simple-module-hosting 0.0.28__tar.gz → 0.0.30__tar.gz

{simple_module_hosting-0.0.28 → simple_module_hosting-0.0.30}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simple_module_hosting
-Version: 0.0.28
+Version: 0.0.30
 Summary: FastAPI + Inertia.js host runtime for simple_module — app_builder, middleware stack, CLI (sm / simple-module), scaffolding
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -27,8 +27,8 @@ Requires-Dist: fastapi>=0.115
 Requires-Dist: httpx>=0.27
 Requires-Dist: itsdangerous>=2.0
 Requires-Dist: jinja2>=3.1
-Requires-Dist: simple-module-core==0.0.28
-Requires-Dist: simple-module-db==0.0.28
+Requires-Dist: simple-module-core==0.0.30
+Requires-Dist: simple-module-db==0.0.30
 Requires-Dist: starlette>=0.44
 Requires-Dist: tomlkit>=0.13
 Requires-Dist: uvicorn[standard]>=0.34

{simple_module_hosting-0.0.28 → simple_module_hosting-0.0.30}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_hosting"
-version = "0.0.28"
+version = "0.0.30"
 description = "FastAPI + Inertia.js host runtime for simple_module — app_builder, middleware stack, CLI (sm / simple-module), scaffolding"
 readme = "README.md"
 license = "MIT"
@@ -30,8 +30,8 @@ dependencies = [
     # it directly — out-of-tree hosts have nothing else pulling it in.
     "itsdangerous>=2.0",
     "jinja2>=3.1",
-    "simple_module_core==0.0.28",
-    "simple_module_db==0.0.28",
+    "simple_module_core==0.0.30",
+    "simple_module_db==0.0.30",
     "starlette>=0.44",
     "tomlkit>=0.13",
     "uvicorn[standard]>=0.34",

{simple_module_hosting-0.0.28 → simple_module_hosting-0.0.30}/simple_module_hosting/app_builder.py

@@ -12,7 +12,7 @@ from pathlib import Path
 from fastapi import FastAPI
 from simple_module_core.design_packs import DesignPackRegistry
 from simple_module_core.diagnostics import DiagnosticLevel, print_diagnostics, run_diagnostics
-from simple_module_core.discovery import discover_modules, topological_sort
+from simple_module_core.discovery import discover_modules, select_auth_provider, topological_sort
 from simple_module_core.events import EventBus
 from simple_module_core.feature_flags import FeatureFlagRegistry
 from simple_module_core.health import HealthRegistry
@@ -120,6 +120,13 @@ def create_app(settings: Settings | None = None) -> FastAPI:
         enabled=settings.modules_enabled,
         strict=not settings.is_development,
     )
+    # Two auth providers can be installed at once (they are in this workspace);
+    # only the configured one is activated. See select_auth_provider / SM020.
+    # Strict outside development: diagnostics don't run there, so an
+    # unrecognised name would otherwise mount both providers unreported.
+    modules = select_auth_provider(
+        modules, settings.auth_provider, strict=not settings.is_development
+    )
     modules = topological_sort(modules)
     logger.info(
         "Loaded %d module(s): %s",

{simple_module_hosting-0.0.28 → simple_module_hosting-0.0.30}/simple_module_hosting/assets.py

@@ -13,9 +13,22 @@ A module may ship two optional stylesheets beside its ``pages/`` directory:
   utility: a module shipping a bare ``.card { padding: 0 }`` would otherwise
   silently beat ``p-4``.
 
-Both are referenced through a per-module Vite alias (``#module/<pkg>``) rather
-than a filesystem path, so the generated CSS never contains something like
-``../../../.venv/lib/python3.12/site-packages/<pkg>/styles.css``.
+Both are referenced by **absolute** filesystem path, exactly as the ``@source``
+lines in the same file already are.
+
+This used to emit a per-module Vite alias (``#module/<pkg>/styles.css``) to
+avoid a relative path like ``../../../.venv/lib/python3.12/site-packages/<pkg>``
+— but that objection only ever applied to *relative* paths, and the alias made
+this generated file depend on the host resolving it. ``vite.config.ts`` is
+scaffold output: it is written once into an app and then owned and edited
+there, so it is versioned independently of these Python packages. A host
+scaffolded before the alias existed never receives it, and a Python-only
+dependency bump would emit specifiers that host cannot resolve, failing the
+build with ``Can't resolve '#module/<pkg>/styles.css'`` — naming something that
+appears nowhere in the app's own sources (GH issue #253).
+
+Absolute paths keep the generated CSS self-contained: it resolves under any
+``vite.config.ts``, old or new, with no alias configured at all.
 """
 
 from __future__ import annotations
@@ -33,7 +46,7 @@ logger = logging.getLogger(__name__)
 
 THEME_CSS = "theme.css"
 STYLES_CSS = "styles.css"
-ALIAS_PREFIX = "#module"
+PACKAGE_JSON = "package.json"
 
 
 @dataclass(frozen=True)
@@ -46,6 +59,39 @@ class ModuleAssets:
     pages_dir: Path | None
     theme_css: Path | None
     styles_css: Path | None
+    npm_name: str | None = None
+
+
+def find_npm_name(pkg_root: Path) -> str | None:
+    """Return the module's npm package name, or ``None`` if it ships no JS.
+
+    Two install layouts put ``package.json`` in different places:
+
+    * **wheel** — Hatch force-includes the module-root ``package.json`` *into*
+      the Python package, so it lands at ``site-packages/<pkg>/package.json``.
+    * **editable / workspace** — it stays at the source-tree module root,
+      ``modules/<name>/package.json``, one level above the Python package.
+
+    The parent candidate is accepted only when that directory also holds a
+    ``pyproject.toml``. Without that guard a wheel-installed module would
+    happily read ``site-packages/package.json`` — some unrelated file that
+    happens to sit there — and alias the module onto a stranger's name.
+    """
+    candidates = [pkg_root / PACKAGE_JSON]
+    parent = pkg_root.parent
+    if (parent / "pyproject.toml").is_file():
+        candidates.append(parent / PACKAGE_JSON)
+    for candidate in candidates:
+        if not candidate.is_file():
+            continue
+        try:
+            name = json.loads(candidate.read_text(encoding="utf-8")).get("name")
+        except (OSError, ValueError):
+            logger.debug("Module package.json at %s is unreadable — ignoring", candidate)
+            continue
+        if isinstance(name, str) and name:
+            return name
+    return None
 
 
 def compute_module_assets(modules: Sequence[ModuleBase]) -> list[ModuleAssets]:
@@ -78,6 +124,7 @@ def compute_module_assets(modules: Sequence[ModuleBase]) -> list[ModuleAssets]:
             pages_dir=pages_dir.resolve() if pages_dir.is_dir() else None,
             theme_css=theme.resolve() if theme.is_file() else None,
             styles_css=styles.resolve() if styles.is_file() else None,
+            npm_name=find_npm_name(pkg_root),
         )
         if entry.pages_dir or entry.theme_css or entry.styles_css:
             result.append(entry)
@@ -109,19 +156,18 @@ def render_modules_css(
     ``styles.css``, so emitting an absolute one too would just duplicate it.
     ``@import`` is emitted for *every* module, in-repo and wheel alike, because
     there is no static-glob equivalent for CSS.
+
+    Every path is absolute, so nothing here depends on the host's
+    ``vite.config.ts`` — see the module docstring for why that matters.
     """
     source_lines = [
         f'@source "{e.pages_dir.as_posix()}/**/*.{{ts,tsx}}";'
         for e in assets
         if e.pages_dir and not in_repo(e.pages_dir)
     ]
-    theme_lines = [
-        f'@import "{ALIAS_PREFIX}/{e.package_name}/{THEME_CSS}";' for e in assets if e.theme_css
-    ]
+    theme_lines = [f'@import "{e.theme_css.as_posix()}";' for e in assets if e.theme_css]
     style_lines = [
-        f'@import "{ALIAS_PREFIX}/{e.package_name}/{STYLES_CSS}" layer(components);'
-        for e in assets
-        if e.styles_css
+        f'@import "{e.styles_css.as_posix()}" layer(components);' for e in assets if e.styles_css
     ]
 
     out = [_CSS_HEADER]
@@ -146,6 +192,13 @@ def render_assets_json(assets: Sequence[ModuleAssets]) -> str:
     manifest's value shape would break every downstream app at once. This file
     is purely additive, and also covers CSS-only modules that never appear in
     the pages manifest because they ship no ``pages/``.
+
+    ``npm_name`` is what lets one module import another's TS/TSX by package
+    name. The host aliases it onto ``package`` — the module's *Python package
+    directory* — and that target is forced, not chosen: a wheel contains only
+    ``site-packages/<pkg>/**``, so the source-tree module root simply does not
+    exist once installed. Anchoring the npm name there is the only mapping
+    that can mean the same thing in both layouts. See ``find_npm_name``.
     """
     payload = {
         e.name: {
@@ -154,6 +207,7 @@ def render_assets_json(assets: Sequence[ModuleAssets]) -> str:
             "pages": e.pages_dir.as_posix() if e.pages_dir else None,
             "theme": e.theme_css.as_posix() if e.theme_css else None,
             "styles": e.styles_css.as_posix() if e.styles_css else None,
+            "npm_name": e.npm_name,
         }
         for e in assets
     }

{simple_module_hosting-0.0.28 → simple_module_hosting-0.0.30}/simple_module_hosting/bootstrap_settings.py

@@ -11,6 +11,7 @@ from typing import Literal
 
 from pydantic import field_validator, model_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
+from simple_module_core.discovery import DEFAULT_AUTH_PROVIDER
 from simple_module_core.environments import NON_PROD_ENVIRONMENTS
 
 _PLACEHOLDER_SECRET_KEY = "change-me-in-production"
@@ -46,6 +47,14 @@ class BootstrapSettings(BaseSettings):
 
     modules_enabled: list[str] | None = None
 
+    auth_provider: str = DEFAULT_AUTH_PROVIDER
+    """Which auth provider module to activate (``SM_AUTH_PROVIDER``).
+
+    ``users`` and ``keycloak`` both provide authentication and only one may be
+    active at a time. When both are installed this picks the winner; the other
+    is skipped at discovery. Ignored when only one is installed.
+    """
+
     auth_public_paths: list[str] = []
     """Host-level anonymous-access path prefixes (``SM_AUTH_PUBLIC_PATHS``).
 
@@ -55,6 +64,19 @@ class BootstrapSettings(BaseSettings):
     ``register_public_routes`` hook, which is method-aware.
     """
 
+    @field_validator("auth_provider", mode="after")
+    @classmethod
+    def _normalize_auth_provider(cls, value: str) -> str:
+        """Strip whitespace; treat blank as unset.
+
+        ``SM_AUTH_PROVIDER=`` in a ``.env`` yields ``''``, which matches no
+        installed provider and would mount all of them. The out-of-process
+        readers (``make doctor``, ``gen-pages``) go through
+        ``resolve_auth_provider``, which already falls back on blank — without
+        this they and the host would disagree about the active provider.
+        """
+        return value.strip() or DEFAULT_AUTH_PROVIDER
+
     @field_validator("trusted_proxy", mode="after")
     @classmethod
     def _normalize_trusted_proxy(cls, value: str | None) -> str | None:

{simple_module_hosting-0.0.28 → simple_module_hosting-0.0.30}/simple_module_hosting/host_cli.py

@@ -13,7 +13,7 @@ from pathlib import Path
 from typing import Annotated
 
 import typer
-from simple_module_core import discover_modules
+from simple_module_core import discover_modules, resolve_auth_provider, select_auth_provider
 
 from simple_module_hosting.manifest import (
     collect_module_js_deps,
@@ -42,7 +42,9 @@ def gen_pages(
     if not host_dir.is_dir():
         typer.echo(f"ERROR: client_app directory not found at {host_dir}", err=True)
         raise typer.Exit(code=1)
-    modules = discover_modules()
+    # Skip the auth provider the host won't boot — its pages would otherwise
+    # ship in the bundle with no view endpoint able to render them.
+    modules = select_auth_provider(discover_modules(), resolve_auth_provider())
     written = write_module_pages_manifest(modules, host_dir)
     typer.echo(
         f"Module pages manifest: {len(modules)} module(s) "
@@ -70,7 +72,7 @@ def sync_js_deps(
         typer.echo(f"ERROR: client_app directory not found at {host_client_app}", err=True)
         raise typer.Exit(code=1)
 
-    modules = discover_modules()
+    modules = select_auth_provider(discover_modules(), resolve_auth_provider())
     by_module = collect_module_js_deps(modules)
     if not by_module:
         typer.echo("No module JS dependencies declared.")

{simple_module_hosting-0.0.28 → simple_module_hosting-0.0.30}/tests/test_app.py

@@ -168,16 +168,16 @@ class TestCreateApp:
         (tmp_path / "host" / "templates").mkdir(parents=True)
         (tmp_path / "host" / "templates" / "index.html").write_text("<html></html>")
 
-        # Exclude Keycloak — both ``users`` and ``keycloak`` are installed as
-        # entry points in the dev workspace. SM020 fires if both are present
-        # because the app is only meant to run with one auth provider.
-        from simple_module_core.discovery import discover_modules
-
-        all_names = [m.meta.name for m in discover_modules() if m.meta.name != "Keycloak"]
-        app = create_app(Settings(modules_enabled=all_names))
+        # No modules_enabled allowlist: both auth providers are entry points in
+        # the dev workspace, and create_app is expected to activate the named
+        # one rather than fail the boot on SM020. auth_provider is passed
+        # explicitly so an SM_AUTH_PROVIDER in the developer's .env can't
+        # decide which provider this asserts on.
+        app = create_app(Settings(auth_provider="users"))
 
         sm = app.state.sm
         assert isinstance(sm, Services)
+        assert [m.meta.name for m in sm.modules].count("Keycloak") == 0
         assert sm.settings is not None
         assert sm.db is not None
         assert sm.event_bus is not None

simple_module_hosting-0.0.30/tests/test_auth_provider_setting.py

@@ -0,0 +1,59 @@
+"""``SM_AUTH_PROVIDER`` normalisation on BootstrapSettings.
+
+The host reads this through ``Settings``; ``make doctor`` and ``smpy host
+gen-pages`` read it through ``simple_module_core.resolve_auth_provider``.
+The two must agree on every input, or the tools report on a different module
+set than the app boots with.
+"""
+
+from __future__ import annotations
+
+import os
+
+import pytest
+from simple_module_core.discovery import DEFAULT_AUTH_PROVIDER, resolve_auth_provider
+from simple_module_hosting.settings import Settings
+
+
+def _settings(**overrides) -> Settings:
+    return Settings(
+        database_url="sqlite+aiosqlite:///:memory:",
+        environment="testing",
+        secret_key="test-secret-key",
+        **overrides,
+    )
+
+
+class TestAuthProviderSetting:
+    @pytest.fixture(autouse=True)
+    def _isolated_env(self, monkeypatch, tmp_path):
+        """Run against an empty ``.env`` and a throwaway environment.
+
+        ``Settings`` resolves ``env_file=".env"`` relative to the working
+        directory, so without the chdir a developer running Keycloak locally
+        would fail the default-value assertions below — the very coupling
+        these tests exist to pin down.
+        """
+        monkeypatch.setattr(os, "environ", dict(os.environ))
+        monkeypatch.delenv("SM_AUTH_PROVIDER", raising=False)
+        monkeypatch.chdir(tmp_path)
+
+    def test_defaults_to_users(self):
+        assert _settings().auth_provider == DEFAULT_AUTH_PROVIDER
+
+    def test_explicit_value_passes_through(self):
+        assert _settings(auth_provider="keycloak").auth_provider == "keycloak"
+
+    @pytest.mark.parametrize("raw", ["", "   ", "\t"])
+    def test_blank_falls_back_to_the_default(self, raw: str):
+        """``SM_AUTH_PROVIDER=`` in .env yielded '', which matches no provider."""
+        assert _settings(auth_provider=raw).auth_provider == DEFAULT_AUTH_PROVIDER
+
+    def test_surrounding_whitespace_stripped(self):
+        assert _settings(auth_provider=" keycloak ").auth_provider == "keycloak"
+
+    @pytest.mark.parametrize("raw", ["", "   ", "keycloak", " keycloak "])
+    def test_agrees_with_resolve_auth_provider(self, raw: str, monkeypatch):
+        """Host and out-of-process readers must land on the same name."""
+        monkeypatch.setenv("SM_AUTH_PROVIDER", raw)
+        assert _settings().auth_provider == resolve_auth_provider()