spatialdds 0.5.3__tar.gz → 0.5.4__tar.gz

{spatialdds-0.5.3 → spatialdds-0.5.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: spatialdds
-Version: 0.5.3
+Version: 0.5.4
 Summary: SpatialDDS over plain HTTPS and a WebSocket: a client for the web binding (Appendix N), and the reference registry behind one command.
 Author: Open AR Cloud
 License: Apache-2.0
@@ -428,7 +428,7 @@ pumping 202 samples into two registered subscriber queues delivered 0 live
 events. If you call `notify` only from the serving loop, 0.5.0 and 0.5.1 were
 correct for you.
 
-0.5.3 lets a browser reach this gateway at all. `Authorization` is not a
+0.5.3 let a browser reach this gateway at all. `Authorization` is not a
 CORS-safelisted request header, so a cross-origin request carrying one is
 preceded by an `OPTIONS` preflight — and no `OPTIONS` was routed, so aiohttp
 answered `405 Allow: GET,HEAD,POST` and the browser stopped there without
@@ -453,7 +453,25 @@ required, and nothing is newly reachable without one.
 If your clients are not browsers, 0.5.0 through 0.5.2 were correct for you:
 nothing else changes, and no response loses a header it had.
 
-## Not in 0.5.3
+0.5.4 finishes what 0.5.3 started, and the gap is instructive. 0.5.3 threaded
+the asking origin through the three places that build a response from
+`_cache_headers` and missed the two that build one by hand: the N.6 command
+lane's own reply, and **every N.8 problem document**. So a command published
+and the page could not read the outcome --- a cross-origin `fetch` rejects a
+response with no allowed origin, so a client saw a failure for a command that
+had in fact succeeded --- and a `401`, `409` or `400` was unreadable by the
+client it was written for, which is N.8 failing at the one thing that
+distinguishes it from a bare status.
+
+The fix is a one-rule middleware rather than a fourth and fifth call site:
+where a response names no origin and the request had one, echo it with
+`Vary: Origin`. `_cache_headers` remains the place that decides cacheability
+and reach together and is unchanged where it already acts. Threading it
+explicitly was tried first and is what missed two paths.
+
+If your clients are not browsers, nothing here changes anything for you.
+
+## Not in 0.5.4
 
 Stated so nobody waits for them: no async API, no caching beyond ETag
 revalidation, no retry policy, no MCAP tooling beyond the journal the server

{spatialdds-0.5.3 → spatialdds-0.5.4}/README.md

@@ -404,7 +404,7 @@ pumping 202 samples into two registered subscriber queues delivered 0 live
 events. If you call `notify` only from the serving loop, 0.5.0 and 0.5.1 were
 correct for you.
 
-0.5.3 lets a browser reach this gateway at all. `Authorization` is not a
+0.5.3 let a browser reach this gateway at all. `Authorization` is not a
 CORS-safelisted request header, so a cross-origin request carrying one is
 preceded by an `OPTIONS` preflight — and no `OPTIONS` was routed, so aiohttp
 answered `405 Allow: GET,HEAD,POST` and the browser stopped there without
@@ -429,7 +429,25 @@ required, and nothing is newly reachable without one.
 If your clients are not browsers, 0.5.0 through 0.5.2 were correct for you:
 nothing else changes, and no response loses a header it had.
 
-## Not in 0.5.3
+0.5.4 finishes what 0.5.3 started, and the gap is instructive. 0.5.3 threaded
+the asking origin through the three places that build a response from
+`_cache_headers` and missed the two that build one by hand: the N.6 command
+lane's own reply, and **every N.8 problem document**. So a command published
+and the page could not read the outcome --- a cross-origin `fetch` rejects a
+response with no allowed origin, so a client saw a failure for a command that
+had in fact succeeded --- and a `401`, `409` or `400` was unreadable by the
+client it was written for, which is N.8 failing at the one thing that
+distinguishes it from a bare status.
+
+The fix is a one-rule middleware rather than a fourth and fifth call site:
+where a response names no origin and the request had one, echo it with
+`Vary: Origin`. `_cache_headers` remains the place that decides cacheability
+and reach together and is unchanged where it already acts. Threading it
+explicitly was tried first and is what missed two paths.
+
+If your clients are not browsers, nothing here changes anything for you.
+
+## Not in 0.5.4
 
 Stated so nobody waits for them: no async API, no caching beyond ETag
 revalidation, no retry policy, no MCAP tooling beyond the journal the server

{spatialdds-0.5.3 → spatialdds-0.5.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "spatialdds"
-version = "0.5.3"
+version = "0.5.4"
 description = "SpatialDDS over plain HTTPS and a WebSocket: a client for the web binding (Appendix N), and the reference registry behind one command."
 readme = "README.md"
 requires-python = ">=3.9"

{spatialdds-0.5.3 → spatialdds-0.5.4}/spatialdds/__init__.py

@@ -37,7 +37,7 @@ __all__ = [
     "content_manifest", "geo_anchor", "service_uri", "content_uri",
 ]
 
-__version__ = "0.5.3"
+__version__ = "0.5.4"
 #: The SpatialDDS-spec commit whose Appendix N and generated artifacts this
 #: package implements. Package versions and specification versions move
 #: independently; this is the one that says what the wire looks like.

{spatialdds-0.5.3 → spatialdds-0.5.4}/spatialdds/server/gw_http.py

@@ -164,6 +164,49 @@ def _cache_headers(access: str, doc_ttl: int | None = None,
     return headers
 
 
+@web.middleware
+async def _reach(request: web.Request, handler) -> web.StreamResponse:
+    """Make sure every answer names the origin that asked for it.
+
+    **A backstop, not the policy.** `_cache_headers` remains the single place
+    that decides cacheability and reach together, and where it has already set
+    `Access-Control-Allow-Origin` this changes nothing. What it covers is the
+    responses that set no reach at all, because they are built by hand rather
+    than through that function --- and the reason it exists is that threading
+    the origin explicitly through every construction site was tried first, in
+    0.5.3, and missed two:
+
+    * `post_command`'s `202`. The command published and the page could not
+      read the outcome: a cross-origin `fetch` rejects a response with no
+      allowed origin, so `bindingCommand` in the demo's client landed in its
+      `catch` with no status at all, for a command that had in fact succeeded.
+    * **Every N.8 problem document.** `_problem` set `no-store` and nothing
+      else, so a `401`, `409` or `400` was unreadable by the client it was
+      written for. N.8 exists to hand a client a *reason*; a reason a browser
+      cannot read is the surface failing at the one thing that distinguishes
+      it from a bare status.
+
+    Both were found by curling the running demo after 0.5.3 shipped, not by
+    this repository's gates --- the same way the original defect was found,
+    which is the lesson repeating rather than a new one.
+
+    Only the origin is echoed here, and only when absent. `Vary: Origin` goes
+    with it so a shared cache cannot serve one origin's answer to another; the
+    `Expose-Headers` set is added for the same reason it is on a GET, since a
+    reader that cannot see the ETag cannot revalidate. `Allow-Credentials` is
+    still set nowhere.
+    """
+    response = await handler(request)
+    origin = request.headers.get("Origin")
+    if origin and "Access-Control-Allow-Origin" not in response.headers:
+        response.headers["Access-Control-Allow-Origin"] = origin
+        vary = response.headers.get("Vary")
+        response.headers["Vary"] = f"{vary}, Origin" if vary else "Origin"
+        response.headers.setdefault("Access-Control-Expose-Headers",
+                                    EXPOSE_HEADERS)
+    return response
+
+
 async def preflight(request: web.Request) -> web.Response:
     """Answer the `OPTIONS` a browser sends before a credentialed request.
 
@@ -1001,7 +1044,7 @@ def make_app(state: gateway.State, base: str, token: str | None,
     embedder passes `publish_enabled=False, live_subscriptions=True` and gets
     the live lane with no write surface at all.
     """
-    app = web.Application()
+    app = web.Application(middlewares=[_reach])
     app["state"] = state
     app["base"] = base.rstrip("/")
     app["token"] = token

{spatialdds-0.5.3 → spatialdds-0.5.4}/spatialdds.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: spatialdds
-Version: 0.5.3
+Version: 0.5.4
 Summary: SpatialDDS over plain HTTPS and a WebSocket: a client for the web binding (Appendix N), and the reference registry behind one command.
 Author: Open AR Cloud
 License: Apache-2.0
@@ -428,7 +428,7 @@ pumping 202 samples into two registered subscriber queues delivered 0 live
 events. If you call `notify` only from the serving loop, 0.5.0 and 0.5.1 were
 correct for you.
 
-0.5.3 lets a browser reach this gateway at all. `Authorization` is not a
+0.5.3 let a browser reach this gateway at all. `Authorization` is not a
 CORS-safelisted request header, so a cross-origin request carrying one is
 preceded by an `OPTIONS` preflight — and no `OPTIONS` was routed, so aiohttp
 answered `405 Allow: GET,HEAD,POST` and the browser stopped there without
@@ -453,7 +453,25 @@ required, and nothing is newly reachable without one.
 If your clients are not browsers, 0.5.0 through 0.5.2 were correct for you:
 nothing else changes, and no response loses a header it had.
 
-## Not in 0.5.3
+0.5.4 finishes what 0.5.3 started, and the gap is instructive. 0.5.3 threaded
+the asking origin through the three places that build a response from
+`_cache_headers` and missed the two that build one by hand: the N.6 command
+lane's own reply, and **every N.8 problem document**. So a command published
+and the page could not read the outcome --- a cross-origin `fetch` rejects a
+response with no allowed origin, so a client saw a failure for a command that
+had in fact succeeded --- and a `401`, `409` or `400` was unreadable by the
+client it was written for, which is N.8 failing at the one thing that
+distinguishes it from a bare status.
+
+The fix is a one-rule middleware rather than a fourth and fifth call site:
+where a response names no origin and the request had one, echo it with
+`Vary: Origin`. `_cache_headers` remains the place that decides cacheability
+and reach together and is unchanged where it already acts. Threading it
+explicitly was tried first and is what missed two paths.
+
+If your clients are not browsers, nothing here changes anything for you.
+
+## Not in 0.5.4
 
 Stated so nobody waits for them: no async API, no caching beyond ETag
 revalidation, no retry policy, no MCAP tooling beyond the journal the server