simple-module-hosting 0.0.27__tar.gz → 0.0.28__tar.gz

{simple_module_hosting-0.0.27 → simple_module_hosting-0.0.28}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simple_module_hosting
-Version: 0.0.27
+Version: 0.0.28
 Summary: FastAPI + Inertia.js host runtime for simple_module — app_builder, middleware stack, CLI (sm / simple-module), scaffolding
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -25,9 +25,10 @@ Requires-Dist: click>=8.1
 Requires-Dist: fastapi-inertia>=1.0
 Requires-Dist: fastapi>=0.115
 Requires-Dist: httpx>=0.27
+Requires-Dist: itsdangerous>=2.0
 Requires-Dist: jinja2>=3.1
-Requires-Dist: simple-module-core==0.0.27
-Requires-Dist: simple-module-db==0.0.27
+Requires-Dist: simple-module-core==0.0.28
+Requires-Dist: simple-module-db==0.0.28
 Requires-Dist: starlette>=0.44
 Requires-Dist: tomlkit>=0.13
 Requires-Dist: uvicorn[standard]>=0.34

{simple_module_hosting-0.0.27 → simple_module_hosting-0.0.28}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_hosting"
-version = "0.0.27"
+version = "0.0.28"
 description = "FastAPI + Inertia.js host runtime for simple_module — app_builder, middleware stack, CLI (sm / simple-module), scaffolding"
 readme = "README.md"
 license = "MIT"
@@ -25,9 +25,13 @@ dependencies = [
     "fastapi>=0.115",
     "fastapi-inertia>=1.0",
     "httpx>=0.27",
+    # SessionMiddleware (starlette.middleware.sessions) imports itsdangerous at
+    # module import time; starlette treats it as an optional extra, so declare
+    # it directly — out-of-tree hosts have nothing else pulling it in.
+    "itsdangerous>=2.0",
     "jinja2>=3.1",
-    "simple_module_core==0.0.27",
-    "simple_module_db==0.0.27",
+    "simple_module_core==0.0.28",
+    "simple_module_db==0.0.28",
     "starlette>=0.44",
     "tomlkit>=0.13",
     "uvicorn[standard]>=0.34",

{simple_module_hosting-0.0.27 → simple_module_hosting-0.0.28}/simple_module_hosting/_inertia_shared.py

@@ -12,20 +12,25 @@ from starlette.types import Scope
 logger = logging.getLogger(__name__)
 
 _I18N_SESSION_LOCALE_KEY = "__i18n_locale"
+_I18N_SESSION_AUDIENCE_KEY = "__i18n_audience"
 _INERTIA_HEADER = "x-inertia"
 _INERTIA_HEADER_TRUE = "true"
 
 
-def build_i18n_block(scope: Scope, request: Request) -> dict:
+def build_i18n_block(scope: Scope, request: Request, *, is_authenticated: bool = True) -> dict:
     """Assemble the ``i18n`` shared-props block for the current request.
 
     Rules:
 
     * No registry / no locale → serve an empty English block and log once.
     * Inertia XHR partials (``X-Inertia: true``) reuse the client-side
-      cached messages; send ``messages: None`` unless the locale differs
-      from what was last served on this session.
+      cached messages; send ``messages: None`` unless the locale — or the
+      audience, see below — differs from what was last served this session.
     * Full page loads and locale transitions ship the complete dict.
+    * Anonymous visitors receive the public snapshot: catalogs of modules
+      declaring ``i18n_audience="admin"`` are withheld (issue #248). A login
+      or logout mid-session counts as a change so the freshly-authenticated
+      client isn't left holding the anonymous catalog (or vice versa).
     """
     # Test fixtures sometimes build a bare FastAPI with a partial app.state.sm
     # stub (e.g. permissions-only, no i18n); guard both lookups to keep them usable.
@@ -42,6 +47,7 @@ def build_i18n_block(scope: Scope, request: Request) -> dict:
         return {"locale": "en", "supportedLocales": ["en"], "messages": {}}
 
     is_inertia = Headers(scope=scope).get(_INERTIA_HEADER) == _INERTIA_HEADER_TRUE
+    audience = "full" if is_authenticated else "public"
     session_dict = scope.get("session")
     # When the session is absent (pre-session-middleware routes, WebSocket
     # upgrades), treat locale as "unchanged" so Inertia XHR requests still
@@ -52,13 +58,22 @@ def build_i18n_block(scope: Scope, request: Request) -> dict:
         locale_changed = last_locale != locale
         if locale_changed:
             session_dict[_I18N_SESSION_LOCALE_KEY] = locale
+        last_audience = session_dict.get(_I18N_SESSION_AUDIENCE_KEY)
+        audience_changed = last_audience != audience
+        if audience_changed:
+            session_dict[_I18N_SESSION_AUDIENCE_KEY] = audience
     else:
         locale_changed = False
-    send_messages = (not is_inertia) or locale_changed
+        audience_changed = False
+    send_messages = (not is_inertia) or locale_changed or audience_changed
     return {
         "locale": locale,
         "supportedLocales": registry.available_locales(),
-        "messages": registry.messages_snapshot(locale) if send_messages else None,
+        "messages": (
+            registry.messages_snapshot(locale, include_admin=is_authenticated)
+            if send_messages
+            else None
+        ),
     }
 
 

{simple_module_hosting-0.0.27 → simple_module_hosting-0.0.28}/simple_module_hosting/i18n_manifest.py

@@ -44,8 +44,9 @@ def build_i18n_registry(
     extra_sources: list[tuple[str, str, Path]] = []
 
     for mod in modules:
+        audience = getattr(mod.meta, "i18n_audience", "public")
         for namespace, locale_dir in mod.locale_dirs().items():
-            registry.add_source(namespace, locale_dir)
+            registry.add_source(namespace, locale_dir, audience=audience)
 
     host_locales = project_root / "host" / "locales"
     if host_locales.is_dir():

{simple_module_hosting-0.0.27 → simple_module_hosting-0.0.28}/simple_module_hosting/middleware.py

@@ -256,7 +256,7 @@ class InertiaLayoutDataMiddleware:
         all_perms = self.permission_registry.all_permissions
         frontend_permissions = expand_permissions(resolved, all_perms) if is_authenticated else []
 
-        i18n_block = build_i18n_block(scope, request)
+        i18n_block = build_i18n_block(scope, request, is_authenticated=is_authenticated)
 
         principal_serializer: PrincipalSerializer | None = getattr(
             scope["app"].state, "principal_serializer", None

{simple_module_hosting-0.0.27 → simple_module_hosting-0.0.28}/tests/test_inertia_i18n_shared_props.py

@@ -64,6 +64,89 @@ def test_inertia_shared_props_reflect_cookie_locale() -> None:
     assert body["i18n"]["messages"] == {"hello": "Hola"}
 
 
+def _build_audience_app(tmp_path) -> FastAPI:
+    """App with a *loaded* registry (public + admin sources) and header-driven auth.
+
+    ``X-Test-Auth: 1`` marks the request authenticated, so one client session
+    can flip auth state mid-session — the login/logout transition the i18n
+    block must react to.
+    """
+    import json
+    from types import SimpleNamespace
+
+    for ns, data in (
+        ("pages", {"title": "Pages"}),
+        ("settings", {"key": "Key"}),
+    ):
+        (tmp_path / ns).mkdir(exist_ok=True)
+        (tmp_path / ns / "en.json").write_text(json.dumps(data))
+    reg = I18nRegistry(default_locale="en", supported_locales=["en"])
+    reg.add_source("pages", tmp_path / "pages")
+    reg.add_source("settings", tmp_path / "settings", audience="admin")
+    reg.load()
+
+    app = FastAPI()
+    app.state.sm = SimpleNamespace(i18n_registry=reg)
+
+    @app.get("/shared")
+    def shared(request: Request) -> JSONResponse:
+        return JSONResponse(request.state.inertia_shared)
+
+    app.add_middleware(
+        InertiaLayoutDataMiddleware,
+        menu_registry=MenuRegistry(),
+        permission_registry=PermissionRegistry(),
+    )
+    app.add_middleware(
+        LocaleMiddleware,
+        supported_locales=["en"],
+        default_locale="en",
+    )
+
+    class _HeaderAuth:
+        def __init__(self, app_):
+            self.app = app_
+
+        async def __call__(self, scope, receive, send):
+            if scope["type"] == "http":
+                request = Request(scope)
+                if request.headers.get("X-Test-Auth") == "1":
+                    request.state.user = SimpleNamespace(roles=[])
+            await self.app(scope, receive, send)
+
+    app.add_middleware(_HeaderAuth)
+    app.add_middleware(SessionMiddleware, secret_key="test-secret")
+    return app
+
+
+def test_anonymous_visitors_receive_only_public_catalogs(tmp_path) -> None:
+    client = TestClient(_build_audience_app(tmp_path))
+    body = client.get("/shared").json()
+    assert body["i18n"]["messages"] == {"pages.title": "Pages"}
+
+
+def test_authenticated_users_receive_admin_catalogs_too(tmp_path) -> None:
+    client = TestClient(_build_audience_app(tmp_path))
+    body = client.get("/shared", headers={"X-Test-Auth": "1"}).json()
+    assert body["i18n"]["messages"] == {"pages.title": "Pages", "settings.key": "Key"}
+
+
+def test_login_mid_session_reships_messages_on_an_inertia_partial(tmp_path) -> None:
+    """An Inertia partial normally skips messages — but not right after login,
+    or the freshly-authenticated client would keep the anonymous catalog."""
+    client = TestClient(_build_audience_app(tmp_path))
+    client.get("/shared")  # anonymous full load seeds the session audience
+    body = client.get("/shared", headers={"X-Test-Auth": "1", "X-Inertia": "true"}).json()
+    assert body["i18n"]["messages"] == {"pages.title": "Pages", "settings.key": "Key"}
+
+
+def test_inertia_partial_with_unchanged_audience_still_skips_messages(tmp_path) -> None:
+    client = TestClient(_build_audience_app(tmp_path))
+    client.get("/shared")
+    body = client.get("/shared", headers={"X-Inertia": "true"}).json()
+    assert body["i18n"]["messages"] is None
+
+
 def test_inertia_shared_props_fallback_when_registry_missing(
     caplog,
 ) -> None: