simple-module-pagebuilder 0.0.8__tar.gz → 0.0.9__tar.gz

{simple_module_pagebuilder-0.0.8 → simple_module_pagebuilder-0.0.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_pagebuilder
-Version: 0.0.8
+Version: 0.0.9
 Summary: Drag-and-drop visual page builder for simple_module apps
 Project-URL: Repository, https://github.com/antosubash/simple_module_python_modules
 Author-email: Anto Subash <antosubash@live.com>

{simple_module_pagebuilder-0.0.8 → simple_module_pagebuilder-0.0.9}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simple-module-py/pagebuilder",
-  "version": "0.0.8",
+  "version": "0.0.9",
   "private": true,
   "description": "Frontend assets for the PageBuilder module",
   "peerDependencies": {

{simple_module_pagebuilder-0.0.8 → simple_module_pagebuilder-0.0.9}/pagebuilder/endpoints/public_views.py

@@ -28,7 +28,7 @@ from pagebuilder.deps import get_settings
 from pagebuilder.layout_service import LayoutService, public_layout_props
 from pagebuilder.service import PagesService
 from pagebuilder.settings import PagebuilderSettings
-from pagebuilder.tenancy import bind_public
+from pagebuilder.tenancy import bind_public, vary_on_tenant
 
 _PAGE_PUBLIC = "PageBuilder/PublicPage"
 
@@ -167,7 +167,8 @@ async def render_public_page(
             # the exact thing recording a redirect exists to prevent.
             claimed = await public_claims.claimed_url(db, moved_to, active)
             target = claimed or locales.public_path(prefix, moved_to, active)
-            return RedirectResponse(target, status_code=301)
+            # A 301 is cacheable by default; key it on what picks the tenant.
+            return vary_on_tenant(RedirectResponse(target, status_code=301), request.app)
         raise HTTPException(status_code=404, detail="Page not found")
 
     layout = await LayoutService(db).get()
@@ -181,6 +182,8 @@ async def render_public_page(
     def apply_headers(response: Response) -> Response:
         response.headers["ETag"] = etag
         response.headers["Vary"] = "X-Inertia"
+        # On a multi-tenant host the tenant can come from the session, not the Host.
+        vary_on_tenant(response, request.app)
         response.headers["Cache-Control"] = cache_control
         # Which language was negotiated, for caches and for anything reading
         # the response without parsing the body.

{simple_module_pagebuilder-0.0.8 → simple_module_pagebuilder-0.0.9}/pagebuilder/endpoints/seo.py

@@ -19,7 +19,7 @@ from pagebuilder import locales, public_claims
 from pagebuilder.deps import get_settings
 from pagebuilder.service import PagesService
 from pagebuilder.settings import PagebuilderSettings
-from pagebuilder.tenancy import bind_public
+from pagebuilder.tenancy import bind_public, vary_on_tenant
 
 seo_router = APIRouter()
 
@@ -137,11 +137,13 @@ async def sitemap(
         + ("\n" if entries else "")
         + "</urlset>\n"
     )
-    return Response(
+    response = Response(
         content=body,
         media_type="application/xml",
         headers={"Cache-Control": f"public, max-age={settings.seo_cache_max_age}"},
     )
+    # Tenant-bound: on a multi-tenant host the session can pick the tenant.
+    return vary_on_tenant(response, request.app)
 
 
 @seo_router.get("/robots.txt", response_class=Response)

{simple_module_pagebuilder-0.0.8 → simple_module_pagebuilder-0.0.9}/pagebuilder/tenancy.py

@@ -45,6 +45,8 @@ __all__ = [
     "mode_of",
     "resolve_admin",
     "resolve_public",
+    "tenant_vary",
+    "vary_on_tenant",
 ]
 
 _log = logging.getLogger("simple_module.pagebuilder")
@@ -119,6 +121,30 @@ def configure(app: Any) -> TenancyMode:
     return mode
 
 
+def tenant_vary(app: Any) -> tuple[str, ...]:
+    """The request headers that pick a public response's tenant.
+
+    ``SINGLE``: none. ``MULTI``: on the apex host the framework falls back to
+    a member's session (``Cookie``) or the configured tenant header, so the
+    same Host + URL answers with different tenants' content and a shared
+    cache has to key on them too.
+    """
+    if mode_of(app) is TenancyMode.SINGLE:
+        return ()
+    header = (getattr(_tenant_middleware(app), "kwargs", None) or {}).get("header")
+    return ("Cookie", header) if header else ("Cookie",)
+
+
+def vary_on_tenant(response: Any, app: Any) -> Any:
+    """Append :func:`tenant_vary` to *response*'s ``Vary``; a no-op in SINGLE."""
+    listed = [f.strip() for f in response.headers.get("vary", "").split(",") if f.strip()]
+    seen = {f.lower() for f in listed}
+    added = [f for f in tenant_vary(app) if f.lower() not in seen]
+    if added:
+        response.headers["Vary"] = ", ".join(listed + added)
+    return response
+
+
 def mode_of(app: Any) -> TenancyMode:
     """The stored mode, or a fresh detection before ``on_startup`` has run."""
     mode = getattr(getattr(app.state, _PACKAGE, None), "tenancy", None)

{simple_module_pagebuilder-0.0.8 → simple_module_pagebuilder-0.0.9}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_pagebuilder"
-version = "0.0.8"
+version = "0.0.9"
 description = "Drag-and-drop visual page builder for simple_module apps"
 readme = "README.md"
 license = "MIT"

{simple_module_pagebuilder-0.0.8 → simple_module_pagebuilder-0.0.9}/tests/test_tenancy_public.py

@@ -76,6 +76,43 @@ async def test_sitemap_lists_only_the_bound_tenant(mt: AsyncClient) -> None:
     assert "/p/beta" in b.text and "/p/alpha" not in b.text
 
 
+def _vary(response) -> list[str]:
+    """The distinct Vary fields: Starlette's ``SessionMiddleware`` appends
+    ``Cookie`` without checking whether it is already listed."""
+    fields = (v.strip() for v in response.headers.get("vary", "").split(","))
+    return list(dict.fromkeys(f for f in fields if f))
+
+
+@pytest.mark.unbound_tenant
+async def test_multi_mode_public_responses_vary_on_cookie(mt: AsyncClient) -> None:
+    """The apex host can take the tenant from a member's session, so a shared
+    cache keyed on Host + URL alone could serve one tenant's page to another."""
+    await _publish(mt, A, "about", "About Acme")
+    page = await mt.get("/p/about", headers=A)
+    assert page.status_code == 200, page.text
+    assert _vary(page) == ["X-Inertia", "Cookie"]
+    cached = await mt.get("/p/about", headers={**A, "If-None-Match": page.headers["etag"]})
+    assert cached.status_code == 304
+    assert _vary(cached) == ["X-Inertia", "Cookie"]
+    sitemap = await mt.get("/sitemap.xml", headers=A)
+    assert sitemap.status_code == 200
+    assert sitemap.headers["cache-control"].startswith("public")
+    assert _vary(sitemap) == ["Cookie"]
+
+
+async def test_single_mode_vary_is_unchanged(authed_client: AsyncClient) -> None:
+    created = await authed_client.post(API, json={"title": "Hi", "slug": "hi", "draft_data": {}})
+    assert created.status_code == 201, created.text
+    await authed_client.post(f"{API}/{created.json()['id']}/publish", json={})
+    page = await authed_client.get("/p/hi")
+    assert page.status_code == 200, page.text
+    # ``Cookie`` here is SessionMiddleware's (the render read the session).
+    assert page.headers["vary"] == "X-Inertia, Cookie"
+    cached = await authed_client.get("/p/hi", headers={"If-None-Match": page.headers["etag"]})
+    assert (cached.status_code, cached.headers.get("vary")) == (304, "X-Inertia")
+    assert (await authed_client.get("/sitemap.xml")).headers.get("vary") is None
+
+
 async def test_single_mode_stamps_the_default_tenant(authed_client: AsyncClient, db) -> None:
     created = await authed_client.post(API, json={"title": "Hi", "slug": "hi", "draft_data": {}})
     assert created.status_code == 201, created.text