simple-module-hosting 0.0.35__tar.gz → 0.0.37__tar.gz

{simple_module_hosting-0.0.35 → simple_module_hosting-0.0.37}/.gitignore

@@ -64,3 +64,4 @@ host/client_app/.playwright-cli/*
 .superpowers/
 .qa/
 .verify/
+/openapi.json

{simple_module_hosting-0.0.35 → simple_module_hosting-0.0.37}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_hosting
-Version: 0.0.35
+Version: 0.0.37
 Summary: FastAPI + Inertia.js host runtime for simple_module — app_builder, middleware stack, CLI (sm / simple-module), scaffolding
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -26,12 +26,14 @@ Requires-Dist: fastapi>=0.115
 Requires-Dist: httpx>=0.27
 Requires-Dist: itsdangerous>=2.0
 Requires-Dist: jinja2>=3.1
-Requires-Dist: simple-module-core==0.0.35
-Requires-Dist: simple-module-db==0.0.35
-Requires-Dist: simple-module-inertia==0.0.35
+Requires-Dist: simple-module-core==0.0.37
+Requires-Dist: simple-module-db==0.0.37
+Requires-Dist: simple-module-inertia==0.0.37
 Requires-Dist: starlette>=0.44
 Requires-Dist: tomlkit>=0.13
 Requires-Dist: uvicorn[standard]>=0.34
+Provides-Extra: redis
+Requires-Dist: redis>=5; extra == 'redis'
 Description-Content-Type: text/markdown
 
 # simple_module_hosting

{simple_module_hosting-0.0.35 → simple_module_hosting-0.0.37}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_hosting"
-version = "0.0.35"
+version = "0.0.37"
 description = "FastAPI + Inertia.js host runtime for simple_module — app_builder, middleware stack, CLI (sm / simple-module), scaffolding"
 readme = "README.md"
 license = "MIT"
@@ -29,14 +29,18 @@ dependencies = [
     # it directly — out-of-tree hosts have nothing else pulling it in.
     "itsdangerous>=2.0",
     "jinja2>=3.1",
-    "simple_module_core==0.0.35",
-    "simple_module_db==0.0.35",
-    "simple_module_inertia==0.0.35",
+    "simple_module_core==0.0.37",
+    "simple_module_db==0.0.37",
+    "simple_module_inertia==0.0.37",
     "starlette>=0.44",
     "tomlkit>=0.13",
     "uvicorn[standard]>=0.34",
 ]
 
+[project.optional-dependencies]
+# Shared rate-limiter store (SM_REDIS_URL). Without it the limiter counts per worker.
+redis = ["redis>=5"]
+
 [project.scripts]
 sm-host = "simple_module_hosting.host_cli:app"
 

simple_module_hosting-0.0.37/simple_module_hosting/_anonymous.py

@@ -0,0 +1,27 @@
+"""Demote a request's principal to the anonymous visitor, mid-request.
+
+Used when a credential authenticated but must not act as its account here: an
+API token on a public route (``token_guard``), or a token whose owner no
+longer holds the permission it requires (``permissions``). "Anonymous" means
+all of it — no user, no permissions, no audit identity, and the tenant an
+anonymous request would have resolved to rather than the one the credential
+pinned.
+"""
+
+from __future__ import annotations
+
+from simple_module_db.listeners import current_user_id
+from starlette.requests import HTTPConnection
+
+from simple_module_hosting._tenant import reresolve_tenant
+
+
+async def demote_to_anonymous(request: HTTPConnection) -> None:
+    """Drop the principal and re-run tenant resolution as anonymous."""
+    request.state.user = None
+    request.state.resolved_permissions = set()
+    current_user_id.set(None)
+    await reresolve_tenant(request)
+
+
+__all__ = ["demote_to_anonymous"]

simple_module_hosting-0.0.37/simple_module_hosting/_body_limit.py

@@ -0,0 +1,191 @@
+"""Request-body size guard (GH #345).
+
+Pure ASGI. Refuses an oversized body *before* a route reads it, so the limit
+protects the process and not just the database:
+
+* ``Content-Length`` over the ceiling is refused outright, body unread.
+* No (or a lying) ``Content-Length`` — chunked transfer — is caught by counting
+  the bytes the app actually pulls through ``receive`` and aborting once the
+  ceiling is crossed.
+
+The ceiling is the global ``max_request_body_bytes`` unless a module declared a
+per-path override with ``register_body_limits``.
+"""
+
+from __future__ import annotations
+
+import logging
+
+from simple_module_core.body_limits import BodyLimitRegistry
+from starlette.datastructures import Headers
+from starlette.exceptions import HTTPException
+from starlette.requests import Request
+from starlette.types import ASGIApp, Message, Receive, Scope, Send
+
+from simple_module_hosting._error_handlers import _wants_json
+from simple_module_hosting._request_guard_responses import send_guard_response
+
+logger = logging.getLogger("simple_module.request_guard")
+
+_MESSAGE = "Request body is too large."
+
+
+class _BodyTooLargeError(Exception):
+    pass
+
+
+class BodyLimitMiddleware:
+    def __init__(
+        self,
+        app: ASGIApp,
+        *,
+        max_bytes: int,
+        registry: BodyLimitRegistry | None = None,
+    ) -> None:
+        self.app = app
+        self.max_bytes = max_bytes
+        self.registry = registry
+
+    def _ceiling(self, scope: Scope) -> int:
+        override = None
+        if self.registry is not None:
+            override = self.registry.limit_for(scope["method"], scope["path"], scope.get("app"))
+        return self.max_bytes if override is None else override
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] != "http":
+            await self.app(scope, receive, send)
+            return
+        limit = self._ceiling(scope)
+        if limit <= 0:
+            await self.app(scope, receive, send)
+            return
+
+        declared = Headers(scope=scope).get("content-length")
+        too_big = (
+            declared is not None
+            and declared.isascii()
+            and declared.isdigit()
+            and int(declared) > limit
+        )
+        # A browser-shaped request is answered with the Inertia error page, which
+        # needs the session / locale / shared props the layers *inside* this one
+        # set up. So it is not refused here: the body read raises an
+        # ``HTTPException(413)`` that the app's own handler renders in full.
+        # (FastAPI re-raises HTTPException from body parsing untouched.) API
+        # callers are refused right here, before anything runs.
+        if not self._wants_json(scope):
+            await self._handle_page(scope, receive, send, limit, too_big)
+            return
+        if too_big:
+            self._log(scope, limit, int(declared))
+            await self._refuse(scope, receive, send, limit)
+            return
+
+        seen = 0
+        exceeded = False
+        refused = False
+        started = False
+
+        async def counting_receive() -> Message:
+            nonlocal seen, exceeded
+            message = await receive()
+            if message["type"] == "http.request":
+                seen += len(message.get("body", b""))
+                if seen > limit:
+                    exceeded = True
+                    raise _BodyTooLargeError
+            return message
+
+        async def guarded_send(message: Message) -> None:
+            nonlocal refused, started
+            if exceeded and not started:
+                # The app is answering a body we cut off (often with a 400 from
+                # its own parser). Swallow it; the 413 below is the real answer.
+                if not refused:
+                    refused = True
+                    self._log(scope, limit, seen)
+                    await self._refuse(scope, receive, send, limit)
+                return
+            # Once the app's own response has started it is passed through whole:
+            # swallowing the rest would leave the client hanging on a half-sent
+            # response. (Any exception it raises for the cut-off body is re-raised
+            # below, which aborts the connection instead.)
+            if message["type"] == "http.response.start":
+                started = True
+            await send(message)
+
+        try:
+            await self.app(scope, counting_receive, guarded_send)
+        except Exception:
+            if not exceeded or started:
+                if exceeded:
+                    self._log(scope, limit, seen)
+                raise
+        if exceeded and not refused and not started:
+            self._log(scope, limit, seen)
+            await self._refuse(scope, receive, send, limit)
+
+    @staticmethod
+    def _wants_json(scope: Scope) -> bool:
+        return _wants_json(Request(scope))
+
+    async def _handle_page(
+        self, scope: Scope, receive: Receive, send: Send, limit: int, too_big: bool
+    ) -> None:
+        seen = 0
+
+        async def receive_or_413() -> Message:
+            nonlocal seen
+            if too_big:
+                self._log(scope, limit, seen)
+                raise HTTPException(status_code=413, detail=_MESSAGE)
+            message = await receive()
+            if message["type"] == "http.request":
+                seen += len(message.get("body", b""))
+                if seen > limit:
+                    self._log(scope, limit, seen)
+                    raise HTTPException(status_code=413, detail=_MESSAGE)
+            return message
+
+        started = False
+
+        async def tracking_send(message: Message) -> None:
+            nonlocal started
+            if message["type"] == "http.response.start":
+                started = True
+            await send(message)
+
+        try:
+            await self.app(scope, receive_or_413, tracking_send)
+        except HTTPException as exc:
+            # Raised by a middleware that reads the body *outside* the router's
+            # exception handling (e.g. a form gate). Without this it would
+            # surface as a bare 500 from ServerErrorMiddleware.
+            if exc.status_code != 413 or started:
+                raise
+            await self._refuse(scope, receive, send, limit)
+
+    @staticmethod
+    def _log(scope: Scope, limit: int, size: int) -> None:
+        cid = scope.get("state", {}).get("correlation_id", "")
+        logger.warning(
+            "Request body over limit: %s %s (%d > %d bytes) correlation_id=%s",
+            scope["method"],
+            scope["path"],
+            size,
+            limit,
+            cid,
+        )
+
+    @staticmethod
+    async def _refuse(scope: Scope, receive: Receive, send: Send, limit: int) -> None:
+        await send_guard_response(
+            scope,
+            receive,
+            send,
+            413,
+            _MESSAGE,
+            headers={"Connection": "close"},
+            extra={"max_bytes": limit},
+        )

simple_module_hosting-0.0.37/simple_module_hosting/_boot_checks.py

@@ -0,0 +1,47 @@
+"""Diagnostics that need the built app, so cannot run from ``make doctor``.
+
+The module diagnostics in Phase 2 see only module classes and the source tree.
+A check about what modules *registered* has to wait until after Phase 5, and
+unlike the source-tree checks it is meaningful in production too.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any
+
+from simple_module_core.diagnostics import Diagnostic, check_tenant_resolver, print_diagnostics
+
+if TYPE_CHECKING:
+    from fastapi import FastAPI
+    from simple_module_core.services import DiagnosticsState
+
+logger = logging.getLogger(__name__)
+
+
+def _tenant_checks(app: FastAPI, settings: Any) -> list[Diagnostic]:
+    return check_tenant_resolver(
+        multi_tenant=bool(getattr(settings, "multi_tenant", False)),
+        resolver=getattr(app.state, "tenant_resolver", None),
+    )
+
+
+def report_tenant_resolution(
+    app: FastAPI, settings: Any, diagnostics_state: DiagnosticsState
+) -> list[Diagnostic]:
+    """SM025: report, and fold into the Doctor screen's results when it has a runner."""
+    found = _tenant_checks(app, settings)
+    if found:
+        if settings.is_development:
+            print_diagnostics(found)
+        else:
+            for diag in found:
+                logger.warning("%s", diag)
+    runner = diagnostics_state.runner
+    if runner is not None:
+        diagnostics_state.runner = lambda: [*runner(), *_tenant_checks(app, settings)]
+        diagnostics_state.results = [*diagnostics_state.results, *found]
+    return found
+
+
+__all__ = ["report_tenant_resolution"]

simple_module_hosting-0.0.37/simple_module_hosting/_csp_dynamic.py

@@ -0,0 +1,99 @@
+"""Per-response evaluation of module CSP providers (#434).
+
+``register_csp_sources`` runs before DB settings hydrate, so origins that come
+from a setting are declared as providers (``registry.add_provider(fn)``) and
+evaluated here on each response. The finished policy is cached by the *value*
+the providers return, so a settings edit changes the key on the next response
+without any invalidation wiring.
+
+Fail closed: a provider that raises, or a pair that fails the same validation
+``CspSourceRegistry.add`` applies, contributes nothing — the static policy
+still ships. Each distinct failure is logged once per process.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+from simple_module_core.csp import CspSourceRegistry, is_valid_source
+
+logger = logging.getLogger(__name__)
+
+_CACHE_MAX = 32
+_LOGGED_MAX = 256
+
+
+class DynamicCsp:
+    """Builds the CSP for one response from a static base plus provider output."""
+
+    def __init__(self, base: str, registry: CspSourceRegistry) -> None:
+        self.base = base
+        self._registry = registry
+        self._providers = registry.providers
+        self._cache: dict[frozenset[tuple[str, str]], str] = {}
+        self._logged: set[str] = set()
+
+    def policy_for(self, app: Any) -> str:
+        pairs = frozenset(self._collect(app))
+        if not pairs:
+            return self.base
+        policy = self._cache.get(pairs)
+        if policy is None:
+            if len(self._cache) >= _CACHE_MAX:
+                self._cache.clear()
+            # Sorted so the clause order is stable for a given set of pairs.
+            try:
+                policy = self._registry.extend_policy(self.base, extra=sorted(pairs))
+            except Exception as exc:
+                # Last line of the fail-closed guarantee: this runs inside the
+                # response for every page, so a bug here must cost the extra
+                # origins, never the response.
+                self._warn_once(
+                    f"build:{type(exc).__name__}:{exc}",
+                    "CSP provider policy build failed (%r); serving the static policy",
+                    exc,
+                )
+                return self.base
+            self._cache[pairs] = policy
+        return policy
+
+    def _collect(self, app: Any) -> list[tuple[str, str]]:
+        out: list[tuple[str, str]] = []
+        for provider in self._providers:
+            name = getattr(provider, "__qualname__", repr(provider))
+            try:
+                pairs = list(provider(app))
+            except Exception as exc:
+                self._warn_once(
+                    f"{name}:{type(exc).__name__}:{exc}",
+                    "CSP provider %s raised %r; its sources are skipped",
+                    name,
+                    exc,
+                )
+                continue
+            for pair in pairs:
+                if (
+                    isinstance(pair, tuple)
+                    and len(pair) == 2
+                    and isinstance(pair[0], str)
+                    and isinstance(pair[1], str)
+                    and is_valid_source(pair[0], pair[1])
+                ):
+                    out.append((pair[0], pair[1].strip()))
+                else:
+                    self._warn_once(
+                        f"{name}:{pair!r}",
+                        "CSP provider %s returned invalid pair %r; dropped",
+                        name,
+                        pair,
+                    )
+        return out
+
+    def _warn_once(self, key: str, msg: str, *args: object) -> None:
+        if key in self._logged:
+            return
+        if len(self._logged) >= _LOGGED_MAX:
+            self._logged.clear()
+        self._logged.add(key)
+        logger.warning(msg, *args)

{simple_module_hosting-0.0.35 → simple_module_hosting-0.0.37}/simple_module_hosting/_dev_boot.py

@@ -35,6 +35,7 @@ def run_dev_boot(
     installed_modules: list[ModuleBase],
     *,
     i18n_extra,
+    i18n_unknown_overrides: dict[str, list[str]] | None = None,
     diagnostics_state: DiagnosticsState,
     project_root: Path,
 ) -> None:
@@ -54,6 +55,8 @@ def run_dev_boot(
         i18n_supported_locales=settings.i18n_supported_locales,
         i18n_default_locale=settings.i18n_default_locale,
         i18n_extra_sources=i18n_extra,
+        i18n_unknown_overrides=i18n_unknown_overrides,
+        database_dialect=settings.database_url.split(":", 1)[0].split("+", 1)[0],
     )
     diagnostics = diagnostics_state.rerun()
     errors = [d for d in diagnostics if d.level == DiagnosticLevel.ERROR]

{simple_module_hosting-0.0.35 → simple_module_hosting-0.0.37}/simple_module_hosting/_error_handlers.py

@@ -21,11 +21,12 @@ from starlette.requests import Request
 from starlette.responses import Response
 
 from simple_module_hosting._inertia_shared import _INERTIA_HEADER
+from simple_module_hosting._observability import CorrelationIdMiddleware
 from simple_module_hosting.permissions import PERMISSION_DENIED_PREFIX
 
 logger = logging.getLogger(__name__)
 
-_INERTIA_ERROR_STATUSES = frozenset({401, 403, 404, 419, 422, 429, 500, 503})
+_INERTIA_ERROR_STATUSES = frozenset({401, 403, 404, 413, 419, 422, 429, 500, 503})
 
 # Statuses whose remedy is "sign in", so the page offers that as its primary
 # action rather than sending the visitor to the landing page.
@@ -186,7 +187,7 @@ async def render_error_page(
             inertia = Inertia(request, config)
         # This does not go through get_inertia, so the share step has to be
         # repeated here. Without it the error page renders raw translation keys
-        # (host.error.not_found_title) and loses auth/menus, so a signed-in
+        # (ui.error_page.not_found_title) and loses auth/menus, so a signed-in
         # user's 404 has no layout.
         shared = getattr(request.state, "inertia_shared", None)
         if shared:
@@ -278,5 +279,16 @@ async def request_validation_error_handler(
 async def unhandled_exception_handler(request: Request, exc: Exception) -> Response:
     logger.exception("Unhandled exception: %s", exc)
     if _wants_json(request):
-        return JSONResponse(status_code=500, content={"detail": "Internal Server Error"})
-    return await render_error_page(request, 500, "")
+        response: Response = JSONResponse(
+            status_code=500, content={"detail": "Internal Server Error"}
+        )
+    else:
+        response = await render_error_page(request, 500, "")
+    # A catch-all `Exception` handler runs in Starlette's ServerErrorMiddleware,
+    # which wraps *outside* CorrelationIdMiddleware, so the response never
+    # passes through it. Without this the 500 — the one response a caller most
+    # needs to quote back to support — is the one without the header.
+    cid = getattr(request.state, "correlation_id", "")
+    if cid:
+        response.headers.setdefault(CorrelationIdMiddleware.HEADER, cid)
+    return response

{simple_module_hosting-0.0.35 → simple_module_hosting-0.0.37}/simple_module_hosting/_hydrate_step.py

@@ -28,7 +28,7 @@ async def hydrate_all(app: FastAPI, store: Any) -> None:
 
     for package, cls in settings_services.module_registry.items():
         try:
-            hydrated = await hydrate_settings(cls, store, package)
+            hydrated = await hydrate_settings(cls, store, package, lenient=True)
         except Exception:
             logger.exception("Hydrating %s failed; falling back to defaults", package)
             continue

simple_module_hosting-0.0.37/simple_module_hosting/_i18n_build.py

@@ -0,0 +1,58 @@
+"""Construct the i18n registry from module, host and UI sources."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from simple_module_core import ModuleBase
+from simple_module_core.i18n import I18nRegistry
+
+from simple_module_hosting.settings import Settings
+
+
+def build_i18n_registry(
+    settings: Settings,
+    modules: list[ModuleBase],
+    project_root: Path,
+) -> tuple[I18nRegistry, list[tuple[str, str, Path]]]:
+    """Construct the i18n registry from module + host + UI sources.
+
+    Returns ``(registry, extra_sources)`` where ``extra_sources`` is the list
+    of ``(reporter_name, namespace, dir)`` triples the diagnostic runner
+    needs to validate non-module locale directories.
+    """
+    registry = I18nRegistry(
+        default_locale=settings.i18n_default_locale,
+        supported_locales=settings.i18n_supported_locales,
+    )
+    extra_sources: list[tuple[str, str, Path]] = []
+
+    for mod in modules:
+        audience = getattr(mod.meta, "i18n_audience", "public")
+        for namespace, locale_dir in mod.locale_dirs().items():
+            registry.add_source(namespace, locale_dir, audience=audience)
+
+    # The framework's own catalog — the setup wizard ships with this package,
+    # so its strings must too, whatever host is serving it.
+    hosting_locales = Path(__file__).resolve().parent / "locales"
+    registry.add_source("hosting", hosting_locales)
+    extra_sources.append(("simple_module_hosting", "hosting", hosting_locales))
+
+    host_locales = project_root / "host" / "locales"
+    if host_locales.is_dir():
+        registry.add_source("host", host_locales)
+        extra_sources.append(("host", "host", host_locales))
+
+    overrides = host_locales / "overrides"
+    if overrides.is_dir():
+        registry.add_overrides(overrides)
+
+    # Shared UI strings ship inside this package (not ``packages/ui``) so a
+    # scaffolded app, which has no ``packages/ui`` checkout, still resolves
+    # every ``ui.*`` key.
+    ui_locales = Path(__file__).resolve().parent / "ui_locales"
+    registry.add_source("ui", ui_locales)
+    extra_sources.append(("simple_module_hosting/ui", "ui", ui_locales))
+
+    registry.load()
+    return registry, extra_sources

simple_module_hosting-0.0.37/simple_module_hosting/_i18n_target.py

@@ -0,0 +1,40 @@
+"""Where generated i18n key files are written: monorepo checkout or published npm package."""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+RESOURCE_KEY_RE = re.compile(r"^\s+'([^']+)': '',$", re.MULTILINE)
+
+_PUBLISHED_PKG = Path("node_modules") / "@simple-module-py" / "i18n" / "src"
+
+
+def resolve_i18n_types_dir(project_root: Path) -> tuple[Path | None, bool]:
+    """Where the generated key files go, and whether that is a published package.
+
+    The monorepo's ``packages/i18n/src`` wins. A scaffolded app has no such
+    checkout — ``@simple-module-py/i18n`` is an npm dependency — so walk up from
+    ``project_root`` to the nearest ``node_modules`` holding it (npm workspaces
+    hoist it to the workspace root, above the host; a flat host installs into
+    ``client_app/``). ``(None, False)`` when
+    neither exists, the normal shape of a wheel-installed prod app.
+    """
+    local = project_root / "packages" / "i18n" / "src"
+    if local.is_dir():
+        return local, False
+    root = project_root.resolve()
+    # A flat host (``smpy new --flat``) keeps its npm install in client_app/.
+    for base in (root, root / "client_app", *root.parents):
+        published = base / _PUBLISHED_PKG
+        if published.is_dir():
+            return published, True
+    return None, False
+
+
+def read_resource_keys(resources_path: Path) -> frozenset[str]:
+    """Keys listed in an existing ``generated-resources.ts`` (empty if unreadable)."""
+    try:
+        return frozenset(RESOURCE_KEY_RE.findall(resources_path.read_text(encoding="utf-8")))
+    except OSError:
+        return frozenset()

{simple_module_hosting-0.0.35 → simple_module_hosting-0.0.37}/simple_module_hosting/_inertia_setup.py

@@ -48,7 +48,11 @@ def branding_head(request: Request) -> dict:
     rather than ``None``, because omitting the tag sends the browser to
     ``/favicon.ico``, which this app does not serve.
     """
-    services = getattr(request.app.state, "branding", None)
+    # A per-request object (same duck shape) wins: branding resolves a tenant's
+    # own theme into ``request.state.branding`` from its shared-props provider.
+    services = getattr(getattr(request, "state", None), "branding", None) or getattr(
+        request.app.state, "branding", None
+    )
     settings = getattr(services, "settings", None)
     app_name = getattr(settings, "app_name", "") or _DEFAULT_APP_NAME
     accent = getattr(settings, "primary_color", "") or ""