vpndetection-fastapi 2.1.2__tar.gz → 2.1.4__tar.gz

{vpndetection_fastapi-2.1.2 → vpndetection_fastapi-2.1.4}/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 What each release changed for you, newest first. Each line is a commit's summary, linked to its full description and diff. Releases before 2.0.5 are described by their release commits.
 
+## 2.1.4 - 2026-10-15
+
+### Fixes
+
+- Require vpndetection 5.7.2: Retry-After, the key, the base URL and unreadable answers ([`4d74c45`](https://github.com/vpndetection-io/sdk-python-fastapi/commit/4d74c456bb11419cb181d5f7c911913a84398ca3))
+
+## 2.1.3 - 2026-10-10
+
+### Fixes
+
+- Require vpndetection 5.7.1: the spec re-pinned to 2026.10.09 ([`62563b2`](https://github.com/vpndetection-io/sdk-python-fastapi/commit/62563b2ec2b31e6b317d836c229f939bb9f0ec30))
+
 ## 2.1.2 - 2026-10-06
 
 ### Features

{vpndetection_fastapi-2.1.2 → vpndetection_fastapi-2.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vpndetection-fastapi
-Version: 2.1.2
+Version: 2.1.4
 Summary: Official FastAPI and Starlette middleware for the VPNDetection API. Detect VPNs, proxies, Tor, hosting and CDN visitors on every request.
 Project-URL: Homepage, https://vpndetection.io
 Project-URL: Source, https://github.com/vpndetection-io/sdk-python-fastapi
@@ -20,7 +20,7 @@ Classifier: Topic :: Security
 Classifier: Typing :: Typed
 Requires-Python: >=3.11
 Requires-Dist: starlette>=0.37
-Requires-Dist: vpndetection<6,>=5.7.0
+Requires-Dist: vpndetection<6,>=5.7.2
 Provides-Extra: dev
 Requires-Dist: fastapi>=0.115; extra == 'dev'
 Requires-Dist: mypy>=1.11; extra == 'dev'
@@ -112,7 +112,7 @@ A refused request gets an `HTTPException`, `403` with `{"detail": "access denied
 
 This is the setting that decides whether any of the above works, and it is the one thing only you can get right.
 
-By default the middleware uses `request.client.host`, which is the socket peer unless the server was started with proxy-header support. Behind a load balancer without it, every visitor looks like the load balancer — a datacenter address, so a hosting rule would block all of them. Starting uvicorn with `--proxy-headers --forwarded-allow-ips=<your proxy>` is the server's own answer, and the one that knows your topology.
+By default the middleware uses `request.client.host`. uvicorn, and `fastapi run` with it, reads proxy headers by default, but only from a peer that `--forwarded-allow-ips` trusts, and that defaults to `127.0.0.1,::1` (or `$FORWARDED_ALLOW_IPS`). So behind a proxy on the same machine, the visitor's address arrives with no setup. Behind one anywhere else, such as nginx in its own container or a load balancer in a VPC, every visitor looks like the proxy. That address is usually a private one, which the middleware answers locally: nobody is flagged, nothing is blocked, and the private-address warning below is the only sign. Name your proxy, by its address or its subnet: `--forwarded-allow-ips=172.28.5.0/28`. gunicorn's own `--forwarded-allow-ips` works the same way. Never pass `*`. It trusts every peer, so the left-most `X-Forwarded-For` entry wins, and that is whatever the visitor sent: someone on a VPN who sends `X-Forwarded-For: 1.1.1.1` is looked up as `1.1.1.1`.
 
 For an edge that writes the address into its own header, name the header:
 

{vpndetection_fastapi-2.1.2 → vpndetection_fastapi-2.1.4}/README.md

@@ -82,7 +82,7 @@ A refused request gets an `HTTPException`, `403` with `{"detail": "access denied
 
 This is the setting that decides whether any of the above works, and it is the one thing only you can get right.
 
-By default the middleware uses `request.client.host`, which is the socket peer unless the server was started with proxy-header support. Behind a load balancer without it, every visitor looks like the load balancer — a datacenter address, so a hosting rule would block all of them. Starting uvicorn with `--proxy-headers --forwarded-allow-ips=<your proxy>` is the server's own answer, and the one that knows your topology.
+By default the middleware uses `request.client.host`. uvicorn, and `fastapi run` with it, reads proxy headers by default, but only from a peer that `--forwarded-allow-ips` trusts, and that defaults to `127.0.0.1,::1` (or `$FORWARDED_ALLOW_IPS`). So behind a proxy on the same machine, the visitor's address arrives with no setup. Behind one anywhere else, such as nginx in its own container or a load balancer in a VPC, every visitor looks like the proxy. That address is usually a private one, which the middleware answers locally: nobody is flagged, nothing is blocked, and the private-address warning below is the only sign. Name your proxy, by its address or its subnet: `--forwarded-allow-ips=172.28.5.0/28`. gunicorn's own `--forwarded-allow-ips` works the same way. Never pass `*`. It trusts every peer, so the left-most `X-Forwarded-For` entry wins, and that is whatever the visitor sent: someone on a VPN who sends `X-Forwarded-For: 1.1.1.1` is looked up as `1.1.1.1`.
 
 For an edge that writes the address into its own header, name the header:
 

{vpndetection_fastapi-2.1.2 → vpndetection_fastapi-2.1.4}/pyproject.toml

@@ -24,7 +24,7 @@ classifiers = [
     "Topic :: Security",
     "Typing :: Typed",
 ]
-dependencies = ["vpndetection>=5.7.0,<6", "starlette>=0.37"]
+dependencies = ["vpndetection>=5.7.2,<6", "starlette>=0.37"]
 
 [project.urls]
 Homepage = "https://vpndetection.io"

{vpndetection_fastapi-2.1.2 → vpndetection_fastapi-2.1.4}/src/vpndetection_fastapi/__init__.py

@@ -45,7 +45,7 @@ __all__ = [
     "xff_ip_selector",
 ]
 
-__version__ = "2.1.2"
+__version__ = "2.1.4"
 
 # Set on a request ``skip`` claimed, so block_if can tell it from one the middleware
 # never saw.
@@ -58,13 +58,14 @@ _SELECTORS: Selectors[Request] = bind_selectors(
     )
 )
 
-#: ``request.client.host``, which is the socket peer unless the app was started with
-#: uvicorn's ``--proxy-headers``.
+#: ``request.client.host``. uvicorn reads proxy headers into it by default, but only
+#: from a peer ``--forwarded-allow-ips`` trusts, which defaults to ``127.0.0.1,::1``.
 #:
-#: Behind a load balancer without it, every visitor looks like the load balancer - a
-#: datacenter address a hosting rule would block them all for. If you are behind one,
-#: pass ``--proxy-headers --forwarded-allow-ips=<your proxy>`` (the server's own answer,
-#: and the one that knows your topology) or use :func:`header_ip_selector`.
+#: Behind a proxy anywhere else, every visitor looks like the proxy, usually a private
+#: address that is answered locally, so nobody is flagged and the private-address
+#: warning is the only sign. Pass ``--forwarded-allow-ips=<your proxy's address or
+#: subnet>``, never ``*``, which takes the left-most ``X-Forwarded-For`` entry a visitor
+#: can forge, or use :func:`header_ip_selector`.
 default_ip_selector: IpSelector[Request] = _SELECTORS.default
 
 #: An address from ``X-Forwarded-For``.

{vpndetection_fastapi-2.1.2 → vpndetection_fastapi-2.1.4}/tests/test_middleware.py

@@ -8,6 +8,7 @@ to arrive wearing a public address, through a selector.
 from __future__ import annotations
 
 import json
+import os
 import pathlib
 from typing import Any
 
@@ -359,3 +360,18 @@ def test_corpus_conditions_through_block_if(case: dict[str, Any]) -> None:
     assert len(reported) == (1 if case["expect"]["missing"] else 0), case["why"]
     for member in case["expect"]["missing"]:
         assert member in reported[0], case["why"]
+
+
+# Built exactly as the README builds it: an API key and nothing else. Every other test hands
+# the middleware a client, so none of them could see a core that cannot start from a key
+# alone. The test client's loopback peer is a bogon, answered with no request.
+def test_the_middleware_starts_the_way_the_readme_builds_it(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setenv("VPNDETECTION_API_KEY", "a-key")
+    status, body = get(app_with(api_key=os.environ["VPNDETECTION_API_KEY"]))
+
+    assert status == 200
+    assert body["attached"] is True
+    assert body["is_bogon"] is True
+    assert body["error"] is None