stkit 17.2.5__tar.gz → 17.2.7__tar.gz

{stkit-17.2.5 → stkit-17.2.7}/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## v17.2.7 (2026-10-31)
+
+No migration required. Requires quart-security 2.0.6.
+
+- Registration no longer reveals which emails have an account: an existing email gets the same answer as a new one and nothing is created. With `MAIL_SERVER` set, the owner is emailed in the background that someone tried; its link comes from `STK_PUBLIC_URL`, never the request's Host header (Authentication).
+- After login, users land back on the page that sent them to `/login`, including through 2FA and passkeys (Authentication).
+- `stk.files` refuses to start when `STK_UPLOAD_MAX_BYTES` does not fit under Quart's `MAX_CONTENT_LENGTH`. Before, any limit above about 16 MiB was silently capped with a generic 413 (Configuration).
+- `stk doctor` warns when `STK_PUBLIC_URL` is unset outside development, since any Host header is then accepted.
+
+## v17.2.6 (2026-10-31)
+
+No migration required.
+
+- `stk smoke`'s `hex-id` rule no longer flags mixed-case names such as `Ed25519`. Ids are printed in one case, so `1fbaac41` and `1FBAAC41` still fail (Build Loop).
+
 ## v17.2.5 (2026-10-31)
 
 No migration required.

{stkit-17.2.5 → stkit-17.2.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stkit
-Version: 17.2.5
+Version: 17.2.7
 Summary: An async Quart framework optimized for AI-assisted development workflows
 Project-URL: Documentation, https://docs.stkit.dev
 Project-URL: Source, https://github.com/level09/stk
@@ -28,7 +28,7 @@ Requires-Dist: pillow>=13.0.0
 Requires-Dist: psycopg2-binary>=2.9.10
 Requires-Dist: python-dotenv>=1.2.2
 Requires-Dist: qrcode>=8.2
-Requires-Dist: quart-security<3,>=2.0.5
+Requires-Dist: quart-security<3,>=2.0.6
 Requires-Dist: quart-session>=3.0.0
 Requires-Dist: quart>=0.20.0
 Requires-Dist: rich>=14.0.0

{stkit-17.2.5 → stkit-17.2.7}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stkit"
-version = "17.2.5"
+version = "17.2.7"
 description = "An async Quart framework optimized for AI-assisted development workflows"
 authors = [
     {name = "Level09", email = "hello@level09.com"}
@@ -30,7 +30,7 @@ dependencies = [
     "python-dotenv>=1.2.2",
     "qrcode>=8.2",
     "quart>=0.20.0",
-    "quart-security>=2.0.5,<3",
+    "quart-security>=2.0.6,<3",
     "quart-session>=3.0.0",
     "rich>=14.0.0",
     "sqlalchemy[asyncio]>=2.0.41",

{stkit-17.2.5 → stkit-17.2.7}/stk/__init__.py

@@ -3,7 +3,7 @@ stk Framework
 A modern Python web framework optimized for AI-assisted development.
 """
 
-__version__ = "17.2.5"
+__version__ = "17.2.7"
 
 
 def __getattr__(name):

{stkit-17.2.5 → stkit-17.2.7}/stk/app.py

@@ -18,7 +18,7 @@ from quart import (
     send_from_directory,
     url_for,
 )
-from quart_security import Security, SQLAlchemyUserDatastore
+from quart_security import Security, SQLAlchemyUserDatastore, user_register_conflict
 from quart_security.views import _ensure_csrf_token
 from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
 from werkzeug.exceptions import HTTPException, NotFound
@@ -172,7 +172,7 @@ def register_extensions(app):
         except TimeoutError:
             app.logger.warning("Timed out while disposing SQLAlchemy engine")
 
-    from stk.security import register_security_controls
+    from stk.security import notify_register_conflict, register_security_controls
     from stk.utils.ratelimit import register_rate_limits
 
     register_rate_limits(app)
@@ -184,6 +184,7 @@ def register_extensions(app):
         register_form=ExtendedRegisterForm,
         change_password_form=OAuthAwareChangePasswordForm,
     )
+    user_register_conflict.connect(notify_register_conflict, sender=app, weak=False)
     # The library resets its session before loading the user. Share that session
     # so signals and application routes participate in the same transaction.
     app.before_request(_open_session)

{stkit-17.2.5 → stkit-17.2.7}/stk/cli/copy_rules.py

@@ -83,14 +83,17 @@ def uuid(text):
 
 
 def hex_id(text):
-    """6+ hex characters with at least two digits and a letter, alone or glued to a
-    word: 'Request 1fbaac41'. Uuids are their own rule."""
+    """6+ hex characters in one case with at least two digits and a letter, alone
+    or glued to a word: 'Request 1fbaac41'. Uuids are their own rule. Mixed case
+    is a name, not an id: 'Ed25519'."""
     text = UUID.sub(" ", text)
     out = []
     for m in HEX.finditer(text):
         token = m.group()
         if sum(c.isdigit() for c in token) < 2 or token.isdigit():
             continue
+        if token not in (token.lower(), token.upper()):
+            continue
         if HASH_LABEL.search(text[max(0, m.start() - 20) : m.start()]):
             continue
         out.append(_around(text, m))

{stkit-17.2.5 → stkit-17.2.7}/stk/cli/doctor.py

@@ -193,6 +193,18 @@ def _check_agent_login(config):
     )
 
 
+def _check_public_url(config):
+    env = config.get("STK_ENV", "production")
+    if env != "development" and not config.get("STK_PUBLIC_URL"):
+        return _finding(
+            "public url",
+            WARN,
+            f"STK_PUBLIC_URL unset with STK_ENV={env}: any Host header is accepted",
+            "set STK_PUBLIC_URL to the origin users visit, e.g. https://app.example.com",
+        )
+    return _finding("public url", OK, config.get("STK_PUBLIC_URL") or "development")
+
+
 def _check_browser():
     try:
         from playwright.sync_api import sync_playwright
@@ -244,6 +256,7 @@ def build_doctor_report():
             _check_migrations(app),
             _check_admin(),
             _check_agent_login(app.config),
+            _check_public_url(app.config),
         ]
     findings += [_check_assets(), _check_browser(), _check_repl()]
     if any(item["status"] == FAIL for item in findings):

{stkit-17.2.5 → stkit-17.2.7}/stk/files/__init__.py

@@ -8,10 +8,22 @@ from pathlib import Path
 
 
 def init_app(app):
-    from stk.files.views import SNIFFED, bp, can_read
+    from stk.files.views import MULTIPART_SLACK, SNIFFED, bp, can_read
 
     app.config.setdefault("STK_UPLOAD_DIR", str(Path(app.instance_path) / "files"))
     app.config.setdefault("STK_UPLOAD_MAX_BYTES", 10 * 1024 * 1024)
+    # Quart caps every request body at MAX_CONTENT_LENGTH before a view runs, so
+    # a larger upload limit would never take effect.
+    limit, body_max = (
+        app.config["STK_UPLOAD_MAX_BYTES"],
+        app.config["MAX_CONTENT_LENGTH"],
+    )
+    if body_max is not None and limit + MULTIPART_SLACK > body_max:
+        raise ValueError(
+            f"STK_UPLOAD_MAX_BYTES ({limit}) plus {MULTIPART_SLACK} bytes of"
+            f" multipart framing exceeds MAX_CONTENT_LENGTH ({body_max}): raise"
+            " MAX_CONTENT_LENGTH or lower STK_UPLOAD_MAX_BYTES"
+        )
     app.config.setdefault(
         "STK_UPLOAD_TYPES",
         ("image/png", "image/jpeg", "image/gif", "image/webp", "application/pdf"),

{stkit-17.2.5 → stkit-17.2.7}/stk/security.py

@@ -124,6 +124,31 @@ def register_security_controls(app):
         return response
 
 
+async def notify_register_conflict(app, user):
+    """Tell an account's owner that someone tried to register with their email.
+
+    Registration answers as if it succeeded, so this mail is the owner's only
+    sign. It goes out in the background: waiting on SMTP would make this one
+    response slower and reveal the account. Links come from STK_PUBLIC_URL,
+    never the request's Host header, which the sender controls."""
+    if not app.config.get("MAIL_SERVER"):
+        app.logger.warning("Sign-up attempt for an existing account: no MAIL_SERVER")
+        return
+    from stk.utils.email import send_email
+
+    public_url = app.config.get("STK_PUBLIC_URL")
+    where = f" at {public_url}" if public_url else ""
+    sign_in = f"\n\nSign in at {public_url.rstrip('/')}/login" if public_url else ""
+    body = (
+        f"Someone tried to create a {app.config['APP_NAME']} account{where} with"
+        " this email address. You already have one, so nothing changed."
+        f"{sign_in}\n\nIf it was not you, you can ignore this email."
+    )
+    app.add_background_task(
+        send_email, "Sign-up attempt with your email", user.email, body
+    )
+
+
 async def check_password_policy(password):
     from quart import current_app
 

{stkit-17.2.5 → stkit-17.2.7}/tests/test_cli.py

@@ -55,6 +55,16 @@ if __name__ == "__main__":
     unittest.main()
 
 
+class PublicUrlDoctorTest(unittest.TestCase):
+    def test_warns_only_outside_development_without_a_public_url(self):
+        from stk.cli.doctor import _check_public_url
+
+        self.assertEqual(_check_public_url({})["status"], "warn")
+        self.assertEqual(_check_public_url({"STK_ENV": "development"})["status"], "ok")
+        set_url = {"STK_PUBLIC_URL": "https://app.example.com"}
+        self.assertEqual(_check_public_url(set_url)["status"], "ok")
+
+
 class DowngradeArgumentTest(unittest.TestCase):
     def test_relative_revision_is_accepted(self):
         with patch("stk.cli.database.run_alembic") as run:

{stkit-17.2.5 → stkit-17.2.7}/tests/test_copy_rules.py

@@ -31,9 +31,11 @@ class CopyRuleTests(unittest.TestCase):
     def test_hex_id(self):
         self.assertRule(
             hex_id,
-            ["Request 1fbaac41 failed", "texteb148f8f"],
+            ["Request 1fbaac41 failed", "texteb148f8f", "Build 1FBAAC41"],
             [
                 "SHA-256: 9f86d081884c7d65",
+                "Every run gets a fresh Ed25519 key",
+                "a facade from a decade ago",
                 "Total 1234567",
                 "Accepted",
                 "Owner 3f2b8c1e-9a4d-4e2f-8b1c-0d9e7f6a5b4c",

{stkit-17.2.5 → stkit-17.2.7}/tests/test_files.py

@@ -82,6 +82,19 @@ class FilesTests(unittest.IsolatedAsyncioTestCase):
     def stored(self):
         return sorted(p.name for p in Path(self.dir.name).rglob("*") if p.is_file())
 
+    def test_upload_limit_above_the_body_limit_refuses_to_start(self):
+        class Config(TestingConfig):
+            STK_UPLOAD_DIR = self.dir.name
+            STK_UPLOAD_MAX_BYTES = 20 * 1024 * 1024
+
+        with self.assertRaisesRegex(ValueError, "MAX_CONTENT_LENGTH"):
+            Stk(__name__, config=Config, extensions=[stk.files])
+
+        class Raised(Config):
+            MAX_CONTENT_LENGTH = 21 * 1024 * 1024
+
+        Stk(__name__, config=Raised, extensions=[stk.files])
+
     async def test_same_bytes_are_stored_once(self):
         alice, bob = await self.client(), await self.client("bob@example.com")
         data = png()

{stkit-17.2.5 → stkit-17.2.7}/tests/test_security_compatibility.py

@@ -146,5 +146,34 @@ class SecurityCompatibilityTests(unittest.IsolatedAsyncioTestCase):
         )
         self.assertNotEqual((await second.get("/dashboard/")).status_code, 200)
 
+    async def test_registering_an_existing_email_mails_the_owner_in_background(self):
+        self.app.config.update(
+            SECURITY_REGISTERABLE=True,
+            MAIL_SERVER="smtp.example.com",
+            STK_PUBLIC_URL="http://localhost",
+        )
+        queued = []
+        self.app.add_background_task = lambda func, *args: queued.append(args)
+        client = self.app.test_client()
+        await client.get("/login")
+        async with client.session_transaction() as cookie:
+            csrf = cookie["_csrf_token"]
+        form = {
+            "email": "USER@example.com",
+            "password": "AnotherPassword123!",
+            "password_confirm": "AnotherPassword123!",
+            "csrf_token": csrf,
+        }
+        response = await client.post("/register", form=form)
+        self.assertEqual(response.status_code, 302)
+        self.assertEqual(len(queued), 1)
+        subject, recipient, body = queued[0]
+        self.assertEqual(recipient, "user@example.com")
+        self.assertIn("http://localhost/login", body)
+        # A forged Host header never reaches the mail's links.
+        self.app.config["STK_PUBLIC_URL"] = None
+        await client.post("/register", form=form, headers={"Host": "evil.example"})
+        self.assertNotIn("evil.example", queued[1][2])
+
     def test_cookie_setting_preserves_local_http_support(self):
         self.assertFalse(self.app.config["SESSION_COOKIE_SECURE"])