rpc-python-toolkit 0.1.0__py3-none-any.whl → 0.2.1__py3-none-any.whl

rpc_python_toolkit/__init__.py

@@ -1,5 +1,5 @@
 from .client import RpcClient, RpcSafeClient
-from .endpoint import RpcEndpoint, RpcHttpResponse, RpcSafeEndpoint
+from .endpoint import RpcCallContext, RpcEndpoint, RpcHttpResponse, RpcSafeEndpoint
 from .errors import RpcError, RpcRemoteError
 from .serialization import deserialize_value, serialize_value
 from .version import __version__
@@ -10,10 +10,10 @@ __all__ = [
     "serialize_value",
     "RpcClient",
     "RpcEndpoint",
+    "RpcCallContext",
     "RpcError",
     "RpcHttpResponse",
     "RpcRemoteError",
     "RpcSafeClient",
     "RpcSafeEndpoint",
 ]
-

rpc_python_toolkit/endpoint.py

@@ -23,6 +23,19 @@ class RpcHttpResponse:
     body: Any | None = None
 
 
+@dataclass(frozen=True)
+class RpcCallContext:
+    """Context used when application state is not a mapping.
+
+    Mapping application contexts are merged with request data for backward
+    compatibility. For other application context types, this wrapper keeps
+    application and request scopes explicit.
+    """
+
+    application: Any
+    request: dict[str, Any]
+
+
 @dataclass
 class MethodConfig:
     handler: Handler
@@ -40,8 +53,11 @@ class RpcEndpoint:
         strict_mode: bool = True,
         enable_introspection: bool = False,
         introspection_prefix: str = "__rpc",
+        enable_batch: bool = True,
+        max_batch_size: int = 100,
         max_serialization_depth: int = 100,
         max_deserialization_depth: int = 100,
+        sanitize_errors: bool = True,
     ):
         self.context = context
         self.methods: dict[str, MethodConfig] = {}
@@ -49,8 +65,11 @@ class RpcEndpoint:
         self.strict_mode = strict_mode
         self.enable_introspection = enable_introspection
         self.introspection_prefix = introspection_prefix
+        self.enable_batch = enable_batch
+        self.max_batch_size = max_batch_size
         self.max_serialization_depth = max_serialization_depth
         self.max_deserialization_depth = max_deserialization_depth
+        self.sanitize_errors = sanitize_errors
         self.validator = SchemaValidator()
 
         if self.enable_introspection:
@@ -100,17 +119,13 @@ class RpcEndpoint:
         try:
             request = self._decode_payload(payload)
         except Exception as exc:
+            error = {"code": -32700, "message": "Parse error"}
+            if not self.sanitize_errors:
+                error["data"] = {"message": str(exc)}
             return RpcHttpResponse(
                 200,
                 headers,
-                make_response(
-                    None,
-                    error={
-                        "code": -32700,
-                        "message": "Parse error",
-                        "data": {"message": str(exc)},
-                    },
-                ),
+                make_response(None, error=error),
             )
 
         request_context = context or {}
@@ -159,6 +174,29 @@ class RpcEndpoint:
                 make_response(None, error={"code": -32600, "message": "Invalid Request"}),
             )
 
+        if not self.enable_batch:
+            return RpcHttpResponse(
+                200,
+                headers,
+                make_response(
+                    None,
+                    error={"code": -32600, "message": "Batch requests are not enabled"},
+                ),
+            )
+
+        if self.max_batch_size > 0 and len(batch) > self.max_batch_size:
+            return RpcHttpResponse(
+                200,
+                headers,
+                make_response(
+                    None,
+                    error={
+                        "code": -32600,
+                        "message": f"Batch size exceeds maximum of {self.max_batch_size}",
+                    },
+                ),
+            )
+
         responses = []
         for item in batch:
             result = self._process_single(item, context)
@@ -171,8 +209,12 @@ class RpcEndpoint:
         return RpcHttpResponse(200, headers, responses)
 
     def _process_single(self, request: Any, context: dict[str, Any]) -> dict[str, Any] | None:
+        # An invalid envelope is not a notification, even when it has no id.
+        # Do not echo an untrusted id until the complete envelope is validated.
+        valid_request = False
         try:
             validate_request_envelope(request)
+            valid_request = True
             client_safe_enabled = self._client_safe_enabled(context)
 
             if self.safe_enabled and self.strict_mode and not self._has_safe_header(context):
@@ -198,23 +240,24 @@ class RpcEndpoint:
                 result=self.serialize_bigints_and_dates(result),
             )
         except RpcError as exc:
-            if isinstance(request, dict) and not has_id(request):
+            if valid_request and not has_id(request):
                 return None
-            request_id = request.get("id") if isinstance(request, dict) else None
+            request_id = request.get("id") if valid_request else None
             return self._make_error_response(request_id, exc)
         except Exception as exc:
-            if isinstance(request, dict) and not has_id(request):
+            if valid_request and not has_id(request):
                 return None
-            request_id = request.get("id") if isinstance(request, dict) else None
+            request_id = request.get("id") if valid_request else None
             return self._make_error_response(request_id, RpcError(str(exc), -32603))
 
     def _make_error_response(self, request_id: Any, error: RpcError) -> dict[str, Any]:
+        internal_error = self.sanitize_errors and error.code == -32603
         body = {
             "code": error.code,
-            "message": str(error),
+            "message": "Internal error" if internal_error else str(error),
         }
 
-        if error.data is not None:
+        if not internal_error and error.data is not None:
             body["data"] = self.serialize_bigints_and_dates(error.data)
 
         return make_response(request_id, error=body)
@@ -226,11 +269,23 @@ class RpcEndpoint:
         context: dict[str, Any],
         params: Any,
     ) -> Any:
-        result = handler(request, self.context if self.context is not None else context, params)
+        result = handler(request, self._resolve_handler_context(context), params)
         if inspect.isawaitable(result):
             raise RpcError("Async handlers require an async adapter", -32603)
         return result
 
+    def _resolve_handler_context(self, request_context: dict[str, Any]) -> Any:
+        if self.context is None:
+            return request_context
+
+        if isinstance(self.context, dict):
+            return {**self.context, **request_context}
+
+        if request_context:
+            return RpcCallContext(application=self.context, request=request_context)
+
+        return self.context
+
     def _register_introspection_methods(self) -> None:
         prefix = self.introspection_prefix
 
@@ -255,7 +310,7 @@ class RpcEndpoint:
             f"{prefix}.capabilities",
             lambda _request, _context, _params: {
                 "jsonrpc": "2.0",
-                "batch": True,
+                "batch": self.enable_batch,
                 "notifications": True,
                 "introspection": True,
                 "safeMode": self.safe_enabled,
@@ -287,7 +342,10 @@ class RpcEndpoint:
             payload = payload.decode("utf-8")
 
         if isinstance(payload, str):
-            return json.loads(payload)
+            def reject_non_json_constant(value: str) -> None:
+                raise ValueError(f"Invalid JSON constant: {value}")
+
+            return json.loads(payload, parse_constant=reject_non_json_constant)
 
         return payload
 
@@ -311,4 +369,3 @@ class RpcSafeEndpoint(RpcEndpoint):
         options.setdefault("safe_enabled", True)
         options.setdefault("strict_mode", True)
         super().__init__(context, **options)
-

rpc_python_toolkit/protocol.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import math
 from typing import Any
 
 from .errors import RpcError
@@ -35,8 +36,14 @@ def validate_request_envelope(request: Any) -> None:
         raise RpcError("Method not specified or invalid", -32600)
 
     if "params" in request and not isinstance(request["params"], (dict, list)):
-        raise RpcError("Invalid params", -32602)
-
-    if "id" in request and not isinstance(request["id"], (str, int, float, type(None))):
-        raise RpcError("Invalid request id", -32600)
+        raise RpcError("Invalid params container", -32600)
+
+    if "id" in request:
+        request_id = request["id"]
+        if (
+            isinstance(request_id, bool)
+            or not isinstance(request_id, (str, int, float, type(None)))
+            or (isinstance(request_id, float) and not math.isfinite(request_id))
+        ):
+            raise RpcError("Invalid request id", -32600)
 

rpc_python_toolkit/version.py

@@ -1,2 +1 @@
-__version__ = "0.1.0"
-
+__version__ = "0.2.1"

{rpc_python_toolkit-0.1.0.dist-info → rpc_python_toolkit-0.2.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rpc-python-toolkit
-Version: 0.1.0
+Version: 0.2.1
 Summary: Framework-agnostic Python JSON-RPC 2.0 toolkit with Safe Mode interoperability.
 Author: Nicola Carpanese
 License-Expression: MIT
@@ -25,19 +25,34 @@ Dynamic: license-file
 
 # RPC Python Toolkit
 
+[![CI](https://github.com/n-car/rpc-python-toolkit/actions/workflows/ci.yml/badge.svg)](https://github.com/n-car/rpc-python-toolkit/actions/workflows/ci.yml)
+[![PyPI Version](https://img.shields.io/pypi/v/rpc-python-toolkit.svg)](https://pypi.org/project/rpc-python-toolkit/)
+[![Python Versions](https://img.shields.io/pypi/pyversions/rpc-python-toolkit.svg)](https://pypi.org/project/rpc-python-toolkit/)
+[![License](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![Status](https://img.shields.io/badge/status-alpha-orange.svg)](https://pypi.org/project/rpc-python-toolkit/)
+
 Framework-agnostic JSON-RPC 2.0 toolkit for Python.
 
 Use this package when you need a small Python JSON-RPC 2.0 client/server core that can be embedded directly or adapted to HTTP frameworks. It follows the same protocol conventions used across the RPC Toolkit ecosystem.
 
 ## Project Status
 
-Small early package with the core JSON-RPC behavior implemented.
+Alpha package with the core JSON-RPC behavior implemented.
 
 - Published on PyPI as `rpc-python-toolkit`.
 - Standard JSON-RPC 2.0 remains the default behavior.
 - Safe Mode follows the same `X-RPC-Safe-Enabled` and value marker conventions used by `rpc-express-toolkit`.
 - The public API may still change before a stable Python release.
 
+## Release Notes
+
+### 0.2.1 - 2026-10-12
+
+- Sanitize unexpected errors and `RpcError(-32603)` by default, removing internal messages and data while preserving explicit application errors.
+- Validate request envelopes and reject non-JSON numeric constants, scalar/null parameters, boolean IDs, and non-finite IDs.
+- Return errors for invalid batch elements, distinguish explicit null IDs from notifications, and preserve JSON payload shapes.
+- Add error-handling and protocol regression tests, and document the tightened wire contract and trusted handler context.
+
 ## Installation
 
 Install from PyPI:
@@ -80,7 +95,11 @@ python -m unittest discover
 ```python
 from rpc_python_toolkit import RpcEndpoint
 
-rpc = RpcEndpoint(enable_introspection=True)
+rpc = RpcEndpoint(
+    enable_introspection=True,
+    enable_batch=True,
+    max_batch_size=100,
+)
 
 def test(request, context, params):
     return {"ok": True, "params": params}
@@ -97,6 +116,28 @@ response = rpc.handle_payload({
 print(response.body)
 ```
 
+Batch can be disabled with `enable_batch=False`. Introspection remains opt-in.
+Unexpected errors and `RpcError` instances with code `-32603` return only
+`Internal error` by default, without internal messages or data. Other explicit
+`RpcError` codes, messages, and data are preserved. Parse errors omit diagnostic
+data. Use `sanitize_errors=False` only for local debugging to restore details.
+
+Only valid requests without an `id` are notifications. An explicit `id: null`
+receives a response; malformed envelopes (including scalar/null `params` or
+boolean/non-finite IDs) return `-32600` with `id: null`. Method parameter schema
+errors remain `-32602`.
+Malformed JSON, including the non-JSON constants `NaN`, `Infinity`, and `-Infinity`,
+returns `-32700`. Invalid elements in a batch produce individual error responses;
+valid notifications remain silent even when their method fails. Objects, arrays,
+and null results retain their JSON shapes.
+
+When both application and request contexts are dictionaries, handlers receive a
+merged dictionary and request values take precedence. For a non-dictionary
+application context plus request data, handlers receive `RpcCallContext` with
+separate `application` and `request` attributes.
+These contexts are supplied by application/adapter code. Client `params` remain a
+separate third handler argument and cannot replace trusted context.
+
 Result:
 
 ```json
@@ -131,6 +172,10 @@ Safe Mode enables `X-RPC-Safe-Enabled` negotiation and recursive value encoding/
 
 Python exposes arbitrary precision integers as `int`. BigInt marker strings from other RPC Toolkit implementations are decoded to Python `int` values when they are real markers, while literal marker-like strings are protected by the `S:` prefix in Safe Mode.
 
+Safe Mode transforms payload values, not method names, request IDs, error codes,
+or error messages. Application `RpcError.data` is encoded like a result; sanitized
+internal errors expose neither their original message nor their data.
+
 ## Examples
 
 Runnable examples are available in [`examples/`](examples/):

rpc_python_toolkit-0.2.1.dist-info/RECORD

@@ -0,0 +1,13 @@
+rpc_python_toolkit/__init__.py,sha256=OR3yfeiE-KEwC6CqAql59PljqW_VzHDyTwCZ5h7iJwU,514
+rpc_python_toolkit/client.py,sha256=QD3vf8OSdDe42522nwWEy2gEyNAjNJzayezvqN6jP5A,5276
+rpc_python_toolkit/endpoint.py,sha256=nucv7Q9gEeiFWQlL8ajdHFcgxjouK2EqqMMP-K_lOs0,12997
+rpc_python_toolkit/errors.py,sha256=en8mmO56IeT8OfRCTheMxNOUN09RpdLqR8X4BQTB6gk,374
+rpc_python_toolkit/protocol.py,sha256=CfI316lATY5qWH0LER5lnqR4c5m7tnh_S5sO4xDPVmc,1360
+rpc_python_toolkit/serialization.py,sha256=gWI0UyxzNj-EATaBkSG9i-b-De-bH49igqBmzkfE9fM,5755
+rpc_python_toolkit/validation.py,sha256=MXibLokBpBq_mDo7yxZ_64S6Mc_S1LWPM6UYsdxTXZg,617
+rpc_python_toolkit/version.py,sha256=HfjVOrpTnmZ-xVFCYSVmX50EXaBQeJteUHG-PD6iQs8,22
+rpc_python_toolkit-0.2.1.dist-info/licenses/LICENSE,sha256=-JOXJbeUglpNN6FaH-5OkUacdU1e8cXsttGJxO8EAAY,1074
+rpc_python_toolkit-0.2.1.dist-info/METADATA,sha256=9h1w-55QH0IpP4Tv2s2ZU1ryriyyqj7rxPZBrlPk5rI,8133
+rpc_python_toolkit-0.2.1.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+rpc_python_toolkit-0.2.1.dist-info/top_level.txt,sha256=KeHhMmqjDgfOlP13qPd9_FhW3vXFe2xTL3HzuDAqiv4,19
+rpc_python_toolkit-0.2.1.dist-info/RECORD,,

{rpc_python_toolkit-0.1.0.dist-info → rpc_python_toolkit-0.2.1.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (82.0.1)
+Generator: setuptools (84.0.0)
 Root-Is-Purelib: true
 Tag: py3-none-any
 

rpc_python_toolkit-0.1.0.dist-info/RECORD

@@ -1,13 +0,0 @@
-rpc_python_toolkit/__init__.py,sha256=ph_tY5IvR-ihwa9ubr-vKWIhS4ru73RmHVbRjt-7YME,477
-rpc_python_toolkit/client.py,sha256=QD3vf8OSdDe42522nwWEy2gEyNAjNJzayezvqN6jP5A,5276
-rpc_python_toolkit/endpoint.py,sha256=vMizSI0lQH2HpocWyZS4238NE2wK2peQmkjSvYArVXo,10867
-rpc_python_toolkit/errors.py,sha256=en8mmO56IeT8OfRCTheMxNOUN09RpdLqR8X4BQTB6gk,374
-rpc_python_toolkit/protocol.py,sha256=MMQ1tF1waizZ0dlq3LZc_Dx9tVN00KFLaWh70wR9g7A,1145
-rpc_python_toolkit/serialization.py,sha256=gWI0UyxzNj-EATaBkSG9i-b-De-bH49igqBmzkfE9fM,5755
-rpc_python_toolkit/validation.py,sha256=MXibLokBpBq_mDo7yxZ_64S6Mc_S1LWPM6UYsdxTXZg,617
-rpc_python_toolkit/version.py,sha256=p4MxVO8ih2-hnh7INVBkrqMKBDGTkMso1LEbM6mx3jg,23
-rpc_python_toolkit-0.1.0.dist-info/licenses/LICENSE,sha256=-JOXJbeUglpNN6FaH-5OkUacdU1e8cXsttGJxO8EAAY,1074
-rpc_python_toolkit-0.1.0.dist-info/METADATA,sha256=6SM4BQFhVt9QUCPJmp3k20qKy5Zcugd0hEhYQPPkm08,5317
-rpc_python_toolkit-0.1.0.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
-rpc_python_toolkit-0.1.0.dist-info/top_level.txt,sha256=KeHhMmqjDgfOlP13qPd9_FhW3vXFe2xTL3HzuDAqiv4,19
-rpc_python_toolkit-0.1.0.dist-info/RECORD,,