rpc-python-toolkit 0.2.0__py3-none-any.whl → 0.2.1__py3-none-any.whl

rpc_python_toolkit/endpoint.py

@@ -57,6 +57,7 @@ class RpcEndpoint:
         max_batch_size: int = 100,
         max_serialization_depth: int = 100,
         max_deserialization_depth: int = 100,
+        sanitize_errors: bool = True,
     ):
         self.context = context
         self.methods: dict[str, MethodConfig] = {}
@@ -68,6 +69,7 @@ class RpcEndpoint:
         self.max_batch_size = max_batch_size
         self.max_serialization_depth = max_serialization_depth
         self.max_deserialization_depth = max_deserialization_depth
+        self.sanitize_errors = sanitize_errors
         self.validator = SchemaValidator()
 
         if self.enable_introspection:
@@ -117,17 +119,13 @@ class RpcEndpoint:
         try:
             request = self._decode_payload(payload)
         except Exception as exc:
+            error = {"code": -32700, "message": "Parse error"}
+            if not self.sanitize_errors:
+                error["data"] = {"message": str(exc)}
             return RpcHttpResponse(
                 200,
                 headers,
-                make_response(
-                    None,
-                    error={
-                        "code": -32700,
-                        "message": "Parse error",
-                        "data": {"message": str(exc)},
-                    },
-                ),
+                make_response(None, error=error),
             )
 
         request_context = context or {}
@@ -211,8 +209,12 @@ class RpcEndpoint:
         return RpcHttpResponse(200, headers, responses)
 
     def _process_single(self, request: Any, context: dict[str, Any]) -> dict[str, Any] | None:
+        # An invalid envelope is not a notification, even when it has no id.
+        # Do not echo an untrusted id until the complete envelope is validated.
+        valid_request = False
         try:
             validate_request_envelope(request)
+            valid_request = True
             client_safe_enabled = self._client_safe_enabled(context)
 
             if self.safe_enabled and self.strict_mode and not self._has_safe_header(context):
@@ -238,23 +240,24 @@ class RpcEndpoint:
                 result=self.serialize_bigints_and_dates(result),
             )
         except RpcError as exc:
-            if isinstance(request, dict) and not has_id(request):
+            if valid_request and not has_id(request):
                 return None
-            request_id = request.get("id") if isinstance(request, dict) else None
+            request_id = request.get("id") if valid_request else None
             return self._make_error_response(request_id, exc)
         except Exception as exc:
-            if isinstance(request, dict) and not has_id(request):
+            if valid_request and not has_id(request):
                 return None
-            request_id = request.get("id") if isinstance(request, dict) else None
+            request_id = request.get("id") if valid_request else None
             return self._make_error_response(request_id, RpcError(str(exc), -32603))
 
     def _make_error_response(self, request_id: Any, error: RpcError) -> dict[str, Any]:
+        internal_error = self.sanitize_errors and error.code == -32603
         body = {
             "code": error.code,
-            "message": str(error),
+            "message": "Internal error" if internal_error else str(error),
         }
 
-        if error.data is not None:
+        if not internal_error and error.data is not None:
             body["data"] = self.serialize_bigints_and_dates(error.data)
 
         return make_response(request_id, error=body)
@@ -339,7 +342,10 @@ class RpcEndpoint:
             payload = payload.decode("utf-8")
 
         if isinstance(payload, str):
-            return json.loads(payload)
+            def reject_non_json_constant(value: str) -> None:
+                raise ValueError(f"Invalid JSON constant: {value}")
+
+            return json.loads(payload, parse_constant=reject_non_json_constant)
 
         return payload
 

rpc_python_toolkit/protocol.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import math
 from typing import Any
 
 from .errors import RpcError
@@ -35,8 +36,14 @@ def validate_request_envelope(request: Any) -> None:
         raise RpcError("Method not specified or invalid", -32600)
 
     if "params" in request and not isinstance(request["params"], (dict, list)):
-        raise RpcError("Invalid params", -32602)
-
-    if "id" in request and not isinstance(request["id"], (str, int, float, type(None))):
-        raise RpcError("Invalid request id", -32600)
+        raise RpcError("Invalid params container", -32600)
+
+    if "id" in request:
+        request_id = request["id"]
+        if (
+            isinstance(request_id, bool)
+            or not isinstance(request_id, (str, int, float, type(None)))
+            or (isinstance(request_id, float) and not math.isfinite(request_id))
+        ):
+            raise RpcError("Invalid request id", -32600)
 

rpc_python_toolkit/version.py

@@ -1 +1 @@
-__version__ = "0.2.0"
+__version__ = "0.2.1"

{rpc_python_toolkit-0.2.0.dist-info → rpc_python_toolkit-0.2.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rpc-python-toolkit
-Version: 0.2.0
+Version: 0.2.1
 Summary: Framework-agnostic Python JSON-RPC 2.0 toolkit with Safe Mode interoperability.
 Author: Nicola Carpanese
 License-Expression: MIT
@@ -44,6 +44,15 @@ Alpha package with the core JSON-RPC behavior implemented.
 - Safe Mode follows the same `X-RPC-Safe-Enabled` and value marker conventions used by `rpc-express-toolkit`.
 - The public API may still change before a stable Python release.
 
+## Release Notes
+
+### 0.2.1 - 2026-10-12
+
+- Sanitize unexpected errors and `RpcError(-32603)` by default, removing internal messages and data while preserving explicit application errors.
+- Validate request envelopes and reject non-JSON numeric constants, scalar/null parameters, boolean IDs, and non-finite IDs.
+- Return errors for invalid batch elements, distinguish explicit null IDs from notifications, and preserve JSON payload shapes.
+- Add error-handling and protocol regression tests, and document the tightened wire contract and trusted handler context.
+
 ## Installation
 
 Install from PyPI:
@@ -108,10 +117,26 @@ print(response.body)
 ```
 
 Batch can be disabled with `enable_batch=False`. Introspection remains opt-in.
+Unexpected errors and `RpcError` instances with code `-32603` return only
+`Internal error` by default, without internal messages or data. Other explicit
+`RpcError` codes, messages, and data are preserved. Parse errors omit diagnostic
+data. Use `sanitize_errors=False` only for local debugging to restore details.
+
+Only valid requests without an `id` are notifications. An explicit `id: null`
+receives a response; malformed envelopes (including scalar/null `params` or
+boolean/non-finite IDs) return `-32600` with `id: null`. Method parameter schema
+errors remain `-32602`.
+Malformed JSON, including the non-JSON constants `NaN`, `Infinity`, and `-Infinity`,
+returns `-32700`. Invalid elements in a batch produce individual error responses;
+valid notifications remain silent even when their method fails. Objects, arrays,
+and null results retain their JSON shapes.
+
 When both application and request contexts are dictionaries, handlers receive a
 merged dictionary and request values take precedence. For a non-dictionary
 application context plus request data, handlers receive `RpcCallContext` with
 separate `application` and `request` attributes.
+These contexts are supplied by application/adapter code. Client `params` remain a
+separate third handler argument and cannot replace trusted context.
 
 Result:
 
@@ -147,6 +172,10 @@ Safe Mode enables `X-RPC-Safe-Enabled` negotiation and recursive value encoding/
 
 Python exposes arbitrary precision integers as `int`. BigInt marker strings from other RPC Toolkit implementations are decoded to Python `int` values when they are real markers, while literal marker-like strings are protected by the `S:` prefix in Safe Mode.
 
+Safe Mode transforms payload values, not method names, request IDs, error codes,
+or error messages. Application `RpcError.data` is encoded like a result; sanitized
+internal errors expose neither their original message nor their data.
+
 ## Examples
 
 Runnable examples are available in [`examples/`](examples/):

rpc_python_toolkit-0.2.1.dist-info/RECORD

@@ -0,0 +1,13 @@
+rpc_python_toolkit/__init__.py,sha256=OR3yfeiE-KEwC6CqAql59PljqW_VzHDyTwCZ5h7iJwU,514
+rpc_python_toolkit/client.py,sha256=QD3vf8OSdDe42522nwWEy2gEyNAjNJzayezvqN6jP5A,5276
+rpc_python_toolkit/endpoint.py,sha256=nucv7Q9gEeiFWQlL8ajdHFcgxjouK2EqqMMP-K_lOs0,12997
+rpc_python_toolkit/errors.py,sha256=en8mmO56IeT8OfRCTheMxNOUN09RpdLqR8X4BQTB6gk,374
+rpc_python_toolkit/protocol.py,sha256=CfI316lATY5qWH0LER5lnqR4c5m7tnh_S5sO4xDPVmc,1360
+rpc_python_toolkit/serialization.py,sha256=gWI0UyxzNj-EATaBkSG9i-b-De-bH49igqBmzkfE9fM,5755
+rpc_python_toolkit/validation.py,sha256=MXibLokBpBq_mDo7yxZ_64S6Mc_S1LWPM6UYsdxTXZg,617
+rpc_python_toolkit/version.py,sha256=HfjVOrpTnmZ-xVFCYSVmX50EXaBQeJteUHG-PD6iQs8,22
+rpc_python_toolkit-0.2.1.dist-info/licenses/LICENSE,sha256=-JOXJbeUglpNN6FaH-5OkUacdU1e8cXsttGJxO8EAAY,1074
+rpc_python_toolkit-0.2.1.dist-info/METADATA,sha256=9h1w-55QH0IpP4Tv2s2ZU1ryriyyqj7rxPZBrlPk5rI,8133
+rpc_python_toolkit-0.2.1.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+rpc_python_toolkit-0.2.1.dist-info/top_level.txt,sha256=KeHhMmqjDgfOlP13qPd9_FhW3vXFe2xTL3HzuDAqiv4,19
+rpc_python_toolkit-0.2.1.dist-info/RECORD,,

rpc_python_toolkit-0.2.0.dist-info/RECORD

@@ -1,13 +0,0 @@
-rpc_python_toolkit/__init__.py,sha256=OR3yfeiE-KEwC6CqAql59PljqW_VzHDyTwCZ5h7iJwU,514
-rpc_python_toolkit/client.py,sha256=QD3vf8OSdDe42522nwWEy2gEyNAjNJzayezvqN6jP5A,5276
-rpc_python_toolkit/endpoint.py,sha256=uTIM2YxiOb6lk4ORMCyg12T64CERFuQWXCjQSd8ditc,12498
-rpc_python_toolkit/errors.py,sha256=en8mmO56IeT8OfRCTheMxNOUN09RpdLqR8X4BQTB6gk,374
-rpc_python_toolkit/protocol.py,sha256=MMQ1tF1waizZ0dlq3LZc_Dx9tVN00KFLaWh70wR9g7A,1145
-rpc_python_toolkit/serialization.py,sha256=gWI0UyxzNj-EATaBkSG9i-b-De-bH49igqBmzkfE9fM,5755
-rpc_python_toolkit/validation.py,sha256=MXibLokBpBq_mDo7yxZ_64S6Mc_S1LWPM6UYsdxTXZg,617
-rpc_python_toolkit/version.py,sha256=Zn1KFblwuFHiDRdRAiRnDBRkbPttWh44jKa5zG2ov0E,22
-rpc_python_toolkit-0.2.0.dist-info/licenses/LICENSE,sha256=-JOXJbeUglpNN6FaH-5OkUacdU1e8cXsttGJxO8EAAY,1074
-rpc_python_toolkit-0.2.0.dist-info/METADATA,sha256=eCYHtsYntC9qSy6AxvDv8BLf8-vVlcnbC_mK9MciTiA,6319
-rpc_python_toolkit-0.2.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-rpc_python_toolkit-0.2.0.dist-info/top_level.txt,sha256=KeHhMmqjDgfOlP13qPd9_FhW3vXFe2xTL3HzuDAqiv4,19
-rpc_python_toolkit-0.2.0.dist-info/RECORD,,