simple-module-hosting 0.0.17__tar.gz → 0.0.18__tar.gz

{simple_module_hosting-0.0.17 → simple_module_hosting-0.0.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simple_module_hosting
-Version: 0.0.17
+Version: 0.0.18
 Summary: FastAPI + Inertia.js host runtime for simple_module — app_builder, middleware stack, CLI (sm / simple-module), scaffolding
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -26,8 +26,8 @@ Requires-Dist: fastapi-inertia>=1.0
 Requires-Dist: fastapi>=0.115
 Requires-Dist: httpx>=0.27
 Requires-Dist: jinja2>=3.1
-Requires-Dist: simple-module-core==0.0.17
-Requires-Dist: simple-module-db==0.0.17
+Requires-Dist: simple-module-core==0.0.18
+Requires-Dist: simple-module-db==0.0.18
 Requires-Dist: starlette>=0.44
 Requires-Dist: tomlkit>=0.13
 Requires-Dist: uvicorn[standard]>=0.34

{simple_module_hosting-0.0.17 → simple_module_hosting-0.0.18}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_hosting"
-version = "0.0.17"
+version = "0.0.18"
 description = "FastAPI + Inertia.js host runtime for simple_module — app_builder, middleware stack, CLI (sm / simple-module), scaffolding"
 readme = "README.md"
 license = "MIT"
@@ -26,8 +26,8 @@ dependencies = [
     "fastapi-inertia>=1.0",
     "httpx>=0.27",
     "jinja2>=3.1",
-    "simple_module_core==0.0.17",
-    "simple_module_db==0.0.17",
+    "simple_module_core==0.0.18",
+    "simple_module_db==0.0.18",
     "starlette>=0.44",
     "tomlkit>=0.13",
     "uvicorn[standard]>=0.34",

{simple_module_hosting-0.0.17 → simple_module_hosting-0.0.18}/simple_module_hosting/_phase_helpers.py

@@ -105,6 +105,20 @@ def install_middleware(
     app.add_middleware(CorrelationIdMiddleware)
 
 
+def attach_public_routes(app: FastAPI, settings: Settings, registry) -> None:
+    """Seed host-level public paths and publish the registry for AuthMiddleware.
+
+    Modules contribute method-aware rules through their ``register_public_routes``
+    hook (already applied to *registry* by the caller). This adds the host escape
+    hatch — ``SM_AUTH_PUBLIC_PATHS`` prefixes — then exposes the registry at
+    ``app.state.public_routes``, where ``auth.middleware.AuthMiddleware`` reads it
+    on every request.
+    """
+    for prefix in settings.auth_public_paths:
+        registry.add_prefix(prefix)
+    app.state.public_routes = registry
+
+
 def mount_module_static_dirs(app: FastAPI, modules: list) -> None:
     """Mount each module's declared static directories.
 

{simple_module_hosting-0.0.17 → simple_module_hosting-0.0.18}/simple_module_hosting/app_builder.py

@@ -18,6 +18,7 @@ from simple_module_core.feature_flags import FeatureFlagRegistry
 from simple_module_core.health import HealthRegistry
 from simple_module_core.menu import MenuRegistry
 from simple_module_core.permissions import PermissionRegistry
+from simple_module_core.public_routes import PublicRouteRegistry
 from simple_module_core.services import Services
 from simple_module_db.listeners import register_listeners
 from simple_module_db.session import init_db
@@ -25,6 +26,7 @@ from simple_module_db.session import init_db
 from simple_module_hosting._host_services import _HostServices
 from simple_module_hosting._inertia_setup import setup_inertia
 from simple_module_hosting._phase_helpers import (
+    attach_public_routes,
     check_settings_registration,
     install_middleware,
     mount_module_static_dirs,
@@ -162,6 +164,7 @@ def create_app(settings: Settings | None = None) -> FastAPI:
     ff_registry = FeatureFlagRegistry()
     event_bus = EventBus()
     health_registry = HealthRegistry()
+    public_route_registry = PublicRouteRegistry()
 
     @asynccontextmanager
     async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
@@ -232,13 +235,18 @@ def create_app(settings: Settings | None = None) -> FastAPI:
         mod.register_feature_flags(ff_registry)
         _register_event_handlers(mod, event_bus, app)
         mod.register_health_checks(health_registry)
+        mod.register_public_routes(public_route_registry)
+
+    attach_public_routes(app, settings, public_route_registry)
 
     logger.info(
-        "Registered %d menu items, %d permissions, %d feature flags, %d health checks",
+        "Registered %d menu items, %d permissions, %d feature flags, "
+        "%d health checks, %d public routes",
         len(menu_registry.all_items),
         len(perm_registry.all_permissions),
         len(ff_registry.all_flags),
         len(health_registry.all_checks),
+        len(public_route_registry.routes),
     )
 
     # ── Phase 6: Initialize database ───────────────────────
@@ -281,6 +289,7 @@ def create_app(settings: Settings | None = None) -> FastAPI:
         permissions=perm_registry,
         feature_flags=ff_registry,
         health_registry=health_registry,
+        public_routes=public_route_registry,
         i18n_registry=i18n_registry,
         inertia_config=inertia_config,
         modules=tuple(modules),

{simple_module_hosting-0.0.17 → simple_module_hosting-0.0.18}/simple_module_hosting/bootstrap_settings.py

@@ -37,6 +37,15 @@ class BootstrapSettings(BaseSettings):
 
     modules_enabled: list[str] | None = None
 
+    auth_public_paths: list[str] = []
+    """Host-level anonymous-access path prefixes (``SM_AUTH_PUBLIC_PATHS``).
+
+    An escape hatch for exposing a route without a session when no module owns
+    it. Each entry is treated as a prefix rule and seeded into the
+    ``PublicRouteRegistry`` at boot. Modules should prefer the
+    ``register_public_routes`` hook, which is method-aware.
+    """
+
     @property
     def is_development(self) -> bool:
         return self.environment == "development"

{simple_module_hosting-0.0.17 → simple_module_hosting-0.0.18}/tests/test_app.py

@@ -65,6 +65,95 @@ class TestCreateApp:
         paths = {getattr(r, "path", None) for r in app.routes}
         assert "/modules/fakestatic/static" in paths
 
+    async def test_module_register_public_routes_is_wired(
+        self,
+        settings: Settings,
+        monkeypatch,
+    ):
+        """register_public_routes() contributions land on app.state.public_routes."""
+        from simple_module_core import ModuleBase, ModuleMeta
+        from simple_module_hosting import app_builder
+
+        class FakePublicMod(ModuleBase):
+            meta = ModuleMeta(name="FakePublic")
+
+            def register_public_routes(self, registry):
+                registry.add_prefix("/api/fakepublic/stac")
+                registry.add_regex(r"/api/fakepublic/datasets/[^/]+/tilejson$", methods={"GET"})
+
+        real_discover = app_builder.discover_modules
+
+        def fake_discover(enabled=None, *, strict=False):
+            return [*real_discover(enabled=enabled, strict=strict), FakePublicMod()]
+
+        monkeypatch.setattr(app_builder, "discover_modules", fake_discover)
+
+        app = create_app(settings)
+        registry = app.state.public_routes
+        assert registry is app.state.sm.public_routes
+        assert registry.matches("GET", "/api/fakepublic/stac/collections")
+        assert registry.matches("GET", "/api/fakepublic/datasets/7/tilejson")
+        assert not registry.matches("PATCH", "/api/fakepublic/datasets/7/tilejson")
+
+    async def test_host_public_paths_setting_is_seeded(self, settings: Settings):
+        """SM_AUTH_PUBLIC_PATHS prefixes land on the registry as prefix rules."""
+        with_paths = settings.model_copy(
+            update={"auth_public_paths": ["/api/hostpublic", "/status"]}
+        )
+        app = create_app(with_paths)
+        registry = app.state.public_routes
+        assert registry.matches("GET", "/api/hostpublic/anything")
+        assert registry.matches("POST", "/status")
+        assert not registry.matches("GET", "/api/private")
+
+    async def test_module_public_route_reachable_anonymously(
+        self,
+        settings: Settings,
+        monkeypatch,
+    ):
+        """End-to-end: an unauthenticated GET to a module-declared public route
+        returns 200, while a sibling gated route under the same prefix 401s.
+
+        This is the repro from issue #191 — a read-only anonymous API
+        (STAC / OGC) consumed without a session cookie.
+        """
+        from simple_module_core import ModuleBase, ModuleMeta
+        from simple_module_hosting import app_builder
+
+        class FakeGisMod(ModuleBase):
+            meta = ModuleMeta(name="FakeGis", route_prefix="/api/fakegis")
+
+            def register_routes(self, api_router, view_router):
+                @api_router.get("/stac")
+                async def stac():
+                    return {"type": "Catalog"}
+
+                @api_router.get("/secret")
+                async def secret():
+                    return {"private": True}
+
+            def register_public_routes(self, registry):
+                registry.add_prefix("/api/fakegis/stac")
+
+        real_discover = app_builder.discover_modules
+
+        def fake_discover(enabled=None, *, strict=False):
+            return [*real_discover(enabled=enabled, strict=strict), FakeGisMod()]
+
+        monkeypatch.setattr(app_builder, "discover_modules", fake_discover)
+
+        app = create_app(settings)
+        transport = httpx.ASGITransport(app=app)
+        async with httpx.AsyncClient(
+            transport=transport, base_url="http://testserver", follow_redirects=False
+        ) as client:
+            public = await client.get("/api/fakegis/stac")
+            gated = await client.get("/api/fakegis/secret")
+
+        assert public.status_code == 200
+        assert public.json() == {"type": "Catalog"}
+        assert gated.status_code == 401
+
     async def test_app_state_has_sm_services(
         self, monkeypatch: pytest.MonkeyPatch, tmp_path
     ) -> None: