simple-module-hosting 0.0.33__tar.gz → 0.0.34__tar.gz

{simple_module_hosting-0.0.33 → simple_module_hosting-0.0.34}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_hosting
-Version: 0.0.33
+Version: 0.0.34
 Summary: FastAPI + Inertia.js host runtime for simple_module — app_builder, middleware stack, CLI (sm / simple-module), scaffolding
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -27,8 +27,8 @@ Requires-Dist: fastapi>=0.115
 Requires-Dist: httpx>=0.27
 Requires-Dist: itsdangerous>=2.0
 Requires-Dist: jinja2>=3.1
-Requires-Dist: simple-module-core==0.0.33
-Requires-Dist: simple-module-db==0.0.33
+Requires-Dist: simple-module-core==0.0.34
+Requires-Dist: simple-module-db==0.0.34
 Requires-Dist: starlette>=0.44
 Requires-Dist: tomlkit>=0.13
 Requires-Dist: uvicorn[standard]>=0.34

{simple_module_hosting-0.0.33 → simple_module_hosting-0.0.34}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_hosting"
-version = "0.0.33"
+version = "0.0.34"
 description = "FastAPI + Inertia.js host runtime for simple_module — app_builder, middleware stack, CLI (sm / simple-module), scaffolding"
 readme = "README.md"
 license = "MIT"
@@ -30,8 +30,8 @@ dependencies = [
     # it directly — out-of-tree hosts have nothing else pulling it in.
     "itsdangerous>=2.0",
     "jinja2>=3.1",
-    "simple_module_core==0.0.33",
-    "simple_module_db==0.0.33",
+    "simple_module_core==0.0.34",
+    "simple_module_db==0.0.34",
     "starlette>=0.44",
     "tomlkit>=0.13",
     "uvicorn[standard]>=0.34",

{simple_module_hosting-0.0.33 → simple_module_hosting-0.0.34}/simple_module_hosting/_error_handlers.py

@@ -21,6 +21,7 @@ from starlette.requests import Request
 from starlette.responses import Response
 
 from simple_module_hosting._inertia_shared import _INERTIA_HEADER
+from simple_module_hosting._inertia_url import patch_relative_page_url
 from simple_module_hosting.permissions import PERMISSION_DENIED_PREFIX
 
 logger = logging.getLogger(__name__)
@@ -172,11 +173,25 @@ async def render_error_page(
         # thing that is missing when the app is half-built, and an error page
         # that raises while reporting an error leaves the caller with nothing.
         config: InertiaConfig = request.app.state.sm.inertia_config
-        inertia = Inertia(request, config)
-        # This builds its own Inertia instead of going through get_inertia, so
-        # the share step has to be repeated here. Without it the error page
-        # renders raw translation keys (host.error.not_found_title) and loses
-        # auth/menus, so a signed-in user's 404 has no layout.
+        # Prefer the app's configured dependency over constructing Inertia
+        # directly: it carries the framework's wraps, and an error page built
+        # around them is an error page rendered differently from every other
+        # page. That is how the 404 kept throwing the cross-scheme `pushState`
+        # SecurityError after the page url was made relative everywhere else.
+        # The raw construction stays as the fallback for a half-built app —
+        # the case this whole handler exists to survive — but still goes
+        # through the same url-relativizing patch directly: a fallback that
+        # skipped it would reintroduce the exact bug this module exists to
+        # fix, just for the one request that hit it before setup finished.
+        inertia_dep = getattr(request.app.state, "inertia_dependency", None)
+        if inertia_dep is not None:
+            inertia = inertia_dep(request, None)
+        else:
+            inertia = patch_relative_page_url(Inertia(request, config))
+        # This does not go through get_inertia, so the share step has to be
+        # repeated here. Without it the error page renders raw translation keys
+        # (host.error.not_found_title) and loses auth/menus, so a signed-in
+        # user's 404 has no layout.
         shared = getattr(request.state, "inertia_shared", None)
         if shared:
             inertia.share(**shared)

simple_module_hosting-0.0.34/simple_module_hosting/_favicon.py

@@ -0,0 +1,94 @@
+"""The favicon an install has before anyone uploads one.
+
+Without a default, ``index.html`` emitted no ``<link rel="icon">`` at all, so
+every browser fell back to its implicit ``/favicon.ico`` request — which this
+app does not route. Anonymous visitors got a 302 to the login page (an HTML
+document offered as an image), authenticated ones a 404, and either way a
+console error on every full page load, on a brand-new install that has done
+nothing wrong.
+
+Rendered as an SVG ``data:`` URI rather than a file so there is nothing to
+mount, nothing to exempt from auth, and nothing to ship in the image: the
+static mount is a build artifact (``host/static/dist`` is generated), and a
+route would need its own public-route rule. ``img-src`` already allows
+``data:``, so the strict CSP is untouched.
+
+The mark mirrors ``BrandingMark``'s fallback badge — the app's initial on the
+brand gradient — so the tab icon and the in-app logo are the same thing, for
+whatever the app is named. An uploaded favicon still wins; this is only the
+floor.
+"""
+
+from __future__ import annotations
+
+from functools import lru_cache
+from urllib.parse import quote
+from xml.sax.saxutils import escape as _xml_escape
+
+#: sRGB for `--color-primary-600` / `--color-primary-800`
+#: (`oklch(0.59 0.14 158)` / `oklch(0.42 0.09 175)`), the two stops of
+#: `BRAND_ACCENT`. Hard-coded because a data URI cannot read a CSS custom
+#: property — kept beside the tokens they mirror in `ui/styles/globals.css`.
+_ACCENT_FROM = "#00955c"
+_ACCENT_TO = "#005c4a"
+
+_SVG = (
+    '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">'
+    '<defs><linearGradient id="a" x1="0" y1="0" x2="1" y2="1">'
+    '<stop offset="0" stop-color="{from_}"/>'
+    '<stop offset="1" stop-color="{to}"/>'
+    "</linearGradient></defs>"
+    '<rect width="64" height="64" rx="14" fill="url(#a)"/>'
+    '<text x="32" y="45" text-anchor="middle" fill="#fff" font-size="34" '
+    'font-weight="700" font-family="system-ui,-apple-system,Segoe UI,'
+    'Roboto,sans-serif">{initial}</text>'
+    "</svg>"
+)
+
+
+@lru_cache(maxsize=64)
+def default_favicon_data_uri(app_name: str, accent: str = "") -> str:
+    """An SVG data URI showing ``app_name``'s initial on the brand gradient.
+
+    ``accent`` is branding's configured primary colour: when set it replaces
+    both gradient stops with the flat brand colour, so a customised install's
+    tab icon matches the rest of its chrome. Already validated as a hex colour
+    by ``BrandingSettings``; anything else is ignored rather than trusted into
+    the markup.
+
+    Pure function of its two arguments, cached: ``branding_head`` calls it on
+    every full page render, and with no favicon uploaded — the state every
+    install starts in — that means every single page load rebuilds and
+    re-quotes the same SVG. The cache is keyed on ``(app_name, accent)``, both
+    of which only change when an admin edits branding settings.
+    """
+    initial = _initial(app_name)
+    from_, to = (accent, accent) if _is_hex_colour(accent) else (_ACCENT_FROM, _ACCENT_TO)
+    svg = _SVG.format(from_=from_, to=to, initial=initial)
+    # Everything structural is encoded — `#` above all, or the browser reads
+    # the gradient reference as the URI's fragment and the shape loses its
+    # fill, but also `"`, `<`, `>` and spaces so the result stays a single
+    # valid attribute value without relying on the template's escaping. The
+    # safe set is only characters that are already legal unencoded in a URI.
+    return "data:image/svg+xml," + quote(svg, safe="/:=,;()-_.'")
+
+
+def _initial(app_name: str) -> str:
+    """First character of the app name, XML-escaped, defaulting to ``S``.
+
+    Matches ``BrandingMark``'s ``appName.trim().charAt(0).toUpperCase() || 'S'``
+    so the tab and the sidebar badge never disagree.
+    """
+    raw = (app_name or "").strip()[:1].upper() or "S"
+    return _xml_escape(raw)
+
+
+def _is_hex_colour(value: str) -> bool:
+    """Whether ``value`` is a ``#rgb``/``#rrggbb`` literal safe to interpolate."""
+    if not value.startswith("#"):
+        return False
+    body = value[1:]
+    return len(body) in (3, 6) and all(c in "0123456789abcdefABCDEF" for c in body)
+
+
+__all__ = ["default_favicon_data_uri"]

{simple_module_hosting-0.0.33 → simple_module_hosting-0.0.34}/simple_module_hosting/_inertia_setup.py

@@ -12,7 +12,9 @@ from fastapi import FastAPI
 from inertia import InertiaConfig, inertia_dependency_factory
 from starlette.requests import Request
 
+from simple_module_hosting._favicon import default_favicon_data_uri
 from simple_module_hosting._inertia_json import json_safe_inertia_dependency
+from simple_module_hosting._inertia_url import relative_page_url_dependency
 from simple_module_hosting.settings import Settings
 
 logger = logging.getLogger(__name__)
@@ -40,16 +42,22 @@ def branding_head(request: Request) -> dict:
     The favicon URL is read from the module rather than assembled here: branding
     owns its route shape, and framework code must not reach into a plugin
     (SM009). ``BrandingHead`` still applies it client-side too, so a favicon
-    changed at runtime updates without a reload.
+    changed at runtime updates without a reload. When nothing has been uploaded
+    — the state every install starts in — it falls back to a generated mark
+    rather than ``None``, because omitting the tag sends the browser to
+    ``/favicon.ico``, which this app does not serve.
     """
     services = getattr(request.app.state, "branding", None)
     settings = getattr(services, "settings", None)
-    if settings is None:
-        return {"app_name": _DEFAULT_APP_NAME, "theme_color": None, "favicon_url": None}
+    app_name = getattr(settings, "app_name", "") or _DEFAULT_APP_NAME
+    accent = getattr(settings, "primary_color", "") or ""
+    favicon_url = getattr(services, "favicon_url", None) or default_favicon_data_uri(
+        app_name, accent
+    )
     return {
-        "app_name": getattr(settings, "app_name", "") or _DEFAULT_APP_NAME,
-        "theme_color": getattr(settings, "primary_color", "") or None,
-        "favicon_url": getattr(services, "favicon_url", None),
+        "app_name": app_name,
+        "theme_color": accent or None,
+        "favicon_url": favicon_url,
     }
 
 
@@ -185,9 +193,15 @@ def setup_inertia(
         use_flash_errors=True,
     )
 
-    # Upstream's JSON branch builds a Starlette JSONResponse directly, so the
-    # encoder configured above only ever applies to full page loads. Wrap the
-    # dependency so a client-side visit encodes the same props the same way.
-    inertia_dep = json_safe_inertia_dependency(inertia_dependency_factory(inertia_config))
+    # Two wraps over the stock dependency, each closing a gap in upstream:
+    #   * JSON branch builds a Starlette JSONResponse directly, so the encoder
+    #     configured above only ever applies to full page loads — wrap it so a
+    #     client-side visit encodes the same props the same way.
+    #   * The page url is absolute, which the browser rejects for pushState
+    #     behind a TLS-terminating proxy — wrap it back to the root-relative
+    #     path the Inertia protocol specifies.
+    inertia_dep = relative_page_url_dependency(
+        json_safe_inertia_dependency(inertia_dependency_factory(inertia_config))
+    )
     app.state.inertia_dependency = inertia_dep
     return inertia_config

simple_module_hosting-0.0.34/simple_module_hosting/_inertia_url.py

@@ -0,0 +1,131 @@
+"""Make Inertia's page ``url`` root-relative, as the protocol specifies.
+
+``fastapi-inertia`` builds the page object with the *absolute* request url::
+
+    page_data = {
+        "component": self._component,
+        "props": await self._build_props(),
+        "url": str(self._request.url),      # http://host:8000/dashboard/
+        "version": self._config.version,
+    }
+
+The Inertia protocol says otherwise — every official adapter emits a
+root-relative path (Laravel's ``$request->getRequestUri()``, Rails'
+``request.original_fullpath``), and the documented page object is
+``{"component": "Event", "props": {...}, "url": "/events/80", ...}``. The
+client hands that value straight to ``history.pushState``/``replaceState``,
+which resolves a relative url against the current document and so can never
+disagree with it.
+
+An absolute url can, and behind a TLS-terminating reverse proxy it always
+does. The proxy speaks https to the browser and http to the container, so
+``request.url`` is ``http://…`` while the document origin is ``https://…``,
+and the browser rejects the state write::
+
+    SecurityError: Failed to execute 'pushState' on 'History': A history state
+    object with URL 'http://example.com/' cannot be created in a document with
+    origin 'https://example.com' and URL 'https://example.com/'
+
+That fires on *every* page — the initial ``replaceState`` and every subsequent
+visit — so history state is never written: back/forward navigation and scroll
+restoration silently stop working, and the console fills with the error. The
+throw escapes as an unhandled rejection, because the client's
+``isHistoryThrottleError`` guard matches the string ``"history.pushState"``
+while the browser's message reads ``"Failed to execute 'pushState'"``.
+
+``SM_TRUSTED_PROXY`` fixes the scheme by trusting ``X-Forwarded-Proto``, and is
+still worth setting — it is what makes request logs record the real client IP.
+But an install should not need it merely to have working history, and trusting
+forwarded headers is a security decision that must stay opt-in: the default
+image is documented as runnable standalone, where a spoofed ``X-Forwarded-For``
+would poison the audit log. Emitting the relative url the protocol asks for
+removes the dependency entirely, whatever the deployment looks like.
+
+Patched at ``_get_page_data`` because it is the single choke point: upstream's
+SSR, JSON and full-page-load branches all build their payload from it. The
+replacement binds to the instance, so the library's class is untouched.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+from urllib.parse import urlsplit
+
+logger = logging.getLogger(__name__)
+
+
+def patch_relative_page_url(inertia: Any) -> Any:
+    """Patch a single Inertia instance in place so its page ``url`` is
+    root-relative, and return it.
+
+    Shared by :func:`relative_page_url_dependency` (the normal per-request
+    path) and by callers that already hold a bare instance — the error
+    handler's half-built-app fallback — so there is exactly one place that
+    knows how to apply the patch rather than a second copy of this hasattr
+    check.
+
+    An instance that doesn't expose the hook is handed back untouched: the
+    failure mode is the absolute url that already ships, and refusing to boot
+    because an upstream attribute moved would be a worse trade.
+    """
+    if hasattr(inertia, "_get_page_data"):
+        inertia._get_page_data = _page_data_for(inertia)
+    else:  # pragma: no cover - upstream layout changed
+        logger.warning(
+            "Inertia instance has no _get_page_data; the page url stays "
+            "absolute and history writes will fail behind a TLS proxy"
+        )
+    return inertia
+
+
+def relative_page_url_dependency(inertia_dep: Any) -> Any:
+    """Wrap an Inertia dependency so its page ``url`` is root-relative.
+
+    Keeps the ``(request, client)`` shape ``inertia_dependency_factory``
+    returns, and composes with the other wraps in either order — each patches a
+    different instance attribute, and the JSON wrap looks ``_get_page_data`` up
+    on the instance at call time.
+    """
+
+    def dependency(request: Any, client: Any = None) -> Any:
+        return patch_relative_page_url(inertia_dep(request, client))
+
+    return dependency
+
+
+def _page_data_for(inertia: Any) -> Any:
+    """Build the instance's replacement ``_get_page_data``."""
+    stock = inertia._get_page_data
+
+    async def _get_page_data() -> dict:
+        page_data = await stock()
+        url = page_data.get("url")
+        if isinstance(url, str):
+            page_data["url"] = to_relative_url(url)
+        return page_data
+
+    return _get_page_data
+
+
+def to_relative_url(url: str) -> str:
+    """Reduce an absolute url to the path-and-query the protocol wants.
+
+    A url that is already relative is returned unchanged, so this is safe to
+    apply twice and safe to apply to a payload upstream may one day fix.
+    Anything unparseable is passed through rather than mangled — a wrong url is
+    still better than a crash on the render path.
+    """
+    try:
+        parts = urlsplit(url)
+    except ValueError:  # pragma: no cover - urlsplit is near-total
+        return url
+    if not parts.scheme and not parts.netloc:
+        return url
+    relative = parts.path or "/"
+    if parts.query:
+        relative = f"{relative}?{parts.query}"
+    return relative
+
+
+__all__ = ["patch_relative_page_url", "relative_page_url_dependency", "to_relative_url"]

{simple_module_hosting-0.0.33 → simple_module_hosting-0.0.34}/simple_module_hosting/_phase_helpers.py

@@ -167,8 +167,10 @@ def install_middleware(
     app.add_middleware(RequestLoggingMiddleware)
     app.add_middleware(CorrelationIdMiddleware)
     # Outermost: rewrite scheme/client from X-Forwarded-* before anything else
-    # reads them, so request logs see the real client IP and Inertia's absolute
-    # page url carries the proxy-terminated scheme (GH #223). Gated on an
+    # reads them, so request logs see the real client IP rather than the
+    # proxy's. Inertia no longer needs this: its page url is
+    # root-relative, so pushState can't see a cross-scheme url either way (it
+    # used to throw a SecurityError on every page — GH #223). Gated on an
     # explicit trust setting — never trust forwarded headers by default.
     if settings.trusted_proxy:
         app.add_middleware(ProxyHeadersMiddleware, trusted_hosts=settings.trusted_proxy)

{simple_module_hosting-0.0.33 → simple_module_hosting-0.0.34}/simple_module_hosting/host_settings.py

@@ -58,8 +58,15 @@ class HostSettings(BaseSettings):
     # the container is only reachable through a single proxy), or a comma-
     # separated list of proxy IPs / CIDRs. Drives uvicorn's
     # ProxyHeadersMiddleware so request.url.scheme reflects X-Forwarded-Proto
-    # behind a TLS-terminating proxy — without it Inertia's pushState throws a
-    # cross-scheme SecurityError and login breaks (GH #223).
+    # and request logs record the real client IP rather than the proxy's.
+    # Recommended behind a TLS-terminating proxy, not required for
+    # Inertia: the page url is root-relative, so pushState can't see a
+    # cross-scheme url regardless (it used to throw a SecurityError on every
+    # page — GH #223). Still required for anything else that reads
+    # request.url.scheme or calls request.url_for(...) to build an absolute
+    # url, e.g. OAuth's callback_url and the locale cookie's `secure` flag —
+    # left unset behind such a proxy, an OAuth redirect_uri ships as http://
+    # and most providers reject it.
     trusted_proxy: str | None = None
 
     auth_provider: str = DEFAULT_AUTH_PROVIDER

{simple_module_hosting-0.0.33 → simple_module_hosting-0.0.34}/simple_module_hosting/i18n_manifest.py

@@ -66,6 +66,8 @@ def emit_frontend_types_for_modules(
     settings: Settings,
     installed_modules: list[ModuleBase],
     project_root: Path,
+    *,
+    strict: bool = False,
 ) -> None:
     """Emit the TS key union covering every *installed* module.
 
@@ -77,20 +79,33 @@ def emit_frontend_types_for_modules(
     inactive module's strings are typed, never served.
     """
     registry, _ = build_i18n_registry(settings, installed_modules, project_root)
-    emit_frontend_types(registry, project_root)
+    emit_frontend_types(registry, project_root, strict=strict)
 
 
-def emit_frontend_types(registry: I18nRegistry, project_root: Path) -> None:
+def emit_frontend_types(
+    registry: I18nRegistry, project_root: Path, *, strict: bool = False
+) -> None:
     """Write the TS augmentation files into @simple-module-py/i18n if present.
 
     Logs but does not raise on failure — stale types are preferable to a
     broken boot. Dev-loop only; callers should gate on ``is_development``.
+
+    ``strict=True`` re-raises instead, for a tool whose whole job is this
+    regeneration (``make gen-i18n``). There a swallowed failure only defers the
+    error to a ``tsc`` run several steps removed from the cause. Under strict a
+    missing package directory is an error too, where on the boot path it is the
+    normal shape of a wheel-installed app that ships no i18n workspace.
     """
+    pkg_src = project_root / "packages" / "i18n" / "src"
+    if not pkg_src.is_dir():
+        if strict:
+            raise FileNotFoundError(f"{pkg_src} does not exist — nothing to regenerate")
+        return
     try:
-        pkg_src = project_root / "packages" / "i18n" / "src"
-        if pkg_src.is_dir():
-            write_generated_resources(registry, pkg_src)
+        write_generated_resources(registry, pkg_src)
     except Exception:
+        if strict:
+            raise
         logger.exception("Failed to write generated-resources.ts — frontend types will be stale")
 
 

{simple_module_hosting-0.0.33 → simple_module_hosting-0.0.34}/simple_module_hosting/permissions.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 from fastapi import HTTPException, Request
-from simple_module_core.permissions import DEFAULT_ROLE_PERMISSIONS, WILDCARD
+from simple_module_core.permissions import DEFAULT_ROLE_PERMISSIONS, WILDCARD, grants
 
 __all__ = [
     "DEFAULT_ROLE_PERMISSIONS",
@@ -12,6 +12,7 @@ __all__ = [
     "RequiresPermission",
     "expand_permissions",
     "resolve_permissions",
+    "resolved_permissions_for",
 ]
 
 # How a denial spells the missing permission in ``HTTPException.detail``.
@@ -45,6 +46,39 @@ def expand_permissions(
     return sorted(resolved)
 
 
+def resolved_permissions_for(request: Request) -> set[str]:
+    """The permission set this request's principal holds, wildcard included.
+
+    Prefers what ``InertiaLayoutDataMiddleware`` already resolved and cached on
+    ``request.state``; falls back to resolving from the registry's role map when
+    the middleware is not in the stack (a bare router under a test transport),
+    caching the result so a route with several gates resolves once.
+
+    Anonymous requests hold nothing. Exposed because a handler sometimes has to
+    gate part of its *response* rather than the route — the audit log's entity
+    labels, for one — and that decision must read the same permission set the
+    door did.
+
+    Role-derived only, matching ``RequiresPermission``: the ``permissions``
+    module's direct per-user grants are its own dependency's business, and a
+    caller wanting those consults ``permissions.deps.RequiresPermission``.
+    """
+    cached: set[str] | None = getattr(request.state, "resolved_permissions", None)
+    if cached is not None:
+        return cached
+
+    user = getattr(request.state, "user", None)
+    if user is None:
+        return set()
+
+    sm = getattr(getattr(request.app, "state", None), "sm", None)
+    perm_registry = getattr(sm, "permissions", None) if sm is not None else None
+    role_map = perm_registry.role_map if perm_registry is not None else None
+    permissions = resolve_permissions(user.roles, role_map=role_map)
+    request.state.resolved_permissions = permissions
+    return permissions
+
+
 class RequiresPermission:
     """FastAPI dependency that enforces a specific permission.
 
@@ -63,20 +97,7 @@ class RequiresPermission:
         if user is None:
             raise HTTPException(status_code=401, detail="Authentication required")
 
-        # Use cached permissions from middleware if available
-        permissions: set[str] | None = getattr(request.state, "resolved_permissions", None)
-        if permissions is None:
-            # Fallback: middleware did not run — consult registry role_map if available
-            sm = getattr(getattr(request.app, "state", None), "sm", None)
-            perm_registry = getattr(sm, "permissions", None) if sm is not None else None
-            role_map = perm_registry.role_map if perm_registry is not None else None
-            permissions = resolve_permissions(user.roles, role_map=role_map)
-            request.state.resolved_permissions = permissions
-
-        if WILDCARD in permissions:
-            return
-
-        if self.permission not in permissions:
+        if not grants(resolved_permissions_for(request), self.permission):
             raise HTTPException(
                 status_code=403,
                 detail=f"{PERMISSION_DENIED_PREFIX}{self.permission}",

{simple_module_hosting-0.0.33 → simple_module_hosting-0.0.34}/simple_module_hosting/session.py

@@ -61,9 +61,11 @@ off disk. Recording the deadline in the payload puts the ceiling back per
 session: the auth provider treats a session past it as signed out, whatever
 the signer is still willing to verify.
 
-Written by whoever signs the user in, via :func:`stamp_session_expiry`.
-Sessions minted before this existed carry no key and are accepted as legacy —
-failing closed on absence would sign the entire user base out on deploy.
+Written by whoever signs the user in, via :func:`stamp_session_expiry`. A
+session minted before this existed carries no key; the auth provider stamps one
+on first sight (:func:`ensure_session_expiry`) rather than either rejecting it —
+which would sign the entire user base out on deploy — or accepting it forever,
+which would leave the hole this key was added to close.
 """
 
 SESSION_COOKIE_MAX_AGE_KEY = "session_cookie_max_age"
@@ -176,17 +178,40 @@ def stamp_session_expiry(session: MutableMapping[str, Any], max_age_seconds: int
     return deadline
 
 
+def ensure_session_expiry(session: MutableMapping[str, Any], max_age_seconds: int) -> int:
+    """Return this session's deadline, stamping one if it has none.
+
+    The migration path for sessions minted before :func:`stamp_session_expiry`
+    existed. Failing closed on absence would sign the whole user base out at
+    deploy time; accepting absence forever leaves open the hole the deadline was
+    added to close. Stamping on first sight does neither — the session keeps
+    working, and from that request on it carries the same bound as one minted
+    today.
+
+    It cannot widen anything: an existing deadline is returned untouched, and a
+    stamp written now is still capped by the signature window, which the signer
+    enforces from the session's *original* mint time. So a legacy session's real
+    ceiling stays what it always was, and one signature window after this ships
+    there are no unstamped sessions left for :func:`session_has_expired` to
+    decide about.
+    """
+    recorded = session.get(SESSION_EXPIRES_AT_KEY) if isinstance(session, Mapping) else None
+    if not isinstance(recorded, bool) and isinstance(recorded, (int, float)):
+        return int(recorded)
+    return stamp_session_expiry(session, max_age_seconds)
+
+
 def session_has_expired(session: Any) -> bool:
-    """True only if the session records a deadline that has passed.
+    """True if the session has no deadline, or records one that has passed.
 
-    Fail-open on a missing or unreadable key: it means the session predates
-    :func:`stamp_session_expiry`, and the alternative is signing every current
-    user out at deploy time. Revisit once deployed sessions have all turned
-    over — at that point absence should mean expired.
+    Fails **closed** on a missing or unreadable key. That is safe because the
+    only caller stamps first — see :func:`ensure_session_expiry` — so absence
+    here means the session never went through that path, which is not something
+    to give the benefit of the doubt to.
     """
     if not isinstance(session, Mapping):
-        return False
+        return True
     recorded = session.get(SESSION_EXPIRES_AT_KEY)
     if isinstance(recorded, bool) or not isinstance(recorded, (int, float)):
-        return False
+        return True
     return recorded <= time.time()

{simple_module_hosting-0.0.33 → simple_module_hosting-0.0.34}/tests/test_branding_head.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 from types import SimpleNamespace
 
+from simple_module_hosting._favicon import default_favicon_data_uri
 from simple_module_hosting._inertia_setup import branding_head
 
 
@@ -16,7 +17,11 @@ def _request(branding: object | None) -> SimpleNamespace:
 
 def test_defaults_when_branding_not_installed() -> None:
     meta = branding_head(_request(None))
-    assert meta == {"app_name": "SimpleModule", "theme_color": None, "favicon_url": None}
+    assert meta == {
+        "app_name": "SimpleModule",
+        "theme_color": None,
+        "favicon_url": default_favicon_data_uri("SimpleModule"),
+    }
 
 
 def test_reads_app_name_and_theme_color() -> None:
@@ -29,7 +34,11 @@ def test_reads_app_name_and_theme_color() -> None:
 def test_blank_values_fall_back() -> None:
     settings = SimpleNamespace(app_name="", primary_color="")
     meta = branding_head(_request(SimpleNamespace(settings=settings)))
-    assert meta == {"app_name": "SimpleModule", "theme_color": None, "favicon_url": None}
+    assert meta == {
+        "app_name": "SimpleModule",
+        "theme_color": None,
+        "favicon_url": default_favicon_data_uri("SimpleModule"),
+    }
 
 
 def test_favicon_url_comes_from_the_module_not_from_here() -> None:
@@ -42,8 +51,25 @@ def test_favicon_url_comes_from_the_module_not_from_here() -> None:
     assert branding_head(_request(services))["favicon_url"] == "/api/branding/favicon?v=abc"
 
 
-def test_favicon_url_is_none_on_a_host_without_that_attribute() -> None:
-    # An older branding release exposes no favicon_url; the shell just omits
-    # the link rather than erroring, and BrandingHead still sets it client-side.
+def test_an_uploaded_favicon_always_wins_over_the_default() -> None:
+    services = SimpleNamespace(
+        settings=SimpleNamespace(app_name="Acme", primary_color="#1a7dd1"),
+        favicon_url="/api/branding/favicon?v=abc",
+    )
+    assert branding_head(_request(services))["favicon_url"] == "/api/branding/favicon?v=abc"
+
+
+def test_a_host_without_that_attribute_still_gets_a_favicon() -> None:
+    # An older branding release exposes no favicon_url. Omitting the link tag
+    # sends the browser to /favicon.ico, which this app does not route — a 404
+    # (or a 302 to the login page) in the console on every full page load — so
+    # the generated mark stands in.
     services = SimpleNamespace(settings=SimpleNamespace(app_name="Acme", primary_color=""))
-    assert branding_head(_request(services))["favicon_url"] is None
+    assert branding_head(_request(services))["favicon_url"] == default_favicon_data_uri("Acme")
+
+
+def test_the_default_follows_the_configured_brand_colour() -> None:
+    services = SimpleNamespace(settings=SimpleNamespace(app_name="Acme", primary_color="#1a7dd1"))
+    favicon = branding_head(_request(services))["favicon_url"]
+    assert favicon == default_favicon_data_uri("Acme", "#1a7dd1")
+    assert favicon != default_favicon_data_uri("Acme")