supython 0.1.11__tar.gz → 0.1.12__tar.gz

{supython-0.1.11 → supython-0.1.12}/.gitignore

@@ -23,6 +23,7 @@ htmlcov/
 # dev-app/ is the dogfooded scaffolded project living inside the lib repo.
 # Its checked-in shape (compose files, functions, storage fixtures) mirrors
 # what `supython init` would produce; runtime state stays untracked.
+dev-app/
 dev-app/.env
 dev-app/.supython/
 dev-app/backups/

{supython-0.1.11 → supython-0.1.12}/CHANGELOG.md

@@ -30,6 +30,26 @@ Each entry links the relevant `PROJECT.md` section and decision-log row
 
 ---
 
+## [0.1.12] — 2026-07-01
+
+### Fixed
+
+- `RequestLoggingMiddleware` no longer truncates request bodies larger than
+  `_REQUEST_LOG_MAX_BODY_BYTES` (10 KiB) before they reach the application. It
+  had eagerly drained the whole body, kept only the first 10 KiB for the 5xx
+  log copy, then replayed *that truncated buffer* to the app — so every request
+  with a larger body was silently corrupted before the handler saw it: multipart
+  uploads lost their trailing bytes and closing boundary (Starlette then dropped
+  the file part, surfacing as a misleading `a multipart 'file' part is required`
+  400), and large JSON payloads were cut mid-document. The middleware now **tees**
+  the body — forwarding each ASGI message to the app untouched while copying only
+  a bounded prefix aside for logging — so the stream stays intact, true streaming
+  (storage/functions) is never buffered whole, and `http.disconnect` still
+  propagates for streaming-response hangup detection. The logged `request_body`
+  now reflects the bytes the app actually consumed. (#5)
+
+---
+
 ## [0.1.11] — 2026-06-13
 
 Project-initialization ergonomics. `supython init` now produces a project that
@@ -298,6 +318,7 @@ v0.1–v0.7 plus a v1.1.x admin track; see §19 decision log
 ---
 
 
+[0.1.12]: https://github.com/Tkeby/supython/releases/tag/v0.1.12
 [0.1.11]: https://github.com/Tkeby/supython/releases/tag/v0.1.11
 [0.1.10]: https://github.com/Tkeby/supython/releases/tag/v0.1.10
 [0.1.9]: https://github.com/Tkeby/supython/releases/tag/v0.1.9

{supython-0.1.11 → supython-0.1.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: supython
-Version: 0.1.11
+Version: 0.1.12
 Summary: A lightweight Postgres-first BaaS framework for Python
 Project-URL: Homepage, https://github.com/Tkeby/supython
 Project-URL: Repository, https://github.com/Tkeby/supython

{supython-0.1.11 → supython-0.1.12}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "supython"
-version = "0.1.11"
+version = "0.1.12"
 description = "A lightweight Postgres-first BaaS framework for Python"
 readme = "README.md"
 requires-python = ">=3.11"

{supython-0.1.11 → supython-0.1.12}/src/supython/logging_config.py

@@ -179,18 +179,29 @@ class RequestLoggingMiddleware:
 
         rid = get_request_id()
 
+        # Capture a bounded prefix of the request body for diagnostic logging
+        # WITHOUT altering the byte stream the inner app receives. Each ASGI
+        # message is forwarded through untouched while up to
+        # _REQUEST_LOG_MAX_BODY_BYTES is copied aside for the log record.
+        #
+        # This must never pre-read or rewrite the body. The previous approach
+        # eagerly drained the whole request, kept only the first
+        # _REQUEST_LOG_MAX_BODY_BYTES, then replayed *that truncated buffer* to
+        # the app — silently corrupting every request whose body exceeded the
+        # cap (multipart file uploads, large JSON payloads: the trailing bytes,
+        # and with them the multipart closing boundary, never reached the
+        # handler). Teeing keeps the stream intact, preserves true streaming
+        # (storage/functions are never buffered whole), and still forwards
+        # http.disconnect so streaming responses can detect client hangups.
         body_chunks: list[bytes] = []
         body_size = 0
         body_truncated = False
 
-        async def _drain_body() -> None:
+        async def _receive() -> dict[str, Any]:
             nonlocal body_size, body_truncated
-            while True:
-                msg = await receive()
-                if msg["type"] != "http.request":
-                    continue
+            msg = await receive()
+            if msg["type"] == "http.request":
                 chunk = msg.get("body", b"")
-                more = msg.get("more_body", False)
                 if chunk and body_size < _REQUEST_LOG_MAX_BODY_BYTES:
                     space = _REQUEST_LOG_MAX_BODY_BYTES - body_size
                     if len(chunk) > space:
@@ -200,29 +211,7 @@ class RequestLoggingMiddleware:
                     else:
                         body_chunks.append(chunk)
                         body_size += len(chunk)
-                if not more:
-                    break
-
-        await _drain_body()
-
-        full_body = b"".join(body_chunks)
-        body_consumed = False
-
-        async def _receive() -> dict[str, Any]:
-            nonlocal body_consumed
-            if not body_consumed:
-                body_consumed = True
-                return {
-                    "type": "http.request",
-                    "body": full_body,
-                    "more_body": False,
-                }
-            # Body already delivered. Forward subsequent calls to the real
-            # receive() so callers awaiting http.disconnect (e.g. Starlette's
-            # StreamingResponse.listen_for_disconnect) actually block on the
-            # event loop instead of busy-looping on synchronous returns,
-            # which would starve the streaming task and hang the request.
-            return await receive()
+            return msg
 
         status_code: int = 0
         response_size: int = 0
@@ -270,6 +259,9 @@ class RequestLoggingMiddleware:
             is_server_error = 500 <= status_code < 600 or exc_info is not None
 
             if is_server_error:
+                # The bounded prefix the app actually consumed (see the tee in
+                # _receive above); empty if the handler errored before reading.
+                full_body = b"".join(body_chunks)
                 fields["request_body"] = full_body.decode("utf-8", errors="replace")
                 if body_truncated:
                     fields["body_truncated"] = True