python-neva 5.4.0__tar.gz → 5.4.1__tar.gz

{python_neva-5.4.0 → python_neva-5.4.1}/CHANGELOG.md

@@ -1,3 +1,10 @@
+## 5.4.1 (2026-09-09)
+
+### 🐛🚑️ Fixes
+
+- **config**: apply provider declarations on a late registration
+- **guidelines**: render the drivers fragment for apps below 5.3
+
 ## 5.4.0 (2026-09-07)
 
 ### ✨ Features

{python_neva-5.4.0 → python_neva-5.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: python-neva
-Version: 5.4.0
+Version: 5.4.1
 Summary: Add your description here
 Requires-Python: >=3.12
 Requires-Dist: aiosqlite>=0.20.0

{python_neva-5.4.0 → python_neva-5.4.1}/neva/arch/application.py

@@ -68,6 +68,7 @@ class Application:
         self._extra_providers: list[BaseProvider] = []
         self._container: dishka.AsyncContainer | None = None
         self._booted: bool = False
+        self._declarations_applied: bool = False
 
         configuration_path = _resolve_config_path(config_path)
         match ConfigLoader(configuration_path).load_all():
@@ -164,6 +165,15 @@ class Application:
         would orphan. Registering after boot is an error rather than a
         silently ignored call.
 
+        A provider arriving after construction has its declared config
+        namespaces validated here, and its secrets marked once it registers, so
+        that it is held to the same shape as one named in the `providers`
+        config namespace. Validation runs before the provider is instantiated:
+        a malformed namespace leaves nothing registered and no secret marked.
+        Providers registered *during* construction are skipped here and
+        validated together by `_apply_provider_config_declarations`, which
+        reports every bad namespace in one message.
+
         Returns:
             Result containing the registered provider instance or an error message.
         """
@@ -177,12 +187,18 @@ class Application:
                 "or declare them in the 'providers' config namespace."
             )
 
+        late = self._declarations_applied
+        if late and (failures := self._declaration_failures(provider)):
+            return Err("Invalid configuration: " + "; ".join(failures))
+
         registered = (
             provider(self)
             .register()
             .map(lambda p: self.providers.setdefault(provider, p))
         )
         if registered.is_ok:
+            if late:
+                self.config.mark_sensitive(*provider.sensitive)
             self._container = None
         return registered
 
@@ -194,22 +210,39 @@ class Application:
         configuration error. Every failure is reported together, so a boot
         naming three bad namespaces takes one run rather than three.
 
+        Providers registered after this point go through `register`, which
+        applies the same declarations one provider at a time.
+
         Raises:
             RuntimeError: If any declared namespace fails its shape.
         """
-        checks: list[Result[None, str]] = []
+        failures: list[str] = []
         for provider in self.providers.values():
             declaring = type(provider)
             self.config.mark_sensitive(*declaring.sensitive)
-            checks.extend(
-                self._validate_namespace(namespace, schema)
-                for namespace, schema in declaring.config_schema.items()
-            )
+            failures.extend(self._declaration_failures(declaring))
 
-        _, failures = partition(checks)
         if failures:
             raise RuntimeError("Invalid configuration: " + "; ".join(failures))
 
+        self._declarations_applied = True
+
+    def _declaration_failures(self, declaring: type[ServiceProvider]) -> list[str]:
+        """Check one provider's declared namespaces, applying nothing.
+
+        Args:
+            declaring: The provider type whose `config_schema` to check.
+
+        Returns:
+            One message per malformed namespace, empty when every declared
+            namespace is absent or valid.
+        """
+        _, failures = partition(
+            self._validate_namespace(namespace, schema)
+            for namespace, schema in declaring.config_schema.items()
+        )
+        return failures
+
     def _validate_namespace(
         self, namespace: str, schema: TypeForm[Any]
     ) -> Result[None, str]:

{python_neva-5.4.0 → python_neva-5.4.1}/neva/guidelines/fragments/configuration.md

@@ -104,9 +104,9 @@ reaches the repository, frozen or not.
 
 ## Validating a namespace at boot
 
-A provider declares the shape its namespace must have, and it is checked once during
-construction (since 5.4). The declaration reuses the `TypedDict` shapes above — nothing needs
-to become a pydantic model.
+A provider declares the shape its namespace must have, and it is checked at boot (since 5.4).
+The declaration reuses the `TypedDict` shapes above — nothing needs to become a pydantic
+model.
 
 ```python
 class DatabaseServiceProvider(ServiceProvider):
@@ -120,10 +120,21 @@ class DatabaseServiceProvider(ServiceProvider):
 - A provider that declares nothing is validated not at all — the behaviour before 5.4.
 - The constructor raises, as it does for any config failure; `Application.create()` returns it
   as an `Err` instead.
+- **A provider registered after construction is checked too, and reports as an `Err` from
+  `Application.register` rather than raising** (since 5.4.1). That is the path
+  `App.register` on `neva-fastapi` and `neva-faststream` delegates to; before 5.4.1 it skipped
+  validation and marked no secrets. A rejected provider is not registered at all.
+
+**`type_` is a cast, not validation, so the value a malformed key holds is still whatever the
+file put there.** Validation only *rejects* it — nothing is coerced and written back, and
+pydantic's default lax mode accepts `"false"` for a `bool`. A namespace whose values must be
+exactly typed declares `__pydantic_config__ = ConfigDict(strict=True)` on its `TypedDict`.
 
 ## Secrets
 
 A provider marks the keys that hold secrets, and they are replaced in the display form only.
+Marking happens wherever the provider is registered — at construction, or through
+`Application.register` (since 5.4.1).
 
 ```python
 class SecurityProvider(ServiceProvider):

{python_neva-5.4.0 → python_neva-5.4.1}/neva/guidelines/fragments/drivers.md

@@ -1,7 +1,7 @@
 ---
 id: drivers
 title: Swappable drivers
-requires: python-neva>=5.3
+requires: python-neva>=5.0
 triggers: [swappable backend, driver manager, multiple implementations, choosing an implementation from config, registering a driver, plugin extension point]
 priority: 70
 verified_by: [tests/support/test_strategy.py, tests/support/test_strategy_imports.py]

{python_neva-5.4.0 → python_neva-5.4.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "python-neva"
-version = "5.4.0"
+version = "5.4.1"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.12"

{python_neva-5.4.0 → python_neva-5.4.1}/tests/config/test_provider_declarations.py

@@ -1,13 +1,14 @@
 """Config namespaces a provider declares are validated and redacted at boot."""
 
 from pathlib import Path
-from typing import Any, ClassVar
+from typing import Any, ClassVar, NotRequired, TypedDict, override
 
 import pytest
 from typing_extensions import TypeForm
 
-from neva.arch import Application
+from neva.arch import Application, ServiceProvider
 from neva.config.repository import REDACTED, ConfigRepository
+from neva.support import Ok, Result
 
 
 def _config_dir(tmp_path: Path, **files: str) -> Path:
@@ -28,6 +29,34 @@ config = {"connections": {"default": {"url": "sqlite+aiosqlite:///:memory:"}}}
 BAD_DATABASE = """
 config = {"connections": {"default": {"pool_size": 5}}}
 """
+GOOD_WIDGETS = """
+config = {"per_page": 25, "token": "s3cret"}
+"""
+BAD_WIDGETS = """
+config = {"per_page": "many"}
+"""
+
+
+class WidgetConfig(TypedDict):
+    """A namespace owned by a provider that is registered after construction."""
+
+    per_page: NotRequired[int]
+    token: NotRequired[str]
+
+
+class WidgetProvider(ServiceProvider):
+    config_schema: ClassVar[dict[str, TypeForm[Any]]] = {"widgets": WidgetConfig}
+    sensitive: ClassVar[tuple[str, ...]] = ("widgets.token",)
+
+    @override
+    def register(self) -> Result["WidgetProvider", str]:
+        return Ok(self)
+
+
+class SilentProvider(ServiceProvider):
+    @override
+    def register(self) -> Result["SilentProvider", str]:
+        return Ok(self)
 
 
 class TestValidationAtBoot:
@@ -145,3 +174,83 @@ class TestDeclarationsAreTyped:
 
         assert Declaring.config_schema == {"x": dict[str, int]}
         assert Declaring.sensitive == ("x.token",)
+
+
+class TestDeclarationsApplyToALateRegistration:
+    """A provider registered after construction is held to the same shape.
+
+    The declarations pass runs in `__init__` over the providers construction
+    knows about. Every integration package exposes `Application.register` as
+    its own `register`, so a provider reaching the application that way used
+    to skip validation entirely and never mark its secrets.
+    """
+
+    @staticmethod
+    def _app(tmp_path: Path, **files: str) -> Application:
+        return Application.create(config_path=_config_dir(tmp_path, **files)).unwrap()
+
+    def test_a_malformed_namespace_fails_the_registration(self, tmp_path: Path) -> None:
+        app = self._app(tmp_path, widgets=BAD_WIDGETS)
+
+        result = app.register(WidgetProvider)
+
+        assert result.is_err
+        assert "'widgets' is malformed" in result.unwrap_err()
+        assert "per_page" in result.unwrap_err()
+
+    def test_a_rejected_provider_is_not_registered(self, tmp_path: Path) -> None:
+        app = self._app(tmp_path, widgets=BAD_WIDGETS)
+
+        _ = app.register(WidgetProvider)
+
+        assert WidgetProvider not in app.providers
+
+    def test_a_rejected_provider_marks_no_secret(self, tmp_path: Path) -> None:
+        """Validation runs before anything is applied, secrets included."""
+        app = self._app(tmp_path, widgets=BAD_WIDGETS)
+
+        _ = app.register(WidgetProvider)
+
+        assert "widgets.token" not in app.config.sensitive
+
+    def test_a_valid_namespace_registers(self, tmp_path: Path) -> None:
+        app = self._app(tmp_path, widgets=GOOD_WIDGETS)
+
+        assert app.register(WidgetProvider).is_ok
+
+    def test_an_absent_namespace_registers(self, tmp_path: Path) -> None:
+        app = self._app(tmp_path)
+
+        assert app.register(WidgetProvider).is_ok
+
+    def test_a_registered_provider_marks_its_secrets(self, tmp_path: Path) -> None:
+        app = self._app(tmp_path, widgets=GOOD_WIDGETS)
+
+        _ = app.register(WidgetProvider).unwrap()
+
+        assert "widgets.token" in app.config.sensitive
+        assert app.config.redacted()["widgets"]["token"] == REDACTED
+        assert app.config.get("widgets.token", type_=str).unwrap() == "s3cret"
+
+    def test_a_provider_declaring_nothing_still_registers(self, tmp_path: Path) -> None:
+        """The additive guarantee, on this path too."""
+        app = self._app(tmp_path, widgets=BAD_WIDGETS)
+
+        assert app.register(SilentProvider).is_ok
+
+    def test_registering_twice_is_still_idempotent(self, tmp_path: Path) -> None:
+        app = self._app(tmp_path, widgets=GOOD_WIDGETS)
+
+        first = app.register(WidgetProvider).unwrap()
+
+        assert app.register(WidgetProvider).unwrap() is first
+
+    def test_a_construction_time_provider_is_still_reported_in_one_message(
+        self, tmp_path: Path
+    ) -> None:
+        """The batch path keeps its behaviour: one message, every namespace."""
+        config_dir = _config_dir(tmp_path, database=BAD_DATABASE)
+
+        message = Application.create(config_path=config_dir).unwrap_err()
+
+        assert message.startswith("Invalid configuration: ")

{python_neva-5.4.0 → python_neva-5.4.1}/uv.lock

@@ -1539,7 +1539,7 @@ wheels = [
 
 [[package]]
 name = "python-neva"
-version = "5.4.0"
+version = "5.4.1"
 source = { editable = "." }
 dependencies = [
     { name = "aiosqlite" },