vortexpy 4.1.7__tar.gz → 4.2.0__tar.gz

vortexpy-4.2.0/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2016-2026 Flying Ion Pty Ltd
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

{vortexpy-4.1.7 → vortexpy-4.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vortexpy
-Version: 4.1.7
+Version: 4.2.0
 Summary: Flying Ion's observable, routable, data serialisation and transport code.
 Author-email: Flying Ion Pty Ltd <contact@flyingion.com>
 License: MIT

{vortexpy-4.1.7 → vortexpy-4.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "vortexpy"
-version = "4.1.7"
+version = "4.2.0"
 license = {text = "MIT"}
 authors = [{name = "Flying Ion Pty Ltd", email = "contact@flyingion.com"}]
 description = "Flying Ion's observable, routable, data serialisation and transport code."

{vortexpy-4.1.7 → vortexpy-4.2.0}/vortex/DeferUtil.py

@@ -8,6 +8,7 @@
 
 import inspect
 import logging
+import time
 from collections.abc import Callable
 from typing import ParamSpec, TypeVar
 
@@ -209,7 +210,27 @@ def deferToThreadWrapWithLogger(
                     "Deferring to a thread can only be done from the main thread"
                 )
 
-            d: Deferred[_R] = deferToThread(funcToWrap, *args, **kwargs)
+            def timedFuncToRun(*runArgs: _P.args, **runKwargs: _P.kwargs) -> _R:
+                startMonotonic = time.monotonic()
+                try:
+                    return funcToWrap(*runArgs, **runKwargs)
+                finally:
+                    durationMs = (time.monotonic() - startMonotonic) * 1000.0
+                    from vortex.twisted_runtime_metrics import (
+                        STACK_CAPTURE_THRESHOLD_MS,
+                        TwistedRuntimeMetrics,
+                    )
+
+                    methodFrame = None
+                    if durationMs >= STACK_CAPTURE_THRESHOLD_MS:
+                        methodFrame = TwistedRuntimeMetrics._captureWorkerThreadFrame()
+                    TwistedRuntimeMetrics._collector()._recordThreadedCall(
+                        funcToWrap.__qualname__,
+                        durationMs,
+                        methodFrame,
+                    )
+
+            d: Deferred[_R] = deferToThread(timedFuncToRun, *args, **kwargs)
             d.addCallback(checkForInlineCallbackYield)
             d.addErrback(vortexLogFailure, loggerArg, consumeError=consumeError)
             return d
@@ -225,13 +246,9 @@ def isMainThread():
 
 def noMainThread():
     if isMainThread():
-        raise Exception(
-            "Blocking operations shouldn't occur in the reactors thread."
-        )
+        raise Exception("Blocking operations shouldn't occur in the reactors thread.")
 
 
 def yesMainThread():
     if not isMainThread():
-        raise Exception(
-            "Async operations must occur in the reactors main thread."
-        )
+        raise Exception("Async operations must occur in the reactors main thread.")

vortexpy-4.2.0/vortex/DeferUtil_test.py

@@ -0,0 +1,86 @@
+# Copyright (c) 2016-2026 Flying Ion Pty Ltd
+# See LICENSE for the full license text.
+
+from __future__ import annotations
+
+import logging
+import time
+from collections.abc import Generator
+
+import pytest
+from pytest_twisted import ensureDeferred  # type: ignore[import-untyped]
+
+from vortex.DeferUtil import deferToThreadWrapWithLogger
+from vortex.twisted_runtime_metrics import TwistedRuntimeMetrics
+from vortex.twisted_runtime_metrics_test import (
+    utilResetTwistedRuntimeMetricsSingletonForTests,
+)
+
+logger = logging.getLogger(__name__)
+
+
+@deferToThreadWrapWithLogger(logger)
+def _deferUtilTestBlockingWork() -> str:
+    time.sleep(0.01)
+    return "done"
+
+
+@deferToThreadWrapWithLogger(logger)
+def _deferUtilTestSlowBlockingWork() -> str:
+    time.sleep(0.06)
+    return "slow-done"
+
+
+@pytest.fixture(autouse=True)
+def resetMetricsSingleton() -> Generator[None, None, None]:
+    utilResetTwistedRuntimeMetricsSingletonForTests()
+    yield
+    utilResetTwistedRuntimeMetricsSingletonForTests()
+
+
+@pytest.mark.twisted
+@ensureDeferred
+async def testDeferToThreadWrapWithLoggerRecordsThreadedCallTiming() -> None:
+    result = await _deferUtilTestBlockingWork()
+    assert result == "done", "deferred thread call must return worker result"
+
+    snapshot = TwistedRuntimeMetrics.snapshotAndResetWindow()
+    assert snapshot.threadedCallCount == 1, (
+        "defer hook must record one threaded call per invocation"
+    )
+    assert snapshot.longestThreadedMethodName == "_deferUtilTestBlockingWork", (
+        "defer hook must record wrapped function qualname"
+    )
+    assert snapshot.longestThreadedMethodMs >= 10.0, (
+        "defer hook must record at least sleep duration in ms"
+    )
+    assert snapshot.longestThreadedMethodFrame is None, (
+        "fast defer hook must not capture worker thread frame"
+    )
+
+
+@pytest.mark.twisted
+@ensureDeferred
+async def testDeferToThreadWrapWithLoggerCapturesSlowCallFrame() -> None:
+    result = await _deferUtilTestSlowBlockingWork()
+    assert result == "slow-done", "deferred slow thread call must return worker result"
+
+    snapshot = TwistedRuntimeMetrics.snapshotAndResetWindow()
+    assert snapshot.threadedCallCount == 1, (
+        "slow defer hook must record one threaded call"
+    )
+    assert snapshot.longestThreadedMethodName == "_deferUtilTestSlowBlockingWork", (
+        "slow defer hook must record wrapped function qualname"
+    )
+    assert snapshot.longestThreadedMethodMs >= 50.0, (
+        "slow defer hook must exceed stack capture threshold in ms"
+    )
+    assert snapshot.longestThreadedMethodFrame is not None, (
+        "slow defer hook must capture worker thread frame"
+    )
+    assert "DeferUtil.py" not in snapshot.longestThreadedMethodFrame, (
+        "captured frame must skip defer hook internals"
+    )
+    assert "twisted_runtime_metrics.py" not in snapshot.longestThreadedMethodFrame, (
+        "captured frame must skip metrics collector internals"
+    )

vortexpy-4.2.0/vortex/MtlsAuthorizedClientRegistry.py

@@ -0,0 +1,150 @@
+# Copyright (c) 2016-2026 Flying Ion Pty Ltd
+#
+# This software is open source; the MIT license applies.
+# See LICENSE for the full license text.
+#
+# Website : https://flyingion.com
+# Support : contact@flyingion.com
+
+"""Mutable authorized-client certificate set for mTLS server verification."""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+import threading
+from typing import NamedTuple
+
+from OpenSSL import crypto
+from txhttputil.util.PemUtil import parsePemBundleForTrustedPeers
+
+logger = logging.getLogger(name=__name__)
+
+
+class AuthorizedClientIdentity(NamedTuple):
+    """Metadata for one authorized mTLS client certificate."""
+
+    fingerprint: str
+    publicKeyAsn1: bytes
+    instanceId: str
+    ownerUsername: str
+    commonName: str
+
+
+class MtlsAuthorizedClientRegistry:
+    """Runtime-mutable allowlist of client certificate public keys.
+
+    Static PEM bundles can be loaded at startup; ``addAuthorizedClientCertificate``
+    and ``revokeAuthorizedClientCertificate`` mutate the set without restarting
+    the TLS listener when used with ``buildMtlsServerCertificateOptions``.
+    """
+
+    def __init__(self) -> None:
+        self._lock = threading.RLock()
+        self._byPublicKey: dict[bytes, AuthorizedClientIdentity] = {}
+        self._byFingerprint: dict[str, AuthorizedClientIdentity] = {}
+
+    def loadTrustedPeerBundle(self, bundle_file_path: str) -> int:
+        """Load client certificates from a PEM bundle into the registry.
+
+        :param bundle_file_path: Path to a PEM file with one or more client certs.
+        :return: Number of certificates added.
+        """
+        trusted_peer_certificates = parsePemBundleForTrustedPeers(bundle_file_path)
+        added = 0
+        for trusted_peer in trusted_peer_certificates:
+            cert_pem = trusted_peer.as_bytes()
+            fingerprint = self.addAuthorizedClientCertificate(
+                cert_pem,
+                instanceId="",
+                ownerUsername="",
+            )
+            if fingerprint:
+                added += 1
+        return added
+
+    def addAuthorizedClientCertificate(
+        self,
+        certificate_pem: bytes | str,
+        *,
+        instanceId: str = "",
+        ownerUsername: str = "",
+    ) -> str:
+        """Authorize a client certificate for future mTLS handshakes.
+
+        :param certificate_pem: PEM-encoded X.509 client certificate.
+        :param instanceId: Codie instance id (CN when issued by hub CA).
+        :param ownerUsername: OAuth username or operator id for audit logs.
+        :return: SHA-256 fingerprint prefix (hex) for the certificate.
+        """
+        if isinstance(certificate_pem, str):
+            certificate_pem = certificate_pem.encode("utf-8")
+
+        x509_cert = crypto.load_certificate(crypto.FILETYPE_PEM, certificate_pem)
+        public_key_asn1 = crypto.dump_publickey(
+            crypto.FILETYPE_ASN1, x509_cert.get_pubkey()
+        )
+        fingerprint = hashlib.sha256(
+            crypto.dump_certificate(crypto.FILETYPE_ASN1, x509_cert)
+        ).hexdigest()[:16]
+        subject = x509_cert.get_subject()
+        common_name = (
+            subject.CN.decode("utf-8")
+            if isinstance(subject.CN, bytes)
+            else str(subject.CN or "")
+        )
+        resolved_instance_id = instanceId or common_name
+        identity = AuthorizedClientIdentity(
+            fingerprint=fingerprint,
+            publicKeyAsn1=public_key_asn1,
+            instanceId=resolved_instance_id,
+            ownerUsername=ownerUsername,
+            commonName=common_name,
+        )
+        with self._lock:
+            self._byPublicKey[public_key_asn1] = identity
+            self._byFingerprint[fingerprint] = identity
+        logger.info(
+            "Authorized mTLS client cert fingerprint=%s instanceId=%s owner=%s cn=%s",
+            fingerprint,
+            resolved_instance_id,
+            ownerUsername or "(unknown)",
+            common_name,
+        )
+        return fingerprint
+
+    def revokeAuthorizedClientCertificate(self, fingerprint: str) -> bool:
+        """Remove a client certificate from the authorized set.
+
+        :param fingerprint: Value returned from ``addAuthorizedClientCertificate``.
+        :return: ``True`` when a certificate was removed.
+        """
+        with self._lock:
+            identity = self._byFingerprint.pop(fingerprint, None)
+            if identity is None:
+                return False
+            self._byPublicKey.pop(identity.publicKeyAsn1, None)
+        logger.info(
+            "Revoked mTLS client cert fingerprint=%s instanceId=%s owner=%s",
+            identity.fingerprint,
+            identity.instanceId,
+            identity.ownerUsername or "(unknown)",
+        )
+        return True
+
+    def isPublicKeyAuthorized(self, public_key_asn1: bytes) -> bool:
+        """Return whether a TLS peer public key is currently authorized."""
+        with self._lock:
+            return public_key_asn1 in self._byPublicKey
+
+    def getIdentityForPublicKey(
+        self, public_key_asn1: bytes
+    ) -> AuthorizedClientIdentity | None:
+        """Return audit metadata for an authorized peer public key."""
+        with self._lock:
+            return self._byPublicKey.get(public_key_asn1)
+
+    def listAuthorizedIdentities(self) -> list[AuthorizedClientIdentity]:
+        """Return a snapshot of all authorized client identities."""
+        with self._lock:
+            return list(self._byFingerprint.values())

vortexpy-4.2.0/vortex/MtlsAuthorizedClientRegistry_test.py

@@ -0,0 +1,75 @@
+# Copyright (c) 2016-2026 Flying Ion Pty Ltd
+#
+# This software is open source; the MIT license applies.
+# See LICENSE for the full license text.
+#
+# Website : https://flyingion.com
+# Support : contact@flyingion.com
+
+from __future__ import annotations
+
+import os
+
+import pytest
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.x509.oid import ExtendedKeyUsageOID, NameOID
+from datetime import datetime, timedelta, timezone
+from OpenSSL import crypto
+
+from vortex.MtlsAuthorizedClientRegistry import MtlsAuthorizedClientRegistry
+
+
+def _makeClientCertPem(common_name: str) -> bytes:
+    private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    subject = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, common_name)])
+    now = datetime.now(timezone.utc)
+    cert = (
+        x509.CertificateBuilder()
+        .subject_name(subject)
+        .issuer_name(subject)
+        .public_key(private_key.public_key())
+        .serial_number(x509.random_serial_number())
+        .not_valid_before(now)
+        .not_valid_after(now + timedelta(days=30))
+        .add_extension(
+            x509.ExtendedKeyUsage([ExtendedKeyUsageOID.CLIENT_AUTH]),
+            critical=False,
+        )
+        .sign(private_key, hashes.SHA256())
+    )
+    return cert.public_bytes(serialization.Encoding.PEM)
+
+
+def test_add_and_revoke_client_certificate() -> None:
+    registry = MtlsAuthorizedClientRegistry()
+    cert_pem = _makeClientCertPem("local-mac")
+    fingerprint = registry.addAuthorizedClientCertificate(
+        cert_pem,
+        instanceId="local-mac",
+        ownerUsername="operator",
+    )
+    assert fingerprint
+    x509_cert = crypto.load_certificate(crypto.FILETYPE_PEM, cert_pem)
+    public_key_asn1 = crypto.dump_publickey(
+        crypto.FILETYPE_ASN1, x509_cert.get_pubkey()
+    )
+    assert registry.isPublicKeyAuthorized(public_key_asn1)
+    identity = registry.getIdentityForPublicKey(public_key_asn1)
+    assert identity is not None
+    assert identity.instanceId == "local-mac"
+    assert identity.ownerUsername == "operator"
+    assert registry.revokeAuthorizedClientCertificate(fingerprint)
+    assert not registry.isPublicKeyAuthorized(public_key_asn1)
+
+
+def test_load_trusted_peer_bundle(tmp_path) -> None:
+    cert_pem = _makeClientCertPem("cloud-instance")
+    bundle_path = os.path.join(str(tmp_path), "trusted-peers.pem")
+    with open(bundle_path, "wb") as handle:
+        handle.write(cert_pem)
+    registry = MtlsAuthorizedClientRegistry()
+    added = registry.loadTrustedPeerBundle(bundle_path)
+    assert added == 1
+    assert len(registry.listAuthorizedIdentities()) == 1

vortexpy-4.2.0/vortex/MtlsServerSslOptions.py

@@ -0,0 +1,176 @@
+# Copyright (c) 2016-2026 Flying Ion Pty Ltd
+#
+# This software is open source; the MIT license applies.
+# See LICENSE for the full license text.
+#
+# Website : https://flyingion.com
+# Support : contact@flyingion.com
+
+"""Build Twisted server SSL options with a dynamic mTLS client allowlist."""
+
+from __future__ import annotations
+
+import logging
+from typing import Optional
+
+from OpenSSL import SSL, crypto
+from twisted.internet._sslverify import Certificate, KeyPair, TLSVersion
+from twisted.internet.ssl import CertificateOptions
+from twisted.python.randbytes import secureRandom
+from txhttputil.util.PemUtil import PrivateKeyWithFullChain
+
+from vortex.MtlsAuthorizedClientRegistry import MtlsAuthorizedClientRegistry
+
+logger = logging.getLogger(name=__name__)
+
+
+class _MtlsServerCertificateOptions(CertificateOptions):
+    """Server ``CertificateOptions`` with registry-backed client verification."""
+
+    def __init__(
+        self,
+        *,
+        authorized_client_registry: MtlsAuthorizedClientRegistry,
+        **kwargs,
+    ) -> None:
+        self._authorizedClientRegistry = authorized_client_registry
+        super().__init__(**kwargs)
+
+    def _makeContext(self):
+        ctx = self._contextFactory(self.method)
+        ctx.set_options(self._options)
+        ctx.set_mode(self._mode)
+
+        if self.certificate is not None and self.privateKey is not None:
+            ctx.use_certificate(self.certificate)
+            ctx.use_privatekey(self.privateKey)
+            for extra_cert in self.extraCertChain:
+                ctx.add_extra_chain_cert(extra_cert)
+            ctx.check_privatekey()
+
+        verify_flags = SSL.VERIFY_NONE
+        if self.verify:
+            verify_flags = SSL.VERIFY_PEER
+            if self.requireCertificate:
+                verify_flags |= SSL.VERIFY_FAIL_IF_NO_PEER_CERT
+            if self.verifyOnce:
+                verify_flags |= SSL.VERIFY_CLIENT_ONCE
+            self.trustRoot._addCACertsToContext(ctx)
+
+        registry = self._authorizedClientRegistry
+
+        def verifyCallback(
+            conn: SSL.Connection,
+            cert: crypto.X509,
+            errno: int,
+            depth: int,
+            preverify_ok: int,
+        ) -> int:
+            fail = 0
+
+            if depth != 0:
+                return preverify_ok
+
+            if preverify_ok == fail:
+                return preverify_ok
+
+            session_peer_public_key_bytes = crypto.dump_publickey(
+                crypto.FILETYPE_ASN1, cert.get_pubkey()
+            )
+            if not registry.isPublicKeyAuthorized(session_peer_public_key_bytes):
+                subject = cert.get_subject()
+                logger.error(
+                    "mTLS peer verify failed: certificate not authorized subject=%s",
+                    subject,
+                )
+                return fail
+
+            identity = registry.getIdentityForPublicKey(
+                session_peer_public_key_bytes
+            )
+            if identity is not None:
+                logger.info(
+                    "mTLS peer verified instanceId=%s owner=%s fingerprint=%s",
+                    identity.instanceId or "(unknown)",
+                    identity.ownerUsername or "(unknown)",
+                    identity.fingerprint,
+                )
+            return preverify_ok
+
+        ctx.set_verify(verify_flags, verifyCallback)
+        if self.verifyDepth is not None:
+            ctx.set_verify_depth(self.verifyDepth)
+
+        from binascii import hexlify
+
+        session_id_context = hexlify(secureRandom(7))
+        ctx.set_session_id(session_id_context)
+
+        if self.enableSessions:
+            ctx.set_session_cache_mode(SSL.SESS_CACHE_SERVER)
+        else:
+            ctx.set_session_cache_mode(SSL.SESS_CACHE_OFF)
+
+        if self.dhParameters:
+            ctx.load_tmp_dh(self.dhParameters._dhFile.path)
+        ctx.set_cipher_list(self._cipherString.encode("ascii"))
+
+        self._ecChooser.configureECDHCurve(ctx)
+
+        if self._acceptableProtocols:
+            from twisted.internet._sslverify import _setAcceptableProtocols
+
+            _setAcceptableProtocols(ctx, self._acceptableProtocols)
+
+        return ctx
+
+
+def buildMtlsServerCertificateOptions(
+    private_key_with_full_chain: PrivateKeyWithFullChain,
+    trust_root,
+    authorized_client_registry: MtlsAuthorizedClientRegistry,
+    *,
+    acceptable_protocols: Optional[list[bytes]] = None,
+    dh_parameters=None,
+) -> CertificateOptions:
+    """Build server TLS options with dynamic authorized-client verification.
+
+    Existing callers that pass a static trusted-peer PEM bundle should load
+    that bundle into ``authorized_client_registry`` first; runtime ``add`` /
+    ``revoke`` on the registry updates verification without rebuilding options.
+
+    :param private_key_with_full_chain: Server key + certificate chain PEM bank.
+    :param trust_root: Twisted trust root for client certificate chain validation.
+    :param authorized_client_registry: Mutable authorized client public keys.
+    :return: Twisted ``CertificateOptions`` for ``reactor.listenSSL``.
+    """
+    if acceptable_protocols is None:
+        acceptable_protocols = [b"http/1.1"]
+
+    twisted_loaded_chain = PrivateKeyWithFullChain(
+        privateKey=KeyPair.load(
+            private_key_with_full_chain.privateKey.as_bytes(), crypto.FILETYPE_PEM
+        ).original,
+        certificate=Certificate.loadPEM(
+            private_key_with_full_chain.certificate.as_bytes()
+        ).original,
+        intermediateCAs=[
+            Certificate.loadPEM(intermediate_ca.as_bytes()).original
+            for intermediate_ca in private_key_with_full_chain.intermediateCAs
+        ],
+        rootCA=Certificate.loadPEM(
+            private_key_with_full_chain.rootCA.as_bytes()
+        ).original,
+    )
+
+    return _MtlsServerCertificateOptions(
+        authorized_client_registry=authorized_client_registry,
+        privateKey=twisted_loaded_chain.privateKey,
+        certificate=twisted_loaded_chain.certificate,
+        extraCertChain=twisted_loaded_chain.intermediateCAs,
+        trustRoot=trust_root,
+        raiseMinimumTo=TLSVersion.TLSv1_2,
+        lowerMaximumSecurityTo=TLSVersion.TLSv1_3,
+        acceptableProtocols=acceptable_protocols,
+        dhParameters=dh_parameters,
+    )

{vortexpy-4.1.7 → vortexpy-4.2.0}/vortex/PayloadEndpoint.py

@@ -22,9 +22,7 @@ from vortex.VortexAccessControlContextABC import (
     NO_AUTH_ACCESS_CONTROL_CONTEXT,
     VortexAccessControlContextABC,
 )
-from vortex.VortexEndpointPermission import (
-    EndpointPermissionsType as PermissionsType,
-)
+from vortex.VortexEndpointPermission import EndpointPermissionsType as PermissionsType
 from vortex.VortexSession import (
     _callableLabel,
     checkAccessControlContextSignature,
@@ -71,7 +69,6 @@ class PayloadEndpoint:
         acceptOnlyFromVortex: Optional[Union[str, tuple]] = None,
         ignoreFromVortex: Optional[Union[str, tuple]] = None,
         requiredPermissions: Optional[PermissionsType] = None,
-        logProcessException: bool = True,
     ) -> None:
         """
         :param filt: The filter to match against payloads
@@ -83,13 +80,8 @@ class PayloadEndpoint:
             the caller's session must hold.  Pass an empty frozenset to
             explicitly declare "no permissions required".  Omitting the
             parameter (``None``) emits a deprecation warning.
-        :param logProcessException: When True, handler exceptions log at ERROR.
-            When False, the same events log at DEBUG with neutral wording.
         """
-        self._requiredPermissions: Optional[PermissionsType] = (
-            requiredPermissions
-        )
-        self._logProcessException = logProcessException
+        self._requiredPermissions: Optional[PermissionsType] = requiredPermissions
 
         if requiredPermissions is None:
             logger.warning(self._NO_PERMISSIONS_WARNING, filt)
@@ -97,11 +89,9 @@ class PayloadEndpoint:
         callableDesc = (
             f"PayloadEndpoint filt={filt} callback={_callableLabel(callable_)}"
         )
-        self._callableAcceptsAccessControlContext = (
-            checkAccessControlContextSignature(
-                callable_,
-                callableDescription=callableDesc,
-            )
+        self._callableAcceptsAccessControlContext = checkAccessControlContextSignature(
+            callable_,
+            callableDescription=callableDesc,
         )
         checkNoHttpSessionInSignature(callable_, callableDesc)
 
@@ -178,10 +168,7 @@ class PayloadEndpoint:
             return False
 
         # Filter for the backend vortexes.
-        if (
-            self._acceptOnlyFromVortex
-            and vortexName not in self._acceptOnlyFromVortex
-        ):
+        if self._acceptOnlyFromVortex and vortexName not in self._acceptOnlyFromVortex:
             return False
 
         def removeUnhashable(filt):
@@ -225,9 +212,7 @@ class PayloadEndpoint:
         if not self.check(payloadEnvelope, vortexName):
             return
 
-        if self.PERMITTER and not self.PERMITTER.check(
-            payloadEnvelope, vortexSession
-        ):
+        if self.PERMITTER and not self.PERMITTER.check(payloadEnvelope, vortexSession):
             logger.debug("Permission failed for %s", payloadEnvelope.filt)
             return
 
@@ -265,10 +250,7 @@ class PayloadEndpoint:
         accessControlContext = NO_AUTH_ACCESS_CONTROL_CONTEXT
         if self._callableAcceptsAccessControlContext and auth and vortexSession:
             raw_ctx = yield maybeDeferred(
-                auth.getAccessControlContext,
-                vortexSession,
-                vortexName,
-                vortexUuid,
+                auth.getAccessControlContext, vortexSession, vortexName, vortexUuid
             )
             if not isinstance(raw_ctx, VortexAccessControlContextABC):
                 logger.error(

{vortexpy-4.1.7 → vortexpy-4.2.0}/vortex/PayloadEndpointTest.py

@@ -143,7 +143,9 @@ class PayloadEndpointPyTest(unittest.TestCase):
 
         def subScope():
             inst = PayloadEndpointPyTestAssignPayload(self)
-            PayloadEndpoint(filt, inst.process, requiredPermissions=frozenset())
+            PayloadEndpoint(
+                filt, inst.process, requiredPermissions=frozenset()
+            )
 
         self._processEnvelope(payload)
         yield self._flushReactor()