tigrbl 0.3.13.dev1__tar.gz → 0.3.14.dev1__tar.gz

{tigrbl-0.3.13.dev1 → tigrbl-0.3.14.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tigrbl
-Version: 0.3.13.dev1
+Version: 0.3.14.dev1
 Summary: A modern pure ASGI/WSGI Python framework for building schema-first REST and JSON-RPC APIs with SQLAlchemy models, typed validation, lifecycle hooks, and engine extension support.
 License-Expression: Apache-2.0
 License-File: LICENSE

{tigrbl-0.3.13.dev1 → tigrbl-0.3.14.dev1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tigrbl"
-version = "0.3.13.dev1"
+version = "0.3.14.dev1"
 description = "A modern pure ASGI/WSGI Python framework for building schema-first REST and JSON-RPC APIs with SQLAlchemy models, typed validation, lifecycle hooks, and engine extension support."
 license = "Apache-2.0"
 readme = "README.md"

{tigrbl-0.3.13.dev1 → tigrbl-0.3.14.dev1}/tigrbl/api/tigrbl_api.py

@@ -213,6 +213,7 @@ class TigrblApi(_Api):
     def mount_jsonrpc(self, *, prefix: str | None = None) -> Any:
         """Mount a JSON-RPC router onto this TigrblApi instance."""
         px = prefix if prefix is not None else self.jsonrpc_prefix
+        self.jsonrpc_prefix = px
         prov = _resolver.resolve_provider(api=self)
         get_db = prov.get_db if prov else None
         router = _mount_jsonrpc(

{tigrbl-0.3.13.dev1 → tigrbl-0.3.14.dev1}/tigrbl/app/tigrbl_app.py

@@ -428,6 +428,7 @@ class TigrblApp(_App):
     def mount_jsonrpc(self, *, prefix: str | None = None) -> Any:
         """Mount JSON-RPC router onto this app."""
         px = prefix if prefix is not None else self.jsonrpc_prefix
+        self.jsonrpc_prefix = px
         prov = _resolver.resolve_provider(api=self)
         get_db = prov.get_db if prov else None
         router = _mount_jsonrpc(

{tigrbl-0.3.13.dev1 → tigrbl-0.3.14.dev1}/tigrbl/bindings/rpc.py

@@ -20,6 +20,7 @@ from pydantic import BaseModel
 from ..op import OpSpec
 from ..op.types import PHASES
 from ..runtime import executor as _executor  # expects _invoke(request, db, phases, ctx)
+from ..runtime.status import HTTPException
 
 # Prefer Kernel phase-chains if available (atoms + system steps + hooks)
 try:
@@ -33,6 +34,65 @@ logger.debug("Loaded module v3/bindings/rpc")
 _Key = Tuple[str, str]  # (alias, target)
 
 
+_WRAPPER_KEYS = frozenset({"data", "payload", "body", "item"})
+
+
+def _schema_field_names(schema: Any) -> set[str]:
+    """Return top-level field names declared by a Pydantic schema class."""
+    if not schema or not inspect.isclass(schema) or not issubclass(schema, BaseModel):
+        return set()
+
+    fields = getattr(schema, "model_fields", None)
+    if not isinstance(fields, Mapping):
+        return set()
+
+    names: set[str] = set(fields.keys())
+    for field_name, field_info in fields.items():
+        alias = getattr(field_info, "alias", None)
+        if isinstance(alias, str) and alias:
+            names.add(alias)
+        validation_alias = getattr(field_info, "validation_alias", None)
+        if isinstance(validation_alias, str) and validation_alias:
+            names.add(validation_alias)
+    return names
+
+
+def _allowed_wrapper_keys(model: type, alias: str, target: str) -> set[str]:
+    """Wrapper-like names that are valid operation fields for this RPC method."""
+    schemas_root = getattr(model, "schemas", None)
+    alias_ns = getattr(schemas_root, alias, None) if schemas_root else None
+    if not alias_ns:
+        return set()
+
+    allowed = _schema_field_names(getattr(alias_ns, "in_", None))
+    if target.startswith("bulk_") and target != "bulk_delete":
+        allowed |= _schema_field_names(getattr(alias_ns, "in_item", None))
+    return allowed & set(_WRAPPER_KEYS)
+
+
+def _reject_wrapper_keys(payload: Any, *, allowed_keys: set[str] | None = None) -> None:
+    allowed = allowed_keys or set()
+
+    if isinstance(payload, Mapping):
+        disallowed = sorted(
+            k for k in payload if k in _WRAPPER_KEYS and k not in allowed
+        )
+        if disallowed:
+            raise HTTPException(
+                status_code=422,
+                detail={
+                    "reason": "Wrapper keys are not allowed; params must match the operation schema.",
+                    "disallowed_keys": disallowed,
+                },
+            )
+        return
+
+    if isinstance(payload, Sequence) and not isinstance(payload, (str, bytes)):
+        for item in payload:
+            if isinstance(item, Mapping):
+                _reject_wrapper_keys(item, allowed_keys=allowed)
+
+
 # Mapping with attribute-style access
 class AttrDict(dict):
     def __getattr__(self, item: str) -> Any:  # pragma: no cover - trivial
@@ -99,7 +159,12 @@ def _coerce_payload(payload: Any) -> Any:
     if isinstance(payload, Sequence) and not isinstance(payload, (str, bytes)):
         out: list[Any] = []
         for item in payload:
-            if isinstance(item, Mapping):
+            if isinstance(item, BaseModel):
+                try:
+                    out.append(item.model_dump(exclude_none=False))
+                except Exception:
+                    out.append(dict(item.__dict__))
+            elif isinstance(item, Mapping):
                 out.append(dict(item))
             else:
                 out.append(item)
@@ -263,8 +328,10 @@ def _build_rpc_callable(model: type, sp: OpSpec) -> Callable[..., Awaitable[Any]
         schemas_root = getattr(model, "schemas", None)
         alias_ns = getattr(schemas_root, alias, None)
         item_in_model = getattr(alias_ns, "in_item", None)
+        allowed_wrapper_keys = _allowed_wrapper_keys(model, alias, target)
 
         raw_payload = _coerce_payload(payload)
+        _reject_wrapper_keys(raw_payload, allowed_keys=allowed_wrapper_keys)
         if target == "bulk_delete" and not isinstance(raw_payload, Mapping):
             raw_payload = {"ids": raw_payload}
         if (

{tigrbl-0.3.13.dev1 → tigrbl-0.3.14.dev1}/tigrbl/system/docs/lens.py

@@ -7,6 +7,7 @@ from ...responses import Response
 
 
 TIGRBL_LENS_VERSION = "latest"
+TIGRBL_LENS_CSS_URL = f"https://esm.sh/@tigrbljs/tigrbl-lens@{TIGRBL_LENS_VERSION}/dist/tigrbl-lens.css?css"
 
 
 def _with_leading_slash(path: str) -> str:
@@ -25,7 +26,7 @@ def build_lens_html(router: Any, request: Any, *, spec_path: str) -> str:
     <title>{router.title} — Lens</title>
     <link
       rel="stylesheet"
-      href="https://esm.sh/@tigrbljs/tigrbl-lens@{TIGRBL_LENS_VERSION}/dist/tigrbl-lens.css"
+      href="{TIGRBL_LENS_CSS_URL}"
     />
     <style>
       html, body, #root {{
@@ -79,7 +80,8 @@ def mount_lens(
 ) -> Any:
     """Mount a tigrbl-lens HTML endpoint onto ``router``."""
 
-    resolved_spec_path = spec_path or "/openrpc.json"
+    resolved_spec_path = spec_path or getattr(router, "openrpc_path", "/openrpc.json")
+    resolved_spec_path = _with_leading_slash(resolved_spec_path)
 
     def _lens_handler(request: Any) -> Response:
         return Response.html(

{tigrbl-0.3.13.dev1 → tigrbl-0.3.14.dev1}/tigrbl/system/docs/openapi/schema.py

@@ -24,6 +24,9 @@ def openapi(router: Any) -> dict[str, Any]:
             continue
 
         canonical_path = route.path_template.rstrip("/") or "/"
+        if canonical_path == "/openrpc.json" or route.name == "openrpc_json":
+            continue
+
         path_item = paths.setdefault(canonical_path, {})
         for method in sorted(route.methods):
             status_code = route.status_code or status.HTTP_200_OK

{tigrbl-0.3.13.dev1 → tigrbl-0.3.14.dev1}/tigrbl/system/docs/openrpc.py

@@ -179,12 +179,14 @@ def mount_openrpc(
     """Mount an OpenRPC JSON endpoint onto ``router`` or ``api``."""
 
     target_router = router if router is not None else api
+    normalized_path = _with_leading_slash(path)
+    setattr(api, "openrpc_path", normalized_path)
 
     def _openrpc_endpoint(request: Any) -> Response:
         return Response.json(build_openrpc_spec(api, request=request))
 
     target_router.add_api_route(
-        path,
+        normalized_path,
         _openrpc_endpoint,
         methods=["GET"],
         name=name,

{tigrbl-0.3.13.dev1 → tigrbl-0.3.14.dev1}/tigrbl/transport/__init__.py

@@ -71,10 +71,13 @@ def mount_jsonrpc(
         Optional tags applied to the mounted "/rpc" endpoint. Defaults to
         ``("rpc",)``.
     """
+    normalized_prefix = prefix if str(prefix).startswith("/") else f"/{prefix}"
+    setattr(api, "jsonrpc_prefix", normalized_prefix.rstrip("/") or "/")
+
     router = build_jsonrpc_router(api, get_db=get_db, tags=tags)
     include_router = getattr(app, "include_router", None)
     if callable(include_router):
-        include_router(router, prefix=prefix)
+        include_router(router, prefix=normalized_prefix)
 
     return router
 

{tigrbl-0.3.13.dev1 → tigrbl-0.3.14.dev1}/tigrbl/transport/jsonrpc/helpers.py

@@ -35,7 +35,11 @@ def _normalize_params(params: Any) -> Any:
     if params is None:
         return {}
     if isinstance(params, Mapping):
-        return dict(params)
+        normalized = dict(params)
+        nested = normalized.get("params")
+        if set(normalized) == {"params"} and isinstance(nested, Mapping):
+            return dict(nested)
+        return normalized
     if isinstance(params, Sequence) and not isinstance(params, (str, bytes)):
         return list(params)
     raise HTTPException(