simple-module-hosting 0.0.26__tar.gz → 0.0.27__tar.gz

{simple_module_hosting-0.0.26 → simple_module_hosting-0.0.27}/.gitignore

@@ -45,6 +45,7 @@ docs/.vitepress/dist/
 host/client_app/modules.manifest.json
 host/client_app/modules.generated.ts
 host/client_app/modules.generated.css
+host/client_app/modules.assets.json
 
 # Worktrees
 .worktrees/

{simple_module_hosting-0.0.26 → simple_module_hosting-0.0.27}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simple_module_hosting
-Version: 0.0.26
+Version: 0.0.27
 Summary: FastAPI + Inertia.js host runtime for simple_module — app_builder, middleware stack, CLI (sm / simple-module), scaffolding
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -26,8 +26,8 @@ Requires-Dist: fastapi-inertia>=1.0
 Requires-Dist: fastapi>=0.115
 Requires-Dist: httpx>=0.27
 Requires-Dist: jinja2>=3.1
-Requires-Dist: simple-module-core==0.0.26
-Requires-Dist: simple-module-db==0.0.26
+Requires-Dist: simple-module-core==0.0.27
+Requires-Dist: simple-module-db==0.0.27
 Requires-Dist: starlette>=0.44
 Requires-Dist: tomlkit>=0.13
 Requires-Dist: uvicorn[standard]>=0.34

{simple_module_hosting-0.0.26 → simple_module_hosting-0.0.27}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_hosting"
-version = "0.0.26"
+version = "0.0.27"
 description = "FastAPI + Inertia.js host runtime for simple_module — app_builder, middleware stack, CLI (sm / simple-module), scaffolding"
 readme = "README.md"
 license = "MIT"
@@ -26,8 +26,8 @@ dependencies = [
     "fastapi-inertia>=1.0",
     "httpx>=0.27",
     "jinja2>=3.1",
-    "simple_module_core==0.0.26",
-    "simple_module_db==0.0.26",
+    "simple_module_core==0.0.27",
+    "simple_module_db==0.0.27",
     "starlette>=0.44",
     "tomlkit>=0.13",
     "uvicorn[standard]>=0.34",

{simple_module_hosting-0.0.26 → simple_module_hosting-0.0.27}/simple_module_hosting/_inertia_setup.py

@@ -30,20 +30,25 @@ def branding_head(request: Request) -> dict:
     """Branding metadata for the root template's ``<head>``.
 
     Reads the optional branding module's settings off ``app.state`` by name
-    (duck-typed, never imported) so the static ``<title>`` and ``theme-color``
-    are already branded *before* React hydrates. Degrades to the framework
-    default when branding isn't installed. Only plain settings strings are
-    surfaced here — the favicon is applied client-side by ``BrandingHead`` via
-    Inertia's ``<Head>``, keeping file_storage's download-route shape out of
-    framework code.
+    (duck-typed, never imported) so the ``<title>``, ``theme-color`` and
+    favicon are already branded *before* React hydrates — otherwise the browser
+    paints the default favicon and only swaps on hydration, a visible flicker on
+    every full page load. Degrades to the framework default when branding isn't
+    installed.
+
+    The favicon URL is read from the module rather than assembled here: branding
+    owns its route shape, and framework code must not reach into a plugin
+    (SM009). ``BrandingHead`` still applies it client-side too, so a favicon
+    changed at runtime updates without a reload.
     """
     services = getattr(request.app.state, "branding", None)
     settings = getattr(services, "settings", None)
     if settings is None:
-        return {"app_name": _DEFAULT_APP_NAME, "theme_color": None}
+        return {"app_name": _DEFAULT_APP_NAME, "theme_color": None, "favicon_url": None}
     return {
         "app_name": getattr(settings, "app_name", "") or _DEFAULT_APP_NAME,
         "theme_color": getattr(settings, "primary_color", "") or None,
+        "favicon_url": getattr(services, "favicon_url", None),
     }
 
 

simple_module_hosting-0.0.27/simple_module_hosting/assets.py

@@ -0,0 +1,160 @@
+"""Per-module frontend asset discovery and CSS emission.
+
+Split out from :mod:`simple_module_hosting.manifest`, which is already at the
+repo's 300-line cap. ``manifest.py`` imports from here.
+
+A module may ship two optional stylesheets beside its ``pages/`` directory:
+
+* ``theme.css`` — ``@theme`` tokens, ``@custom-variant``, ``@font-face``.
+  Imported *unlayered*, because a ``@theme`` block inside a cascade layer is
+  inert and registers no design tokens.
+* ``styles.css`` — component rules, keyframes, vendor CSS. Imported into
+  ``layer(components)``, because unlayered CSS outranks every Tailwind
+  utility: a module shipping a bare ``.card { padding: 0 }`` would otherwise
+  silently beat ``p-4``.
+
+Both are referenced through a per-module Vite alias (``#module/<pkg>``) rather
+than a filesystem path, so the generated CSS never contains something like
+``../../../.venv/lib/python3.12/site-packages/<pkg>/styles.css``.
+"""
+
+from __future__ import annotations
+
+import importlib.resources
+import json
+import logging
+from collections.abc import Callable, Sequence
+from dataclasses import dataclass
+from pathlib import Path
+
+from simple_module_core import ModuleBase, get_module_package_name
+
+logger = logging.getLogger(__name__)
+
+THEME_CSS = "theme.css"
+STYLES_CSS = "styles.css"
+ALIAS_PREFIX = "#module"
+
+
+@dataclass(frozen=True)
+class ModuleAssets:
+    """Frontend assets a single module contributes."""
+
+    name: str
+    package_name: str
+    package_dir: Path
+    pages_dir: Path | None
+    theme_css: Path | None
+    styles_css: Path | None
+
+
+def compute_module_assets(modules: Sequence[ModuleBase]) -> list[ModuleAssets]:
+    """Return per-module frontend assets, preserving discovery order.
+
+    Discovery order matters. ``discover_modules()`` topologically sorts by
+    ``ModuleMeta.depends_on``, which is the order the host invokes
+    ``register_*`` hooks in; emitting CSS in that same order means a module
+    that depends on another can override its dependency's styles.
+
+    A module is included only if it contributes at least one asset.
+    """
+    result: list[ModuleAssets] = []
+    for mod in modules:
+        pkg_name = get_module_package_name(mod)
+        try:
+            pkg_root = Path(str(importlib.resources.files(pkg_name)))
+        except (ModuleNotFoundError, TypeError):
+            logger.debug(
+                "Module '%s': package %s not importable — skipping", mod.meta.name, pkg_name
+            )
+            continue
+        pages_dir = pkg_root / "pages"
+        theme = pkg_root / THEME_CSS
+        styles = pkg_root / STYLES_CSS
+        entry = ModuleAssets(
+            name=mod.meta.name,
+            package_name=pkg_name,
+            package_dir=pkg_root.resolve(),
+            pages_dir=pages_dir.resolve() if pages_dir.is_dir() else None,
+            theme_css=theme.resolve() if theme.is_file() else None,
+            styles_css=styles.resolve() if styles.is_file() else None,
+        )
+        if entry.pages_dir or entry.theme_css or entry.styles_css:
+            result.append(entry)
+    return result
+
+
+_CSS_HEADER = """\
+/* AUTO-GENERATED by simple_module_hosting.assets — do not edit by hand.
+ * Regenerate with: smpy gen-pages
+ *
+ * Emission order is module discovery order (topological by depends_on), so a
+ * dependent module's CSS can override its dependency's.
+ *
+ * theme.css is imported unlayered so its @theme blocks register as design
+ * tokens; styles.css is imported into layer(components) so a module rule can
+ * never outrank a Tailwind utility.
+ */"""
+
+
+def render_modules_css(
+    assets: Sequence[ModuleAssets],
+    *,
+    in_repo: Callable[[Path], bool],
+) -> str:
+    """Render the contents of ``modules.generated.css``.
+
+    ``@source`` is emitted only for wheel-installed modules — in-repo module
+    pages are already covered by the static ``@source`` glob in the host's
+    ``styles.css``, so emitting an absolute one too would just duplicate it.
+    ``@import`` is emitted for *every* module, in-repo and wheel alike, because
+    there is no static-glob equivalent for CSS.
+    """
+    source_lines = [
+        f'@source "{e.pages_dir.as_posix()}/**/*.{{ts,tsx}}";'
+        for e in assets
+        if e.pages_dir and not in_repo(e.pages_dir)
+    ]
+    theme_lines = [
+        f'@import "{ALIAS_PREFIX}/{e.package_name}/{THEME_CSS}";' for e in assets if e.theme_css
+    ]
+    style_lines = [
+        f'@import "{ALIAS_PREFIX}/{e.package_name}/{STYLES_CSS}" layer(components);'
+        for e in assets
+        if e.styles_css
+    ]
+
+    out = [_CSS_HEADER]
+    for heading, lines in (
+        ("/* ── @source: class scanning (wheel-installed modules) ── */", source_lines),
+        ("/* ── theme: unlayered, registers @theme tokens ── */", theme_lines),
+        ("/* ── styles: layer(components), always loses to utilities ── */", style_lines),
+    ):
+        if lines:
+            out.append("")
+            out.append(heading)
+            out.extend(lines)
+    out.append("")
+    return "\n".join(out)
+
+
+def render_assets_json(assets: Sequence[ModuleAssets]) -> str:
+    """Render ``modules.assets.json`` — the richer companion to the pages manifest.
+
+    Kept separate from ``modules.manifest.json`` rather than replacing it:
+    ``vite.config.ts`` is scaffolded *into* each app, so changing the existing
+    manifest's value shape would break every downstream app at once. This file
+    is purely additive, and also covers CSS-only modules that never appear in
+    the pages manifest because they ship no ``pages/``.
+    """
+    payload = {
+        e.name: {
+            "package_name": e.package_name,
+            "package": e.package_dir.as_posix(),
+            "pages": e.pages_dir.as_posix() if e.pages_dir else None,
+            "theme": e.theme_css.as_posix() if e.theme_css else None,
+            "styles": e.styles_css.as_posix() if e.styles_css else None,
+        }
+        for e in assets
+    }
+    return json.dumps(payload, indent=2, sort_keys=True) + "\n"

{simple_module_hosting-0.0.26 → simple_module_hosting-0.0.27}/simple_module_hosting/host_cli.py

@@ -37,7 +37,7 @@ def gen_pages(
         ),
     ] = Path("client_app"),
 ) -> None:
-    """Regenerate client_app/modules.{manifest.json,generated.ts,generated.css}."""
+    """Regenerate client_app/modules.{manifest.json,generated.ts,generated.css,assets.json}."""
     logging.basicConfig(level=logging.INFO, format="%(levelname)s: %(message)s")
     if not host_dir.is_dir():
         typer.echo(f"ERROR: client_app directory not found at {host_dir}", err=True)
@@ -47,7 +47,7 @@ def gen_pages(
     typer.echo(
         f"Module pages manifest: {len(modules)} module(s) "
         f"→ {written['manifest'].name}, {written['generated'].name}, "
-        f"{written['css'].name} in {host_dir}"
+        f"{written['css'].name}, {written['assets'].name} in {host_dir}"
     )
 
 

{simple_module_hosting-0.0.26 → simple_module_hosting-0.0.27}/simple_module_hosting/manifest.py

@@ -1,10 +1,13 @@
 """Frontend pages manifest + per-module JS dependency discovery.
 
-* :func:`write_module_pages_manifest` emits the three generated files Vite
+* :func:`write_module_pages_manifest` emits the four generated files Vite
   and Tailwind read at build time:
   - ``modules.manifest.json`` — name -> absolute pages dir
   - ``modules.generated.ts`` — ``import.meta.glob`` per module
-  - ``modules.generated.css`` — ``@source`` per wheel-installed module
+  - ``modules.generated.css`` — ``@source`` per wheel-installed module, plus
+    an ``@import`` per module-shipped stylesheet
+  - ``modules.assets.json`` — the richer per-module asset record the host's
+    ``vite.config.ts`` builds its ``#module/<pkg>`` aliases from
 * :func:`read_module_package_json` / :func:`collect_module_js_deps` locate
   the per-module ``package.json`` shipped inside wheels (or alongside the
   source for editable installs) and aggregate its ``dependencies`` block.
@@ -22,6 +25,12 @@ from pathlib import Path
 
 from simple_module_core import ModuleBase, get_module_package_name
 
+from simple_module_hosting.assets import (
+    compute_module_assets,
+    render_assets_json,
+    render_modules_css,
+)
+
 logger = logging.getLogger(__name__)
 
 _GENERATED_TS_HEADER = """\
@@ -33,16 +42,6 @@ _GENERATED_TS_HEADER = """\
 // pip-installed module wheels are picked up by Vite's import.meta.glob.
 """
 
-_GENERATED_CSS_HEADER = """\
-/* AUTO-GENERATED by simple_module_hosting.manifest — do not edit by hand.
- * Regenerate with: smpy gen-pages
- *
- * @source entries for module pages shipped inside pip-installed wheels.
- * In-repo modules are covered by the static @source glob in
- * host/client_app/styles.css.
- */
-"""
-
 
 def repo_root_from_client_app(client_app_dir: Path) -> Path:
     """Locate the workspace/repo root that contains ``client_app_dir``.
@@ -144,11 +143,16 @@ def write_module_pages_manifest(
     output_dir: Path,
     repo_root: Path | None = None,
 ) -> dict[str, Path]:
-    """Write the three generated files (manifest JSON, glob TS, Tailwind CSS).
+    """Write the four generated files (manifest JSON, glob TS, CSS, assets JSON).
 
     Returns the paths that were written. Content is written only when
     different from what's on disk, so booting the host repeatedly in dev
     does not wake up Vite's file watcher.
+
+    ``modules.manifest.json`` deliberately keeps its ``{name: pages_dir}``
+    shape: every downstream app holds its own copy of ``vite.config.ts`` and
+    reads it, so changing the value shape would break them all at once. The
+    new per-module asset record goes in ``modules.assets.json`` instead.
     """
     output_dir = Path(output_dir)
     output_dir.mkdir(parents=True, exist_ok=True)
@@ -180,32 +184,35 @@ def write_module_pages_manifest(
     lines.append("")
     generated_text = "\n".join(lines)
 
-    # In-repo modules are already covered by the static glob in styles.css;
-    # only emit @source for wheel-installed ones. pages_map is keyed by
-    # module name so each pages_dir is unique — no further dedup needed.
+    # Rendered from the richer asset record rather than pages_map, so that a
+    # module shipping CSS but no pages/ still contributes its stylesheets.
+    assets = compute_module_assets(modules)
     css_path = output_dir / "modules.generated.css"
-    css_lines: list[str] = [_GENERATED_CSS_HEADER]
-    for name in sorted(pages_map):
-        pages_dir = pages_map[name]
-        if _is_in_repo_module(pages_dir, repo_root):
-            continue
-        css_lines.append(f'@source "{pages_dir.as_posix()}";')
-    css_lines.append("")
-    css_text = "\n".join(css_lines)
+    css_text = render_modules_css(assets, in_repo=lambda p: _is_in_repo_module(p, repo_root))
+
+    assets_path = output_dir / "modules.assets.json"
+    assets_text = render_assets_json(assets)
 
     wrote_manifest = _write_if_changed(manifest_path, manifest_text)
     wrote_generated = _write_if_changed(generated_path, generated_text)
     wrote_css = _write_if_changed(css_path, css_text)
+    wrote_assets = _write_if_changed(assets_path, assets_text)
 
-    if wrote_manifest or wrote_generated or wrote_css:
+    if wrote_manifest or wrote_generated or wrote_css or wrote_assets:
         logger.info(
-            "Wrote module pages manifest: %d module(s) -> %s, %s, %s",
+            "Wrote module pages manifest: %d module(s) -> %s, %s, %s, %s",
             len(pages_map),
             manifest_path.name,
             generated_path.name,
             css_path.name,
+            assets_path.name,
         )
-    return {"manifest": manifest_path, "generated": generated_path, "css": css_path}
+    return {
+        "manifest": manifest_path,
+        "generated": generated_path,
+        "css": css_path,
+        "assets": assets_path,
+    }
 
 
 def _glob_pattern_for(pages_dir: Path, output_dir: Path) -> str:

{simple_module_hosting-0.0.26 → simple_module_hosting-0.0.27}/tests/test_branding_head.py

@@ -16,7 +16,7 @@ def _request(branding: object | None) -> SimpleNamespace:
 
 def test_defaults_when_branding_not_installed() -> None:
     meta = branding_head(_request(None))
-    assert meta == {"app_name": "SimpleModule", "theme_color": None}
+    assert meta == {"app_name": "SimpleModule", "theme_color": None, "favicon_url": None}
 
 
 def test_reads_app_name_and_theme_color() -> None:
@@ -29,4 +29,21 @@ def test_reads_app_name_and_theme_color() -> None:
 def test_blank_values_fall_back() -> None:
     settings = SimpleNamespace(app_name="", primary_color="")
     meta = branding_head(_request(SimpleNamespace(settings=settings)))
-    assert meta == {"app_name": "SimpleModule", "theme_color": None}
+    assert meta == {"app_name": "SimpleModule", "theme_color": None, "favicon_url": None}
+
+
+def test_favicon_url_comes_from_the_module_not_from_here() -> None:
+    # The framework must not know branding's route shape (SM009), so it reads
+    # whatever the module exposes rather than assembling a URL itself.
+    services = SimpleNamespace(
+        settings=SimpleNamespace(app_name="Acme", primary_color=""),
+        favicon_url="/api/branding/favicon?v=abc",
+    )
+    assert branding_head(_request(services))["favicon_url"] == "/api/branding/favicon?v=abc"
+
+
+def test_favicon_url_is_none_on_a_host_without_that_attribute() -> None:
+    # An older branding release exposes no favicon_url; the shell just omits
+    # the link rather than erroring, and BrandingHead still sets it client-side.
+    services = SimpleNamespace(settings=SimpleNamespace(app_name="Acme", primary_color=""))
+    assert branding_head(_request(services))["favicon_url"] is None

{simple_module_hosting-0.0.26 → simple_module_hosting-0.0.27}/tests/test_middleware_order.py

@@ -7,7 +7,13 @@ CLAUDE.md spells out the pipeline:
 
 Tenant/Locale must see ``request.state.user`` set by AuthMiddleware so
 DB queries get filtered correctly; CorrelationId must wrap everything so
-every log line carries its id. GZip sits inside the observability pair so
+every log line carries its id. SiteLock must precede AuthMiddleware: it gates
+anonymous visitors itself, and if Auth ran first they would be redirected to
+the login page — revealing that a login form exists on a site that is meant
+to be fully hidden. That inversion breaks the feature without failing any
+site_lock unit test, which is why the order is pinned here.
+
+GZip sits inside the observability pair so
 those still see every request, but outside everything that produces a body
 — including the /static mount, which is where compression pays off most.
 Order matters and a swap is the kind of
@@ -28,6 +34,7 @@ _EXPECTED_MULTI_TENANT = (
     "GZipMiddleware",
     "SecurityHeadersMiddleware",
     "SessionMiddleware",
+    "SiteLockMiddleware",
     "AuthMiddleware",
     "TenantMiddleware",
     "LocaleMiddleware",
@@ -40,6 +47,7 @@ _EXPECTED_SINGLE_TENANT = (
     "GZipMiddleware",
     "SecurityHeadersMiddleware",
     "SessionMiddleware",
+    "SiteLockMiddleware",
     "AuthMiddleware",
     "LocaleMiddleware",
     "InertiaLayoutDataMiddleware",