spaps-server-quickstart 0.6.2__tar.gz → 0.6.5__tar.gz

spaps_server_quickstart-0.6.5/.gitignore

@@ -0,0 +1,207 @@
+# Dependencies
+node_modules/
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+lerna-debug.log*
+
+sweet-potato-threat-model.md
+
+# Python
+**/__pycache__/
+*.py[cod]
+*.pyo
+*.pyd
+.venv/
+*.egg-info/
+
+# Testing
+coverage/
+coverage-*/
+**/coverage/
+**/coverage-*/
+**/.coverage
+**/.coverage.*
+**/.pytest_cache/
+**/.mypy_cache/
+**/.ruff_cache/
+**/.hypothesis/
+**/.testmondata
+**/.testmondata-shm
+**/.testmondata-wal
+packages/python-server-quickstart/tests/benchmarks/.artifacts/
+*.lcov
+**/lcov.info
+**/lcov-report/
+.nyc_output
+packages/python-client/.coverage
+
+# Production builds
+dist/
+**/dist/
+build/
+out/
+*.tsbuildinfo
+
+# Storybook
+storybook-static/
+*.storybook
+
+# Environment files
+.env
+.env.*
+*.env
+*.env.draft
+**/.env
+**/.env.*
+.env.development
+.env.production
+.env.staging
+.env.deploy
+.env.local
+.env.development.local
+.env.test.local
+.env.production.local
+# Allow committed templates/examples
+!*.env.example
+!*.env.sample
+!*.env.template
+!**/.env.example
+!**/.env.sample
+!**/.env.template
+!**/.env.*.example
+!**/.env.*.sample
+!**/.env.*.template
+!**/*.env.example
+!**/*.env.sample
+!**/*.env.template
+
+# IDE
+.vscode/
+.idea/
+.codex/
+.mcp.json
+.claude/settings.local.json
+.claude/skills/
+.beads/*.db
+.beads/*.db-shm
+.beads/*.db-wal
+*.swp
+*.swo
+*.swn
+.DS_Store
+
+# Debug
+debug.log
+*.log
+
+# Temporary files
+tmp/
+temp/
+*.tmp
+packages/python-client/**/__pycache__/
+
+# Package manager files
+.pnp.*
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/sdks
+!.yarn/versions
+
+# Next.js specific
+.next/
+next-env.d.ts
+.vercel/
+
+# Example projects - ignore build artifacts
+examples/**/.next/
+examples/**/node_modules/
+examples/**/dist/
+examples/**/build/
+examples/**/*.log
+examples/**/.env
+examples/**/.env.local
+
+# MCP/Sweetpotato docs build
+mcp-sweetpotato-docs/node_modules/
+mcp-sweetpotato-docs/dist/
+mcp-sweetpotato-docs/build/
+mcp-sweetpotato-docs/.next/
+
+# Large test files
+*.jpg
+*.jpeg
+*.png
+*.gif
+*.bmp
+*.mp4
+*.mov
+*.avi
+*.zip
+*.tar
+*.gz
+*.rar
+
+# Database files
+*.sqlite
+*.sqlite3
+*.db
+
+# Supabase production backups (contain real user data)
+schema.sql
+roles.sql
+data.sql
+backup-feb8.sql
+
+# Stripe CLI
+.stripe-listen.pid
+
+# Local Solana Devnet keypairs
+*-devnet.json
+
+# Local modes/swarm artifacts
+.ntm/
+.skillbox/
+artifacts/openapi-contract/
+MODES_ANALYSIS_PROGRESS.md
+MODES_OF_REASONING_REPORT_AND_ANALYSIS_OF_PROJECT.md
+MODE_OUTPUT_*.md
+MODES_SWARM/
+
+# OS files
+Thumbs.db
+Desktop.ini
+
+# Backup files
+*.bak
+*.backup
+*.old
+
+# Test output
+test-results/
+playwright-report/
+playwright/.cache/
+tests/artifacts/
+
+# Lock files that shouldn't be committed for libraries
+# (keep package-lock.json for applications)
+# yarn.lock
+# pnpm-lock.yaml*.tgz
+
+**/coverage.xml
+
+context.yaml
+MODES_OF_REASONING_SECOND_PASS_REPORT.md
+skillbox-config/
+
+# Simplify/refactor tool run artifacts
+refactor/
+
+# bv (beads viewer) local config and caches
+.bv/
+
+# Beads compliance audit dir (managed by /beads-compliance-and-completion-verification skill)
+/beads_compliance_audit/

spaps_server_quickstart-0.6.5/CHANGELOG.md

@@ -0,0 +1,192 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Security
+
+- WebSocket connect tickets minted for one application are no longer redeemable
+  through callers that omit `application_id`; unscoped WebSocket ticket
+  consumers now only accept tokens stored without an application binding.
+
+## [0.6.5] - 2026-07-13
+
+### Fixed
+
+- `RequestLoggingMiddleware` now emits a single `request.failed` structured log
+  (status 500, request id, duration, exception type) when an unhandled exception
+  escapes a request, re-raises the original exception, and no longer emits
+  `request.completed` with a null status on the failure path. Exception message
+  text is never included in the failure log fields. Its pure-ASGI implementation
+  preserves cancellation instead of converting it to a synthetic 500, and
+  unsafe/unbounded inbound request IDs are replaced before logging or response
+  propagation. It also rejects secret-shaped request IDs, overwrites conflicting
+  downstream response headers with the canonical ID, and treats an ASGI app
+  that returns without starting a response as a failed request.
+- The deploy-time CORS contract reader now retrieves every paginated application
+  row instead of silently comparing only the first page.
+
+## [0.6.4] - 2026-06-27
+
+### Added
+
+- Exposes the public auth-channel magic-link contract with `confirm_url` plus
+  signup identity fields (`full_name`, `date_of_birth`, `terms_accepted`, and
+  `terms_text_version`) forwarded through
+  `SpapsAuthChannelService.send_magic_link(...)`, so downstream services can
+  remove private client fallbacks.
+
+## [0.6.3] - 2026-06-04
+
+### Fixed
+
+- `entitlements.grant_entitlement` now treats a partial-UNIQUE-index violation (the Stripe entitlement dedupe indexes from migration `000000000044`) as the idempotent "already granted" case: it rolls back the aborted transaction, re-fetches the winning row, and returns it with `created=False`. Previously a concurrent grant for the same checkout/subscription raised an unhandled `IntegrityError` that poisoned the DB session and could wedge Stripe webhook processing (the event was never marked processed, so Stripe retried indefinitely). A genuine non-dedupe integrity error still fails closed (re-raises). (sp-entitlement-grant-integrityerror-idempotency-b5sl)
+
+## [0.6.2] - 2026-06-01
+
+### Changed
+
+- Raised the FastAPI lower bound to `>=0.120.0` and added an explicit `starlette>=0.49.1,<2.0` dependency floor so downstream services can resolve Starlette security fixes without audit ignores.
+- Raised the `cryptography` lower bound to `>=46.0.7` and relaxed the upper bound to `<49.0` so downstream services can adopt current CVE-fixed releases.
+
+## [0.6.1] - 2026-06-01
+
+### Changed
+
+- Relaxed the FastAPI upper bound to `<0.120` so downstream services can adopt FastAPI 0.119 and Starlette security fixes.
+- Relaxed the `cryptography` upper bound to `<46.0` so downstream services can resolve CVE-fixed releases without local pip-audit ignores.
+
+## [0.6.0] - 2026-05-29
+
+### Added
+
+- Shared WebSocket connect-auth: `mint_ws_ticket`, `consume_ws_ticket`, and the `resolve_ws_identity` WebSocket helper, plus a `POST /realtime/ws-ticket` route. Browsers cannot set the WebSocket `Authorization` header, so apps mint a short-lived, single-use connection ticket over authenticated HTTP and present it on the socket query string. Built on the existing one-time `AuthToken` primitive (`type="ws_connect"`) — no new table.
+- Added reusable hosted-asset storage adapters and issue-reporting screenshot attachment routes backed by private hosted objects.
+
+## [0.5.1] - 2026-04-25
+
+### Fixed
+
+- Hardened request middleware for API keys, key scopes, origin validation, rate limiting, webhook delivery, and self-service access paths.
+
+## [0.5.0] - 2026-03-29
+
+### Added
+
+- End-user issue-reporting flows, runtime token admin support, and support-telemetry helpers for downstream FastAPI services.
+- Browser-friendly device-flow verification and expanded reusable database helper surface.
+
+### Fixed
+
+- Magic-link redirect handling, stale session admin-email behavior, and related auth/session hardening.
+- Hotspot complexity and coverage gaps across webhook, auth, and session paths.
+
+## [0.4.0] - 2026-02-11
+
+### Added
+
+- Full domain rewrite covering auth, sessions, users, wallets, payments, entitlements, dayrate, agent approvals, affiliate referrals, email templates, and related operational domains.
+- Approval capability gates and governance health endpoint.
+
+### Changed
+
+- Production cutover to Python SPAPS stack (CI/CD, Docker Compose, deploy scripts).
+- Consolidated SPAPS integration patterns into published packages.
+
+### Security
+
+- Rate limiting by client IP.
+- PII encryption startup checks.
+- Webhook authentication hardening.
+- Row-level locking on refresh tokens.
+- Fail-closed settings defaults.
+
+## [0.3.0] - 2026-02-08
+
+### Added
+
+- Contract tests and shared testing module.
+- Health endpoint enhancements.
+
+### Changed
+
+- Expanded coverage across settings, middleware, database, Celery, and auth helpers.
+
+## [0.2.3] - 2026-01-12
+
+### Fixed
+
+- `SpapsAuthMiddleware` now skips execution when `authenticated_user` is already populated.
+
+## [0.2.2] - 2026-01-11
+
+### Added
+
+- `fnmatch` glob support for `spaps_auth_exempt_paths`.
+- Set-password endpoint support for authenticated users.
+- Stripe webhook admin tooling for entitlement workflows.
+- Tier 3 templates: seeds, tests, domain examples, docs.
+- Startup validation, Alembic templates, and CI/CD workflow scaffolding.
+
+## [0.2.1] - 2025-12-01
+
+### Added
+
+- Shared pgvector dev scripts: `start-db.sh`, `stop-db.sh`, `await_db.py`.
+- Dynamic DNS resolver support for Docker reverse-proxy setups.
+
+### Fixed
+
+- nginx DNS caching behavior.
+- HTMA rate-limiting exemption handling.
+
+## [0.2.0] - 2025-10-15
+
+### Added
+
+- Local auth bypass mode with pre-configured admin/user personas.
+- Deployment check scripts (`pre-deploy`, `post-deploy`).
+- Database caching workflow for local debug loops.
+- Operational templates (Makefile, GHCR deploy, compose/reverse-proxy stubs).
+
+### Security
+
+- Production guardrails for local-auth bypass mode.
+
+## [0.1.2] - 2025-10-15
+
+### Fixed
+
+- CI pipeline trigger scoping and quickstart build stability.
+
+## [0.1.1] - 2025-10-14
+
+### Changed
+
+- Maintenance release to unblock automated PyPI publishing workflow.
+
+## [0.1.0] - 2025-10-14
+
+### Added
+
+- FastAPI lifespan handling for SPAPS auth cleanup.
+- Migration and upgrading guidance for downstream services.
+- Shared refresh-cookie configuration and browser helper exports.
+- Expanded package exports for auth helpers and operational templates.
+- RBAC role helpers and sample domain routers.
+- Comprehensive unit tests across settings, middleware, DB, Celery, and auth helpers.
+
+## [0.0.2] - 2025-10-12
+
+### Added
+
+- Declared the `spaps` Python client dependency for downstream installs and CI runs.
+
+## [0.0.1] - 2025-10-14
+
+### Added
+
+- Initial `spaps-server-quickstart` scaffold with shared FastAPI/Celery/database utilities.