simple-module-hosting 0.0.35__tar.gz → 0.0.36__tar.gz

{simple_module_hosting-0.0.35 → simple_module_hosting-0.0.36}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_hosting
-Version: 0.0.35
+Version: 0.0.36
 Summary: FastAPI + Inertia.js host runtime for simple_module — app_builder, middleware stack, CLI (sm / simple-module), scaffolding
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -26,12 +26,14 @@ Requires-Dist: fastapi>=0.115
 Requires-Dist: httpx>=0.27
 Requires-Dist: itsdangerous>=2.0
 Requires-Dist: jinja2>=3.1
-Requires-Dist: simple-module-core==0.0.35
-Requires-Dist: simple-module-db==0.0.35
-Requires-Dist: simple-module-inertia==0.0.35
+Requires-Dist: simple-module-core==0.0.36
+Requires-Dist: simple-module-db==0.0.36
+Requires-Dist: simple-module-inertia==0.0.36
 Requires-Dist: starlette>=0.44
 Requires-Dist: tomlkit>=0.13
 Requires-Dist: uvicorn[standard]>=0.34
+Provides-Extra: redis
+Requires-Dist: redis>=5; extra == 'redis'
 Description-Content-Type: text/markdown
 
 # simple_module_hosting

{simple_module_hosting-0.0.35 → simple_module_hosting-0.0.36}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_hosting"
-version = "0.0.35"
+version = "0.0.36"
 description = "FastAPI + Inertia.js host runtime for simple_module — app_builder, middleware stack, CLI (sm / simple-module), scaffolding"
 readme = "README.md"
 license = "MIT"
@@ -29,14 +29,18 @@ dependencies = [
     # it directly — out-of-tree hosts have nothing else pulling it in.
     "itsdangerous>=2.0",
     "jinja2>=3.1",
-    "simple_module_core==0.0.35",
-    "simple_module_db==0.0.35",
-    "simple_module_inertia==0.0.35",
+    "simple_module_core==0.0.36",
+    "simple_module_db==0.0.36",
+    "simple_module_inertia==0.0.36",
     "starlette>=0.44",
     "tomlkit>=0.13",
     "uvicorn[standard]>=0.34",
 ]
 
+[project.optional-dependencies]
+# Shared rate-limiter store (SM_REDIS_URL). Without it the limiter counts per worker.
+redis = ["redis>=5"]
+
 [project.scripts]
 sm-host = "simple_module_hosting.host_cli:app"
 

simple_module_hosting-0.0.36/simple_module_hosting/_body_limit.py

@@ -0,0 +1,191 @@
+"""Request-body size guard (GH #345).
+
+Pure ASGI. Refuses an oversized body *before* a route reads it, so the limit
+protects the process and not just the database:
+
+* ``Content-Length`` over the ceiling is refused outright, body unread.
+* No (or a lying) ``Content-Length`` — chunked transfer — is caught by counting
+  the bytes the app actually pulls through ``receive`` and aborting once the
+  ceiling is crossed.
+
+The ceiling is the global ``max_request_body_bytes`` unless a module declared a
+per-path override with ``register_body_limits``.
+"""
+
+from __future__ import annotations
+
+import logging
+
+from simple_module_core.body_limits import BodyLimitRegistry
+from starlette.datastructures import Headers
+from starlette.exceptions import HTTPException
+from starlette.requests import Request
+from starlette.types import ASGIApp, Message, Receive, Scope, Send
+
+from simple_module_hosting._error_handlers import _wants_json
+from simple_module_hosting._request_guard_responses import send_guard_response
+
+logger = logging.getLogger("simple_module.request_guard")
+
+_MESSAGE = "Request body is too large."
+
+
+class _BodyTooLargeError(Exception):
+    pass
+
+
+class BodyLimitMiddleware:
+    def __init__(
+        self,
+        app: ASGIApp,
+        *,
+        max_bytes: int,
+        registry: BodyLimitRegistry | None = None,
+    ) -> None:
+        self.app = app
+        self.max_bytes = max_bytes
+        self.registry = registry
+
+    def _ceiling(self, scope: Scope) -> int:
+        override = None
+        if self.registry is not None:
+            override = self.registry.limit_for(scope["method"], scope["path"], scope.get("app"))
+        return self.max_bytes if override is None else override
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] != "http":
+            await self.app(scope, receive, send)
+            return
+        limit = self._ceiling(scope)
+        if limit <= 0:
+            await self.app(scope, receive, send)
+            return
+
+        declared = Headers(scope=scope).get("content-length")
+        too_big = (
+            declared is not None
+            and declared.isascii()
+            and declared.isdigit()
+            and int(declared) > limit
+        )
+        # A browser-shaped request is answered with the Inertia error page, which
+        # needs the session / locale / shared props the layers *inside* this one
+        # set up. So it is not refused here: the body read raises an
+        # ``HTTPException(413)`` that the app's own handler renders in full.
+        # (FastAPI re-raises HTTPException from body parsing untouched.) API
+        # callers are refused right here, before anything runs.
+        if not self._wants_json(scope):
+            await self._handle_page(scope, receive, send, limit, too_big)
+            return
+        if too_big:
+            self._log(scope, limit, int(declared))
+            await self._refuse(scope, receive, send, limit)
+            return
+
+        seen = 0
+        exceeded = False
+        refused = False
+        started = False
+
+        async def counting_receive() -> Message:
+            nonlocal seen, exceeded
+            message = await receive()
+            if message["type"] == "http.request":
+                seen += len(message.get("body", b""))
+                if seen > limit:
+                    exceeded = True
+                    raise _BodyTooLargeError
+            return message
+
+        async def guarded_send(message: Message) -> None:
+            nonlocal refused, started
+            if exceeded and not started:
+                # The app is answering a body we cut off (often with a 400 from
+                # its own parser). Swallow it; the 413 below is the real answer.
+                if not refused:
+                    refused = True
+                    self._log(scope, limit, seen)
+                    await self._refuse(scope, receive, send, limit)
+                return
+            # Once the app's own response has started it is passed through whole:
+            # swallowing the rest would leave the client hanging on a half-sent
+            # response. (Any exception it raises for the cut-off body is re-raised
+            # below, which aborts the connection instead.)
+            if message["type"] == "http.response.start":
+                started = True
+            await send(message)
+
+        try:
+            await self.app(scope, counting_receive, guarded_send)
+        except Exception:
+            if not exceeded or started:
+                if exceeded:
+                    self._log(scope, limit, seen)
+                raise
+        if exceeded and not refused and not started:
+            self._log(scope, limit, seen)
+            await self._refuse(scope, receive, send, limit)
+
+    @staticmethod
+    def _wants_json(scope: Scope) -> bool:
+        return _wants_json(Request(scope))
+
+    async def _handle_page(
+        self, scope: Scope, receive: Receive, send: Send, limit: int, too_big: bool
+    ) -> None:
+        seen = 0
+
+        async def receive_or_413() -> Message:
+            nonlocal seen
+            if too_big:
+                self._log(scope, limit, seen)
+                raise HTTPException(status_code=413, detail=_MESSAGE)
+            message = await receive()
+            if message["type"] == "http.request":
+                seen += len(message.get("body", b""))
+                if seen > limit:
+                    self._log(scope, limit, seen)
+                    raise HTTPException(status_code=413, detail=_MESSAGE)
+            return message
+
+        started = False
+
+        async def tracking_send(message: Message) -> None:
+            nonlocal started
+            if message["type"] == "http.response.start":
+                started = True
+            await send(message)
+
+        try:
+            await self.app(scope, receive_or_413, tracking_send)
+        except HTTPException as exc:
+            # Raised by a middleware that reads the body *outside* the router's
+            # exception handling (e.g. a form gate). Without this it would
+            # surface as a bare 500 from ServerErrorMiddleware.
+            if exc.status_code != 413 or started:
+                raise
+            await self._refuse(scope, receive, send, limit)
+
+    @staticmethod
+    def _log(scope: Scope, limit: int, size: int) -> None:
+        cid = scope.get("state", {}).get("correlation_id", "")
+        logger.warning(
+            "Request body over limit: %s %s (%d > %d bytes) correlation_id=%s",
+            scope["method"],
+            scope["path"],
+            size,
+            limit,
+            cid,
+        )
+
+    @staticmethod
+    async def _refuse(scope: Scope, receive: Receive, send: Send, limit: int) -> None:
+        await send_guard_response(
+            scope,
+            receive,
+            send,
+            413,
+            _MESSAGE,
+            headers={"Connection": "close"},
+            extra={"max_bytes": limit},
+        )

simple_module_hosting-0.0.36/simple_module_hosting/_boot_checks.py

@@ -0,0 +1,47 @@
+"""Diagnostics that need the built app, so cannot run from ``make doctor``.
+
+The module diagnostics in Phase 2 see only module classes and the source tree.
+A check about what modules *registered* has to wait until after Phase 5, and
+unlike the source-tree checks it is meaningful in production too.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any
+
+from simple_module_core.diagnostics import Diagnostic, check_tenant_resolver, print_diagnostics
+
+if TYPE_CHECKING:
+    from fastapi import FastAPI
+    from simple_module_core.services import DiagnosticsState
+
+logger = logging.getLogger(__name__)
+
+
+def _tenant_checks(app: FastAPI, settings: Any) -> list[Diagnostic]:
+    return check_tenant_resolver(
+        multi_tenant=bool(getattr(settings, "multi_tenant", False)),
+        resolver=getattr(app.state, "tenant_resolver", None),
+    )
+
+
+def report_tenant_resolution(
+    app: FastAPI, settings: Any, diagnostics_state: DiagnosticsState
+) -> list[Diagnostic]:
+    """SM025: report, and fold into the Doctor screen's results when it has a runner."""
+    found = _tenant_checks(app, settings)
+    if found:
+        if settings.is_development:
+            print_diagnostics(found)
+        else:
+            for diag in found:
+                logger.warning("%s", diag)
+    runner = diagnostics_state.runner
+    if runner is not None:
+        diagnostics_state.runner = lambda: [*runner(), *_tenant_checks(app, settings)]
+        diagnostics_state.results = [*diagnostics_state.results, *found]
+    return found
+
+
+__all__ = ["report_tenant_resolution"]

simple_module_hosting-0.0.36/simple_module_hosting/_csp_dynamic.py

@@ -0,0 +1,99 @@
+"""Per-response evaluation of module CSP providers (#434).
+
+``register_csp_sources`` runs before DB settings hydrate, so origins that come
+from a setting are declared as providers (``registry.add_provider(fn)``) and
+evaluated here on each response. The finished policy is cached by the *value*
+the providers return, so a settings edit changes the key on the next response
+without any invalidation wiring.
+
+Fail closed: a provider that raises, or a pair that fails the same validation
+``CspSourceRegistry.add`` applies, contributes nothing — the static policy
+still ships. Each distinct failure is logged once per process.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+from simple_module_core.csp import CspSourceRegistry, is_valid_source
+
+logger = logging.getLogger(__name__)
+
+_CACHE_MAX = 32
+_LOGGED_MAX = 256
+
+
+class DynamicCsp:
+    """Builds the CSP for one response from a static base plus provider output."""
+
+    def __init__(self, base: str, registry: CspSourceRegistry) -> None:
+        self.base = base
+        self._registry = registry
+        self._providers = registry.providers
+        self._cache: dict[frozenset[tuple[str, str]], str] = {}
+        self._logged: set[str] = set()
+
+    def policy_for(self, app: Any) -> str:
+        pairs = frozenset(self._collect(app))
+        if not pairs:
+            return self.base
+        policy = self._cache.get(pairs)
+        if policy is None:
+            if len(self._cache) >= _CACHE_MAX:
+                self._cache.clear()
+            # Sorted so the clause order is stable for a given set of pairs.
+            try:
+                policy = self._registry.extend_policy(self.base, extra=sorted(pairs))
+            except Exception as exc:
+                # Last line of the fail-closed guarantee: this runs inside the
+                # response for every page, so a bug here must cost the extra
+                # origins, never the response.
+                self._warn_once(
+                    f"build:{type(exc).__name__}:{exc}",
+                    "CSP provider policy build failed (%r); serving the static policy",
+                    exc,
+                )
+                return self.base
+            self._cache[pairs] = policy
+        return policy
+
+    def _collect(self, app: Any) -> list[tuple[str, str]]:
+        out: list[tuple[str, str]] = []
+        for provider in self._providers:
+            name = getattr(provider, "__qualname__", repr(provider))
+            try:
+                pairs = list(provider(app))
+            except Exception as exc:
+                self._warn_once(
+                    f"{name}:{type(exc).__name__}:{exc}",
+                    "CSP provider %s raised %r; its sources are skipped",
+                    name,
+                    exc,
+                )
+                continue
+            for pair in pairs:
+                if (
+                    isinstance(pair, tuple)
+                    and len(pair) == 2
+                    and isinstance(pair[0], str)
+                    and isinstance(pair[1], str)
+                    and is_valid_source(pair[0], pair[1])
+                ):
+                    out.append((pair[0], pair[1].strip()))
+                else:
+                    self._warn_once(
+                        f"{name}:{pair!r}",
+                        "CSP provider %s returned invalid pair %r; dropped",
+                        name,
+                        pair,
+                    )
+        return out
+
+    def _warn_once(self, key: str, msg: str, *args: object) -> None:
+        if key in self._logged:
+            return
+        if len(self._logged) >= _LOGGED_MAX:
+            self._logged.clear()
+        self._logged.add(key)
+        logger.warning(msg, *args)

{simple_module_hosting-0.0.35 → simple_module_hosting-0.0.36}/simple_module_hosting/_dev_boot.py

@@ -35,6 +35,7 @@ def run_dev_boot(
     installed_modules: list[ModuleBase],
     *,
     i18n_extra,
+    i18n_unknown_overrides: dict[str, list[str]] | None = None,
     diagnostics_state: DiagnosticsState,
     project_root: Path,
 ) -> None:
@@ -54,6 +55,8 @@ def run_dev_boot(
         i18n_supported_locales=settings.i18n_supported_locales,
         i18n_default_locale=settings.i18n_default_locale,
         i18n_extra_sources=i18n_extra,
+        i18n_unknown_overrides=i18n_unknown_overrides,
+        database_dialect=settings.database_url.split(":", 1)[0].split("+", 1)[0],
     )
     diagnostics = diagnostics_state.rerun()
     errors = [d for d in diagnostics if d.level == DiagnosticLevel.ERROR]

{simple_module_hosting-0.0.35 → simple_module_hosting-0.0.36}/simple_module_hosting/_error_handlers.py

@@ -21,11 +21,12 @@ from starlette.requests import Request
 from starlette.responses import Response
 
 from simple_module_hosting._inertia_shared import _INERTIA_HEADER
+from simple_module_hosting._observability import CorrelationIdMiddleware
 from simple_module_hosting.permissions import PERMISSION_DENIED_PREFIX
 
 logger = logging.getLogger(__name__)
 
-_INERTIA_ERROR_STATUSES = frozenset({401, 403, 404, 419, 422, 429, 500, 503})
+_INERTIA_ERROR_STATUSES = frozenset({401, 403, 404, 413, 419, 422, 429, 500, 503})
 
 # Statuses whose remedy is "sign in", so the page offers that as its primary
 # action rather than sending the visitor to the landing page.
@@ -278,5 +279,16 @@ async def request_validation_error_handler(
 async def unhandled_exception_handler(request: Request, exc: Exception) -> Response:
     logger.exception("Unhandled exception: %s", exc)
     if _wants_json(request):
-        return JSONResponse(status_code=500, content={"detail": "Internal Server Error"})
-    return await render_error_page(request, 500, "")
+        response: Response = JSONResponse(
+            status_code=500, content={"detail": "Internal Server Error"}
+        )
+    else:
+        response = await render_error_page(request, 500, "")
+    # A catch-all `Exception` handler runs in Starlette's ServerErrorMiddleware,
+    # which wraps *outside* CorrelationIdMiddleware, so the response never
+    # passes through it. Without this the 500 — the one response a caller most
+    # needs to quote back to support — is the one without the header.
+    cid = getattr(request.state, "correlation_id", "")
+    if cid:
+        response.headers.setdefault(CorrelationIdMiddleware.HEADER, cid)
+    return response

simple_module_hosting-0.0.36/simple_module_hosting/_i18n_build.py

@@ -0,0 +1,58 @@
+"""Construct the i18n registry from module, host and UI sources."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from simple_module_core import ModuleBase
+from simple_module_core.i18n import I18nRegistry
+
+from simple_module_hosting.settings import Settings
+
+
+def build_i18n_registry(
+    settings: Settings,
+    modules: list[ModuleBase],
+    project_root: Path,
+) -> tuple[I18nRegistry, list[tuple[str, str, Path]]]:
+    """Construct the i18n registry from module + host + UI sources.
+
+    Returns ``(registry, extra_sources)`` where ``extra_sources`` is the list
+    of ``(reporter_name, namespace, dir)`` triples the diagnostic runner
+    needs to validate non-module locale directories.
+    """
+    registry = I18nRegistry(
+        default_locale=settings.i18n_default_locale,
+        supported_locales=settings.i18n_supported_locales,
+    )
+    extra_sources: list[tuple[str, str, Path]] = []
+
+    for mod in modules:
+        audience = getattr(mod.meta, "i18n_audience", "public")
+        for namespace, locale_dir in mod.locale_dirs().items():
+            registry.add_source(namespace, locale_dir, audience=audience)
+
+    # The framework's own catalog — the setup wizard ships with this package,
+    # so its strings must too, whatever host is serving it.
+    hosting_locales = Path(__file__).resolve().parent / "locales"
+    registry.add_source("hosting", hosting_locales)
+    extra_sources.append(("simple_module_hosting", "hosting", hosting_locales))
+
+    host_locales = project_root / "host" / "locales"
+    if host_locales.is_dir():
+        registry.add_source("host", host_locales)
+        extra_sources.append(("host", "host", host_locales))
+
+    overrides = host_locales / "overrides"
+    if overrides.is_dir():
+        registry.add_overrides(overrides)
+
+    # Shared UI strings ship inside this package (not ``packages/ui``) so a
+    # scaffolded app, which has no ``packages/ui`` checkout, still resolves
+    # every ``ui.*`` key.
+    ui_locales = Path(__file__).resolve().parent / "ui_locales"
+    registry.add_source("ui", ui_locales)
+    extra_sources.append(("simple_module_hosting/ui", "ui", ui_locales))
+
+    registry.load()
+    return registry, extra_sources

{simple_module_hosting-0.0.35 → simple_module_hosting-0.0.36}/simple_module_hosting/_inertia_setup.py

@@ -48,7 +48,11 @@ def branding_head(request: Request) -> dict:
     rather than ``None``, because omitting the tag sends the browser to
     ``/favicon.ico``, which this app does not serve.
     """
-    services = getattr(request.app.state, "branding", None)
+    # A per-request object (same duck shape) wins: branding resolves a tenant's
+    # own theme into ``request.state.branding`` from its shared-props provider.
+    services = getattr(getattr(request, "state", None), "branding", None) or getattr(
+        request.app.state, "branding", None
+    )
     settings = getattr(services, "settings", None)
     app_name = getattr(settings, "app_name", "") or _DEFAULT_APP_NAME
     accent = getattr(settings, "primary_color", "") or ""

{simple_module_hosting-0.0.35 → simple_module_hosting-0.0.36}/simple_module_hosting/_inertia_shared.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import inspect
 import logging
 from collections.abc import Callable
 from typing import Any
@@ -19,6 +20,10 @@ _INERTIA_HEADER = "x-inertia"
 _INERTIA_HEADER_TRUE = "true"
 
 
+def _accepts_html(scope: Scope) -> bool:
+    return "text/html" in Headers(scope=scope).get("accept", "").lower()
+
+
 def build_i18n_block(scope: Scope, request: Request, *, is_authenticated: bool = True) -> dict:
     """Assemble the ``i18n`` shared-props block for the current request.
 
@@ -56,13 +61,21 @@ def build_i18n_block(scope: Scope, request: Request, *, is_authenticated: bool =
     # skip the messages payload. Non-Inertia requests will always ship them
     # regardless of the session state.
     if session_dict is not None:
+        # Remembering the locale only pays off for a client that will come back
+        # with an Inertia XHR (to skip re-sending the catalog). A bare API or
+        # health-check call from a cookie-less client will not, and writing
+        # here would make Starlette's SessionMiddleware emit a two-week
+        # Set-Cookie on every anonymous response, which keeps shared caches
+        # from storing it (GH #349). So persist only when a session already
+        # exists (it has data) or the caller is page-shaped.
+        persist = bool(session_dict) or is_inertia or _accepts_html(scope)
         last_locale = session_dict.get(_I18N_SESSION_LOCALE_KEY)
         locale_changed = last_locale != locale
-        if locale_changed:
+        if locale_changed and persist:
             session_dict[_I18N_SESSION_LOCALE_KEY] = locale
         last_audience = session_dict.get(_I18N_SESSION_AUDIENCE_KEY)
         audience_changed = last_audience != audience
-        if audience_changed:
+        if audience_changed and persist:
             session_dict[_I18N_SESSION_AUDIENCE_KEY] = audience
     else:
         locale_changed = False
@@ -103,19 +116,22 @@ def build_menu_translator(request: Request) -> Callable[[str], str] | None:
     return translator.t
 
 
-def merge_shared_prop_providers(app: Any, request: Request, shared: dict) -> None:
+async def merge_shared_prop_providers(app: Any, request: Request, shared: dict) -> None:
     """Merge module-registered Inertia shared-prop providers into ``shared`` in place.
 
     Providers are read off ``app.state.inertia_shared_providers`` (never importing
     the plugin — preserves SM009). A provider that raises is skipped and logged; a
     provider may not clobber a framework-owned key (auth/menus/i18n) or an earlier
-    provider's key.
+    provider's key. A provider may be ``async`` (its result is awaited) — a
+    per-tenant lookup cannot be answered from a process-wide object.
     """
     providers = getattr(app.state, "inertia_shared_providers", None) or ()
     for provider in providers:
         name = getattr(provider, "__name__", provider)
         try:
             extra = provider(request)
+            if inspect.isawaitable(extra):
+                extra = await extra
         except Exception:  # a bad provider must not break the page render
             logger.warning("shared-prop provider %r raised; skipping", name, exc_info=True)
             continue
@@ -128,3 +144,16 @@ def merge_shared_prop_providers(app: Any, request: Request, shared: dict) -> Non
                 )
                 continue
             shared[key] = value
+
+
+def default_home_url(app: Any) -> str:
+    """Where the layouts' "home" links point when no module publishes ``homeUrl``.
+
+    The users module publishes its configured landing URL and wins; this covers
+    installs without it (Keycloak). Dashboard is the conventional landing page,
+    named by string from ``sm.view_prefixes`` so nothing is imported (SM009);
+    ``/`` is a host route in every app, so the link can never 404.
+    """
+    sm = getattr(app.state, "sm", None)
+    prefix = getattr(sm, "view_prefixes", {}).get("Dashboard")
+    return f"{prefix}/" if prefix else "/"