simple-module-hosting 0.0.24__tar.gz → 0.0.26__tar.gz

{simple_module_hosting-0.0.24 → simple_module_hosting-0.0.26}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simple_module_hosting
-Version: 0.0.24
+Version: 0.0.26
 Summary: FastAPI + Inertia.js host runtime for simple_module — app_builder, middleware stack, CLI (sm / simple-module), scaffolding
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -26,8 +26,8 @@ Requires-Dist: fastapi-inertia>=1.0
 Requires-Dist: fastapi>=0.115
 Requires-Dist: httpx>=0.27
 Requires-Dist: jinja2>=3.1
-Requires-Dist: simple-module-core==0.0.24
-Requires-Dist: simple-module-db==0.0.24
+Requires-Dist: simple-module-core==0.0.26
+Requires-Dist: simple-module-db==0.0.26
 Requires-Dist: starlette>=0.44
 Requires-Dist: tomlkit>=0.13
 Requires-Dist: uvicorn[standard]>=0.34
@@ -64,11 +64,12 @@ Minimal `main.py`:
 from simple_module_hosting import create_app
 from simple_module_hosting.settings import Settings
 
-settings = Settings()           # reads SM_* env vars
-app = create_app(settings)      # discovers + registers every installed module
+settings = Settings()  # reads SM_* env vars
+app = create_app(settings)  # discovers + registers every installed module
 
 if __name__ == "__main__":
     import uvicorn
+
     uvicorn.run(app, host="0.0.0.0", port=8000)
 ```
 

{simple_module_hosting-0.0.24 → simple_module_hosting-0.0.26}/README.md

@@ -29,11 +29,12 @@ Minimal `main.py`:
 from simple_module_hosting import create_app
 from simple_module_hosting.settings import Settings
 
-settings = Settings()           # reads SM_* env vars
-app = create_app(settings)      # discovers + registers every installed module
+settings = Settings()  # reads SM_* env vars
+app = create_app(settings)  # discovers + registers every installed module
 
 if __name__ == "__main__":
     import uvicorn
+
     uvicorn.run(app, host="0.0.0.0", port=8000)
 ```
 

{simple_module_hosting-0.0.24 → simple_module_hosting-0.0.26}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_hosting"
-version = "0.0.24"
+version = "0.0.26"
 description = "FastAPI + Inertia.js host runtime for simple_module — app_builder, middleware stack, CLI (sm / simple-module), scaffolding"
 readme = "README.md"
 license = "MIT"
@@ -26,8 +26,8 @@ dependencies = [
     "fastapi-inertia>=1.0",
     "httpx>=0.27",
     "jinja2>=3.1",
-    "simple_module_core==0.0.24",
-    "simple_module_db==0.0.24",
+    "simple_module_core==0.0.26",
+    "simple_module_db==0.0.26",
     "starlette>=0.44",
     "tomlkit>=0.13",
     "uvicorn[standard]>=0.34",

{simple_module_hosting-0.0.24 → simple_module_hosting-0.0.26}/simple_module_hosting/_error_handlers.py

@@ -27,6 +27,13 @@ async def render_error_page(request: Request, status_code: int, message: str) ->
     config: InertiaConfig = request.app.state.sm.inertia_config
     try:
         inertia = Inertia(request, config)
+        # This builds its own Inertia instead of going through get_inertia, so
+        # the share step has to be repeated here. Without it the error page
+        # renders raw translation keys (host.error.not_found_title) and loses
+        # auth/menus, so a signed-in user's 404 has no layout.
+        shared = getattr(request.state, "inertia_shared", None)
+        if shared:
+            inertia.share(**shared)
         response = await inertia.render("Error", {"status": status_code, "message": message})
         response.status_code = status_code
         return response

{simple_module_hosting-0.0.24 → simple_module_hosting-0.0.26}/simple_module_hosting/_phase_helpers.py

@@ -22,9 +22,9 @@ from inertia import (
 from simple_module_core.diagnostics import Diagnostic, DiagnosticLevel
 from simple_module_core.exceptions import NotFoundError
 from starlette.exceptions import HTTPException
+from starlette.middleware.gzip import GZipMiddleware
 from starlette.middleware.sessions import SessionMiddleware
-from starlette.responses import Response
-from starlette.types import Scope
+from uvicorn.middleware.proxy_headers import ProxyHeadersMiddleware
 
 from simple_module_hosting._error_handlers import (
     http_exception_handler,
@@ -32,6 +32,8 @@ from simple_module_hosting._error_handlers import (
     request_validation_error_handler,
     unhandled_exception_handler,
 )
+from simple_module_hosting._host_services import _HostServices
+from simple_module_hosting.host_settings import HostSettings
 from simple_module_hosting.i18n_middleware import LocaleMiddleware
 from simple_module_hosting.middleware import (
     CorrelationIdMiddleware,
@@ -41,6 +43,7 @@ from simple_module_hosting.middleware import (
     TenantMiddleware,
 )
 from simple_module_hosting.settings import Settings
+from simple_module_hosting.static_files import PrecompressedStaticFiles
 
 if TYPE_CHECKING:
     from simple_module_core.menu import MenuRegistry
@@ -48,27 +51,11 @@ if TYPE_CHECKING:
 
 logger = logging.getLogger(__name__)
 
-_IMMUTABLE_CACHE_CONTROL = "public, max-age=31536000, immutable"
+# Below this, gzip framing costs more than it saves. Starlette's own default.
+COMPRESSION_MIN_BYTES = 500
 
-
-class ImmutableStaticFiles(StaticFiles):
-    """StaticFiles that marks Vite's content-hashed build assets immutable.
-
-    Vite emits files under ``dist/assets/`` with a content hash in the filename
-    (e.g. ``main-3YbShAJ4.js``), so the bytes for a given URL never change —
-    browsers can cache them indefinitely and skip even the revalidation
-    round-trip. The default StaticFiles only sets ETag/Last-Modified, forcing a
-    conditional GET per asset on every visit. Non-hashed paths (the manifest,
-    etc.) keep the default behaviour.
-    """
-
-    async def get_response(self, path: str, scope: Scope) -> Response:
-        response = await super().get_response(path, scope)
-        # StaticFiles hands us an OS-separator path (backslashes on Windows), so
-        # normalize before matching the forward-slash asset prefix.
-        if response.status_code == 200 and path.replace("\\", "/").startswith("dist/assets/"):
-            response.headers["Cache-Control"] = _IMMUTABLE_CACHE_CONTROL
-        return response
+# Re-exported for back-compat: static-file serving now lives in static_files.
+ImmutableStaticFiles = PrecompressedStaticFiles
 
 
 def register_exception_handlers(app: FastAPI, modules: list) -> None:
@@ -95,8 +82,8 @@ def install_middleware(
     """Install the full middleware pipeline.
 
     Order matters: last added = first executed. Execution order:
-    CorrelationId → RequestLogging → Security → Session
-    → [module] → (Tenant, if multi_tenant) → Locale → Inertia.
+    (ProxyHeaders, if trusted_proxy) → CorrelationId → RequestLogging
+    → Security → Session → [module] → (Tenant, if multi_tenant) → Locale → Inertia.
     """
     app.add_middleware(
         InertiaLayoutDataMiddleware,
@@ -125,8 +112,21 @@ def install_middleware(
         )
     else:
         app.add_middleware(SecurityHeadersMiddleware)
+    # Compress response bodies. Added here so it sits inside CorrelationId and
+    # RequestLogging (which set headers and read request state) but outside
+    # everything that produces a body — including the /static mount, where it
+    # matters most: the built CSS is ~139 KB raw and ~21 KB gzipped, and the
+    # JS bundle compresses about 3x. Uncompressed assets dominated cold page
+    # load, several times larger than anything on the server request path.
+    app.add_middleware(GZipMiddleware, minimum_size=COMPRESSION_MIN_BYTES)
     app.add_middleware(RequestLoggingMiddleware)
     app.add_middleware(CorrelationIdMiddleware)
+    # Outermost: rewrite scheme/client from X-Forwarded-* before anything else
+    # reads them, so request logs see the real client IP and Inertia's absolute
+    # page url carries the proxy-terminated scheme (GH #223). Gated on an
+    # explicit trust setting — never trust forwarded headers by default.
+    if settings.trusted_proxy:
+        app.add_middleware(ProxyHeadersMiddleware, trusted_hosts=settings.trusted_proxy)
 
 
 def attach_public_routes(app: FastAPI, settings: Settings, registry) -> None:
@@ -167,6 +167,32 @@ def mount_module_static_dirs(app: FastAPI, modules: list) -> None:
             )
 
 
+def register_host_settings(app: FastAPI) -> None:
+    """Register host-level settings under ``package="host"`` (DB-backed).
+
+    The Settings module must already have run ``register_settings`` — topo
+    order puts it early, since its ``meta.depends_on`` is empty. When the
+    Settings module isn't enabled there's no registry to register against, so
+    this skips quietly.
+
+    ``settings.registration`` is resolved via importlib rather than a plain
+    ``from settings.registration import ...``: the SM009 coupling check is
+    AST-based and forbids any static import of a plugin package name from
+    within ``framework/*``. Dynamic resolution keeps the framework AST
+    plugin-free while still hitting the real helper at runtime.
+    """
+    if not hasattr(app.state, "settings"):
+        return
+
+    import importlib
+
+    register_module_settings = importlib.import_module(
+        "settings.registration"
+    ).register_module_settings
+
+    register_module_settings(app, "host", HostSettings, lambda s: _HostServices(settings=s))
+
+
 def check_settings_registration(app: FastAPI, modules: list) -> list[Diagnostic]:
     """SM012: warn if a module overrides register_settings but added nothing to app.state.
 

{simple_module_hosting-0.0.24 → simple_module_hosting-0.0.26}/simple_module_hosting/app_builder.py

@@ -10,6 +10,7 @@ from contextlib import asynccontextmanager
 from pathlib import Path
 
 from fastapi import FastAPI
+from simple_module_core.design_packs import DesignPackRegistry
 from simple_module_core.diagnostics import DiagnosticLevel, print_diagnostics, run_diagnostics
 from simple_module_core.discovery import discover_modules, topological_sort
 from simple_module_core.events import EventBus
@@ -22,22 +23,21 @@ from simple_module_core.services import Services
 from simple_module_db.listeners import register_listeners
 from simple_module_db.session import init_db
 
-from simple_module_hosting._host_services import _HostServices
 from simple_module_hosting._inertia_setup import setup_inertia
 from simple_module_hosting._phase_helpers import (
-    ImmutableStaticFiles,
     attach_public_routes,
     check_settings_registration,
     install_middleware,
     mount_module_static_dirs,
     register_exception_handlers,
+    register_host_settings,
     wire_module_routes,
 )
 from simple_module_hosting.health import router as health_router
-from simple_module_hosting.host_settings import HostSettings
 from simple_module_hosting.i18n_manifest import build_i18n_registry, emit_frontend_types
 from simple_module_hosting.migrations import check_migrations
 from simple_module_hosting.settings import Settings
+from simple_module_hosting.static_files import PrecompressedStaticFiles
 
 logger = logging.getLogger(__name__)
 
@@ -165,6 +165,7 @@ def create_app(settings: Settings | None = None) -> FastAPI:
     event_bus = EventBus()
     health_registry = HealthRegistry()
     public_route_registry = PublicRouteRegistry()
+    design_pack_registry = DesignPackRegistry()
 
     @asynccontextmanager
     async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
@@ -203,25 +204,7 @@ def create_app(settings: Settings | None = None) -> FastAPI:
     for mod in modules:
         mod.register_settings(app)
 
-    # Register host-level settings under package="host" (DB-backed). The
-    # Settings module must already have run register_settings (topo order
-    # puts it early; its meta.depends_on = [] so it's among the first).
-    # When the Settings module isn't enabled, there's no registry to
-    # register against — skip quietly.
-    #
-    # We resolve `settings.registration` via importlib rather than a plain
-    # `from settings.registration import ...`: the SM009 coupling check is
-    # AST-based and forbids any static import of a plugin package name
-    # from within framework/* code. Dynamic resolution keeps the framework
-    # AST plugin-free while still hitting the real helper at runtime.
-    if hasattr(app.state, "settings"):
-        import importlib
-
-        _register_module_settings = importlib.import_module(
-            "settings.registration"
-        ).register_module_settings
-
-        _register_module_settings(app, "host", HostSettings, lambda s: _HostServices(settings=s))
+    register_host_settings(app)
 
     if settings.is_development:
         settings_diagnostics = check_settings_registration(app, modules)
@@ -236,17 +219,23 @@ def create_app(settings: Settings | None = None) -> FastAPI:
         _register_event_handlers(mod, event_bus, app)
         mod.register_health_checks(health_registry)
         mod.register_public_routes(public_route_registry)
+        mod.register_design_packs(design_pack_registry)
 
     attach_public_routes(app, settings, public_route_registry)
 
+    # Branding reads the packs off app.state directly: its API validates a
+    # submitted slug before persisting it, and its view builds the dropdown.
+    app.state.design_packs = design_pack_registry
+
     logger.info(
         "Registered %d menu items, %d permissions, %d feature flags, "
-        "%d health checks, %d public routes",
+        "%d health checks, %d public routes, %d design packs",
         len(menu_registry.all_items),
         len(perm_registry.all_permissions),
         len(ff_registry.all_flags),
         len(health_registry.all_checks),
         len(public_route_registry.routes),
+        len(design_pack_registry.all()),
     )
 
     # ── Phase 6: Initialize database ───────────────────────
@@ -277,9 +266,8 @@ def create_app(settings: Settings | None = None) -> FastAPI:
 
     static_dir = _PROJECT_ROOT / "host" / _STATIC_DIR_NAME
     if static_dir.is_dir():
-        app.mount(
-            _STATIC_MOUNT_PATH, ImmutableStaticFiles(directory=static_dir), name=_STATIC_DIR_NAME
-        )
+        static = PrecompressedStaticFiles(directory=static_dir)
+        app.mount(_STATIC_MOUNT_PATH, static, name=_STATIC_DIR_NAME)
 
     mount_module_static_dirs(app, modules)
 
@@ -292,6 +280,7 @@ def create_app(settings: Settings | None = None) -> FastAPI:
         feature_flags=ff_registry,
         health_registry=health_registry,
         public_routes=public_route_registry,
+        design_packs=design_pack_registry,
         i18n_registry=i18n_registry,
         inertia_config=inertia_config,
         modules=tuple(modules),

{simple_module_hosting-0.0.24 → simple_module_hosting-0.0.26}/simple_module_hosting/bootstrap_settings.py

@@ -9,7 +9,7 @@ from __future__ import annotations
 
 from typing import Literal
 
-from pydantic import model_validator
+from pydantic import field_validator, model_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 from simple_module_core.environments import NON_PROD_ENVIRONMENTS
 
@@ -32,6 +32,15 @@ class BootstrapSettings(BaseSettings):
     vite_dev_url: str = "http://localhost:5050"
     debug: bool = False
 
+    # Trust the X-Forwarded-* headers from a fronting reverse proxy. Unset by
+    # default (no proxy trusted). Set to ``*`` to trust any peer (correct when
+    # the container is only reachable through a single proxy), or a comma-
+    # separated list of proxy IPs / CIDRs. Drives uvicorn's
+    # ProxyHeadersMiddleware so request.url.scheme reflects X-Forwarded-Proto
+    # behind a TLS-terminating proxy — without it Inertia's pushState throws a
+    # cross-scheme SecurityError and login breaks (GH #223).
+    trusted_proxy: str | None = None
+
     log_level: str = "INFO"
     log_format: Literal["json", "text"] = "json"
 
@@ -46,6 +55,21 @@ class BootstrapSettings(BaseSettings):
     ``register_public_routes`` hook, which is method-aware.
     """
 
+    @field_validator("trusted_proxy", mode="after")
+    @classmethod
+    def _normalize_trusted_proxy(cls, value: str | None) -> str | None:
+        """Strip surrounding whitespace; treat blank as unset.
+
+        Guards against a stray space silently defeating the feature: uvicorn
+        decides ``*``-trust by comparing the *raw* string to ``"*"`` before it
+        strips, so ``"* "`` would be parsed as a literal host that matches no
+        client — re-introducing GH #223 with no error. Blank → ``None`` so the
+        middleware isn't installed at all.
+        """
+        if value is None:
+            return None
+        return value.strip() or None
+
     @property
     def is_development(self) -> bool:
         return self.environment == "development"

simple_module_hosting-0.0.26/simple_module_hosting/static_files.py

@@ -0,0 +1,102 @@
+"""Static-file serving: immutable caching and pre-compressed variants.
+
+Split out of ``_phase_helpers`` — static delivery is its own responsibility,
+and that module was near the repo's 300-line cap.
+
+Two optimizations live here, both aimed at cold page load:
+
+* **Immutable caching.** Vite emits content-hashed filenames, so the bytes for
+  a given URL never change and the browser can skip even the revalidation
+  round-trip.
+* **Pre-compressed variants.** ``GZipMiddleware`` would otherwise re-compress
+  the same immutable bundle on every request, using a fast (and therefore
+  worse) compression level. Files compressed once at build time can afford the
+  maximum level, and brotli is ~14% smaller than gzip on this bundle.
+"""
+
+from __future__ import annotations
+
+from mimetypes import guess_type
+
+from fastapi.staticfiles import StaticFiles
+from starlette.datastructures import Headers
+from starlette.exceptions import HTTPException
+from starlette.responses import Response
+from starlette.types import Scope
+
+__all__ = ["IMMUTABLE_CACHE_CONTROL", "PrecompressedStaticFiles"]
+
+IMMUTABLE_CACHE_CONTROL = "public, max-age=31536000, immutable"
+
+_HASHED_ASSET_PREFIX = "dist/assets/"
+_ACCEPT_ENCODING = "accept-encoding"
+_CONTENT_ENCODING = "Content-Encoding"
+_CONTENT_TYPE = "content-type"
+_VARY = "Vary"
+_ACCEPT_ENCODING_HEADER = "Accept-Encoding"
+_OK = 200
+
+# (encoding token, filename suffix), best first. Brotli wins where offered:
+# measured 248.5 KB vs 287.6 KB gzip-9 across this bundle.
+_VARIANTS: tuple[tuple[str, str], ...] = (("br", ".br"), ("gzip", ".gz"))
+
+
+def _accepted_encodings(scope: Scope) -> set[str]:
+    """Encoding tokens the client advertises.
+
+    Deliberately ignores q-values. Any client sending ``br;q=0`` to actively
+    refuse brotli is vanishingly rare, and getting it wrong only costs a few
+    KB — whereas parsing it wrong could serve a body the client cannot read.
+    Tokens are matched exactly, so a ``q=0`` entry still reads as "accepted";
+    that is the conservative direction only because every real client that
+    lists an encoding can decode it.
+    """
+    raw = Headers(scope=scope).get(_ACCEPT_ENCODING, "")
+    return {part.split(";")[0].strip().lower() for part in raw.split(",") if part.strip()}
+
+
+class PrecompressedStaticFiles(StaticFiles):
+    """Serve ``.br``/``.gz`` siblings when present, and mark hashed assets immutable.
+
+    A request for ``app.js`` is answered with ``app.js.br`` when the client
+    accepts brotli and that file exists, falling back to ``.gz`` and then to the
+    original. The response keeps the *original* file's Content-Type — serving
+    ``app.js.br`` directly would have Starlette type it from the ``.br``
+    extension, and a browser will refuse to execute a script typed as
+    ``application/octet-stream``.
+
+    ``Vary: Accept-Encoding`` is always set on a negotiated response so shared
+    caches cannot hand a compressed body to a client that never asked for one.
+    """
+
+    async def get_response(self, path: str, scope: Scope) -> Response:
+        response = await self._get_negotiated_response(path, scope)
+        # StaticFiles hands us an OS-separator path (backslashes on Windows), so
+        # normalize before matching the forward-slash asset prefix.
+        if response.status_code == _OK and path.replace("\\", "/").startswith(_HASHED_ASSET_PREFIX):
+            response.headers["Cache-Control"] = IMMUTABLE_CACHE_CONTROL
+        return response
+
+    async def _get_negotiated_response(self, path: str, scope: Scope) -> Response:
+        accepted = _accepted_encodings(scope)
+        for encoding, suffix in _VARIANTS:
+            if encoding not in accepted:
+                continue
+            # StaticFiles signals "no such file" by *raising* HTTPException(404),
+            # not by returning a 404 response — so a missing variant has to be
+            # caught here, not detected from a status code.
+            try:
+                variant = await super().get_response(path + suffix, scope)
+            except HTTPException:
+                continue
+            if variant.status_code != _OK:
+                continue
+            # Type by the original filename, not the variant's extension: a
+            # browser refuses to execute a script typed application/octet-stream.
+            content_type = guess_type(path)[0]
+            if content_type:
+                variant.headers[_CONTENT_TYPE] = content_type
+            variant.headers[_CONTENT_ENCODING] = encoding
+            variant.headers[_VARY] = _ACCEPT_ENCODING_HEADER
+            return variant
+        return await super().get_response(path, scope)

simple_module_hosting-0.0.26/tests/test_design_packs_wiring.py

@@ -0,0 +1,52 @@
+"""``create_app`` must collect module design packs onto ``app.state.design_packs``.
+
+Branding reads this registry twice — the view builds its dropdown from it, and
+the API validates a submitted slug against it. If the hook were never called,
+or the populated registry never reached ``app.state``, branding would offer an
+empty dropdown and reject every pack, with nothing in the logs to explain why.
+"""
+
+from __future__ import annotations
+
+import simple_module_hosting.app_builder as app_builder
+from simple_module_core.design_packs import DesignPack, DesignPackRegistry
+from simple_module_core.module import ModuleBase, ModuleMeta
+from simple_module_hosting.app_builder import create_app
+
+_PACK = DesignPack(value="pack-fixture", label="Pack Fixture")
+
+
+class _PackModule(ModuleBase):
+    """A module whose only contribution is one design pack."""
+
+    meta = ModuleMeta(name="PackFixture")
+
+    def register_design_packs(self, registry: DesignPackRegistry) -> None:
+        registry.register(_PACK)
+
+
+def test_registry_is_published_on_app_state(settings):
+    app = create_app(settings)
+    assert isinstance(app.state.design_packs, DesignPackRegistry)
+
+
+def test_module_registered_pack_reaches_app_state(monkeypatch, settings):
+    real_discover = app_builder.discover_modules
+
+    def _with_pack_module(*args, **kwargs):
+        return [*real_discover(*args, **kwargs), _PackModule()]
+
+    monkeypatch.setattr(app_builder, "discover_modules", _with_pack_module)
+
+    app = create_app(settings)
+
+    assert app.state.design_packs.has("pack-fixture")
+    assert _PACK in app.state.design_packs.all()
+
+
+def test_registry_is_also_reachable_through_services(settings):
+    # ``app.state.sm`` is the aggregate every other registry is published on;
+    # design packs should not be the one exception a module author has to
+    # remember a different lookup for.
+    app = create_app(settings)
+    assert app.state.sm.design_packs is app.state.design_packs

simple_module_hosting-0.0.26/tests/test_error_page_shared_props.py

@@ -0,0 +1,67 @@
+"""The Inertia error page must carry the same shared props as any other page.
+
+``render_error_page`` builds its own ``Inertia`` instance instead of going
+through ``get_inertia``, so it skipped the ``inertia.share(**shared)`` step.
+The consequence was visible: a 404 rendered its copy as raw translation keys
+— ``host.error.not_found_title``, ``host.error.go_home`` — because the page
+received no ``i18n`` block at all. It also lost ``auth`` and ``menus``, so the
+error page could not render the layout a signed-in user expects.
+"""
+
+from __future__ import annotations
+
+import html
+import json
+import re
+
+import httpx
+import pytest
+
+_NOT_FOUND = 404
+_MISSING_PATH = "/definitely/not/a/real/route"
+
+
+def _inertia_page(body: str) -> dict:
+    """Pull the JSON blob Inertia embeds in the server-rendered document."""
+    match = re.search(r'data-page="([^"]+)"', body) or re.search(r"data-page='([^']+)'", body)
+    if match is None:
+        pytest.fail("no data-page attribute found — the error page did not render via Inertia")
+    return json.loads(html.unescape(match.group(1)))
+
+
+class TestErrorPageSharedProps:
+    async def test_error_page_renders_via_inertia(
+        self, authenticated_client: httpx.AsyncClient
+    ) -> None:
+        resp = await authenticated_client.get(_MISSING_PATH)
+        assert resp.status_code == _NOT_FOUND
+        assert _inertia_page(resp.text)["component"] == "Error"
+
+    async def test_error_page_carries_i18n_messages(
+        self, authenticated_client: httpx.AsyncClient
+    ) -> None:
+        """Without this the page prints raw keys like host.error.not_found_title."""
+        resp = await authenticated_client.get(_MISSING_PATH)
+        props = _inertia_page(resp.text)["props"]
+        assert "i18n" in props, f"error page has no i18n block; props={sorted(props)}"
+        assert props["i18n"].get("messages"), "i18n block present but messages are empty"
+
+    async def test_error_page_carries_auth_and_menus(
+        self, authenticated_client: httpx.AsyncClient
+    ) -> None:
+        """The layout needs these to render for a signed-in user."""
+        props = _inertia_page((await authenticated_client.get(_MISSING_PATH)).text)["props"]
+        assert "auth" in props, f"error page has no auth block; props={sorted(props)}"
+        assert "menus" in props, f"error page has no menus block; props={sorted(props)}"
+
+    async def test_error_page_keeps_its_own_props(
+        self, authenticated_client: httpx.AsyncClient
+    ) -> None:
+        """Sharing must not clobber status/message."""
+        props = _inertia_page((await authenticated_client.get(_MISSING_PATH)).text)["props"]
+        assert props["status"] == _NOT_FOUND
+
+    async def test_anonymous_error_page_still_renders(self, client: httpx.AsyncClient) -> None:
+        """An unauthenticated 404 must not blow up on missing shared state."""
+        resp = await client.get("/health/definitely-not-real")
+        assert resp.status_code >= _NOT_FOUND

simple_module_hosting-0.0.26/tests/test_menu_urls_are_canonical.py

@@ -0,0 +1,65 @@
+"""Every sidebar link must hit its route directly, with no redirect.
+
+A menu item pointing at ``/audit_log`` when the route is registered at
+``/audit_log/`` still works — Starlette 307s to the canonical path and the
+client follows. But it costs a full extra round trip on *every* navigation to
+that page. On localhost that's ~8 ms and invisible; on a 40 ms-latency link it
+roughly doubles the navigation, and it is worse on mobile.
+
+Five of the eight sidebar links had this mismatch when this test was written.
+It is a whole class of bug that no functional test catches, because everything
+still renders correctly — just slower.
+"""
+
+from __future__ import annotations
+
+import httpx
+import pytest
+from simple_module_hosting.middleware import InertiaLayoutDataMiddleware
+
+_REDIRECT_CODES = {301, 302, 307, 308}
+_NOT_FOUND = 404
+
+
+def _menu_urls(app) -> list[str]:
+    """Every internal menu URL registered by the installed modules."""
+    for mw in app.user_middleware:
+        if mw.cls is InertiaLayoutDataMiddleware:
+            registry = mw.kwargs["menu_registry"]
+            break
+    else:  # pragma: no cover - the middleware is always installed
+        pytest.fail("InertiaLayoutDataMiddleware not installed")
+
+    return sorted(
+        {
+            item.url
+            for item in registry.all_items
+            if item.url.startswith("/") and item.method == "get"
+        }
+    )
+
+
+async def test_menu_urls_do_not_redirect(app, authenticated_client: httpx.AsyncClient) -> None:
+    """No sidebar link may cost a redirect hop."""
+    offenders: list[str] = []
+    for url in _menu_urls(app):
+        resp = await authenticated_client.get(url, headers={"X-Inertia": "true"})
+        if resp.status_code in _REDIRECT_CODES:
+            offenders.append(f"{url} -> {resp.status_code} {resp.headers.get('location', '')}")
+
+    assert not offenders, (
+        "These menu URLs redirect, costing an extra round trip on every "
+        "navigation. Point the menu item at the canonical path (usually adding "
+        "a trailing slash), or register the route without one:\n  " + "\n  ".join(offenders)
+    )
+
+
+async def test_menu_urls_resolve(app, authenticated_client: httpx.AsyncClient) -> None:
+    """A menu item pointing at a route that doesn't exist is a dead link."""
+    dead: list[str] = []
+    for url in _menu_urls(app):
+        resp = await authenticated_client.get(url, headers={"X-Inertia": "true"})
+        if resp.status_code == _NOT_FOUND:
+            dead.append(url)
+
+    assert not dead, f"menu URLs resolve to 404: {dead}"

{simple_module_hosting-0.0.24 → simple_module_hosting-0.0.26}/tests/test_middleware_order.py

@@ -2,12 +2,15 @@
 
 CLAUDE.md spells out the pipeline:
 
-    CorrelationId → RequestLogging → Security → Session → <module>
+    CorrelationId → RequestLogging → GZip → Security → Session → <module>
                   → Tenant (opt-in) → Locale → InertiaLayoutData → app
 
 Tenant/Locale must see ``request.state.user`` set by AuthMiddleware so
 DB queries get filtered correctly; CorrelationId must wrap everything so
-every log line carries its id. Order matters and a swap is the kind of
+every log line carries its id. GZip sits inside the observability pair so
+those still see every request, but outside everything that produces a body
+— including the /static mount, which is where compression pays off most.
+Order matters and a swap is the kind of
 regression that breaks production without breaking any happy-path test.
 ``app.user_middleware`` lists middlewares in execution order (Starlette
 LIFOs ``add_middleware`` calls, FastAPI surfaces them already reversed).
@@ -22,6 +25,7 @@ from simple_module_hosting.settings import Settings
 _EXPECTED_MULTI_TENANT = (
     "CorrelationIdMiddleware",
     "RequestLoggingMiddleware",
+    "GZipMiddleware",
     "SecurityHeadersMiddleware",
     "SessionMiddleware",
     "AuthMiddleware",
@@ -33,6 +37,7 @@ _EXPECTED_MULTI_TENANT = (
 _EXPECTED_SINGLE_TENANT = (
     "CorrelationIdMiddleware",
     "RequestLoggingMiddleware",
+    "GZipMiddleware",
     "SecurityHeadersMiddleware",
     "SessionMiddleware",
     "AuthMiddleware",

simple_module_hosting-0.0.26/tests/test_precompressed_static.py

@@ -0,0 +1,142 @@
+"""Serving pre-compressed asset variants.
+
+Compressing the same immutable, content-hashed bundle on every request is
+wasted CPU, and on-the-fly compression has to use a fast (worse) level. Files
+compressed once at build time can use the maximum level, and brotli is ~14%
+smaller than gzip on this bundle.
+
+The subtle part is the Content-Type: naively serving ``main.js.br`` makes
+Starlette guess the type from the ``.br`` extension and the browser refuses to
+execute it. These tests pin that behaviour.
+"""
+
+from __future__ import annotations
+
+import gzip
+from pathlib import Path
+
+import brotli
+import httpx
+import pytest
+from fastapi import FastAPI
+from simple_module_hosting.static_files import PrecompressedStaticFiles
+
+_JS = b"console.log('hello');" * 200
+_OK = 200
+_JS_TYPE = "text/javascript"
+
+
+@pytest.fixture
+def asset_dir(tmp_path: Path) -> Path:
+    (tmp_path / "app.js").write_bytes(_JS)
+    (tmp_path / "app.js.gz").write_bytes(gzip.compress(_JS, 9))
+    # A file with no pre-compressed sibling, to prove the fallback path.
+    (tmp_path / "plain.js").write_bytes(_JS)
+    return tmp_path
+
+
+@pytest.fixture
+def client(asset_dir: Path) -> httpx.AsyncClient:
+    app = FastAPI()
+    app.mount("/static", PrecompressedStaticFiles(directory=asset_dir), name="static")
+    return httpx.AsyncClient(transport=httpx.ASGITransport(app=app), base_url="http://testserver")
+
+
+class TestPrecompressedServing:
+    async def test_serves_gzip_sibling_when_accepted(self, client: httpx.AsyncClient) -> None:
+        resp = await client.get(
+            "/static/app.js", headers={"Accept-Encoding": "gzip"}, extensions={"trust_env": False}
+        )
+        assert resp.status_code == _OK
+        assert resp.headers["content-encoding"] == "gzip"
+
+    async def test_content_type_is_the_original_not_the_variant(
+        self, client: httpx.AsyncClient
+    ) -> None:
+        """The classic bug: .gz would otherwise be typed as octet-stream and
+        the browser would refuse to execute the script."""
+        resp = await client.get("/static/app.js", headers={"Accept-Encoding": "gzip"})
+        assert _JS_TYPE in resp.headers["content-type"]
+
+    async def test_body_decodes_to_the_original_bytes(self, client: httpx.AsyncClient) -> None:
+        resp = await client.get("/static/app.js", headers={"Accept-Encoding": "gzip"})
+        assert resp.content == _JS
+
+    async def test_vary_header_is_set(self, client: httpx.AsyncClient) -> None:
+        """Without Vary, a shared cache could serve a compressed body to a
+        client that never asked for one."""
+        resp = await client.get("/static/app.js", headers={"Accept-Encoding": "gzip"})
+        assert "accept-encoding" in resp.headers.get("vary", "").lower()
+
+    async def test_identity_client_gets_uncompressed(self, client: httpx.AsyncClient) -> None:
+        resp = await client.get("/static/app.js", headers={"Accept-Encoding": "identity"})
+        assert resp.status_code == _OK
+        assert "content-encoding" not in resp.headers
+        assert resp.content == _JS
+
+    async def test_missing_sibling_falls_back_to_original(self, client: httpx.AsyncClient) -> None:
+        resp = await client.get("/static/plain.js", headers={"Accept-Encoding": "gzip, br"})
+        assert resp.status_code == _OK
+        assert "content-encoding" not in resp.headers
+        assert resp.content == _JS
+
+    async def test_unknown_file_still_404s(self, client: httpx.AsyncClient) -> None:
+        resp = await client.get("/static/nope.js", headers={"Accept-Encoding": "gzip"})
+        assert resp.status_code == 404
+
+
+class TestBrotliPreference:
+    async def test_brotli_preferred_over_gzip(self, tmp_path: Path) -> None:
+        """Brotli is ~14% smaller on this bundle, so it wins when both exist."""
+        (tmp_path / "app.js").write_bytes(_JS)
+        (tmp_path / "app.js.gz").write_bytes(gzip.compress(_JS, 9))
+        (tmp_path / "app.js.br").write_bytes(brotli.compress(_JS))
+
+        app = FastAPI()
+        app.mount("/static", PrecompressedStaticFiles(directory=tmp_path), name="static")
+        async with httpx.AsyncClient(
+            transport=httpx.ASGITransport(app=app), base_url="http://testserver"
+        ) as c:
+            resp = await c.get("/static/app.js", headers={"Accept-Encoding": "gzip, deflate, br"})
+        assert resp.headers["content-encoding"] == "br"
+
+    async def test_gzip_used_when_brotli_not_accepted(self, tmp_path: Path) -> None:
+        (tmp_path / "app.js").write_bytes(_JS)
+        (tmp_path / "app.js.gz").write_bytes(gzip.compress(_JS, 9))
+        (tmp_path / "app.js.br").write_bytes(brotli.compress(_JS))
+
+        app = FastAPI()
+        app.mount("/static", PrecompressedStaticFiles(directory=tmp_path), name="static")
+        async with httpx.AsyncClient(
+            transport=httpx.ASGITransport(app=app), base_url="http://testserver"
+        ) as c:
+            resp = await c.get("/static/app.js", headers={"Accept-Encoding": "gzip"})
+        assert resp.headers["content-encoding"] == "gzip"
+
+
+class TestImmutableCachingPreserved:
+    """The existing immutable-caching behaviour must survive the refactor."""
+
+    async def test_hashed_assets_keep_immutable_cache_control(self, tmp_path: Path) -> None:
+        assets = tmp_path / "dist" / "assets"
+        assets.mkdir(parents=True)
+        (assets / "main-abc123.js").write_bytes(_JS)
+
+        app = FastAPI()
+        app.mount("/static", PrecompressedStaticFiles(directory=tmp_path), name="static")
+        async with httpx.AsyncClient(
+            transport=httpx.ASGITransport(app=app), base_url="http://testserver"
+        ) as c:
+            resp = await c.get("/static/dist/assets/main-abc123.js")
+        assert "immutable" in resp.headers.get("cache-control", "")
+
+    async def test_non_hashed_paths_do_not_get_immutable(self, tmp_path: Path) -> None:
+        (tmp_path / "favicon.ico").write_bytes(b"\x00" * 100)
+
+        app = FastAPI()
+        app.mount("/static", PrecompressedStaticFiles(directory=tmp_path), name="static")
+        async with httpx.AsyncClient(
+            transport=httpx.ASGITransport(app=app), base_url="http://testserver"
+        ) as c:
+            resp = await c.get("/static/favicon.ico")
+        assert "immutable" not in resp.headers.get("cache-control", "")

simple_module_hosting-0.0.26/tests/test_proxy_headers.py

@@ -0,0 +1,119 @@
+"""Proxy-header handling (X-Forwarded-Proto / X-Forwarded-For).
+
+Behind a TLS-terminating reverse proxy the app sees plain ``http`` on the
+container socket, so ``request.url.scheme`` is wrong. inertia-python copies
+that scheme into the page object's absolute ``url``; the browser then refuses
+the cross-scheme ``history.pushState`` and login breaks (GH #223).
+
+When ``SM_TRUSTED_PROXY`` is set, the host registers uvicorn's
+``ProxyHeadersMiddleware`` as the outermost middleware so the corrected scheme
+and client IP are visible to every downstream middleware (logging included).
+Left unset (the default) nothing changes — the header is ignored.
+"""
+
+from __future__ import annotations
+
+import httpx
+import pytest
+from simple_module_hosting.app_builder import create_app
+from simple_module_hosting.settings import Settings
+from simple_module_test.fixtures import _create_all_tables
+
+_LOGIN_PATH = "/users/login"
+
+
+def _names(app) -> tuple[str, ...]:
+    return tuple(m.cls.__name__ for m in app.user_middleware)
+
+
+def _settings(**overrides) -> Settings:
+    base = {
+        "database_url": "sqlite+aiosqlite:///:memory:",
+        "environment": "testing",
+        "secret_key": "x" * 32,
+        "multi_tenant": False,
+    }
+    base.update(overrides)
+    return Settings(**base)
+
+
+class TestMiddlewareWiring:
+    def test_absent_by_default(self) -> None:
+        """No SM_TRUSTED_PROXY → ProxyHeadersMiddleware must not be installed."""
+        app = create_app(_settings())
+        assert "ProxyHeadersMiddleware" not in _names(app)
+
+    def test_present_and_outermost_when_configured(self) -> None:
+        """ProxyHeaders must run before every other middleware.
+
+        ``app.user_middleware`` is in execution order (FastAPI reverses the
+        LIFO add_middleware stack), so the proxy middleware must be first —
+        otherwise RequestLogging would log the proxy's address, and Inertia
+        would already have read the wrong scheme.
+        """
+        app = create_app(_settings(trusted_proxy="*"))
+        names = _names(app)
+        assert names[0] == "ProxyHeadersMiddleware"
+
+    def test_trusted_hosts_passed_through(self) -> None:
+        """The configured value reaches uvicorn's middleware as trusted_hosts."""
+        app = create_app(_settings(trusted_proxy="10.0.0.0/8,127.0.0.1"))
+        proxy = next(m for m in app.user_middleware if m.cls.__name__ == "ProxyHeadersMiddleware")
+        assert proxy.kwargs["trusted_hosts"] == "10.0.0.0/8,127.0.0.1"
+
+    def test_surrounding_whitespace_stripped(self) -> None:
+        """A stray space must not silently defeat ``*`` trust.
+
+        uvicorn computes always-trust as ``raw in ("*", ["*"])`` *before*
+        stripping, so ``"* "`` would be parsed as a literal host that never
+        matches any client — silently re-introducing GH #223 with no error.
+        The setting must normalize the value first.
+        """
+        app = create_app(_settings(trusted_proxy="* "))
+        proxy = next(m for m in app.user_middleware if m.cls.__name__ == "ProxyHeadersMiddleware")
+        assert proxy.kwargs["trusted_hosts"] == "*"
+
+    def test_blank_value_disables(self) -> None:
+        """Whitespace-only SM_TRUSTED_PROXY is treated as unset (no middleware)."""
+        app = create_app(_settings(trusted_proxy="   "))
+        assert "ProxyHeadersMiddleware" not in _names(app)
+
+
+async def _client_for(settings: Settings):
+    """Build an app + lifespan-started client mirroring the shared fixtures."""
+    app = create_app(settings)
+    await _create_all_tables(app.state.sm.db.engine)
+    ctx = app.router.lifespan_context(app)
+    await ctx.__aenter__()
+    transport = httpx.ASGITransport(app=app)
+    client = httpx.AsyncClient(transport=transport, base_url="http://testserver")
+    return client, ctx
+
+
+class TestSchemeCorrection:
+    @pytest.mark.parametrize(
+        ("trusted_proxy", "expected_scheme"),
+        [
+            ("*", "https"),  # trusted proxy → X-Forwarded-Proto honored
+            (None, "http"),  # no trust configured → header ignored
+        ],
+    )
+    async def test_inertia_page_url_scheme(
+        self, trusted_proxy: str | None, expected_scheme: str
+    ) -> None:
+        """The Inertia page object's absolute url reflects X-Forwarded-Proto.
+
+        This is the exact thing the browser chokes on: inertia-python sets
+        ``"url": str(request.url)``, scheme included, and embeds it in the
+        ``data-page`` blob of the rendered HTML.
+        """
+        client, ctx = await _client_for(_settings(trusted_proxy=trusted_proxy))
+        try:
+            resp = await client.get(_LOGIN_PATH, headers={"X-Forwarded-Proto": "https"})
+            assert resp.status_code == 200
+            assert f"{expected_scheme}://testserver{_LOGIN_PATH}" in resp.text
+            wrong = "https" if expected_scheme == "http" else "http"
+            assert f"{wrong}://testserver{_LOGIN_PATH}" not in resp.text
+        finally:
+            await client.aclose()
+            await ctx.__aexit__(None, None, None)

simple_module_hosting-0.0.26/tests/test_response_compression.py

@@ -0,0 +1,88 @@
+"""Responses must be compressed when the client advertises support.
+
+The built frontend ships ~139 KB of CSS and ~490 KB of JS. Uncompressed that
+is the dominant cost of a cold page load — far larger than anything on the
+server request path. Compression cuts the CSS alone by ~85%.
+"""
+
+from __future__ import annotations
+
+import httpx
+import pytest
+
+_OK = 200
+_GZIP = "gzip"
+# Below Starlette's default minimum_size, compression is skipped because the
+# gzip framing would cost more than it saves.
+_TINY_BODY_BYTES = 100
+
+
+class TestResponseCompression:
+    async def test_large_response_is_gzipped_when_accepted(
+        self, authenticated_client: httpx.AsyncClient
+    ) -> None:
+        resp = await authenticated_client.get(
+            "/api/permissions/", headers={"Accept-Encoding": "gzip"}
+        )
+        assert resp.status_code == _OK
+        # httpx transparently decodes, so assert on the header the server set.
+        assert resp.headers.get("content-encoding") == _GZIP
+
+    async def test_response_is_not_gzipped_when_not_accepted(
+        self, authenticated_client: httpx.AsyncClient
+    ) -> None:
+        """A client that doesn't advertise gzip must still get a usable body."""
+        resp = await authenticated_client.get(
+            "/api/permissions/", headers={"Accept-Encoding": "identity"}
+        )
+        assert resp.status_code == _OK
+        assert resp.headers.get("content-encoding") != _GZIP
+        assert resp.json() is not None
+
+    async def test_compression_does_not_corrupt_the_payload(
+        self, authenticated_client: httpx.AsyncClient
+    ) -> None:
+        """The decoded body must match what the uncompressed route returns."""
+        compressed = await authenticated_client.get(
+            "/api/permissions/", headers={"Accept-Encoding": "gzip"}
+        )
+        plain = await authenticated_client.get(
+            "/api/permissions/", headers={"Accept-Encoding": "identity"}
+        )
+        assert compressed.json() == plain.json()
+
+    async def test_health_endpoint_still_works(self, client: httpx.AsyncClient) -> None:
+        """Small responses fall under the size threshold and pass through."""
+        resp = await client.get("/health", headers={"Accept-Encoding": "gzip"})
+        assert resp.status_code == _OK
+        assert resp.json() is not None
+
+
+class TestCompressionMiddlewareOrder:
+    def test_gzip_runs_inside_correlation_id(self, app) -> None:
+        """GZip must sit inside CorrelationId/RequestLogging.
+
+        Those two set response headers and read request state; compression is
+        a transport concern that should wrap only the response body beneath
+        them. Starlette's stack is LIFO, so a middleware added *later* is
+        outermost — GZip must therefore appear earlier in user_middleware
+        than CorrelationId.
+        """
+        from simple_module_hosting._observability import CorrelationIdMiddleware
+        from starlette.middleware.gzip import GZipMiddleware
+
+        classes = [m.cls for m in app.user_middleware]
+        assert GZipMiddleware in classes, "GZipMiddleware is not installed"
+        assert classes.index(GZipMiddleware) > classes.index(CorrelationIdMiddleware)
+
+
+@pytest.mark.parametrize("encoding", ["gzip", "gzip, deflate", "gzip, deflate, br"])
+async def test_common_browser_accept_encodings(
+    authenticated_client: httpx.AsyncClient, encoding: str
+) -> None:
+    """Real browsers send several forms; all must yield a valid response."""
+    resp = await authenticated_client.get(
+        "/api/permissions/", headers={"Accept-Encoding": encoding}
+    )
+    assert resp.status_code == _OK
+    assert resp.json() is not None