swiftpy-framework 0.1.0__py3-none-any.whl

swiftpy/http/middleware.py

@@ -0,0 +1,307 @@
+from __future__ import annotations
+
+import json
+import re
+import uuid
+from collections.abc import Awaitable, Callable, Sequence
+from typing import Any
+
+from swiftpy.core.config import Config, ConfigurationError
+from swiftpy.core.container import Container
+from swiftpy.core.context import Context
+from swiftpy.http.exceptions import ClientDisconnect
+from swiftpy.http.request import Request
+from swiftpy.http.response import Response
+
+Handler = Callable[..., Awaitable[Response]]
+
+_REQUEST_ID_RE = re.compile(r"^[A-Za-z0-9._\-:]{1,128}$")
+
+
+class Middleware:
+    async def handle(self, request: Request, next_handler: Handler) -> Response:
+        return await next_handler(request)
+
+
+class MiddlewarePipeline:
+    def __init__(
+        self, container: Container, middleware: Sequence[type[Middleware]]
+    ) -> None:
+        self.container = container
+        self.middleware = list(middleware)
+
+    def wrap(
+        self,
+        handler: Handler,
+        *,
+        exception_handler: Callable[[Exception, Request], Awaitable[Response]] | None = None,
+    ) -> Handler:
+        wrapped = handler
+
+        for middleware_cls in reversed(self.middleware):
+            current = wrapped
+
+            async def wrapped_handler(
+                request: Request,
+                *args: Any,
+                middleware_cls: type[Middleware] = middleware_cls,
+                current: Handler = current,
+                **kwargs: Any,
+            ) -> Response:
+                middleware = self.container.resolve(middleware_cls)
+
+                async def next_handler(req: Request) -> Response:
+                    if exception_handler is None:
+                        return await current(req, *args, **kwargs)
+                    try:
+                        return await current(req, *args, **kwargs)
+                    except ClientDisconnect:
+                        raise
+                    except Exception as exc:  # noqa: BLE001
+                        return await exception_handler(exc, req)
+
+                return await middleware.handle(request, next_handler)
+
+            wrapped = wrapped_handler
+
+        return wrapped
+
+
+class SecurityHeadersMiddleware(Middleware):
+    """
+    Opt-in middleware that attaches standard defensive HTTP security headers.
+    """
+
+    DEFAULT_HEADERS: tuple[tuple[str, str], ...] = (
+        ("X-Content-Type-Options", "nosniff"),
+        ("X-Frame-Options", "DENY"),
+        ("Referrer-Policy", "strict-origin-when-cross-origin"),
+        ("X-XSS-Protection", "0"),
+        ("Cross-Origin-Opener-Policy", "same-origin"),
+    )
+
+    async def handle(self, request: Request, next_handler: Handler) -> Response:
+        response = await next_handler(request)
+        for header_name, header_val in self.DEFAULT_HEADERS:
+            if header_name not in response.headers:
+                response.headers[header_name] = header_val
+        return response
+
+
+class RequestIdMiddleware(Middleware):
+    """
+    Opt-in middleware that assigns or propagates a validated `X-Request-ID` header
+    and stores `request_id` in `request.state` and `Context`.
+    """
+
+    HEADER_NAME: str = "X-Request-ID"
+
+    async def handle(self, request: Request, next_handler: Handler) -> Response:
+        incoming = request.headers.get(self.HEADER_NAME)
+        if incoming and _REQUEST_ID_RE.fullmatch(incoming):
+            request_id = incoming
+        else:
+            request_id = str(uuid.uuid4())
+
+        request.state["request_id"] = request_id
+        Context.set("request_id", request_id)
+
+        response = await next_handler(request)
+        response.headers[self.HEADER_NAME] = request_id
+        return response
+
+
+class CORSMiddleware(Middleware):
+    """
+    Opt-in Cross-Origin Resource Sharing (CORS) middleware configured via `config/cors.py`.
+    Defaults to deny-all (`allowed_origins = []`).
+    """
+
+    def __init__(self, config: Config) -> None:
+        self._config = config
+        self._parse_cors_settings()
+
+    def _get_cors_config(self) -> dict[str, Any]:
+        raw = self._config.get("cors", {})
+        return raw if isinstance(raw, dict) else {}
+
+    @staticmethod
+    def _normalize_list(
+        value: Any,
+        *,
+        default: Sequence[str] = (),
+        field: str = "",
+    ) -> list[str]:
+        if value is None:
+            return list(default)
+        if isinstance(value, str):
+            stripped = value.strip()
+            if not stripped:
+                return list(default) if default else []
+            if stripped.startswith("[") and stripped.endswith("]"):
+                try:
+                    parsed = json.loads(stripped)
+                except (json.JSONDecodeError, ValueError) as exc:
+                    raise ConfigurationError(
+                        f"CORS configuration field '{field}' contains invalid JSON list: '{value}'"
+                    ) from exc
+                if not isinstance(parsed, list):
+                    raise ConfigurationError(
+                        f"CORS configuration field '{field}' expects a JSON array"
+                    )
+                items = [str(item).strip() for item in parsed if str(item).strip()]
+            else:
+                items = [item.strip() for item in stripped.split(",") if item.strip()]
+            return items if items or not default else list(default)
+        if isinstance(value, (list, tuple, set)):
+            items = [str(item).strip() for item in value if str(item).strip()]
+            return items if items or not default else list(default)
+        raise ConfigurationError(
+            f"CORS configuration field '{field}' must be a sequence or comma-separated string, got {type(value).__name__}"
+        )
+
+    @staticmethod
+    def _normalize_bool(value: Any, default: bool = False) -> bool:
+        if value is None:
+            return default
+        if isinstance(value, bool):
+            return value
+        if isinstance(value, str):
+            return value.strip().lower() in ("true", "1", "yes", "on")
+        return bool(value)
+
+    def _parse_cors_settings(
+        self,
+    ) -> tuple[list[str], list[str], list[str], list[str], bool, int | None]:
+        cfg = self._get_cors_config()
+        allowed_origins = self._normalize_list(
+            cfg.get("allowed_origins"),
+            field="allowed_origins",
+        )
+        allowed_methods = self._normalize_list(
+            cfg.get("allowed_methods"),
+            default=("GET", "HEAD", "POST"),
+            field="allowed_methods",
+        )
+        allowed_headers = self._normalize_list(
+            cfg.get("allowed_headers"),
+            field="allowed_headers",
+        )
+        expose_headers = self._normalize_list(
+            cfg.get("expose_headers"),
+            field="expose_headers",
+        )
+        allow_credentials = self._normalize_bool(
+            cfg.get("allow_credentials"),
+            default=False,
+        )
+        if "*" in allowed_origins and allow_credentials:
+            raise ConfigurationError(
+                "Invalid CORS configuration: 'allowed_origins' cannot include '*' when 'allow_credentials' is True."
+            )
+        max_age: int | None = (
+            int(cfg["max_age"]) if cfg.get("max_age") is not None else 600
+        )
+        return (
+            allowed_origins,
+            allowed_methods,
+            allowed_headers,
+            expose_headers,
+            allow_credentials,
+            max_age,
+        )
+
+    @staticmethod
+    def _is_origin_allowed(origin: str, allowed_origins: Sequence[str]) -> bool:
+        if not allowed_origins:
+            return False
+        if "*" in allowed_origins:
+            return True
+        return origin in allowed_origins
+
+    async def handle(self, request: Request, next_handler: Handler) -> Response:
+        (
+            allowed_origins,
+            allowed_methods,
+            allowed_headers,
+            expose_headers,
+            allow_credentials,
+            max_age,
+        ) = self._parse_cors_settings()
+
+        origin = request.headers.get("origin")
+        if not origin:
+            return await next_handler(request)
+
+        is_preflight = (
+            request.method.upper() == "OPTIONS"
+            and "access-control-request-method" in request.headers
+        )
+        origin_allowed = self._is_origin_allowed(origin, allowed_origins)
+
+        if is_preflight:
+            if not origin_allowed:
+                return Response(b"", status_code=204)
+
+            headers: dict[str, str] = {}
+            if "*" in allowed_origins and not allow_credentials:
+                headers["Access-Control-Allow-Origin"] = "*"
+            else:
+                headers["Access-Control-Allow-Origin"] = origin
+                headers["Vary"] = "Origin"
+
+            headers["Access-Control-Allow-Methods"] = ", ".join(allowed_methods)
+            if allowed_headers:
+                if "*" in allowed_headers:
+                    req_hdrs = request.headers.get("access-control-request-headers")
+                    if req_hdrs:
+                        headers["Access-Control-Allow-Headers"] = req_hdrs
+                else:
+                    headers["Access-Control-Allow-Headers"] = ", ".join(allowed_headers)
+
+            if allow_credentials:
+                headers["Access-Control-Allow-Credentials"] = "true"
+            if max_age is not None:
+                headers["Access-Control-Max-Age"] = str(max_age)
+
+            return Response(b"", status_code=204, headers=headers)
+
+        response = await next_handler(request)
+        if not origin_allowed:
+            return response
+
+        if "*" in allowed_origins and not allow_credentials:
+            response.headers["Access-Control-Allow-Origin"] = "*"
+        else:
+            response.headers["Access-Control-Allow-Origin"] = origin
+            existing_vary = response.headers.get("Vary")
+            if not existing_vary:
+                response.headers["Vary"] = "Origin"
+            elif "Origin" not in [v.strip() for v in existing_vary.split(",")]:
+                response.headers["Vary"] = f"{existing_vary}, Origin"
+
+        if allow_credentials:
+            response.headers["Access-Control-Allow-Credentials"] = "true"
+        if expose_headers:
+            response.headers["Access-Control-Expose-Headers"] = ", ".join(
+                expose_headers
+            )
+
+        return response
+
+
+SecurityHeaders = SecurityHeadersMiddleware
+RequestId = RequestIdMiddleware
+CORS = CORSMiddleware
+
+__all__ = [
+    "CORS",
+    "CORSMiddleware",
+    "Handler",
+    "Middleware",
+    "MiddlewarePipeline",
+    "RequestId",
+    "RequestIdMiddleware",
+    "SecurityHeaders",
+    "SecurityHeadersMiddleware",
+]

swiftpy/http/request.py

@@ -0,0 +1,375 @@
+from __future__ import annotations
+
+import json
+from collections.abc import AsyncIterator, Iterator, Mapping
+from typing import Any, cast
+from urllib.parse import parse_qs
+
+from swiftpy.core.config import Config
+from swiftpy.core.container import get_container
+from swiftpy.filesystem.uploads.handlers import FormData, MultipartParser
+from swiftpy.filesystem.uploads.uploaded_file import UploadedFile
+from swiftpy.http.exceptions import (
+    ClientDisconnect,
+    HttpException,
+    PayloadTooLargeError,
+)
+
+DEFAULT_MAX_BODY_SIZE: int = 2 * 1024 * 1024  # 2 MiB
+DEFAULT_MAX_CONTENT_LENGTH: int = 2 * 1024 * 1024  # 2 MiB
+DEFAULT_MAX_JSON_DEPTH: int = 32
+
+
+def _validate_json_depth(
+    obj: Any,
+    current_depth: int = 1,
+    max_depth: int = DEFAULT_MAX_JSON_DEPTH,
+) -> None:
+    """Validate iteratively that nested JSON structures do not exceed maximum nesting depth."""
+    stack: list[tuple[Any, int]] = [(obj, current_depth)]
+    while stack:
+        node, depth = stack.pop()
+        if depth > max_depth:
+            raise HttpException(
+                f"JSON payload exceeds maximum allowed depth of {max_depth}",
+                status_code=400,
+            )
+        if isinstance(node, dict):
+            next_depth = depth + 1
+            for val in node.values():
+                if isinstance(val, (dict, list)):
+                    stack.append((val, next_depth))
+        elif isinstance(node, list):
+            next_depth = depth + 1
+            for item in node:
+                if isinstance(item, (dict, list)):
+                    stack.append((item, next_depth))
+
+
+class RequestHeaders(Mapping[str, str]):
+    """
+    Case-insensitive, immutable HTTP request header container decoded as latin-1 per ASGI spec.
+    Preserves duplicate headers via `.getlist(name)` while using last-wins semantics for
+    dict-style single-value lookups (`headers[name]`, `headers.get(name)`).
+    """
+
+    __slots__ = ("_by_lower", "_items", "_list_by_lower")
+
+    def __init__(self, raw_headers: list[tuple[bytes, bytes]] | None = None) -> None:
+        items: list[tuple[str, str]] = []
+        by_lower: dict[str, str] = {}
+        list_by_lower: dict[str, list[str]] = {}
+
+        for raw_k, raw_v in raw_headers or ():
+            key = raw_k.decode("latin-1")
+            val = raw_v.decode("latin-1")
+            lower_key = key.lower()
+            items.append((key, val))
+            by_lower[lower_key] = val
+            list_by_lower.setdefault(lower_key, []).append(val)
+
+        self._items: list[tuple[str, str]] = items
+        self._by_lower: dict[str, str] = by_lower
+        self._list_by_lower: dict[str, list[str]] = list_by_lower
+
+    def __getitem__(self, name: str) -> str:
+        lower = name.lower()
+        if lower not in self._by_lower:
+            raise KeyError(name)
+        return self._by_lower[lower]
+
+    def __iter__(self) -> Iterator[str]:
+        return iter(self._by_lower)
+
+    def __len__(self) -> int:
+        return len(self._by_lower)
+
+    def __contains__(self, name: object) -> bool:
+        if not isinstance(name, str):
+            return False
+        return name.lower() in self._by_lower
+
+    def getlist(self, name: str) -> list[str]:
+        """Return all values for `name` (case-insensitive) in arrival order."""
+        return list(self._list_by_lower.get(name.lower(), ()))
+
+    def raw_items(self) -> list[tuple[str, str]]:
+        """Return all `(name, value)` header pairs in arrival order."""
+        return list(self._items)
+
+
+class Request:
+    def __init__(
+        self,
+        scope: dict[str, Any],
+        receive: Any,
+        *,
+        max_body_size: int = DEFAULT_MAX_BODY_SIZE,
+        max_content_length: int | None = None,
+        max_json_depth: int = DEFAULT_MAX_JSON_DEPTH,
+    ) -> None:
+        self.scope = scope
+        self._receive = receive
+        self.max_body_size = max_body_size
+        self.max_content_length = max_content_length
+        self.max_json_depth = max_json_depth
+
+        self._headers: RequestHeaders | None = None
+        self._query_params: dict[str, str] | None = None
+        self._query_param_list: dict[str, list[str]] | None = None
+        self._body: bytes | None = None
+        self._json: Any = None
+        self._json_parsed: bool = False
+        self._form: FormData | None = None
+
+        self.state: dict[str, Any] = {}
+
+    @property
+    def method(self) -> str:
+        return cast(str, self.scope["method"])
+
+    @property
+    def path(self) -> str:
+        return cast(str, self.scope["path"])
+
+    @property
+    def headers(self) -> RequestHeaders:
+        if self._headers is None:
+            self._headers = RequestHeaders(self.scope.get("headers", []))
+        return self._headers
+
+    @property
+    def query_param_list(self) -> dict[str, list[str]]:
+        """Parsed dictionary of URL query string parameters with all values as lists (cached)."""
+        if self._query_param_list is None:
+            raw_qs: bytes = self.scope.get("query_string", b"")
+            if not raw_qs:
+                self._query_param_list = {}
+            else:
+                decoded = raw_qs.decode("utf-8", errors="replace")
+                self._query_param_list = parse_qs(
+                    decoded,
+                    keep_blank_values=True,
+                    encoding="utf-8",
+                    errors="replace",
+                )
+        return self._query_param_list
+
+    @property
+    def query_params(self) -> dict[str, str]:
+        """Parsed dictionary of URL query string parameters (first value for each key, cached)."""
+        if self._query_params is None:
+            self._query_params = {
+                k: v[0] for k, v in self.query_param_list.items() if v
+            }
+        return self._query_params
+
+    async def body(self, *, max_size: int | None = None) -> bytes:
+        limit = max_size if max_size is not None else self.max_body_size
+
+        content_length_values = self.headers.getlist("content-length")
+        if content_length_values:
+            parsed_lengths: list[int] = []
+            for raw_cl in content_length_values:
+                try:
+                    parsed_cl = int(raw_cl)
+                except ValueError:
+                    raise HttpException(
+                        "Invalid Content-Length header", status_code=400
+                    ) from None
+                if parsed_cl < 0:
+                    raise HttpException(
+                        "Invalid Content-Length header", status_code=400
+                    )
+                parsed_lengths.append(parsed_cl)
+            if len(content_length_values) > 1 and (
+                len(set(parsed_lengths)) > 1
+                or len({val.strip() for val in content_length_values}) > 1
+            ):
+                raise HttpException(
+                    "Conflicting Content-Length headers", status_code=400
+                )
+            content_length = parsed_lengths[0]
+            cl_limit = (
+                self.max_content_length
+                if self.max_content_length is not None
+                else limit
+            )
+            if cl_limit is not None and content_length > cl_limit:
+                raise PayloadTooLargeError(
+                    f"Request content length exceeds maximum size of {cl_limit} bytes"
+                )
+            if limit is not None and content_length > limit:
+                raise PayloadTooLargeError(
+                    f"Request body exceeds maximum size of {limit} bytes"
+                )
+
+        if self._body is None:
+            chunks: list[bytes] = []
+            total_bytes = 0
+
+            while True:
+                message = await self._receive()
+                msg_type = message.get("type")
+
+                if msg_type == "http.disconnect":
+                    raise ClientDisconnect(
+                        "Client disconnected before request body was completely received"
+                    )
+
+                chunk: bytes = message.get("body", b"")
+                total_bytes += len(chunk)
+                if limit is not None and total_bytes > limit:
+                    raise PayloadTooLargeError(
+                        f"Request body exceeds maximum size of {limit} bytes"
+                    )
+
+                chunks.append(chunk)
+
+                if not message.get("more_body", False):
+                    break
+
+            self._body = b"".join(chunks)
+        elif limit is not None and len(self._body) > limit:
+            raise PayloadTooLargeError(
+                f"Request body exceeds maximum size of {limit} bytes"
+            )
+
+        return self._body
+
+    async def json(self) -> Any:
+        if not self._json_parsed:
+            raw_bytes = await self.body()
+            if not raw_bytes:
+                self._json = {}
+            else:
+                try:
+                    raw_text = raw_bytes.decode("utf-8")
+                    self._json = json.loads(raw_text) if raw_text else {}
+                except (
+                    UnicodeDecodeError,
+                    json.JSONDecodeError,
+                    RecursionError,
+                    ValueError,
+                ):
+                    raise HttpException(
+                        "Invalid JSON payload", status_code=400
+                    ) from None
+                _validate_json_depth(self._json, max_depth=self.max_json_depth)
+            self._json_parsed = True
+
+        return self._json
+
+    def _resolve_upload_limits(self) -> tuple[int, int, int, int, str | None]:
+        """Resolve upload parser limits from filesystems.uploads config and Request overrides."""
+        default_max_file = 100 * 1024 * 1024
+        default_max_req = 200 * 1024 * 1024
+        default_mem_limit = 1024 * 1024
+
+        uploads_cfg: Mapping[str, Any] | None = None
+        try:
+            container = get_container()
+            if container.has(Config):
+                cfg = container.resolve(Config)
+                raw_cfg = cfg.get("filesystems.uploads")
+                if isinstance(raw_cfg, Mapping):
+                    uploads_cfg = raw_cfg
+        except RuntimeError:
+            uploads_cfg = None
+
+        max_file_size = default_max_file
+        memory_limit = default_mem_limit
+        max_field_size = default_mem_limit
+        temp_dir: str | None = None
+        cfg_max_request: int | None = None
+
+        if uploads_cfg is not None:
+            raw_file_limit = uploads_cfg.get("max_file_size")
+            if isinstance(raw_file_limit, int) and not isinstance(raw_file_limit, bool) and raw_file_limit > 0:
+                max_file_size = raw_file_limit
+            raw_mem = uploads_cfg.get("memory_limit")
+            if isinstance(raw_mem, int) and not isinstance(raw_mem, bool) and raw_mem > 0:
+                memory_limit = raw_mem
+                max_field_size = memory_limit
+            raw_field_limit = uploads_cfg.get("max_field_size")
+            if isinstance(raw_field_limit, int) and not isinstance(raw_field_limit, bool) and raw_field_limit > 0:
+                max_field_size = raw_field_limit
+            raw_req_limit = uploads_cfg.get("max_request_size")
+            if isinstance(raw_req_limit, int) and not isinstance(raw_req_limit, bool) and raw_req_limit > 0:
+                cfg_max_request = raw_req_limit
+            raw_temp_dir = uploads_cfg.get("temp_dir")
+            if isinstance(raw_temp_dir, str) and raw_temp_dir.strip():
+                temp_dir = raw_temp_dir
+
+        if self.max_body_size != DEFAULT_MAX_BODY_SIZE and self.max_body_size is not None:
+            max_request_size = (
+                min(self.max_body_size, cfg_max_request)
+                if cfg_max_request is not None
+                else self.max_body_size
+            )
+        elif cfg_max_request is not None:
+            max_request_size = cfg_max_request
+        else:
+            max_request_size = (
+                self.max_body_size if self.max_body_size is not None else default_max_req
+            )
+
+        return max_file_size, max_request_size, memory_limit, max_field_size, temp_dir
+
+    async def form(self) -> FormData:
+        if self._form is None:
+            content_type = self.headers.get("content-type", "")
+            if "multipart/form-data" in content_type.lower():
+                boundary = MultipartParser.extract_boundary(content_type)
+                (
+                    max_file_size,
+                    max_request_size,
+                    memory_limit,
+                    max_field_size,
+                    temp_dir,
+                ) = self._resolve_upload_limits()
+                parser = MultipartParser(
+                    boundary,
+                    max_file_size=max_file_size,
+                    max_request_size=max_request_size,
+                    memory_limit=memory_limit,
+                    max_field_size=max_field_size,
+                    temp_dir=temp_dir,
+                )
+                if self._body is not None:
+                    async def _body_stream(raw: bytes) -> AsyncIterator[bytes]:
+                        chunk_size = 64 * 1024
+                        for i in range(0, len(raw), chunk_size):
+                            yield raw[i : i + chunk_size]
+
+                    self._form = await parser.parse(_body_stream(self._body))
+                else:
+                    self._form = await parser.parse(self._receive)
+            else:
+                raw_bytes = await self.body()
+                form_data = FormData()
+                if raw_bytes:
+                    decoded = raw_bytes.decode("utf-8", errors="replace")
+                    parsed = parse_qs(decoded, keep_blank_values=True)
+                    for k, vals in parsed.items():
+                        for v in vals:
+                            form_data.add_field(k, v)
+                self._form = form_data
+        return self._form
+
+    async def file(self, name: str) -> UploadedFile | None:
+        form_data = await self.form()
+        return form_data.get_file(name)
+
+    async def files(
+        self, name: str | None = None
+    ) -> list[UploadedFile] | dict[str, list[UploadedFile]]:
+        form_data = await self.form()
+        if name is not None:
+            return form_data.get_files(name)
+        return dict(form_data.files_list)
+
+    async def close(self) -> None:
+        if self._form is not None:
+            await self._form.close()
+            self._form = None