDD application framework with project CLI and bundled templates"
 readme = "README.md"
 license = "LicenseRef-Proprietary"

{python_ddd_framework-0.7.2 → python_ddd_framework-0.8.0}/src/python_ddd_framework/__init__.py

@@ -280,6 +280,7 @@ from .settings import (
     SettingDefinitionContext,
     SettingDefinitionError,
     SettingDefinitionProvider,
+    SettingManagementAccess,
     SettingManager,
     SettingProvider,
 )
@@ -528,6 +529,7 @@ __all__ = (
     "SettingDefinitionError",
     "SettingDefinitionProvider",
     "SettingHandlers",
+    "SettingManagementAccess",
     "SettingManager",
     "SettingProvider",
     "SettingsModule",

{python_ddd_framework-0.7.2 → python_ddd_framework-0.8.0}/src/python_ddd_framework/configuration/root.py

@@ -212,4 +212,6 @@ class ConfigurationRoot(Mapping[str, object]):
             provenance=resolved._provenance,
             secret_paths=secret_paths,
             sources=self._sources,
+            # Settings 等能力的晚期策略检查仍需看到被覆盖的输入；沿用冻结引用。
+            payloads=resolved._payloads,
         )

{python_ddd_framework-0.7.2 → python_ddd_framework-0.8.0}/src/python_ddd_framework/settings/__init__.py

@@ -1,7 +1,7 @@
 """Global Runtime Settings 的 typed contract 与 Application-local catalog。"""
 
 from .catalog import SettingCatalog
-from .contracts import SettingDefinition
+from .contracts import SettingDefinition, SettingManagementAccess
 from .definitions import SettingDefinitionContext, SettingDefinitionProvider
 from .errors import RuntimeSettingError, SettingDefinitionError
 from .handlers import SettingApplicationStatus, SettingHandler, SettingHandlerDefinition
@@ -21,6 +21,7 @@ __all__ = (
     "SettingDefinitionProvider",
     "SettingHandler",
     "SettingHandlerDefinition",
+    "SettingManagementAccess",
     "SettingManager",
     "SettingProvider",
     "SettingSnapshot",

{python_ddd_framework-0.7.2 → python_ddd_framework-0.8.0}/src/python_ddd_framework/settings/application.py

@@ -5,15 +5,19 @@ from __future__ import annotations
 import json
 from typing import Any, cast
 
+from dishka import AsyncContainer
 from pydantic import JsonValue
 
 from ..application_services import ApplicationService, application_service
-from ..authorization import authorize
+from ..authorization import PermissionDeniedError, PermissionName, authorize
+from ..authorization.checking import _check_authorization
+from ..authorization.contracts import _AuthorizationRequirement
 from ..configuration.immutability import _serialization_value
 from ..errors import BusinessError, BusinessErrorDefinition, BusinessErrorField
 from ..errors.base import ResourceNotFoundError
+from ..invocation.runtime import _InvocationRuntime
 from .catalog import SettingCatalog
-from .contracts import SettingDefinition
+from .contracts import SettingDefinition, SettingManagementAccess
 from .management import (
     SETTINGS_READ,
     SETTINGS_WRITE,
@@ -32,27 +36,41 @@ _VALUE_FIELD = BusinessErrorField(UpdateSettingCommand, "value")
 
 @application_service(provides=SettingsManagementApplicationService)
 class _SettingsManagementApplicationService(ApplicationService):
-    def __init__(self, catalog: SettingCatalog, settings: SettingManager) -> None:
+    def __init__(
+        self,
+        catalog: SettingCatalog,
+        settings: SettingManager,
+        container: AsyncContainer,
+        runtime: _InvocationRuntime,
+    ) -> None:
         self._catalog = catalog
         self._settings = settings
+        self._container = container
+        self._runtime = runtime
 
     @authorize(SETTINGS_READ)
     async def get_list(self) -> tuple[SettingView, ...]:
-        return tuple(
-            [
-                _view(definition, await self.setting_provider.snapshot(definition))
-                for definition in self._catalog.definitions
-            ]
-        )
+        result: list[SettingView] = []
+        for definition in self._catalog.definitions:
+            if definition.management_access is SettingManagementAccess.HIDDEN:
+                continue
+            try:
+                await self._check_permissions(definition.read_permission)
+            except PermissionDeniedError:
+                continue
+            result.append(_view(definition, await self.setting_provider.snapshot(definition)))
+        return tuple(result)
 
     @authorize(SETTINGS_READ)
     async def get(self, name: str) -> SettingView:
         definition = self._definition(name)
+        await self._check_permissions(definition.read_permission)
         return _view(definition, await self.setting_provider.snapshot(definition))
 
-    @authorize(SETTINGS_WRITE)
+    @authorize(SETTINGS_READ, SETTINGS_WRITE)
     async def update(self, name: str, command: UpdateSettingCommand) -> SettingWriteResult:
         definition = self._definition(name)
+        await self._check_write(definition)
         try:
             # JSON 数组/日期须由 Pydantic 的 JSON 模式解释，不能误用 strict Python 输入语义。
             value = definition._validate_json(json.dumps(command.value, allow_nan=False))
@@ -65,9 +83,10 @@ class _SettingsManagementApplicationService(ApplicationService):
             setting=_view(definition, saved.snapshot), notification=saved.notification
         )
 
-    @authorize(SETTINGS_WRITE)
+    @authorize(SETTINGS_READ, SETTINGS_WRITE)
     async def reset(self, name: str, command: ResetSettingCommand) -> SettingWriteResult:
         definition = self._definition(name)
+        await self._check_write(definition)
         saved = await self._settings.reset(definition, expected_version=command.expected_version)
         return SettingWriteResult(
             setting=_view(definition, saved.snapshot), notification=saved.notification
@@ -75,10 +94,28 @@ class _SettingsManagementApplicationService(ApplicationService):
 
     def _definition(self, name: str) -> SettingDefinition[Any]:
         definition = self._catalog.get(name)
-        if definition is None:
+        if definition is None or definition.management_access is SettingManagementAccess.HIDDEN:
             raise ResourceNotFoundError("Setting not found")
         return definition
 
+    async def _check_write(self, definition: SettingDefinition[Any]) -> None:
+        if (
+            definition.management_access is not SettingManagementAccess.READ_WRITE
+            or SettingValueSource.RUNTIME not in definition.allowed_sources
+        ):
+            raise PermissionDeniedError(permission=str(SETTINGS_WRITE))
+        # 写入响应包含完整快照；读权限须在校验设置值及执行保存前成立。
+        await self._check_permissions(definition.read_permission, definition.write_permission)
+
+    async def _check_permissions(self, *permissions: PermissionName | None) -> None:
+        required = tuple(dict.fromkeys(item for item in permissions if item is not None))
+        if required:
+            await _check_authorization(
+                self._container,
+                self._runtime.current_user,
+                _AuthorizationRequirement(True, required, False),
+            )
+
 
 def _view(definition: SettingDefinition[Any], snapshot: SettingSnapshot[Any]) -> SettingView:
     # HTTP DTO 是独立 JSON 副本；不会把内部不可变快照的容器直接交给调用方。

{python_ddd_framework-0.7.2 → python_ddd_framework-0.8.0}/src/python_ddd_framework/settings/binding.py

@@ -6,9 +6,11 @@ from dishka import Provider, Scope
 
 from ..configuration import ConfigurationRoot
 from .catalog import SettingCatalog
+from .errors import SettingDefinitionError
 from .manager import SettingManager
 from .provider import SettingProvider
 from .store import RuntimeSettingStore
+from .values import SettingValueSource
 
 
 def _provide_settings(
@@ -18,6 +20,18 @@ def _provide_settings(
     *,
     has_store: bool,
 ) -> None:
+    # 检查冻结的输入层，不能让存储覆盖或后续配置遮住被禁止的配置贡献。
+    for definition in catalog.definitions:
+        path = f"settings.{definition.name}"
+        if (
+            SettingValueSource.CONFIGURATION not in definition.allowed_sources
+            and configuration._section_inputs(path)
+        ):
+            raise SettingDefinitionError(
+                setting=definition.name,
+                reason=f"configuration source is not allowed at {path}",
+                source=catalog.sources.get(definition.name),
+            )
     if has_store:
 
         def reader(store: RuntimeSettingStore) -> SettingProvider:

{python_ddd_framework-0.7.2 → python_ddd_framework-0.8.0}/src/python_ddd_framework/settings/contracts.py

@@ -2,10 +2,12 @@
 
 from __future__ import annotations
 
+from enum import Enum
 from typing import Generic, TypeVar, cast, get_args, get_origin
 
 from pydantic import BaseModel, Secret, SecretBytes, SecretStr, TypeAdapter, ValidationError
 
+from ..authorization import PermissionName
 from ..configuration.immutability import (
     _serialization_value,
     freeze_typed_value,
@@ -13,16 +15,65 @@ from ..configuration.immutability import (
 )
 from ..configuration.values import _looks_secret_name, canonical_path
 from .errors import RuntimeSettingError, SettingDefinitionError
+from .values import SettingValueSource
 
 _T = TypeVar("_T")
 _MISSING = object()
+_ALL_VALUE_SOURCES = frozenset(
+    source for source in SettingValueSource if source is not SettingValueSource.UNSET
+)
+
+
+class SettingManagementAccess(str, Enum):
+    """只限制通用管理入口；内部读写仍遵守设置自身的来源与值契约。"""
+
+    HIDDEN = "hidden"
+    READ_ONLY = "read_only"
+    READ_WRITE = "read_write"
 
 
 class SettingDefinition(Generic[_T]):
-    __slots__ = ("_adapter", "_default", "_name", "_value_type")
+    __slots__ = (
+        "_adapter",
+        "_allowed_sources",
+        "_default",
+        "_management_access",
+        "_name",
+        "_read_permission",
+        "_value_type",
+        "_write_permission",
+    )
 
-    def __init__(self, name: str, value_type: type[_T], *, default: object = _MISSING) -> None:
+    def __init__(
+        self,
+        name: str,
+        value_type: type[_T],
+        *,
+        default: object = _MISSING,
+        allowed_sources: frozenset[SettingValueSource] = _ALL_VALUE_SOURCES,
+        management_access: SettingManagementAccess = SettingManagementAccess.READ_WRITE,
+        read_permission: PermissionName | None = None,
+        write_permission: PermissionName | None = None,
+    ) -> None:
         _validate_setting_name(name)
+        if (
+            not isinstance(allowed_sources, frozenset)
+            or not allowed_sources
+            or any(
+                not isinstance(source, SettingValueSource) or source is SettingValueSource.UNSET
+                for source in allowed_sources
+            )
+        ):
+            raise SettingDefinitionError(
+                setting=name, reason="allowed_sources must contain value sources, not UNSET"
+            )
+        if not isinstance(management_access, SettingManagementAccess):
+            raise SettingDefinitionError(setting=name, reason="invalid management_access")
+        for permission in (read_permission, write_permission):
+            if permission is not None and not isinstance(permission, PermissionName):
+                raise SettingDefinitionError(
+                    setting=name, reason="permissions must be PermissionName values"
+                )
         if not isinstance(value_type, type):
             raise SettingDefinitionError(setting=name, reason="value_type must be a runtime type")
         if _contains_secret_type(value_type):
@@ -46,6 +97,10 @@ class SettingDefinition(Generic[_T]):
         self._value_type = value_type
         self._adapter = adapter
         self._default = validated_default
+        self._allowed_sources = allowed_sources
+        self._management_access = management_access
+        self._read_permission = read_permission
+        self._write_permission = write_permission
 
     @property
     def name(self) -> str:
@@ -59,6 +114,22 @@ class SettingDefinition(Generic[_T]):
     def has_default(self) -> bool:
         return self._default is not _MISSING
 
+    @property
+    def allowed_sources(self) -> frozenset[SettingValueSource]:
+        return self._allowed_sources
+
+    @property
+    def management_access(self) -> SettingManagementAccess:
+        return self._management_access
+
+    @property
+    def read_permission(self) -> PermissionName | None:
+        return self._read_permission
+
+    @property
+    def write_permission(self) -> PermissionName | None:
+        return self._write_permission
+
     def _validate_python(self, value: object) -> _T:
         return cast(
             _T, freeze_typed_value(self._adapter.validate_python(value), allow_secrets=False)

{python_ddd_framework-0.7.2 → python_ddd_framework-0.8.0}/src/python_ddd_framework/settings/manager.py

@@ -49,7 +49,7 @@ class SettingManager:
     async def update(
         self, definition: SettingDefinition[_T], value: _T, *, expected_version: UUID | None
     ) -> SettingWriteOutcome[_T]:
-        self._catalog.require_owned(definition)
+        self._require_write(definition, operation="set")
         try:
             validated, serialized = definition._dump_json(value)
         except (TypeError, ValidationError, PydanticSerializationError):
@@ -68,13 +68,20 @@ class SettingManager:
     async def reset(
         self, definition: SettingDefinition[_T], *, expected_version: UUID | None
     ) -> SettingWriteOutcome[_T]:
-        self._catalog.require_owned(definition)
+        self._require_write(definition, operation="reset")
         # 默认值先校验，不能在物理删除已经提交之后再抛出配置校验失败。
         fallback = self._provider._resolve(definition, StoredSetting(None, expected_version))
         saved = await self._store.write(definition.name, None, expected_version=expected_version)
         snapshot = SettingSnapshot(definition.name, fallback.value, fallback.source, saved.version)
         return SettingWriteOutcome(snapshot, await self._committed(definition.name))
 
+    def _require_write(self, definition: SettingDefinition[Any], *, operation: str) -> None:
+        self._catalog.require_owned(definition)
+        if SettingValueSource.RUNTIME not in definition.allowed_sources:
+            raise RuntimeSettingError(
+                setting=definition.name, operation=operation, error_type="SourceNotAllowed"
+            )
+
     async def _committed(self, name: str) -> NotificationPublishStatus:
         # 本地刷新先入队；Redis 降级不会撤销短事务已经提交的结果。
         if self._refresh is not None:

{python_ddd_framework-0.7.2 → python_ddd_framework-0.8.0}/src/python_ddd_framework/settings/module.py

@@ -2,6 +2,7 @@
 
 from dishka import DEFAULT_COMPONENT, DependencyKey, Provider, Scope
 
+from ..authorization.module import AuthorizationModule
 from ..lifecycle import ConfigureContext
 from ..modularity import AppModule, ModuleRef
 from ..services.composition import (
@@ -12,6 +13,7 @@ from ..services.composition import (
 from ..services.registration import RegistrationDecision, RegistrationKind
 from .binding import _provide_settings
 from .catalog import SettingCatalog, _build_setting_catalog, _contribute_setting_handler_defaults
+from .errors import SettingDefinitionError
 from .store import RuntimeSettingStore
 
 
@@ -57,3 +59,19 @@ class SettingsManagementModule(AppModule):
         "python_ddd_framework.settings.application",
         "python_ddd_framework.settings.permissions",
     )
+
+    def configure(self, context: ConfigureContext) -> None:
+        context.services.add_composition(ServiceComposition(bind=self._bind))
+
+    def _bind(self, context: ServiceBindingContext) -> None:
+        # 全局 discovery 屏障后核对实际权限目录；只读 Settings 无需装配授权服务。
+        catalog = context.modules.instance(SettingsModule).catalog
+        permissions = context.modules.instance(AuthorizationModule).catalog
+        for definition in catalog.definitions:
+            for permission in (definition.read_permission, definition.write_permission):
+                if permission is not None and permission not in permissions:
+                    raise SettingDefinitionError(
+                        setting=definition.name,
+                        reason=f"permission {permission} is not defined",
+                        source=catalog.sources.get(definition.name),
+                    )

{python_ddd_framework-0.7.2 → python_ddd_framework-0.8.0}/src/python_ddd_framework/settings/provider.py

@@ -43,7 +43,7 @@ class SettingProvider:
         self._catalog.require_owned(definition)
         stored = (
             await self._store.read(definition.name)
-            if self._store is not None
+            if self._store is not None and SettingValueSource.RUNTIME in definition.allowed_sources
             else StoredSetting(None, None)
         )
         return self._resolve(definition, stored)
@@ -56,11 +56,18 @@ class SettingProvider:
                 value = definition._validate_json(stored.value_json)
                 source = SettingValueSource.RUNTIME
             else:
-                configured = self._configuration.get_path(f"settings.{definition.name}", _MISSING)
+                configured = (
+                    self._configuration.get_path(f"settings.{definition.name}", _MISSING)
+                    if SettingValueSource.CONFIGURATION in definition.allowed_sources
+                    else _MISSING
+                )
                 if configured is not _MISSING:
                     value = definition._validate_python(configured)
                     source = SettingValueSource.CONFIGURATION
-                elif definition.has_default:
+                elif (
+                    definition.has_default
+                    and SettingValueSource.DEFINITION in definition.allowed_sources
+                ):
                     value = definition._default_value()
                     source = SettingValueSource.DEFINITION
                 else: