rabbitkit 0.14.0__tar.gz → 0.17.0__tar.gz

{rabbitkit-0.14.0/src/rabbitkit.egg-info → rabbitkit-0.17.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rabbitkit
-Version: 0.14.0
+Version: 0.17.0
 Summary: Production-grade RabbitMQ toolkit — sync/async, decorator routing, retry, compression, full configurability
 Author-email: Talaat Magdy <talaatmagdy75@gmail.com>
 License-Expression: MIT
@@ -33,7 +33,7 @@ Requires-Dist: rabbitkit[async,sync]; extra == "all-brokers"
 Provides-Extra: redis
 Requires-Dist: redis<9.0.0,>=5.0.0; extra == "redis"
 Provides-Extra: pydantic
-Requires-Dist: pydantic<3.0.0,>=2.0.0; extra == "pydantic"
+Requires-Dist: pydantic<3.0.0,>=2.4.0; extra == "pydantic"
 Provides-Extra: msgspec
 Requires-Dist: msgspec<1.0.0,>=0.18.0; extra == "msgspec"
 Provides-Extra: fastapi
@@ -41,7 +41,7 @@ Requires-Dist: fastapi<1.0.0,>=0.111.0; extra == "fastapi"
 Provides-Extra: compression
 Requires-Dist: zstandard<1.0.0,>=0.22.0; extra == "compression"
 Provides-Extra: management
-Requires-Dist: aiohttp<4.0.0,>=3.9.0; extra == "management"
+Requires-Dist: aiohttp<4.0.0,>=3.14.3; extra == "management"
 Provides-Extra: otel
 Requires-Dist: opentelemetry-api<2,>=1.20; extra == "otel"
 Provides-Extra: settings
@@ -49,7 +49,7 @@ Requires-Dist: pydantic-settings<3.0.0,>=2.0.0; extra == "settings"
 Provides-Extra: cli
 Requires-Dist: typer<1.0.0,>=0.12.0; extra == "cli"
 Provides-Extra: dashboard
-Requires-Dist: starlette<2.0.0,>=0.37.0; extra == "dashboard"
+Requires-Dist: starlette<2.0.0,>=1.4.0; extra == "dashboard"
 Requires-Dist: uvicorn<1.0.0,>=0.29.0; extra == "dashboard"
 Provides-Extra: reload
 Requires-Dist: watchfiles<2.0.0,>=0.21.0; extra == "reload"
@@ -423,9 +423,14 @@ management_client=...)`) verify confirms/mandatory/persistence, a 256 KiB body
 cap, quorum queues and a quorum retry chain — and report anything they cannot
 verify as *unverified*, never green. Retry/DLQ triage headers are sanitized by
 default, and a failing delay-queue handoff backs off instead of hot-looping.
-`CoalescingAcker` is the only place a cumulative `basic.ack(multiple=True)`
-may originate: it knows every delivery on the channel and coalesces only
-through a completed prefix, so a still-running sibling is never acked early.
+`CoalescingAcker` (and `AsyncCoalescingAcker`) is the only place a cumulative
+`basic.ack(multiple=True)` may originate: it knows every delivery on the
+channel and coalesces only through a completed prefix, so a still-running
+sibling is never acked early. Settlement follows a **plan / emit / commit**
+protocol — the ledger advances only for frames the broker actually accepted,
+and emission stops at the first failure, because a cumulative ack that
+follows a nack which never landed would acknowledge the very delivery meant
+to be requeued.
 Every bulk path emits bounded-label metrics
 (`rabbitkit_bulk_publish_items_total{status,reason}`,
 `rabbitkit_settlement_items_total{action,status}`,

{rabbitkit-0.14.0 → rabbitkit-0.17.0}/README.md

@@ -342,9 +342,14 @@ management_client=...)`) verify confirms/mandatory/persistence, a 256 KiB body
 cap, quorum queues and a quorum retry chain — and report anything they cannot
 verify as *unverified*, never green. Retry/DLQ triage headers are sanitized by
 default, and a failing delay-queue handoff backs off instead of hot-looping.
-`CoalescingAcker` is the only place a cumulative `basic.ack(multiple=True)`
-may originate: it knows every delivery on the channel and coalesces only
-through a completed prefix, so a still-running sibling is never acked early.
+`CoalescingAcker` (and `AsyncCoalescingAcker`) is the only place a cumulative
+`basic.ack(multiple=True)` may originate: it knows every delivery on the
+channel and coalesces only through a completed prefix, so a still-running
+sibling is never acked early. Settlement follows a **plan / emit / commit**
+protocol — the ledger advances only for frames the broker actually accepted,
+and emission stops at the first failure, because a cumulative ack that
+follows a nack which never landed would acknowledge the very delivery meant
+to be requeued.
 Every bulk path emits bounded-label metrics
 (`rabbitkit_bulk_publish_items_total{status,reason}`,
 `rabbitkit_settlement_items_total{action,status}`,

{rabbitkit-0.14.0 → rabbitkit-0.17.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "rabbitkit"
-version = "0.14.0"
+version = "0.17.0"
 description = "Production-grade RabbitMQ toolkit — sync/async, decorator routing, retry, compression, full configurability"
 readme = "README.md"
 license = "MIT"
@@ -34,15 +34,24 @@ sync        = ["pika>=1.3.0,<2.0.0"]
 async       = ["aio-pika>=9.1.0,<10.0.0"]
 all-brokers = ["rabbitkit[sync,async]"]
 redis       = ["redis>=5.0.0,<9.0.0"]
-pydantic    = ["pydantic>=2.0.0,<3.0.0"]
+# Floor is the first release with no open advisory (verified against OSV):
+# 2.0.0-2.3.x carry GHSA-mr82-8j83-vxmv / PYSEC-2026-1812.
+pydantic    = ["pydantic>=2.4.0,<3.0.0"]
 msgspec     = ["msgspec>=0.18.0,<1.0.0"]
 fastapi     = ["fastapi>=0.111.0,<1.0.0"]
 compression = ["zstandard>=0.22.0,<1.0.0"]
-management = ["aiohttp>=3.9.0,<4.0.0"]
+# 3.14.3 is the first aiohttp with a clean advisory set (verified against
+# OSV: 3.14.0 -> 22, 3.14.1 -> 6, 3.14.2 -> 2, 3.14.3 -> 0). The old
+# >=3.9.0 floor permitted a resolution with 76 known advisories, and CI
+# could never see it because it always resolves the newest in range.
+management = ["aiohttp>=3.14.3,<4.0.0"]
 otel       = ["opentelemetry-api>=1.20,<2"]
 settings    = ["pydantic-settings>=2.0.0,<3.0.0"]
 cli         = ["typer>=0.12.0,<1.0.0"]
-dashboard   = ["starlette>=0.37.0,<2.0.0", "uvicorn>=0.29.0,<1.0.0"]
+# starlette 1.4.0 is the first clean release (1.0 -> 10 advisories,
+# 1.3 -> 2, 1.4 -> 0). The upper bound already allowed 1.x and CI has
+# been testing 1.6, so this only removes resolutions nothing tested.
+dashboard   = ["starlette>=1.4.0,<2.0.0", "uvicorn>=0.29.0,<1.0.0"]
 reload      = ["watchfiles>=0.21.0,<2.0.0"]
 all         = ["rabbitkit[all-brokers,otel,redis,pydantic,msgspec,fastapi,compression,settings,cli,dashboard,reload,management]"]
 dev         = [

{rabbitkit-0.14.0 → rabbitkit-0.17.0}/src/rabbitkit/__init__.py

@@ -115,6 +115,7 @@ from rabbitkit.health import (
     broker_readiness,
     broker_readiness_async,
 )
+from rabbitkit.highload.async_acker import AsyncCoalescingAcker
 from rabbitkit.highload.backpressure import FlowController
 from rabbitkit.highload.batch import (
     BatchAcker,
@@ -163,6 +164,7 @@ __all__ = [
     "AsyncAPIGeneratorConfig",
     "AsyncBatchPublisher",
     "AsyncBroker",
+    "AsyncCoalescingAcker",
     "AsyncHealthWatcher",
     "AsyncWorkerPool",
     "BackpressureConfig",

{rabbitkit-0.14.0 → rabbitkit-0.17.0}/src/rabbitkit/_version.py

@@ -1,3 +1,3 @@
 """rabbitkit version — single source of truth."""
 
-__version__ = "0.14.0"
+__version__ = "0.17.0"

{rabbitkit-0.14.0 → rabbitkit-0.17.0}/src/rabbitkit/async_/broker.py

@@ -285,6 +285,7 @@ class AsyncBroker:
         prefetch_count: int | None = None,
         filter_fn: Callable[[RabbitMessage], bool] | None = None,
         reject_without_dlx: str | None = None,
+        reply_to_allow: tuple[str, ...] | None = None,
     ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
         """Register a subscriber handler."""
         return self._registry.subscriber(
@@ -301,6 +302,7 @@ class AsyncBroker:
             prefetch_count=prefetch_count,
             filter_fn=filter_fn,
             reject_without_dlx=reject_without_dlx,
+            reply_to_allow=reply_to_allow,
         )
 
     def publisher(

{rabbitkit-0.14.0 → rabbitkit-0.17.0}/src/rabbitkit/cli/commands/topology.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+import urllib.parse
 from typing import Any, cast
 
 import typer
@@ -15,6 +16,24 @@ topology_app = typer.Typer(help="Topology inspection and management commands.")
 topology_app.command("migrate")(migrate_command)
 
 
+def _safe_url(management_url: str) -> str:
+    """The URL with any embedded credentials removed, for display.
+
+    ``--url`` accepts ``http://user:pass@host:15672`` (the form ``migrate``
+    documents), and these commands echo the URL back on failure. Printing it
+    verbatim puts the password into terminal scrollback and, in CI, into the
+    build log.
+    """
+    try:
+        parsed = urllib.parse.urlparse(management_url)
+        if not parsed.hostname:
+            return "<redacted url>"
+        netloc = parsed.hostname if parsed.port is None else f"{parsed.hostname}:{parsed.port}"
+        return f"{parsed.scheme}://{netloc}{parsed.path.rstrip('/')}"
+    except Exception:
+        return "<redacted url>"
+
+
 @topology_app.command("list")
 def topology_list(
     app_path: str = typer.Argument(..., help="Broker path, e.g. 'myapp.main:broker'"),
@@ -143,7 +162,7 @@ def topology_validate(
     try:
         live = _live_resources(management_url, vhost)
     except Exception as exc:
-        typer.echo(f"ERROR: could not reach management API at {management_url}: {exc}", err=True)
+        typer.echo(f"ERROR: could not reach management API at {_safe_url(management_url)}: {exc}", err=True)
         raise typer.Exit(1) from None
 
     issues: list[str] = []
@@ -203,7 +222,7 @@ def topology_diff(
     try:
         live = _live_resources(management_url, vhost)
     except Exception as exc:
-        typer.echo(f"ERROR: could not reach management API at {management_url}: {exc}", err=True)
+        typer.echo(f"ERROR: could not reach management API at {_safe_url(management_url)}: {exc}", err=True)
         raise typer.Exit(1) from None
 
     diff: dict[str, Any] = {

{rabbitkit-0.14.0 → rabbitkit-0.17.0}/src/rabbitkit/concurrency.py

@@ -13,6 +13,7 @@ from __future__ import annotations
 
 import asyncio
 import concurrent.futures
+import contextvars
 import logging
 import queue
 import threading
@@ -112,7 +113,18 @@ class _DaemonWorkerPool:
             fut, fn, args, kwargs = item
             if fut.set_running_or_notify_cancel():
                 try:
-                    fut.set_result(fn(*args, **kwargs))
+                    # Run in a FRESH context per message.
+                    #
+                    # A pooled thread is long-lived and carries ONE
+                    # contextvars.Context for its entire life, so calling the
+                    # handler directly let message A's ContextVar writes leak
+                    # into message B on the same thread. With DI's
+                    # `set_local`, tenant B could read tenant A's scope --
+                    # which contradicts the isolation the DI context class
+                    # advertises. The async path is safe because each message
+                    # is its own Task (and a Task already copies the context);
+                    # this gives the sync pool the same guarantee.
+                    fut.set_result(contextvars.copy_context().run(fn, *args, **kwargs))
                 except BaseException as exc:
                     fut.set_exception(exc)
             # loop back: re-mark idle at the top of the next iteration
@@ -272,8 +284,12 @@ class SyncWorkerPool:
         Otherwise, submits to the thread pool.
         """
         if self._executor is None:
-            # Single worker mode -- run directly
-            callback(message)
+            # Single worker mode -- run directly, but still in a FRESH
+            # context. This runs on the transport's owner thread, which lives
+            # for the whole process, so without the copy every message's
+            # ContextVar writes would accumulate on it and leak into the next
+            # message exactly as they did on the pooled path.
+            contextvars.copy_context().run(callback, message)
             return
 
         future = self._executor.submit(callback, message)

{rabbitkit-0.14.0 → rabbitkit-0.17.0}/src/rabbitkit/core/config.py

@@ -902,6 +902,15 @@ class DeduplicationConfig:
     store_results: bool = False
     max_result_bytes: int = 65536
     on_in_flight: str = "nack_requeue"  # claim only: "nack_requeue" (retry-safe) | "ack_skip"
+    #: Seconds to wait before nack-requeueing a duplicate of an IN-FLIGHT
+    #: message. Without it the requeue is immediate, the broker redelivers at
+    #: once, and the message spins until the claim resolves — measured at
+    #: ~3,160 redeliveries/second from ONE duplicate, for up to
+    #: ``processing_timeout`` (default 300s). That burns a prefetch slot and
+    #: broker bandwidth, and an attacker who can publish a colliding id plus a
+    #: slow payload gets the amplification for free. 0 restores the old
+    #: behaviour.
+    in_flight_requeue_delay: float = 0.5
 
     def __post_init__(self) -> None:
         if self.store_results and self.mark_policy != "claim":

{rabbitkit-0.14.0 → rabbitkit-0.17.0}/src/rabbitkit/core/logging.py

@@ -79,9 +79,12 @@ of (or in addition to) the defaults.
 
 from __future__ import annotations
 
+import logging
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, Any
 
+from rabbitkit.core.sanitizer import ErrorSanitizer
+
 if TYPE_CHECKING:
     import structlog
 
@@ -206,6 +209,119 @@ def _redact_processor(keys: frozenset[str]) -> Any:
     return processor
 
 
+
+# ── Value-level redaction for STDLIB logging (0.16) ───────────────────────
+
+
+class SecretRedactingFilter(logging.Filter):
+    """Redact credential-shaped VALUES from rendered log records.
+
+    ``_redact_processor`` above scrubs by key NAME and only under structlog.
+    Two gaps followed from that, both of which leaked plaintext:
+
+    1. Only four rabbitkit modules use structlog; **thirty-four use
+       :mod:`logging` directly** and bypassed the processor entirely.
+    2. Key-name matching cannot catch a secret in the VALUE of an innocently
+       named field. ``logger.warning("connection lost", error=str(exc))`` has
+       the key ``error``, so an exception carrying
+       ``amqp://svc:pw@host`` sailed through.
+
+    ``ErrorSanitizer`` already knew how to redact these, but it had exactly
+    one call site in the whole package — the dead-letter header — so
+    ``error_detail="sanitized"`` protected the header while the log line,
+    right next to it, printed the password.
+
+    This filter closes both by redacting the *formatted* message. Attach it
+    to the ``rabbitkit`` logger and it covers every module regardless of
+    which logging API they use.
+
+    It does NOT redact tracebacks: those are rendered by the Formatter, not
+    the record. Use :class:`SecretRedactingFormatter` for that.
+    """
+
+    def __init__(self, sanitizer: ErrorSanitizer | None = None, name: str = "") -> None:
+        super().__init__(name)
+        self._sanitizer = sanitizer or ErrorSanitizer()
+
+    def filter(self, record: logging.LogRecord) -> bool:
+        try:
+            rendered = record.getMessage()
+        except Exception:  # pragma: no cover - a broken record must still log
+            return True
+        redacted = self._sanitizer.redact(rendered)
+        if redacted != rendered:
+            # Replace msg wholesale and drop args: the substitution already
+            # happened, and re-applying args would raise or re-introduce the
+            # secret.
+            record.msg = redacted
+            record.args = ()
+        return True
+
+
+class SecretRedactingFormatter(logging.Formatter):
+    """A Formatter that also redacts the rendered TRACEBACK.
+
+    The last line of a traceback is ``str(exc)``, so any handler raising
+    ``SQLAlchemyError("could not connect: postgres://svc:pw@db/app")`` put
+    the password into every ``logger.exception(...)`` and every
+    ``exc_info=True`` call — of which rabbitkit has roughly forty.
+    """
+
+    def __init__(self, *args: Any, sanitizer: ErrorSanitizer | None = None, **kwargs: Any) -> None:
+        super().__init__(*args, **kwargs)
+        self._sanitizer = sanitizer or ErrorSanitizer()
+
+    def formatException(self, ei: Any) -> str:  # noqa: N802 — stdlib signature
+        return self._sanitizer.redact(super().formatException(ei))
+
+    def format(self, record: logging.LogRecord) -> str:
+        return self._sanitizer.redact(super().format(record))
+
+
+def install_log_redaction(
+    logger_name: str = "rabbitkit",
+    *,
+    sanitizer: ErrorSanitizer | None = None,
+) -> SecretRedactingFilter:
+    """Attach :class:`SecretRedactingFilter` to *logger_name*, idempotently.
+
+    Called automatically by :func:`configure_structlog`. Call it directly if
+    you do not use rabbitkit's logging setup but still want its log lines
+    scrubbed.
+    """
+    root = logging.getLogger(logger_name)
+    for existing in root.filters:
+        if isinstance(existing, SecretRedactingFilter):
+            return existing
+    filt = SecretRedactingFilter(sanitizer)
+
+    # A Filter on a Logger runs only for records logged DIRECTLY on it.
+    # Records from child loggers propagate to ancestor HANDLERS and skip
+    # ancestor filters entirely, so attaching to "rabbitkit" alone would
+    # miss every `logging.getLogger(__name__)` in the package — which is 34
+    # of the 38 modules. Attach to each logger in the namespace instead.
+    root.addFilter(filt)
+    prefix = f"{logger_name}."
+    for name, logger in list(logging.Logger.manager.loggerDict.items()):
+        if not name.startswith(prefix) or not isinstance(logger, logging.Logger):
+            continue
+        if not any(isinstance(f, SecretRedactingFilter) for f in logger.filters):
+            logger.addFilter(filt)
+
+    # Any handler already attached under this namespace gets it too, which
+    # also covers loggers created AFTER this call whose records reach one of
+    # those handlers.
+    for logger in (root, *(
+        lg
+        for name, lg in logging.Logger.manager.loggerDict.items()
+        if name.startswith(prefix) and isinstance(lg, logging.Logger)
+    )):
+        for handler in logger.handlers:
+            if not any(isinstance(f, SecretRedactingFilter) for f in handler.filters):
+                handler.addFilter(filt)
+    return filt
+
+
 def configure_structlog(config: LoggingConfig | None = None) -> None:
     """One-time structlog configuration.
 
@@ -232,6 +348,10 @@ def configure_structlog(config: LoggingConfig | None = None) -> None:
 
     if config.redact_keys:
         processors.append(_redact_processor(config.redact_keys))
+        # Key-name redaction only reaches structlog callers (4 of 38 modules)
+        # and cannot see a secret in the VALUE of an innocently named field.
+        # This covers every rabbitkit logger regardless of logging API.
+        install_log_redaction()
 
     if config.add_log_level:
         processors.append(structlog.stdlib.add_log_level)

{rabbitkit-0.14.0 → rabbitkit-0.17.0}/src/rabbitkit/core/pipeline.py

@@ -380,6 +380,28 @@ _ACK_STRATEGIES_ASYNC: dict[AckPolicy, _AsyncAckStrategy] = {
 }
 
 
+#: RabbitMQ's private direct-reply-to pseudo-queue. A reply here can only
+#: reach the channel that issued the request, so it is safe by construction.
+_DIRECT_REPLY_PREFIX = "amq.rabbitmq.reply-to"
+
+
+def _reply_to_permitted(reply_to: str, allow: tuple[str, ...] | None) -> bool:
+    """Is *reply_to* an acceptable destination for a handler result?
+
+    ``allow=None`` permits everything (the historical behaviour). Entries
+    ending in ``*`` match as prefixes.
+    """
+    if allow is None:
+        return True
+    for pattern in allow:
+        if pattern.endswith("*"):
+            if reply_to.startswith(pattern[:-1]):
+                return True
+        elif reply_to == pattern:
+            return True
+    return reply_to.startswith(_DIRECT_REPLY_PREFIX)
+
+
 class HandlerPipeline:
     """Executes the full message processing pipeline.
 
@@ -1267,6 +1289,18 @@ class HandlerPipeline:
 
         # Determine destination (Contract 5)
         if message.reply_to:
+            # `reply_to` comes from the PUBLISHER. Publishing a handler result
+            # to it unchecked is a one-hop write into any queue in the vhost.
+            if not _reply_to_permitted(message.reply_to, route.reply_to_allow):
+                logger.warning(
+                    "Route %r refused to publish its result to reply_to=%r: not in reply_to_allow. "
+                    "Result dropped.",
+                    route.name,
+                    message.reply_to,
+                )
+                return None
+            if route.reply_to_allow is None and not message.reply_to.startswith(_DIRECT_REPLY_PREFIX):
+                route.runtime_state.warn_unbounded_reply_to(route.name, message.reply_to)
             # RPC reply takes precedence
             if user_envelope is not None:
                 # Preserve user-provided fields (headers, message_id,

{rabbitkit-0.14.0 → rabbitkit-0.17.0}/src/rabbitkit/core/registry.py

@@ -66,6 +66,7 @@ class SubscriberRegistry:
         prefetch_count: int | None = None,
         filter_fn: Callable[[RabbitMessage], bool] | None = None,
         reject_without_dlx: str | None = None,
+        reply_to_allow: tuple[str, ...] | None = None,
     ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
         """Decorator to register a message handler for a queue.
 
@@ -81,6 +82,12 @@ class SubscriberRegistry:
             description: Human-readable route description.
             name: Explicit route name (auto-generated if None).
             prefetch_count: Per-route prefetch override (None=use global).
+            reply_to_allow: Destinations this route may publish a handler
+                result to via the incoming message's ``reply_to``. That field
+                is set by the PUBLISHER, so leaving it unrestricted makes the
+                route a one-hop write into any queue in the vhost. ``None``
+                (default) allows anything and warns once per route. Entries
+                ending in ``*`` match as prefixes.
             reject_without_dlx: Per-route override of
                 ``SafetyConfig.reject_without_dlx`` — 'auto_provision',
                 'error', or 'discard' (None=inherit broker default).
@@ -144,6 +151,7 @@ class SubscriberRegistry:
                 description=description,
                 filter_fn=filter_fn,
                 reject_without_dlx=reject_without_dlx,
+                reply_to_allow=reply_to_allow,
             )
 
             # Validate at registration time (fail fast)

{rabbitkit-0.14.0 → rabbitkit-0.17.0}/src/rabbitkit/core/route.py

@@ -67,6 +67,26 @@ class RouteRuntimeState:
     """
 
     consumer_tag: str | None = None
+    #: One-shot latch for the unbounded-reply_to warning (see
+    #: RouteDefinition.reply_to_allow). Per route, so a busy queue does not
+    #: flood the log.
+    _warned_unbounded_reply_to: bool = False
+
+    def warn_unbounded_reply_to(self, route_name: str, reply_to: str) -> None:
+        """Warn ONCE that this route publishes results to an unrestricted
+        publisher-supplied destination."""
+        if self._warned_unbounded_reply_to:
+            return
+        self._warned_unbounded_reply_to = True
+        import logging
+
+        logging.getLogger(__name__).warning(
+            "Route %r published a handler result to reply_to=%r, which the PUBLISHER chose. "
+            "Without reply_to_allow this is a one-hop write into any queue in the vhost. "
+            "Set reply_to_allow=(...) on the subscriber to restrict it. Warned once per route.",
+            route_name,
+            reply_to,
+        )
 
 
 # ── Route definition ─────────────────────────────────────────────────────
@@ -124,6 +144,22 @@ class RouteDefinition:
     # Per-route override of SafetyConfig.reject_without_dlx (None = inherit)
     reject_without_dlx: str | None = None
 
+    # Destinations this route may publish a handler RESULT to via the
+    # incoming message's `reply_to`.
+    #
+    # `reply_to` is set by the PUBLISHER and was used verbatim as a routing
+    # key on the default exchange, which makes it a one-hop write primitive:
+    # a publisher who can reach one queue could have this route's handler
+    # output delivered into any queue in the vhost, including queues they
+    # have no publish rights to. Combined with a dedup result store, it also
+    # let a replayed message return someone else's stored result.
+    #
+    # None (default) keeps the previous behaviour and warns ONCE per route
+    # when a reply goes somewhere other than the broker's private
+    # direct-reply-to pseudo-queue. Set a tuple to enforce; entries ending in
+    # "*" are treated as prefixes.
+    reply_to_allow: tuple[str, ...] | None = None
+
     # ── Runtime state (mutable sub-object; populated by broker) ──
     runtime_state: RouteRuntimeState = field(default_factory=RouteRuntimeState)
 

{rabbitkit-0.14.0 → rabbitkit-0.17.0}/src/rabbitkit/core/router.py

@@ -81,6 +81,7 @@ class RabbitRouter:
         prefetch_count: int | None = None,
         filter_fn: Callable[[RabbitMessage], bool] | None = None,
         reject_without_dlx: str | None = None,
+        reply_to_allow: tuple[str, ...] | None = None,
     ) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
         """Register a subscriber on this router.
 
@@ -125,6 +126,7 @@ class RabbitRouter:
             prefetch_count=prefetch_count,
             filter_fn=filter_fn,
             reject_without_dlx=reject_without_dlx,
+            reply_to_allow=reply_to_allow,
         )
 
     def publisher(

{rabbitkit-0.14.0 → rabbitkit-0.17.0}/src/rabbitkit/core/sanitizer.py

@@ -35,7 +35,13 @@ _DEFAULT_PATTERNS: tuple[re.Pattern[str], ...] = (
     # scheme://user:password@host  → scheme://***:***@host
     # password is greedy up to the LAST "@" before the host so an unescaped
     # "@" inside the secret cannot leak its tail
-    re.compile(r"(?i)\b([a-z][a-z0-9+.-]*://)([^/\s:@]+):([^/\s]+)@"),
+    # The scheme run is bounded ({0,31}) on purpose. With an unbounded `*`
+    # this pattern is QUADRATIC: a long run of scheme-legal characters that
+    # never reaches "://" makes the engine retry from every offset. Measured
+    # before the bound: 8 KiB 0.06s, 16 KiB 0.25s, 32 KiB 0.96s, 64 KiB 3.8s
+    # — 4x per doubling, i.e. ~16 minutes for 1 MiB, on the event loop.
+    # Real URI schemes are a handful of characters (RFC 3986).
+    re.compile(r"(?i)\b([a-z][a-z0-9+.-]{0,31}://)([^/\s:@]{1,256}):([^/\s]{1,512})@"),
     # Authorization: Bearer <token> / Basic <blob>
     re.compile(r"(?i)\b(bearer|basic)\s+[A-Za-z0-9\-._~+/]+=*"),
     # key=value / key: value / "key": "value" for secret-bearing key names
@@ -53,6 +59,9 @@ _DEFAULT_PATTERNS: tuple[re.Pattern[str], ...] = (
 
 _CODE_SAFE = re.compile(r"[^A-Za-z0-9_.]")
 
+#: How much more than the kept summary to redact over. See summary_for().
+_REDACT_WINDOW_FACTOR = 8
+
 
 @dataclass(frozen=True, slots=True)
 class SanitizedError:
@@ -142,7 +151,20 @@ class ErrorSanitizer:
         # Collapse whitespace/newlines: a header is one line; a stack-trace-
         # shaped message must not smuggle formatting into log pipelines.
         text = " ".join(text.split())
-        return self.redact(text)[: self._max_summary]
+        # Bound the input BEFORE redacting. redact() runs six regexes over
+        # whatever it is given, and `str(exc)` is attacker-influenced whenever
+        # a handler echoes the body (json.JSONDecodeError, pydantic's
+        # ValidationError, ValueError(f"bad: {body}")). Redacting a 16 MiB
+        # message to keep 256 characters is pure waste, and on the async path
+        # it blocks the event loop, which costs heartbeats and wedges the
+        # consumer into a redelivery loop.
+        #
+        # The window is a MULTIPLE of the kept length, not the kept length:
+        # truncating to exactly _max_summary could slice a secret that starts
+        # just inside the kept region, leaving its prefix unredacted. With 8x
+        # slack, any secret beginning within the kept 256 characters is still
+        # seen whole by the patterns.
+        return self.redact(text[: self._max_summary * _REDACT_WINDOW_FACTOR])[: self._max_summary]
 
     def sanitize(self, exc: BaseException, severity: ErrorSeverity | None = None) -> SanitizedError:
         category = severity.value if severity is not None else "unknown"