simple-module-hosting 0.0.37__tar.gz → 0.0.39__tar.gz

{simple_module_hosting-0.0.37 → simple_module_hosting-0.0.39}/.gitignore

@@ -7,8 +7,6 @@ build/
 .venv/
 *.egg
 
-# UV
-uv.lock
 
 # Node
 node_modules/
@@ -65,3 +63,4 @@ host/client_app/.playwright-cli/*
 .qa/
 .verify/
 /openapi.json
+qa-shots/

{simple_module_hosting-0.0.37 → simple_module_hosting-0.0.39}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_hosting
-Version: 0.0.37
+Version: 0.0.39
 Summary: FastAPI + Inertia.js host runtime for simple_module — app_builder, middleware stack, CLI (sm / simple-module), scaffolding
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -21,19 +21,21 @@ Classifier: Topic :: Internet :: WWW/HTTP :: WSGI :: Application
 Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Typing :: Typed
 Requires-Python: >=3.12
-Requires-Dist: click>=8.1
-Requires-Dist: fastapi>=0.115
-Requires-Dist: httpx>=0.27
-Requires-Dist: itsdangerous>=2.0
-Requires-Dist: jinja2>=3.1
-Requires-Dist: simple-module-core==0.0.37
-Requires-Dist: simple-module-db==0.0.37
-Requires-Dist: simple-module-inertia==0.0.37
-Requires-Dist: starlette>=0.44
-Requires-Dist: tomlkit>=0.13
-Requires-Dist: uvicorn[standard]>=0.34
+Requires-Dist: click<9,>=8.1
+Requires-Dist: fastapi<0.157,>=0.140
+Requires-Dist: httpx<0.29,>=0.27
+Requires-Dist: itsdangerous<3,>=2.0
+Requires-Dist: jinja2<4,>=3.1
+Requires-Dist: simple-module-core==0.0.39
+Requires-Dist: simple-module-db==0.0.39
+Requires-Dist: simple-module-inertia==0.0.39
+Requires-Dist: starlette<2,>=0.44
+Requires-Dist: tomlkit<0.16,>=0.13
+Requires-Dist: uvicorn[standard]<0.55,>=0.34
 Provides-Extra: redis
-Requires-Dist: redis>=5; extra == 'redis'
+Requires-Dist: redis<7,>=5; extra == 'redis'
+Provides-Extra: sentry
+Requires-Dist: sentry-sdk[celery,fastapi]<3,>=2.20; extra == 'sentry'
 Description-Content-Type: text/markdown
 
 # simple_module_hosting

{simple_module_hosting-0.0.37 → simple_module_hosting-0.0.39}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_hosting"
-version = "0.0.37"
+version = "0.0.39"
 description = "FastAPI + Inertia.js host runtime for simple_module — app_builder, middleware stack, CLI (sm / simple-module), scaffolding"
 readme = "README.md"
 license = "MIT"
@@ -21,25 +21,27 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "click>=8.1",
-    "fastapi>=0.115",
-    "httpx>=0.27",
+    "click>=8.1,<9",
+    "fastapi>=0.140,<0.157",
+    "httpx>=0.27,<0.29",
     # SessionMiddleware (starlette.middleware.sessions) imports itsdangerous at
     # module import time; starlette treats it as an optional extra, so declare
     # it directly — out-of-tree hosts have nothing else pulling it in.
-    "itsdangerous>=2.0",
-    "jinja2>=3.1",
-    "simple_module_core==0.0.37",
-    "simple_module_db==0.0.37",
-    "simple_module_inertia==0.0.37",
-    "starlette>=0.44",
-    "tomlkit>=0.13",
-    "uvicorn[standard]>=0.34",
+    "itsdangerous>=2.0,<3",
+    "jinja2>=3.1,<4",
+    "simple_module_core==0.0.39",
+    "simple_module_db==0.0.39",
+    "simple_module_inertia==0.0.39",
+    "starlette>=0.44,<2",
+    "tomlkit>=0.13,<0.16",
+    "uvicorn[standard]>=0.34,<0.55",
 ]
 
 [project.optional-dependencies]
 # Shared rate-limiter store (SM_REDIS_URL). Without it the limiter counts per worker.
-redis = ["redis>=5"]
+redis = ["redis>=5,<7"]
+# Error reporting (SM_SENTRY_DSN). Never imported unless the DSN is set.
+sentry = ["sentry-sdk[fastapi,celery]>=2.20,<3"]
 
 [project.scripts]
 sm-host = "simple_module_hosting.host_cli:app"

simple_module_hosting-0.0.39/simple_module_hosting/_api_version.py

@@ -0,0 +1,37 @@
+"""Default ``HostSettings.api_version``: the host project's own version."""
+
+from __future__ import annotations
+
+
+def default_api_version() -> str:
+    """The host project's version, else ``0.0.0``.
+
+    This repo's host is the installed ``simple-module-host`` distribution. A
+    scaffolded host is ``package = false`` (never installed), so there is no
+    distribution to ask: read ``[project].version`` from its ``pyproject.toml``
+    under ``SM_PROJECT_ROOT`` (or the cwd) instead.
+    """
+    import tomllib
+    from importlib.metadata import PackageNotFoundError, version
+
+    from simple_module_core.dotenv import find_env_file
+
+    try:
+        return version("simple-module-host")
+    except PackageNotFoundError:
+        pass
+    # Same project-root convention as .env (SM_PROJECT_ROOT, else a bounded walk
+    # up from the cwd), so a CLI run from host/ finds the same project as the app.
+    root = find_env_file().parent
+    for candidate in (root / "host" / "pyproject.toml", root / "pyproject.toml"):
+        try:
+            project = tomllib.loads(candidate.read_text(encoding="utf-8")).get("project")
+        except (OSError, ValueError):  # missing/unreadable, bad UTF-8, bad TOML
+            continue
+        if not isinstance(project, dict):
+            continue
+        # The first file declaring a [project] is the host's: a dynamic version
+        # must not fall through to an unrelated (workspace-root) project's.
+        found = project.get("version")
+        return found if isinstance(found, str) and found else "0.0.0"
+    return "0.0.0"

simple_module_hosting-0.0.39/simple_module_hosting/_app_boot.py

@@ -0,0 +1,107 @@
+"""Boot-phase helpers for ``create_app``: app construction, database init, static mount."""
+
+from __future__ import annotations
+
+import logging
+from pathlib import Path
+
+from fastapi import Depends, FastAPI
+from simple_module_core.design_packs import DesignPackRegistry
+from simple_module_core.feature_flags import FeatureFlagRegistry
+from simple_module_core.health import HealthRegistry
+from simple_module_core.menu import MenuRegistry
+from simple_module_core.permissions import PermissionRegistry
+from simple_module_core.public_routes import PublicRouteRegistry
+from simple_module_db.listeners import register_listeners
+from simple_module_db.session import init_db
+
+from simple_module_hosting._db_health import register_database_check
+from simple_module_hosting._openapi import (
+    API_OPENAPI_URL,
+    install_openapi_filter,
+    make_unique_id_function,
+    openapi_served,
+)
+from simple_module_hosting._process_services import configure_process_services
+from simple_module_hosting.db_options import database_options
+from simple_module_hosting.settings import Settings
+from simple_module_hosting.static_files import PrecompressedStaticFiles
+from simple_module_hosting.token_guard import token_route_guard
+
+logger = logging.getLogger("simple_module_hosting.app_builder")
+
+_DOCS_URL = "/api/docs"
+_REDOC_URL = "/api/redoc"
+_STATIC_MOUNT_PATH = "/static"
+_STATIC_DIR_NAME = "static"
+
+
+def build_fastapi_app(settings: Settings, lifespan) -> FastAPI:
+    serve_openapi = openapi_served(
+        is_development=settings.is_development, openapi_public=settings.openapi_public
+    )
+    app = FastAPI(
+        title=settings.api_title,
+        version=settings.api_version,
+        description=settings.api_description,
+        openapi_url=API_OPENAPI_URL if serve_openapi else None,
+        generate_unique_id_function=make_unique_id_function(),
+        docs_url=_DOCS_URL if settings.is_development else None,
+        redoc_url=_REDOC_URL if settings.is_development else None,
+        lifespan=lifespan,
+        # API tokens reach only permission-gated, non-page routes (or ones
+        # marked ``TokenAllowed``); see ``token_guard``.
+        dependencies=[Depends(token_route_guard)],
+    )
+
+    install_openapi_filter(app)  # AuthMiddleware reads openapi_url: anonymous iff served
+    app.state.openapi_url = API_OPENAPI_URL if serve_openapi else None
+    return app
+
+
+def log_registration_summary(
+    menu_registry: MenuRegistry,
+    perm_registry: PermissionRegistry,
+    ff_registry: FeatureFlagRegistry,
+    health_registry: HealthRegistry,
+    public_route_registry: PublicRouteRegistry,
+    design_pack_registry: DesignPackRegistry,
+) -> None:
+    logger.info(
+        "Registered %d menu items, %d permissions, %d feature flags, "
+        "%d health checks, %d public routes, %d design packs",
+        len(menu_registry.all_items),
+        len(perm_registry.all_permissions),
+        len(ff_registry.all_flags),
+        len(health_registry.all_checks),
+        len(public_route_registry.routes),
+        len(design_pack_registry.all()),
+    )
+
+
+def init_database(settings: Settings, health_registry: HealthRegistry):
+    db_state = init_db(
+        settings.database_url,
+        echo=settings.debug,
+        **database_options(settings),
+    )
+    # Multi-tenant installs fail closed: a tenant-scoped query with no tenant
+    # context raises instead of reading every tenant's rows.
+    db_state.tenant_strict = settings.multi_tenant
+    # Where unbound / all_tenants() writes land on a single-tenant install:
+    # its ``default_tenant`` when set, so they stay visible to its requests.
+    if not settings.multi_tenant and settings.default_tenant:
+        db_state.default_tenant_id = settings.default_tenant
+    register_listeners(db_state)
+    configure_process_services(settings.redis_url, engine=db_state.engine)
+    # The host's own readiness signal, and the only probe-safe check in a
+    # default install — module checks reach third parties and are on-demand.
+    register_database_check(health_registry, db_state)
+    return db_state
+
+
+def mount_host_static(app: FastAPI, project_root: Path) -> None:
+    static_dir = project_root / "host" / _STATIC_DIR_NAME
+    if static_dir.is_dir():
+        static = PrecompressedStaticFiles(directory=static_dir)
+        app.mount(_STATIC_MOUNT_PATH, static, name=_STATIC_DIR_NAME)

{simple_module_hosting-0.0.37 → simple_module_hosting-0.0.39}/simple_module_hosting/_body_limit.py

@@ -22,7 +22,7 @@ from starlette.exceptions import HTTPException
 from starlette.requests import Request
 from starlette.types import ASGIApp, Message, Receive, Scope, Send
 
-from simple_module_hosting._error_handlers import _wants_json
+from simple_module_hosting._error_negotiation import _wants_json
 from simple_module_hosting._request_guard_responses import send_guard_response
 
 logger = logging.getLogger("simple_module.request_guard")

{simple_module_hosting-0.0.37 → simple_module_hosting-0.0.39}/simple_module_hosting/_boot_checks.py

@@ -1,5 +1,8 @@
 """Diagnostics that need the built app, so cannot run from ``make doctor``.
 
+SM025 runs in every environment; SM031 (an unguarded ``/api`` route) needs the
+finished route table, so it runs at the end of a development boot only.
+
 The module diagnostics in Phase 2 see only module classes and the source tree.
 A check about what modules *registered* has to wait until after Phase 5, and
 unlike the source-tree checks it is meaningful in production too.
@@ -10,8 +13,11 @@ from __future__ import annotations
 import logging
 from typing import TYPE_CHECKING, Any
 
+from simple_module_core.app_state import get_tenant_resolver
 from simple_module_core.diagnostics import Diagnostic, check_tenant_resolver, print_diagnostics
 
+from simple_module_hosting._route_access import check_unguarded_api_routes
+
 if TYPE_CHECKING:
     from fastapi import FastAPI
     from simple_module_core.services import DiagnosticsState
@@ -22,7 +28,7 @@ logger = logging.getLogger(__name__)
 def _tenant_checks(app: FastAPI, settings: Any) -> list[Diagnostic]:
     return check_tenant_resolver(
         multi_tenant=bool(getattr(settings, "multi_tenant", False)),
-        resolver=getattr(app.state, "tenant_resolver", None),
+        resolver=get_tenant_resolver(app),
     )
 
 
@@ -44,4 +50,16 @@ def report_tenant_resolution(
     return found
 
 
-__all__ = ["report_tenant_resolution"]
+def report_unguarded_routes(app: FastAPI, diagnostics_state: DiagnosticsState) -> list[Diagnostic]:
+    """SM031 (dev boot only; needs the finished route table): print and fold into Doctor."""
+    found = check_unguarded_api_routes(app)
+    if found:
+        print_diagnostics(found)
+    runner = diagnostics_state.runner
+    if runner is not None:
+        diagnostics_state.runner = lambda: [*runner(), *check_unguarded_api_routes(app)]
+        diagnostics_state.results = [*diagnostics_state.results, *found]
+    return found
+
+
+__all__ = ["report_tenant_resolution", "report_unguarded_routes"]

simple_module_hosting-0.0.39/simple_module_hosting/_cors.py

@@ -0,0 +1,76 @@
+"""CORS dispatch (#527).
+
+One Starlette ``CORSMiddleware`` is built per distinct :class:`CorsPolicy`; each
+request is routed to the one whose policy the registry matches for its method and
+path (most specific wins). A request no policy covers passes through untouched,
+so a path nobody opted in never gains CORS headers.
+
+Installed between RequestLogging and BodyLimit, so a preflight is answered before
+auth, rate limit, setup or maintenance can reject it, and a 413 from BodyLimit
+still carries the CORS headers the browser needs to read it.
+"""
+
+from __future__ import annotations
+
+from simple_module_core.cors import CorsPolicy, CorsPolicyRegistry
+from starlette.middleware.cors import CORSMiddleware
+from starlette.types import ASGIApp, Receive, Scope, Send
+
+from simple_module_hosting.host_settings import HostSettings
+
+
+def host_policy(settings: HostSettings) -> CorsPolicy | None:
+    """The ``/api/`` policy from ``cors_*`` settings; ``None`` when no origin is set."""
+    # Every field is read even when unset: they are restart-required, and the
+    # build-time-settings guard learns that from the reads.
+    fields = (
+        settings.cors_allow_origins,
+        settings.cors_allow_credentials,
+        settings.cors_allow_methods,
+        settings.cors_allow_headers,
+        settings.cors_expose_headers,
+        settings.cors_max_age,
+    )
+    origins, credentials, methods, headers, expose, max_age = fields
+    if not origins:
+        return None
+    return CorsPolicy(
+        origins=tuple(origins),
+        allow_credentials=credentials,
+        methods=tuple(methods),
+        headers=tuple(headers),
+        expose_headers=tuple(expose),
+        max_age=max_age,
+    )
+
+
+class CorsMiddleware:
+    def __init__(self, app: ASGIApp, *, registry: CorsPolicyRegistry) -> None:
+        self.app = app
+        self.registry = registry
+        self._handlers: dict[CorsPolicy, ASGIApp] = {}
+
+    def _handler(self, policy: CorsPolicy) -> ASGIApp:
+        handler = self._handlers.get(policy)
+        if handler is None:
+            handler = CORSMiddleware(
+                self.app,
+                allow_origins=list(policy.origins),
+                allow_credentials=policy.allow_credentials,
+                allow_methods=list(policy.methods),
+                allow_headers=list(policy.headers),
+                expose_headers=list(policy.expose_headers),
+                max_age=policy.max_age,
+            )
+            self._handlers[policy] = handler
+        return handler
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] != "http" or len(self.registry) == 0:
+            await self.app(scope, receive, send)
+            return
+        policy = self.registry.match(scope["method"], scope["path"])
+        if policy is None:
+            await self.app(scope, receive, send)
+            return
+        await self._handler(policy)(scope, receive, send)

simple_module_hosting-0.0.39/simple_module_hosting/_deferred_startup.py

@@ -0,0 +1,65 @@
+"""Settings hydration and deferred startup replay, independent of setup gates."""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+
+from fastapi import FastAPI
+from simple_module_core.app_state import get_deferred_startup, get_deferred_startup_lock
+from simple_module_core.module_settings import get_module_settings_registry
+from simple_module_db.stored_settings import SessionOverrideSource, settings_table_exists
+
+from simple_module_hosting._hydrate_step import hydrate_all
+
+logger = logging.getLogger(__name__)
+
+
+async def hydrate_settings_from_db(app: FastAPI) -> None:
+    """Merge DB-stored overrides into every registered settings object.
+
+    Reads the settings table directly (``simple_module_db.stored_settings``),
+    so it works whether or not the ``settings`` plugin is enabled (#500). A
+    missing table is a fresh install: nothing is stored yet, so there is
+    nothing to merge.
+
+    Note this is the *second* settings read of a boot. The first happens in
+    ``_preapp_config`` before ``create_app`` builds anything, because the
+    module list, i18n registry and middleware stack are all constructed from
+    settings and cannot be rebuilt from here.
+    """
+    if get_module_settings_registry(app) is None:
+        return
+
+    async with app.state.sm.db.session_factory() as session:
+        if not await settings_table_exists(session):
+            return
+        await hydrate_all(app, SessionOverrideSource(session), session)
+
+
+async def run_deferred_startup(app: FastAPI) -> None:
+    """Replay the ``on_startup`` hooks that could not run on an unmigrated DB.
+
+    Called from the wizard's migrations action and from the setup gate's
+    schema re-check, so a worker that did not itself run the migrations (or an
+    operator's out-of-band ``make migrate``) still finishes starting its
+    modules. Serialised per app; a hook that fails again is logged and dropped
+    rather than raised, because this runs after the migrations have already
+    committed and a 500 there would help nobody.
+    """
+    deferred = get_deferred_startup(app)
+    if not deferred:
+        return
+    lock = get_deferred_startup_lock(app)
+    if lock is None:  # no await between check and set, so this cannot race
+        lock = app.state.deferred_startup_lock = asyncio.Lock()
+    async with lock:
+        if not deferred:
+            return
+        await hydrate_settings_from_db(app)
+        while deferred:
+            mod = deferred.pop(0)
+            try:
+                await mod.on_startup(app)
+            except Exception:
+                logger.exception("Deferred on_startup of %s failed after migrations", mod.meta.name)

simple_module_hosting-0.0.39/simple_module_hosting/_error_handlers.py

@@ -0,0 +1,75 @@
+"""Framework-wide exception handlers that render Inertia error pages."""
+
+from __future__ import annotations
+
+import logging
+
+from fastapi.encoders import jsonable_encoder
+from fastapi.exceptions import RequestValidationError
+from fastapi.responses import JSONResponse
+from simple_module_core.exceptions import NotFoundError
+from simple_module_core.permission_denied import PermissionDenied
+from starlette.exceptions import HTTPException
+from starlette.requests import Request
+from starlette.responses import Response
+
+from simple_module_hosting._error_negotiation import _wants_json
+from simple_module_hosting._error_page import render_error_page
+from simple_module_hosting._observability import CorrelationIdMiddleware
+
+logger = logging.getLogger(__name__)
+
+_INERTIA_ERROR_STATUSES = frozenset({401, 403, 404, 413, 419, 422, 429, 500, 503})
+
+
+async def http_exception_handler(request: Request, exc: HTTPException) -> Response:
+    # Preserve exception headers (WWW-Authenticate, Retry-After, ...) the way
+    # FastAPI's stock handler does — on the rendered page as well as the JSON
+    # body, since both answer with the same status.
+    headers = getattr(exc, "headers", None)
+    if exc.status_code in _INERTIA_ERROR_STATUSES and not _wants_json(request):
+        detail = str(exc.detail) if exc.detail else ""
+        required = exc.permission if isinstance(exc, PermissionDenied) else None
+        return await render_error_page(request, exc.status_code, detail, headers, required)
+    return JSONResponse(
+        status_code=exc.status_code,
+        content={"detail": exc.detail},
+        headers=headers,
+    )
+
+
+async def not_found_error_handler(request: Request, exc: NotFoundError) -> Response:
+    if _wants_json(request):
+        return JSONResponse(status_code=404, content={"detail": str(exc)})
+    return await render_error_page(request, 404, str(exc))
+
+
+async def request_validation_error_handler(
+    request: Request, exc: RequestValidationError
+) -> Response:
+    """Return an Inertia error page for browser requests with invalid params.
+
+    Same negotiation rule as 403/404/500 (``_wants_json``), so one request
+    never sees two different error shapes depending on the error class.
+    """
+    if _wants_json(request):
+        return JSONResponse(status_code=422, content={"detail": jsonable_encoder(exc.errors())})
+    return await render_error_page(request, 422, "The requested URL contains invalid parameters.")
+
+
+async def unhandled_exception_handler(request: Request, exc: Exception) -> Response:
+    logger.exception("Unhandled exception: %s", exc)
+    if _wants_json(request):
+        response: Response = JSONResponse(
+            status_code=500, content={"detail": "Internal Server Error"}
+        )
+    else:
+        response = await render_error_page(request, 500, "")
+    # A catch-all `Exception` handler runs in Starlette's ServerErrorMiddleware,
+    # which wraps *outside* CorrelationIdMiddleware, so the response never
+    # passes through it. Without this the 500 — the one response a caller most
+    # needs to quote back to support — is the one without the header.
+    cid = getattr(request.state, "correlation_id", "")
+    if cid:
+        response.headers.setdefault(CorrelationIdMiddleware.HEADER, cid)
+    return response

simple_module_hosting-0.0.39/simple_module_hosting/_error_negotiation.py

@@ -0,0 +1,65 @@
+"""Choose JSON or HTML for framework error responses."""
+
+from starlette.requests import Request
+
+from simple_module_hosting._inertia_shared import _INERTIA_HEADER
+
+
+def _explicit_accept_q(accept: str, media_type: str) -> float | None:
+    """Quality the Accept header gives ``media_type`` by explicit listing, or
+    ``None`` when the caller never named it at all.
+
+    Only exact entries count (no ``*/*`` / ``type/*`` wildcards) — the
+    negotiation below cares whether the caller *named* html or json, and at
+    what preference, and separately whether they named it *at all* (``None``
+    vs. an explicit ``q=0``). Malformed q-values fall back to 1.0 per RFC 9110.
+    """
+    for part in accept.split(","):
+        media, _, params = part.partition(";")
+        if media.strip().lower() != media_type:
+            continue
+        q = 1.0
+        for param in params.split(";"):
+            name, _, value = param.partition("=")
+            if name.strip().lower() == "q":
+                try:
+                    q = float(value.strip())
+                except ValueError:
+                    q = 1.0
+        return q
+    return None
+
+
+def _wants_json(request: Request) -> bool:
+    """API callers get JSON error bodies; browser-shaped requests get the page.
+
+    A request that explicitly accepts ``text/html`` is a browser navigation —
+    and those reach ``/api/*`` too (OAuth login links, file-download hrefs) —
+    so it always gets the rendered page, unless the caller *prefers* JSON via
+    q-values (``application/json, text/html;q=0.5`` is an API client keeping
+    an html fallback). So does an Inertia visit (``X-Inertia`` header),
+    whatever its Accept — an Inertia client can only consume Inertia-protocol
+    responses, never a bare JSON body. Otherwise ``/api/*``, the documented
+    prefix for every module's JSON surface (``ModuleMeta.route_prefix``),
+    gets JSON — a bare ``fetch()`` sends ``Accept: */*`` — as does an
+    explicit ``Accept: application/json`` anywhere else.
+
+    ``text/html;q=0`` rules html out *everywhere*, not just under ``/api/*``:
+    once the caller has explicitly said they won't accept html, this never
+    chooses the html page. The (already-moot) html fallback survives only
+    when json wasn't mentioned either — there's nothing else to offer, so a
+    view path keeps its pre-existing default and an ``/api/*`` path keeps
+    getting JSON either way.
+    """
+    if request.headers.get(_INERTIA_HEADER):
+        return False
+    accept = request.headers.get("accept", "")
+    html_q = _explicit_accept_q(accept, "text/html")
+    json_q = _explicit_accept_q(accept, "application/json")
+    if html_q is not None and html_q > 0 and html_q >= (json_q or 0.0):
+        return False
+    path = request.url.path
+    is_api = path == "/api" or path.startswith("/api/")
+    if html_q == 0:
+        return is_api if json_q is None else True
+    return is_api or bool(json_q)