simple-module-hosting 0.0.34__tar.gz → 0.0.36__tar.gz

{simple_module_hosting-0.0.34 → simple_module_hosting-0.0.36}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_hosting
-Version: 0.0.34
+Version: 0.0.36
 Summary: FastAPI + Inertia.js host runtime for simple_module — app_builder, middleware stack, CLI (sm / simple-module), scaffolding
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -22,16 +22,18 @@ Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Typing :: Typed
 Requires-Python: >=3.12
 Requires-Dist: click>=8.1
-Requires-Dist: fastapi-inertia>=1.0
 Requires-Dist: fastapi>=0.115
 Requires-Dist: httpx>=0.27
 Requires-Dist: itsdangerous>=2.0
 Requires-Dist: jinja2>=3.1
-Requires-Dist: simple-module-core==0.0.34
-Requires-Dist: simple-module-db==0.0.34
+Requires-Dist: simple-module-core==0.0.36
+Requires-Dist: simple-module-db==0.0.36
+Requires-Dist: simple-module-inertia==0.0.36
 Requires-Dist: starlette>=0.44
 Requires-Dist: tomlkit>=0.13
 Requires-Dist: uvicorn[standard]>=0.34
+Provides-Extra: redis
+Requires-Dist: redis>=5; extra == 'redis'
 Description-Content-Type: text/markdown
 
 # simple_module_hosting

{simple_module_hosting-0.0.34 → simple_module_hosting-0.0.36}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_hosting"
-version = "0.0.34"
+version = "0.0.36"
 description = "FastAPI + Inertia.js host runtime for simple_module — app_builder, middleware stack, CLI (sm / simple-module), scaffolding"
 readme = "README.md"
 license = "MIT"
@@ -23,20 +23,24 @@ classifiers = [
 dependencies = [
     "click>=8.1",
     "fastapi>=0.115",
-    "fastapi-inertia>=1.0",
     "httpx>=0.27",
     # SessionMiddleware (starlette.middleware.sessions) imports itsdangerous at
     # module import time; starlette treats it as an optional extra, so declare
     # it directly — out-of-tree hosts have nothing else pulling it in.
     "itsdangerous>=2.0",
     "jinja2>=3.1",
-    "simple_module_core==0.0.34",
-    "simple_module_db==0.0.34",
+    "simple_module_core==0.0.36",
+    "simple_module_db==0.0.36",
+    "simple_module_inertia==0.0.36",
     "starlette>=0.44",
     "tomlkit>=0.13",
     "uvicorn[standard]>=0.34",
 ]
 
+[project.optional-dependencies]
+# Shared rate-limiter store (SM_REDIS_URL). Without it the limiter counts per worker.
+redis = ["redis>=5"]
+
 [project.scripts]
 sm-host = "simple_module_hosting.host_cli:app"
 
@@ -59,3 +63,4 @@ packages = ["simple_module_hosting"]
 [tool.uv.sources]
 simple_module_core = { workspace = true }
 simple_module_db = { workspace = true }
+simple_module_inertia = { workspace = true }

simple_module_hosting-0.0.36/simple_module_hosting/_body_limit.py

@@ -0,0 +1,191 @@
+"""Request-body size guard (GH #345).
+
+Pure ASGI. Refuses an oversized body *before* a route reads it, so the limit
+protects the process and not just the database:
+
+* ``Content-Length`` over the ceiling is refused outright, body unread.
+* No (or a lying) ``Content-Length`` — chunked transfer — is caught by counting
+  the bytes the app actually pulls through ``receive`` and aborting once the
+  ceiling is crossed.
+
+The ceiling is the global ``max_request_body_bytes`` unless a module declared a
+per-path override with ``register_body_limits``.
+"""
+
+from __future__ import annotations
+
+import logging
+
+from simple_module_core.body_limits import BodyLimitRegistry
+from starlette.datastructures import Headers
+from starlette.exceptions import HTTPException
+from starlette.requests import Request
+from starlette.types import ASGIApp, Message, Receive, Scope, Send
+
+from simple_module_hosting._error_handlers import _wants_json
+from simple_module_hosting._request_guard_responses import send_guard_response
+
+logger = logging.getLogger("simple_module.request_guard")
+
+_MESSAGE = "Request body is too large."
+
+
+class _BodyTooLargeError(Exception):
+    pass
+
+
+class BodyLimitMiddleware:
+    def __init__(
+        self,
+        app: ASGIApp,
+        *,
+        max_bytes: int,
+        registry: BodyLimitRegistry | None = None,
+    ) -> None:
+        self.app = app
+        self.max_bytes = max_bytes
+        self.registry = registry
+
+    def _ceiling(self, scope: Scope) -> int:
+        override = None
+        if self.registry is not None:
+            override = self.registry.limit_for(scope["method"], scope["path"], scope.get("app"))
+        return self.max_bytes if override is None else override
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] != "http":
+            await self.app(scope, receive, send)
+            return
+        limit = self._ceiling(scope)
+        if limit <= 0:
+            await self.app(scope, receive, send)
+            return
+
+        declared = Headers(scope=scope).get("content-length")
+        too_big = (
+            declared is not None
+            and declared.isascii()
+            and declared.isdigit()
+            and int(declared) > limit
+        )
+        # A browser-shaped request is answered with the Inertia error page, which
+        # needs the session / locale / shared props the layers *inside* this one
+        # set up. So it is not refused here: the body read raises an
+        # ``HTTPException(413)`` that the app's own handler renders in full.
+        # (FastAPI re-raises HTTPException from body parsing untouched.) API
+        # callers are refused right here, before anything runs.
+        if not self._wants_json(scope):
+            await self._handle_page(scope, receive, send, limit, too_big)
+            return
+        if too_big:
+            self._log(scope, limit, int(declared))
+            await self._refuse(scope, receive, send, limit)
+            return
+
+        seen = 0
+        exceeded = False
+        refused = False
+        started = False
+
+        async def counting_receive() -> Message:
+            nonlocal seen, exceeded
+            message = await receive()
+            if message["type"] == "http.request":
+                seen += len(message.get("body", b""))
+                if seen > limit:
+                    exceeded = True
+                    raise _BodyTooLargeError
+            return message
+
+        async def guarded_send(message: Message) -> None:
+            nonlocal refused, started
+            if exceeded and not started:
+                # The app is answering a body we cut off (often with a 400 from
+                # its own parser). Swallow it; the 413 below is the real answer.
+                if not refused:
+                    refused = True
+                    self._log(scope, limit, seen)
+                    await self._refuse(scope, receive, send, limit)
+                return
+            # Once the app's own response has started it is passed through whole:
+            # swallowing the rest would leave the client hanging on a half-sent
+            # response. (Any exception it raises for the cut-off body is re-raised
+            # below, which aborts the connection instead.)
+            if message["type"] == "http.response.start":
+                started = True
+            await send(message)
+
+        try:
+            await self.app(scope, counting_receive, guarded_send)
+        except Exception:
+            if not exceeded or started:
+                if exceeded:
+                    self._log(scope, limit, seen)
+                raise
+        if exceeded and not refused and not started:
+            self._log(scope, limit, seen)
+            await self._refuse(scope, receive, send, limit)
+
+    @staticmethod
+    def _wants_json(scope: Scope) -> bool:
+        return _wants_json(Request(scope))
+
+    async def _handle_page(
+        self, scope: Scope, receive: Receive, send: Send, limit: int, too_big: bool
+    ) -> None:
+        seen = 0
+
+        async def receive_or_413() -> Message:
+            nonlocal seen
+            if too_big:
+                self._log(scope, limit, seen)
+                raise HTTPException(status_code=413, detail=_MESSAGE)
+            message = await receive()
+            if message["type"] == "http.request":
+                seen += len(message.get("body", b""))
+                if seen > limit:
+                    self._log(scope, limit, seen)
+                    raise HTTPException(status_code=413, detail=_MESSAGE)
+            return message
+
+        started = False
+
+        async def tracking_send(message: Message) -> None:
+            nonlocal started
+            if message["type"] == "http.response.start":
+                started = True
+            await send(message)
+
+        try:
+            await self.app(scope, receive_or_413, tracking_send)
+        except HTTPException as exc:
+            # Raised by a middleware that reads the body *outside* the router's
+            # exception handling (e.g. a form gate). Without this it would
+            # surface as a bare 500 from ServerErrorMiddleware.
+            if exc.status_code != 413 or started:
+                raise
+            await self._refuse(scope, receive, send, limit)
+
+    @staticmethod
+    def _log(scope: Scope, limit: int, size: int) -> None:
+        cid = scope.get("state", {}).get("correlation_id", "")
+        logger.warning(
+            "Request body over limit: %s %s (%d > %d bytes) correlation_id=%s",
+            scope["method"],
+            scope["path"],
+            size,
+            limit,
+            cid,
+        )
+
+    @staticmethod
+    async def _refuse(scope: Scope, receive: Receive, send: Send, limit: int) -> None:
+        await send_guard_response(
+            scope,
+            receive,
+            send,
+            413,
+            _MESSAGE,
+            headers={"Connection": "close"},
+            extra={"max_bytes": limit},
+        )

simple_module_hosting-0.0.36/simple_module_hosting/_boot_checks.py

@@ -0,0 +1,47 @@
+"""Diagnostics that need the built app, so cannot run from ``make doctor``.
+
+The module diagnostics in Phase 2 see only module classes and the source tree.
+A check about what modules *registered* has to wait until after Phase 5, and
+unlike the source-tree checks it is meaningful in production too.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any
+
+from simple_module_core.diagnostics import Diagnostic, check_tenant_resolver, print_diagnostics
+
+if TYPE_CHECKING:
+    from fastapi import FastAPI
+    from simple_module_core.services import DiagnosticsState
+
+logger = logging.getLogger(__name__)
+
+
+def _tenant_checks(app: FastAPI, settings: Any) -> list[Diagnostic]:
+    return check_tenant_resolver(
+        multi_tenant=bool(getattr(settings, "multi_tenant", False)),
+        resolver=getattr(app.state, "tenant_resolver", None),
+    )
+
+
+def report_tenant_resolution(
+    app: FastAPI, settings: Any, diagnostics_state: DiagnosticsState
+) -> list[Diagnostic]:
+    """SM025: report, and fold into the Doctor screen's results when it has a runner."""
+    found = _tenant_checks(app, settings)
+    if found:
+        if settings.is_development:
+            print_diagnostics(found)
+        else:
+            for diag in found:
+                logger.warning("%s", diag)
+    runner = diagnostics_state.runner
+    if runner is not None:
+        diagnostics_state.runner = lambda: [*runner(), *_tenant_checks(app, settings)]
+        diagnostics_state.results = [*diagnostics_state.results, *found]
+    return found
+
+
+__all__ = ["report_tenant_resolution"]

simple_module_hosting-0.0.36/simple_module_hosting/_csp_dynamic.py

@@ -0,0 +1,99 @@
+"""Per-response evaluation of module CSP providers (#434).
+
+``register_csp_sources`` runs before DB settings hydrate, so origins that come
+from a setting are declared as providers (``registry.add_provider(fn)``) and
+evaluated here on each response. The finished policy is cached by the *value*
+the providers return, so a settings edit changes the key on the next response
+without any invalidation wiring.
+
+Fail closed: a provider that raises, or a pair that fails the same validation
+``CspSourceRegistry.add`` applies, contributes nothing — the static policy
+still ships. Each distinct failure is logged once per process.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+from simple_module_core.csp import CspSourceRegistry, is_valid_source
+
+logger = logging.getLogger(__name__)
+
+_CACHE_MAX = 32
+_LOGGED_MAX = 256
+
+
+class DynamicCsp:
+    """Builds the CSP for one response from a static base plus provider output."""
+
+    def __init__(self, base: str, registry: CspSourceRegistry) -> None:
+        self.base = base
+        self._registry = registry
+        self._providers = registry.providers
+        self._cache: dict[frozenset[tuple[str, str]], str] = {}
+        self._logged: set[str] = set()
+
+    def policy_for(self, app: Any) -> str:
+        pairs = frozenset(self._collect(app))
+        if not pairs:
+            return self.base
+        policy = self._cache.get(pairs)
+        if policy is None:
+            if len(self._cache) >= _CACHE_MAX:
+                self._cache.clear()
+            # Sorted so the clause order is stable for a given set of pairs.
+            try:
+                policy = self._registry.extend_policy(self.base, extra=sorted(pairs))
+            except Exception as exc:
+                # Last line of the fail-closed guarantee: this runs inside the
+                # response for every page, so a bug here must cost the extra
+                # origins, never the response.
+                self._warn_once(
+                    f"build:{type(exc).__name__}:{exc}",
+                    "CSP provider policy build failed (%r); serving the static policy",
+                    exc,
+                )
+                return self.base
+            self._cache[pairs] = policy
+        return policy
+
+    def _collect(self, app: Any) -> list[tuple[str, str]]:
+        out: list[tuple[str, str]] = []
+        for provider in self._providers:
+            name = getattr(provider, "__qualname__", repr(provider))
+            try:
+                pairs = list(provider(app))
+            except Exception as exc:
+                self._warn_once(
+                    f"{name}:{type(exc).__name__}:{exc}",
+                    "CSP provider %s raised %r; its sources are skipped",
+                    name,
+                    exc,
+                )
+                continue
+            for pair in pairs:
+                if (
+                    isinstance(pair, tuple)
+                    and len(pair) == 2
+                    and isinstance(pair[0], str)
+                    and isinstance(pair[1], str)
+                    and is_valid_source(pair[0], pair[1])
+                ):
+                    out.append((pair[0], pair[1].strip()))
+                else:
+                    self._warn_once(
+                        f"{name}:{pair!r}",
+                        "CSP provider %s returned invalid pair %r; dropped",
+                        name,
+                        pair,
+                    )
+        return out
+
+    def _warn_once(self, key: str, msg: str, *args: object) -> None:
+        if key in self._logged:
+            return
+        if len(self._logged) >= _LOGGED_MAX:
+            self._logged.clear()
+        self._logged.add(key)
+        logger.warning(msg, *args)

simple_module_hosting-0.0.36/simple_module_hosting/_dev_boot.py

@@ -0,0 +1,86 @@
+"""Development-only boot work: the diagnostics run and the frontend artifacts.
+
+Extracted from ``app_builder`` so that file reads as the phase sequence and
+nothing else. Everything here is gated on ``settings.is_development`` at the one
+call site, and everything here reads or writes the *source tree* — a deployed
+wheel has no ``host/client_app`` to write a manifest into and no module sources
+for the AST checks to walk, which is why none of it belongs on a production boot
+path.
+"""
+
+from __future__ import annotations
+
+import logging
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+from simple_module_core.diagnostics import DiagnosticLevel, print_diagnostics, run_diagnostics
+
+from simple_module_hosting.i18n_manifest import emit_frontend_types_for_modules
+
+if TYPE_CHECKING:
+    from simple_module_core import ModuleBase
+    from simple_module_core.services import DiagnosticsState
+
+    from simple_module_hosting.settings import Settings
+
+logger = logging.getLogger(__name__)
+
+__all__ = ["run_dev_boot"]
+
+
+def run_dev_boot(
+    settings: Settings,
+    modules: list[ModuleBase],
+    installed_modules: list[ModuleBase],
+    *,
+    i18n_extra,
+    i18n_unknown_overrides: dict[str, list[str]] | None = None,
+    diagnostics_state: DiagnosticsState,
+    project_root: Path,
+) -> None:
+    """Run the module diagnostics and emit the frontend's generated files.
+
+    ``diagnostics_state.runner`` is left behind on purpose, not just used: the
+    in-app Doctor screen re-invokes this exact call through ``rerun()``, and
+    re-deriving the arguments from a request would mean re-discovering modules.
+
+    An ERROR-level diagnostic ends the process. A developer whose module has a
+    duplicate name or a framework→plugin import gets one clear message here
+    instead of an inexplicable failure several phases later — and the same
+    checks run at production boot, where the app would refuse to start anyway.
+    """
+    diagnostics_state.runner = lambda: run_diagnostics(
+        modules,
+        i18n_supported_locales=settings.i18n_supported_locales,
+        i18n_default_locale=settings.i18n_default_locale,
+        i18n_extra_sources=i18n_extra,
+        i18n_unknown_overrides=i18n_unknown_overrides,
+        database_dialect=settings.database_url.split(":", 1)[0].split("+", 1)[0],
+    )
+    diagnostics = diagnostics_state.rerun()
+    errors = [d for d in diagnostics if d.level == DiagnosticLevel.ERROR]
+    if diagnostics:
+        print_diagnostics(diagnostics)
+    if errors:
+        raise SystemExit(f"Module diagnostics: {len(errors)} error(s). Fix before continuing.")
+
+    _write_pages_manifest(modules, project_root)
+    emit_frontend_types_for_modules(settings, installed_modules, project_root)
+
+
+def _write_pages_manifest(modules: list[ModuleBase], project_root: Path) -> None:
+    """Tell Vite where pages shipped inside pip-installed wheels live.
+
+    Swallows its own failure: a missing or unwritable ``client_app`` must not
+    stop the API from booting, and the symptom — pages the frontend cannot find
+    — is loud enough on its own. See ``scaffolding.py``.
+    """
+    try:
+        from simple_module_hosting.manifest import write_module_pages_manifest
+
+        client_app = project_root / "host" / "client_app"
+        if client_app.is_dir():
+            write_module_pages_manifest(modules, client_app)
+    except Exception:
+        logger.exception("Failed to write module pages manifest — frontend may miss pages")

{simple_module_hosting-0.0.34 → simple_module_hosting-0.0.36}/simple_module_hosting/_error_handlers.py

@@ -9,24 +9,24 @@ from http import HTTPStatus
 from fastapi.encoders import jsonable_encoder
 from fastapi.exceptions import RequestValidationError
 from fastapi.responses import JSONResponse
-from inertia import (
+from simple_module_core.exceptions import NotFoundError
+from simple_module_inertia import (
     Inertia,
     InertiaConfig,
     InertiaVersionConflictException,
     inertia_version_conflict_exception_handler,
 )
-from simple_module_core.exceptions import NotFoundError
 from starlette.exceptions import HTTPException
 from starlette.requests import Request
 from starlette.responses import Response
 
 from simple_module_hosting._inertia_shared import _INERTIA_HEADER
-from simple_module_hosting._inertia_url import patch_relative_page_url
+from simple_module_hosting._observability import CorrelationIdMiddleware
 from simple_module_hosting.permissions import PERMISSION_DENIED_PREFIX
 
 logger = logging.getLogger(__name__)
 
-_INERTIA_ERROR_STATUSES = frozenset({401, 403, 404, 419, 422, 429, 500, 503})
+_INERTIA_ERROR_STATUSES = frozenset({401, 403, 404, 413, 419, 422, 429, 500, 503})
 
 # Statuses whose remedy is "sign in", so the page offers that as its primary
 # action rather than sending the visitor to the landing page.
@@ -174,20 +174,17 @@ async def render_error_page(
         # that raises while reporting an error leaves the caller with nothing.
         config: InertiaConfig = request.app.state.sm.inertia_config
         # Prefer the app's configured dependency over constructing Inertia
-        # directly: it carries the framework's wraps, and an error page built
-        # around them is an error page rendered differently from every other
-        # page. That is how the 404 kept throwing the cross-scheme `pushState`
-        # SecurityError after the page url was made relative everywhere else.
-        # The raw construction stays as the fallback for a half-built app —
-        # the case this whole handler exists to survive — but still goes
-        # through the same url-relativizing patch directly: a fallback that
-        # skipped it would reintroduce the exact bug this module exists to
-        # fix, just for the one request that hit it before setup finished.
+        # directly, so the error page is built the same way as every other
+        # page. The raw construction is the fallback for a half-built app —
+        # the case this whole handler exists to survive. Both paths emit a
+        # root-relative page url: the adapter does that by construction now,
+        # so the fallback no longer needs a separate patch to avoid the
+        # cross-scheme `pushState` SecurityError behind a TLS proxy.
         inertia_dep = getattr(request.app.state, "inertia_dependency", None)
         if inertia_dep is not None:
             inertia = inertia_dep(request, None)
         else:
-            inertia = patch_relative_page_url(Inertia(request, config))
+            inertia = Inertia(request, config)
         # This does not go through get_inertia, so the share step has to be
         # repeated here. Without it the error page renders raw translation keys
         # (host.error.not_found_title) and loses auth/menus, so a signed-in
@@ -282,5 +279,16 @@ async def request_validation_error_handler(
 async def unhandled_exception_handler(request: Request, exc: Exception) -> Response:
     logger.exception("Unhandled exception: %s", exc)
     if _wants_json(request):
-        return JSONResponse(status_code=500, content={"detail": "Internal Server Error"})
-    return await render_error_page(request, 500, "")
+        response: Response = JSONResponse(
+            status_code=500, content={"detail": "Internal Server Error"}
+        )
+    else:
+        response = await render_error_page(request, 500, "")
+    # A catch-all `Exception` handler runs in Starlette's ServerErrorMiddleware,
+    # which wraps *outside* CorrelationIdMiddleware, so the response never
+    # passes through it. Without this the 500 — the one response a caller most
+    # needs to quote back to support — is the one without the header.
+    cid = getattr(request.state, "correlation_id", "")
+    if cid:
+        response.headers.setdefault(CorrelationIdMiddleware.HEADER, cid)
+    return response

simple_module_hosting-0.0.36/simple_module_hosting/_i18n_build.py

@@ -0,0 +1,58 @@
+"""Construct the i18n registry from module, host and UI sources."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from simple_module_core import ModuleBase
+from simple_module_core.i18n import I18nRegistry
+
+from simple_module_hosting.settings import Settings
+
+
+def build_i18n_registry(
+    settings: Settings,
+    modules: list[ModuleBase],
+    project_root: Path,
+) -> tuple[I18nRegistry, list[tuple[str, str, Path]]]:
+    """Construct the i18n registry from module + host + UI sources.
+
+    Returns ``(registry, extra_sources)`` where ``extra_sources`` is the list
+    of ``(reporter_name, namespace, dir)`` triples the diagnostic runner
+    needs to validate non-module locale directories.
+    """
+    registry = I18nRegistry(
+        default_locale=settings.i18n_default_locale,
+        supported_locales=settings.i18n_supported_locales,
+    )
+    extra_sources: list[tuple[str, str, Path]] = []
+
+    for mod in modules:
+        audience = getattr(mod.meta, "i18n_audience", "public")
+        for namespace, locale_dir in mod.locale_dirs().items():
+            registry.add_source(namespace, locale_dir, audience=audience)
+
+    # The framework's own catalog — the setup wizard ships with this package,
+    # so its strings must too, whatever host is serving it.
+    hosting_locales = Path(__file__).resolve().parent / "locales"
+    registry.add_source("hosting", hosting_locales)
+    extra_sources.append(("simple_module_hosting", "hosting", hosting_locales))
+
+    host_locales = project_root / "host" / "locales"
+    if host_locales.is_dir():
+        registry.add_source("host", host_locales)
+        extra_sources.append(("host", "host", host_locales))
+
+    overrides = host_locales / "overrides"
+    if overrides.is_dir():
+        registry.add_overrides(overrides)
+
+    # Shared UI strings ship inside this package (not ``packages/ui``) so a
+    # scaffolded app, which has no ``packages/ui`` checkout, still resolves
+    # every ``ui.*`` key.
+    ui_locales = Path(__file__).resolve().parent / "ui_locales"
+    registry.add_source("ui", ui_locales)
+    extra_sources.append(("simple_module_hosting/ui", "ui", ui_locales))
+
+    registry.load()
+    return registry, extra_sources