stemtrace 0.3.3__tar.gz → 0.3.4__tar.gz

{stemtrace-0.3.3 → stemtrace-0.3.4}/.bumpversion.toml

@@ -1,5 +1,5 @@
 [tool.bumpversion]
-current_version = "0.3.3"
+current_version = "0.3.4"
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)"
 serialize = ["{major}.{minor}.{patch}"]
 commit = true

{stemtrace-0.3.3 → stemtrace-0.3.4}/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.4] - 2026-06-25
+
+### Fixed
+- WebSocket: deny unauthenticated connections during the handshake instead of accepting and then closing them. The accept-then-close path half-opened the connection, so when an unauthenticated client (e.g. a port scanner) aborted mid-handshake, uvicorn's legacy `websockets` implementation ran `close()` on a protocol whose `transfer_data_task` was never set, raising `AttributeError: 'WebSocketProtocol' object has no attribute 'transfer_data_task'`. Closing before `accept()` rejects the handshake (HTTP 403) without opening the protocol object.
+- Form login: build the login form action and redirects as relative paths instead of absolute URLs, and derive the session cookie's `Secure` flag from `X-Forwarded-Proto`. Behind a TLS-terminating proxy that doesn't forward the scheme to the ASGI scope (e.g. uvicorn without `--forwarded-allow-ips`), absolute URLs were downgraded to `http://`, so the browser posted the login form over http, the proxy answered `301 -> https`, the POST body was dropped, and login silently failed (with a mixed-content warning). stemtrace now works behind such a proxy without requiring forwarded-headers configuration.
+
 ## [0.3.3] - 2026-03-20
 
 ### Added

{stemtrace-0.3.3 → stemtrace-0.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: stemtrace
-Version: 0.3.3
+Version: 0.3.4
 Summary: A lightweight Celery task flow visualizer
 Project-URL: Homepage, https://github.com/iansokolskyi/stemtrace
 Project-URL: Documentation, https://github.com/iansokolskyi/stemtrace#readme
@@ -56,7 +56,7 @@ Description-Content-Type: text/markdown
 
 **Zero-infrastructure Celery task flow visualizer**
 
-[![PyPI version](https://img.shields.io/badge/pypi-v0.3.3-darklime)](https://pypi.org/project/stemtrace)
+[![PyPI version](https://img.shields.io/badge/pypi-v0.3.4-darklime)](https://pypi.org/project/stemtrace)
 [![Python](https://img.shields.io/pypi/pyversions/stemtrace.svg)](https://pypi.org/project/stemtrace/)
 [![CI](https://github.com/iansokolskyi/stemtrace/actions/workflows/ci.yml/badge.svg)](https://github.com/iansokolskyi/stemtrace/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/iansokolskyi/stemtrace/graph/badge.svg)](https://codecov.io/gh/iansokolskyi/stemtrace)

{stemtrace-0.3.3 → stemtrace-0.3.4}/README.md

@@ -2,7 +2,7 @@
 
 **Zero-infrastructure Celery task flow visualizer**
 
-[![PyPI version](https://img.shields.io/badge/pypi-v0.3.3-darklime)](https://pypi.org/project/stemtrace)
+[![PyPI version](https://img.shields.io/badge/pypi-v0.3.4-darklime)](https://pypi.org/project/stemtrace)
 [![Python](https://img.shields.io/pypi/pyversions/stemtrace.svg)](https://pypi.org/project/stemtrace/)
 [![CI](https://github.com/iansokolskyi/stemtrace/actions/workflows/ci.yml/badge.svg)](https://github.com/iansokolskyi/stemtrace/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/iansokolskyi/stemtrace/graph/badge.svg)](https://codecov.io/gh/iansokolskyi/stemtrace)

{stemtrace-0.3.3 → stemtrace-0.3.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stemtrace"
-version = "0.3.3"
+version = "0.3.4"
 description = "A lightweight Celery task flow visualizer"
 readme = "README.md"
 license = { text = "MIT" }

{stemtrace-0.3.3 → stemtrace-0.3.4}/src/stemtrace/__init__.py

@@ -43,7 +43,7 @@ if TYPE_CHECKING:
     from celery import Celery
     from fastapi import FastAPI
 
-__version__ = "0.3.3"
+__version__ = "0.3.4"
 __all__ = [
     "ConfigurationError",
     "StemtraceConfig",

{stemtrace-0.3.3 → stemtrace-0.3.4}/src/stemtrace/server/api/websocket.py

@@ -33,8 +33,12 @@ def create_websocket_router(
                 secret=form_auth_config.secret,
                 expected_username=form_auth_config.username,
             ):
-                # Close without registering the connection.
-                await websocket.accept()
+                # Deny the handshake without completing it. Accepting first and
+                # then closing half-opens the connection; if the unauthenticated
+                # client aborts during that dance, uvicorn's legacy websockets
+                # impl runs close() on a protocol whose transfer_data_task was
+                # never set and raises AttributeError. Closing before accept lets
+                # Starlette reject the handshake (HTTP 403) without opening it.
                 await websocket.close(code=1008)
                 return
 

{stemtrace-0.3.3 → stemtrace-0.3.4}/src/stemtrace/server/fastapi/login_routes.py

@@ -40,6 +40,20 @@ def _safe_next(next_path: str | None, *, default: str) -> str:
     return next_path
 
 
+def _request_is_https(request: Request) -> bool:
+    """Best-effort HTTPS detection that survives a TLS-terminating proxy.
+
+    Falls back to the ``X-Forwarded-Proto`` header when the ASGI scheme is
+    ``http`` because proxy headers weren't applied to the scope (e.g. uvicorn
+    without ``--forwarded-allow-ips``). The first value of a comma-separated
+    list is the original client scheme.
+    """
+    if request.url.scheme == "https":
+        return True
+    forwarded = request.headers.get("x-forwarded-proto", "")
+    return forwarded.split(",")[0].strip().lower() == "https"
+
+
 def _login_page_html(*, action_path: str, error: str | None, next_path: str) -> str:
     """Render the login page HTML from a template."""
     escaped_title = html.escape(_DEFAULT_TITLE, quote=True)
@@ -92,7 +106,10 @@ def create_login_router(
         next_path = _safe_next(
             request.query_params.get("next"), default=default_next_path
         )
-        action_path = str(request.url_for("stemtrace_login_submit"))
+        # Relative path (not an absolute URL): the browser submits using the
+        # page's own scheme/host, so a TLS-terminating proxy that doesn't
+        # forward the scheme can't downgrade the form action to http.
+        action_path = request.url_for("stemtrace_login_submit").path
         rendered_html = _login_page_html(
             action_path=action_path, error=error, next_path=next_path
         )
@@ -125,7 +142,7 @@ def create_login_router(
             qs = {"error": "Invalid username or password"}
             if next_param:
                 qs["next"] = next_param
-            login_url = str(request.url_for("stemtrace_login_page"))
+            login_url = request.url_for("stemtrace_login_page").path
             return RedirectResponse(
                 url=login_url + "?" + urllib.parse.urlencode(qs),
                 status_code=303,
@@ -141,7 +158,7 @@ def create_login_router(
             value=config.create_session_cookie_value(),
             httponly=True,
             samesite="lax",
-            secure=request.url.scheme == "https",
+            secure=_request_is_https(request),
             path=config.cookie_path,
         )
         return response
@@ -149,7 +166,7 @@ def create_login_router(
     @router.post("/logout", include_in_schema=False, name="stemtrace_logout")
     async def logout(request: Request) -> RedirectResponse:
         """Clear the session cookie and redirect to login."""
-        login_url = str(request.url_for("stemtrace_login_page"))
+        login_url = request.url_for("stemtrace_login_page").path
         response = RedirectResponse(url=login_url, status_code=303)
         response.delete_cookie(key=config.cookie_name, path=config.cookie_path)
         return response

{stemtrace-0.3.3 → stemtrace-0.3.4}/src/stemtrace/server/ui/frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "stemtrace-ui",
   "private": true,
-  "version": "0.3.3",
+  "version": "0.3.4",
   "type": "module",
   "scripts": {
     "dev": "vite",

{stemtrace-0.3.3 → stemtrace-0.3.4}/tests/unit/test_form_login.py

@@ -73,6 +73,107 @@ class TestFormLoginProtection:
                 assert ext.ws_manager.connection_count == 1
             assert ext.ws_manager.connection_count == 0
 
+    def test_unauthenticated_websocket_denied_at_handshake(self) -> None:
+        """An unauthenticated WebSocket must be denied DURING the handshake,
+        without calling ``accept()`` first.
+
+        Accepting the handshake and then closing it half-opens the connection;
+        when an unauthenticated client (e.g. a port scanner) aborts during that
+        accept->close dance, uvicorn's legacy ``websockets`` implementation runs
+        ``close()`` on a protocol whose ``transfer_data_task`` was never set,
+        raising ``AttributeError: 'WebSocketProtocol' object has no attribute
+        'transfer_data_task'``. Denying before accept avoids opening the
+        protocol object at all. Regression test for that crash.
+        """
+        app = FastAPI()
+        stemtrace.init_app(
+            app,
+            broker_url="memory://",
+            embedded_consumer=False,
+            serve_ui=False,
+            login_username="admin",
+            login_password="secret",  # NOSONAR - test credential only
+            login_secret="test-secret",
+        )
+
+        with TestClient(app) as client:
+            accepted = False
+            with (
+                pytest.raises(WebSocketDisconnect) as exc_info,
+                client.websocket_connect("/stemtrace/ws") as ws,
+            ):
+                # Only reached if the server accepted the handshake first.
+                accepted = True
+                ws.receive_text()
+
+            assert accepted is False, (
+                "unauthenticated WebSocket must be denied before accept(); "
+                "accepting then closing crashes uvicorn's legacy websockets impl"
+            )
+            assert exc_info.value.code == 1008
+
+    def test_login_urls_relative_and_cookie_secure_behind_tls_proxy(self) -> None:
+        """Behind a TLS-terminating proxy, login URLs must stay relative and the
+        session cookie must still be Secure.
+
+        When the proxy forwards ``X-Forwarded-Proto: https`` but the ASGI scheme
+        is left as ``http`` (e.g. uvicorn without ``--forwarded-allow-ips``),
+        building absolute URLs from the request scheme downgrades the login form
+        action / redirects to ``http://``. The browser then posts over http, the
+        proxy answers 301->https, the POST body is dropped, and login silently
+        fails. Relative URLs keep the page's https scheme; the cookie's Secure
+        flag falls back to the forwarded-proto header.
+        """
+        app = FastAPI()
+        stemtrace.init_app(
+            app,
+            broker_url="memory://",
+            embedded_consumer=False,
+            serve_ui=False,
+            login_username="admin",
+            login_password="secret",  # NOSONAR - test credential only
+            login_secret="test-secret",
+        )
+        # ALB-style header; the ASGI scheme stays http (proxy headers not applied).
+        proxied = {"x-forwarded-proto": "https"}
+
+        with TestClient(app) as client:
+            # The login form action is a relative path, never an absolute URL
+            # that a proxy could downgrade to http.
+            page = client.get("/stemtrace/login", headers=proxied)
+            assert page.status_code == 200
+            assert 'action="/stemtrace/login"' in page.text
+            assert 'action="http' not in page.text
+
+            # Successful login: relative redirect + Secure cookie (via forwarded proto).
+            resp = client.post(
+                "/stemtrace/login",
+                data={
+                    "username": "admin",
+                    "password": "secret",
+                    "next": "/stemtrace/",
+                },  # NOSONAR - test credential only
+                headers=proxied,
+                follow_redirects=False,
+            )
+            assert resp.status_code == 303
+            assert resp.headers["location"] == "/stemtrace/"
+            assert "Secure" in resp.headers["set-cookie"]
+
+            # Failed login: relative redirect, not an absolute http:// URL.
+            bad = client.post(
+                "/stemtrace/login",
+                data={
+                    "username": "admin",
+                    "password": "nope",
+                    "next": "/stemtrace/",
+                },  # NOSONAR - test credential only
+                headers=proxied,
+                follow_redirects=False,
+            )
+            assert bad.headers["location"].startswith("/stemtrace/login?")
+            assert not bad.headers["location"].startswith("http")
+
     def test_invalid_credentials_redirects_to_login_with_error(self) -> None:
         """Invalid credentials redirect back to the login page with an error."""
         app = FastAPI()
@@ -97,9 +198,7 @@ class TestFormLoginProtection:
                 follow_redirects=False,
             )
             assert resp.status_code == 303
-            assert resp.headers["location"].startswith(
-                "http://testserver/stemtrace/login?"
-            )
+            assert resp.headers["location"].startswith("/stemtrace/login?")
 
             page = client.get(resp.headers["location"])
             assert page.status_code == 200
@@ -135,9 +234,8 @@ class TestFormLoginProtection:
 
             logout = client.post("/stemtrace/logout", follow_redirects=False)
             assert logout.status_code == 303
-            assert logout.headers["location"].startswith(
-                "http://testserver/stemtrace/login"
-            )
+            assert logout.headers["location"].startswith("/stemtrace/login")
+            assert not logout.headers["location"].startswith("http")
 
             forbidden = client.get("/stemtrace/api/health", follow_redirects=False)
             assert forbidden.status_code == 401

{stemtrace-0.3.3 → stemtrace-0.3.4}/uv.lock

@@ -1595,7 +1595,7 @@ wheels = [
 
 [[package]]
 name = "stemtrace"
-version = "0.3.3"
+version = "0.3.4"
 source = { editable = "." }
 dependencies = [
     { name = "celery" },