wsbuilder 1.2.7__tar.gz → 1.2.8__tar.gz

{wsbuilder-1.2.7/src/wsbuilder.egg-info → wsbuilder-1.2.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wsbuilder
-Version: 1.2.7
+Version: 1.2.8
 Summary: Lightweight HTTP + WebSocket framework for Python.
 Author: wsbuilder Authors
 License-Expression: MIT

{wsbuilder-1.2.7 → wsbuilder-1.2.8}/docs/data-orm.md

@@ -81,6 +81,10 @@ Operadores soportados:
 - `field__not_in=[...]`
 - `field__isnull=True`
 
+`like` e `ilike` reciben un patron SQL (`%` y `_` son comodines). `contains`,
+`startswith` y `endswith` comparan el valor literal y distinguen mayusculas;
+sus variantes `i*` tambien son literales pero ignoran mayusculas ASCII.
+
 Metodos utiles:
 
 - `filter`, `exclude`

{wsbuilder-1.2.7 → wsbuilder-1.2.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "wsbuilder"
-version = "1.2.7"
+version = "1.2.8"
 description = "Lightweight HTTP + WebSocket framework for Python."
 readme = "README.md"
 requires-python = ">=3.11"

{wsbuilder-1.2.7 → wsbuilder-1.2.8}/src/wsbuilder/__init__.py

@@ -126,7 +126,7 @@ def __getattr__(name):
 def __dir__():
     return sorted(set(globals()) | _PKI_EXPORTS)
 
-__version__ = "1.2.7"
+__version__ = "1.2.8"
 
 __all__ = [
     "App",

{wsbuilder-1.2.7 → wsbuilder-1.2.8}/src/wsbuilder/app.py

@@ -1350,6 +1350,11 @@ class App:
             if thread_info.port > 0:
                 resp.headers.setdefault(THREAD_RESPONSE_PORT_HEADER, str(thread_info.port))
             resp.headers.setdefault(THREAD_RESPONSE_MODE_HEADER, "worker")
+        # Headers hold one value per name, so a cookie the handler set wins
+        # over the affinity cookie instead of being replaced by it.
+        if thread_info is not None and not any(
+            str(name).lower() == "set-cookie" for name in resp.headers
+        ):
             signed_cookie = self._sign_thread_cookie(route.path, thread_info.thread_id)
             resp.headers["Set-Cookie"] = build_set_cookie(
                 self.thread_cookie_name,

{wsbuilder-1.2.7 → wsbuilder-1.2.8}/src/wsbuilder/cache.py

@@ -834,8 +834,10 @@ class SQLiteMemoryCache:
         sql = "SELECT key, expires_at FROM cache_entries WHERE namespace = ?"
         params = [ns]
         if prefix:
-            sql += " AND key LIKE ?"
-            params.append(f"{str(prefix)}%")
+            # LIKE treats % and _ as wildcards and ignores ASCII case.
+            prefix = str(prefix)
+            sql += " AND substr(key, 1, ?) = ?"
+            params.extend((len(prefix), prefix))
         if not include_expired:
             sql += " AND (expires_at IS NULL OR expires_at > ?)"
             params.append(time.time())

{wsbuilder-1.2.7 → wsbuilder-1.2.8}/src/wsbuilder/hpack.py

@@ -157,6 +157,14 @@ class HPACKError(Exception):
     """A header block that cannot be decoded. Always a connection error."""
 
 
+class HeaderListTooLarge(Exception):
+    """A decoded header list over the caller's limit.
+
+    Raised only after the whole block was decoded, so the dynamic table is
+    still in step with the peer and only the request has to be refused.
+    """
+
+
 def _build_huffman_tree():
     """Bit-trie for decoding: nested lists indexed by bit."""
     root = [None, None]
@@ -292,16 +300,20 @@ def decode_string(data, offset):
     raw = bytes(data[offset:end])
     if huffman:
         raw = huffman_decode(raw)
-    return raw.decode("utf-8", errors="strict"), end
+    # Field values may carry obs-text (RFC 9110 section 5.5); ISO-8859-1 maps
+    # every octet, as the HTTP/1 parser does.
+    return raw.decode("iso-8859-1"), end
 
 
 class DynamicTable:
     """The half of the header table that both peers mutate in step."""
 
-    def __init__(self, max_size=DEFAULT_DYNAMIC_TABLE_SIZE):
+    def __init__(self, max_size=DEFAULT_DYNAMIC_TABLE_SIZE, encoding="utf-8"):
         self._entries = []
         self._size = 0
         self._max_size = int(max_size)
+        #: How the entries' strings map to octets, which is what size counts.
+        self.encoding = encoding
 
     def __len__(self):
         return len(self._entries)
@@ -319,16 +331,16 @@ class DynamicTable:
         self._evict()
 
     @staticmethod
-    def entry_size(name, value):
-        return len(name.encode("utf-8")) + len(value.encode("utf-8")) + ENTRY_OVERHEAD
+    def entry_size(name, value, encoding="utf-8"):
+        return len(name.encode(encoding)) + len(value.encode(encoding)) + ENTRY_OVERHEAD
 
     def _evict(self):
         while self._size > self._max_size and self._entries:
             name, value = self._entries.pop()
-            self._size -= self.entry_size(name, value)
+            self._size -= self.entry_size(name, value, self.encoding)
 
     def add(self, name, value):
-        cost = self.entry_size(name, value)
+        cost = self.entry_size(name, value, self.encoding)
         if cost > self._max_size:
             # Section 4.4: an oversized insert empties the table instead.
             self._entries.clear()
@@ -373,7 +385,7 @@ class Decoder:
     """Decodes header blocks, keeping the dynamic table in step with the peer."""
 
     def __init__(self, max_size=DEFAULT_DYNAMIC_TABLE_SIZE):
-        self.table = DynamicTable(max_size)
+        self.table = DynamicTable(max_size, encoding="iso-8859-1")
         #: Ceiling the peer may raise the table to, from SETTINGS.
         self.max_allowed_size = int(max_size)
 
@@ -384,21 +396,38 @@ class Decoder:
             return STATIC_TABLE[index]
         return self.table.get(index - STATIC_TABLE_SIZE)
 
-    def decode(self, block):
+    def decode(self, block, max_list_size=None):
+        """Decode ``block``; ``max_list_size`` bounds the RFC 7541 list size.
+
+        Indexed fields can expand a small block into a large list, so past
+        the limit fields are no longer kept, decoding still runs to the end
+        to keep the table in step, and ``HeaderListTooLarge`` is raised.
+        """
         data = bytes(block)
         offset = 0
         headers = []
         saw_field = False
+        list_size = 0
+
+        def keep(field):
+            nonlocal list_size
+            if max_list_size is None:
+                headers.append(field)
+                return
+            list_size += DynamicTable.entry_size(*field, encoding=self.table.encoding)
+            if list_size <= max_list_size:
+                headers.append(field)
+
         while offset < len(data):
             byte = data[offset]
             if byte & 0x80:
                 index, offset = decode_integer(data, offset, 7)
-                headers.append(self._lookup(index))
+                keep(self._lookup(index))
                 saw_field = True
             elif byte & 0x40:
                 name, value, offset = self._decode_literal(data, offset, 6)
                 self.table.add(name, value)
-                headers.append((name, value))
+                keep((name, value))
                 saw_field = True
             elif byte & 0x20:
                 size, offset = decode_integer(data, offset, 5)
@@ -413,8 +442,12 @@ class Decoder:
             else:
                 # 0000 never-indexed and 0001 without-indexing share a shape.
                 name, value, offset = self._decode_literal(data, offset, 4)
-                headers.append((name, value))
+                keep((name, value))
                 saw_field = True
+        if max_list_size is not None and list_size > max_list_size:
+            raise HeaderListTooLarge(
+                f"header list of {list_size} octets over the {max_list_size} limit"
+            )
         return headers
 
     def _decode_literal(self, data, offset, prefix_bits):
@@ -505,6 +538,7 @@ __all__ = [
     "Encoder",
     "HPACKError",
     "HUFFMAN_CODES",
+    "HeaderListTooLarge",
     "NEVER_INDEXED",
     "STATIC_TABLE",
     "STATIC_TABLE_SIZE",

{wsbuilder-1.2.7 → wsbuilder-1.2.8}/src/wsbuilder/http.py

@@ -8,6 +8,7 @@ from .logs import get_log
 
 MAX_QUERY_FIELDS = 1024
 HTTP_0_9 = "HTTP/0.9"
+HTTP_1_0 = "HTTP/1.0"
 HTTP_1_1 = "HTTP/1.1"
 _HTTP_METHOD_RE = re.compile(r"^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$")
 
@@ -256,7 +257,15 @@ def send_http_response(conn, response, *, send_body=True, keep_alive=False, vers
                 headers.pop(name)
         lowermap = {k.lower(): v for k, v in headers.items()}
     elif getattr(response, "is_stream", False):
-        if "transfer-encoding" not in lowermap and "content-length" not in lowermap:
+        if version == HTTP_1_0:
+            # RFC 9112 section 6.1: an HTTP/1.0 client does not understand
+            # Transfer-Encoding, so without a length the close ends the body.
+            for name in list(headers):
+                if name.lower() == "transfer-encoding":
+                    headers.pop(name)
+            if "content-length" not in lowermap:
+                keep_alive = False
+        elif "transfer-encoding" not in lowermap and "content-length" not in lowermap:
             headers["Transfer-Encoding"] = "chunked"
         lowermap = {k.lower(): v for k, v in headers.items()}
     elif "content-length" not in lowermap:

{wsbuilder-1.2.7 → wsbuilder-1.2.8}/src/wsbuilder/http1.py

@@ -93,6 +93,11 @@ class BufferedReader:
                 return False
         return bytes(self._buffer[: len(prefix)]) == prefix
 
+    def wait_for_data(self):
+        """Block until at least one byte is buffered, reading only if empty."""
+        if not self._buffer:
+            self._fill()
+
     def unread(self, data):
         """Push bytes back so the next read sees them first."""
         if data:
@@ -228,7 +233,7 @@ def client_wants_keep_alive(version, headers):
     return False
 
 
-def response_is_self_delimiting(response, *, send_body=True):
+def response_is_self_delimiting(response, *, send_body=True, version=None):
     """True when the client can tell where the response ends without EOF."""
     status = int(getattr(response, "status", 200))
     if 100 <= status < 200 or status in (204, 304) or not send_body:
@@ -240,6 +245,9 @@ def response_is_self_delimiting(response, *, send_body=True):
     if not getattr(response, "is_stream", False):
         # A buffered body always gets a Content-Length when serialized.
         return True
+    if version == HTTP_1_0:
+        # Chunked coding is never sent to HTTP/1.0, so only EOF delimits.
+        return False
     for name, value in headers.items():
         if str(name).lower() == "transfer-encoding":
             return "chunked" in str(value).lower()
@@ -256,7 +264,7 @@ def should_keep_alive(version, request_headers, response, *, send_body=True, ser
         return False
     if "close" in parse_connection_tokens(getattr(response, "headers", None)):
         return False
-    return response_is_self_delimiting(response, send_body=send_body)
+    return response_is_self_delimiting(response, send_body=send_body, version=version)
 
 
 def connection_header_value(version, keep_alive):

{wsbuilder-1.2.7 → wsbuilder-1.2.8}/src/wsbuilder/http2.py

@@ -12,8 +12,9 @@ it would desynchronise the decoder for every later stream.
 """
 
 import struct
+import threading
 
-from .hpack import Decoder, Encoder, HPACKError
+from .hpack import Decoder, Encoder, HeaderListTooLarge, HPACKError
 from .http import Response
 from .logs import get_log
 
@@ -319,18 +320,41 @@ class Http2Connection:
 
     Takes anything with ``recv`` and ``sendall``, so the frame logic is
     exercised in tests without a socket.
+
+    Streamed response bodies are produced on their own thread so the frame
+    loop keeps reading (WINDOW_UPDATE, other streams) meanwhile; a lock
+    serialises frame handling and sending between the two.
     """
 
+    #: Ids of streams closed by RST_STREAM remembered so that a HEADERS frame
+    #: still in flight on one is decoded and ignored, not a protocol error.
+    RECENTLY_RESET_STREAMS = 256
+    #: Body bytes a streaming producer may queue ahead of the peer's windows.
+    MAX_PENDING_STREAM_BYTES = 64 * 1024
+    #: How long a closing connection waits for producers to finish their bodies.
+    PRODUCER_GRACE_SECONDS = 5.0
+
     def __init__(
-        self, conn, app, *, tls=None, client_address=("", 0), max_streams=100, max_body_bytes=None
+        self,
+        conn,
+        app,
+        *,
+        tls=None,
+        client_address=("", 0),
+        max_streams=100,
+        max_body_bytes=None,
+        max_header_bytes=None,
     ):
         self.conn = conn
         #: Largest request body buffered per stream; None leaves it unbounded.
         self.max_body_bytes = None if max_body_bytes is None else int(max_body_bytes)
+        #: Ceiling for a header block and its decoded list; None is unbounded.
+        self.max_header_bytes = None if max_header_bytes is None else int(max_header_bytes)
         self.app = app
         self.tls = tls or {}
         self.client_address = client_address
         self.streams = {}
+        self._recently_reset = {}
         self.decoder = Decoder()
         self.encoder = Encoder()
         self.inbound = FlowControlWindow()
@@ -341,6 +365,8 @@ class Http2Connection:
             SETTINGS_INITIAL_WINDOW_SIZE: DEFAULT_INITIAL_WINDOW_SIZE,
             SETTINGS_MAX_FRAME_SIZE: DEFAULT_MAX_FRAME_SIZE,
         }
+        if self.max_header_bytes is not None:
+            self.local_settings[SETTINGS_MAX_HEADER_LIST_SIZE] = self.max_header_bytes
         self.peer_settings = {
             SETTINGS_INITIAL_WINDOW_SIZE: DEFAULT_INITIAL_WINDOW_SIZE,
             SETTINGS_MAX_FRAME_SIZE: DEFAULT_MAX_FRAME_SIZE,
@@ -350,6 +376,13 @@ class Http2Connection:
         self._buffer = bytearray()
         self._pending_headers = None
         self._closed = False
+        self._lock = threading.RLock()
+        self._output_ready = threading.Condition(self._lock)
+        self._producers = []
+        #: False once the frame loop stops: no more window credit can arrive.
+        self._reading = True
+        #: Set when producers must stop at once (connection error or timeout).
+        self._abandoned = False
 
     # -- transport -----------------------------------------------------
 
@@ -408,19 +441,54 @@ class Http2Connection:
         """Run the connection until the peer goes away or a fault ends it."""
         try:
             self.read_preface()
-            self.send_settings()
+            with self._lock:
+                self.send_settings()
             while not self._closed:
-                frame = self.next_frame()
-                self.handle_frame(frame)
+                try:
+                    frame = self.next_frame()
+                except TimeoutError:
+                    # A client reading a long streamed body may send nothing;
+                    # _read keeps any partial frame, so waiting again is safe.
+                    if self._streaming():
+                        continue
+                    raise
+                with self._lock:
+                    self.handle_frame(frame)
+                    if self._producers:
+                        self._output_ready.notify_all()
         except ConnectionError_ as exc:
-            self.send_goaway(exc.code, str(exc).encode("utf-8", "replace")[:128])
+            self._abandoned = True
+            with self._lock:
+                self.send_goaway(exc.code, str(exc).encode("utf-8", "replace")[:128])
         except (ConnectionError, OSError):
             pass
         except HPACKError as exc:
+            self._abandoned = True
             # A broken header block leaves the shared table unusable.
-            self.send_goaway(ERROR_COMPRESSION_ERROR, str(exc).encode("utf-8", "replace")[:128])
+            with self._lock:
+                self.send_goaway(
+                    ERROR_COMPRESSION_ERROR, str(exc).encode("utf-8", "replace")[:128]
+                )
         else:
-            self.send_goaway(ERROR_NO_ERROR)
+            with self._lock:
+                self.send_goaway(ERROR_NO_ERROR)
+        finally:
+            self._finish_producers()
+
+    def _streaming(self):
+        self._producers = [thread for thread in self._producers if thread.is_alive()]
+        return bool(self._producers)
+
+    def _finish_producers(self):
+        """Let streamed bodies finish, then stop any that cannot."""
+        with self._lock:
+            self._reading = False
+            self._output_ready.notify_all()
+        for thread in list(self._producers):
+            thread.join(self.PRODUCER_GRACE_SECONDS)
+        self._abandoned = True
+        with self._lock:
+            self._output_ready.notify_all()
 
     # -- frame handling ------------------------------------------------
 
@@ -451,6 +519,22 @@ class Http2Connection:
                 stream.state = CLOSED
                 stream.reset_code = exc.code
             self.send_rst_stream(exc.stream_id, exc.code)
+        self._release_closed_streams()
+
+    def _release_closed_streams(self):
+        """Forget closed streams so their bodies and headers can be freed.
+
+        Nothing more is sent on a closed stream, and frames that may still
+        arrive for one are handled without its state.
+        """
+        for stream_id, stream in list(self.streams.items()):
+            if not stream.closed:
+                continue
+            del self.streams[stream_id]
+            if stream.reset_code is not None:
+                self._recently_reset[stream_id] = None
+                while len(self._recently_reset) > self.RECENTLY_RESET_STREAMS:
+                    del self._recently_reset[next(iter(self._recently_reset))]
 
     def _require_stream_id(self, frame, expected_zero):
         if expected_zero and frame.stream_id != 0:
@@ -534,8 +618,14 @@ class Http2Connection:
         self._require_stream_id(frame, False)
         if frame.stream_id % 2 == 0:
             raise ConnectionError_("clients open odd-numbered streams only")
-        if frame.stream_id <= self.last_stream_id and frame.stream_id not in self.streams:
-            raise ConnectionError_("stream identifiers must increase")
+        stream = self.streams.get(frame.stream_id)
+        if stream is None and frame.stream_id <= self.last_stream_id:
+            if frame.stream_id not in self._recently_reset:
+                raise ConnectionError_("stream identifiers must increase")
+            # Section 5.4.2: frames on a stream we reset are ignored, but the
+            # block is still decoded to keep the shared HPACK table in step.
+            stream = Stream(frame.stream_id)
+            stream.state = CLOSED
 
         payload = strip_padding(frame.payload, frame.flags, frame.stream_id)
         if frame.has(FLAG_PRIORITY):
@@ -543,7 +633,6 @@ class Http2Connection:
                 raise ConnectionError_("HEADERS priority block truncated", ERROR_FRAME_SIZE_ERROR)
             payload = payload[5:]
 
-        stream = self.streams.get(frame.stream_id)
         if stream is None:
             limit = self.local_settings[SETTINGS_MAX_CONCURRENT_STREAMS]
             live = sum(1 for s in self.streams.values() if not s.closed)
@@ -555,6 +644,7 @@ class Http2Connection:
             self.last_stream_id = max(self.last_stream_id, frame.stream_id)
 
         self._pending_headers = (stream, bytearray(payload), frame.has(FLAG_END_STREAM))
+        self._check_header_block_size(self._pending_headers[1])
         if frame.has(FLAG_END_HEADERS):
             self._finish_header_block()
 
@@ -565,15 +655,35 @@ class Http2Connection:
         if frame.stream_id != stream.id:
             raise ConnectionError_("CONTINUATION on a different stream")
         buffer.extend(frame.payload)
+        self._check_header_block_size(buffer)
         if frame.has(FLAG_END_HEADERS):
             self._finish_header_block()
 
+    def _check_header_block_size(self, buffer):
+        # A block cut short cannot be decoded, and the HPACK table is shared,
+        # so an oversized block can only end the connection.
+        if self.max_header_bytes is not None and len(buffer) > self.max_header_bytes:
+            raise ConnectionError_(
+                f"header block over the {self.max_header_bytes} octet limit",
+                ERROR_ENHANCE_YOUR_CALM,
+            )
+
     def _finish_header_block(self):
         stream, buffer, end_stream = self._pending_headers
         self._pending_headers = None
         # Decoded even when the stream is doomed: the HPACK table is shared,
         # so skipping a block would desync every stream that follows.
-        headers = self.decoder.decode(bytes(buffer))
+        try:
+            headers = self.decoder.decode(bytes(buffer), max_list_size=self.max_header_bytes)
+        except HeaderListTooLarge:
+            if stream.closed:
+                return
+            if not stream.headers:
+                stream.open_remote(end_stream)
+            self._refuse_early(
+                stream, Response.text("Request Header Fields Too Large", status=431)
+            )
+            return
         if stream.closed:
             return
         if stream.headers:
@@ -637,14 +747,20 @@ class Http2Connection:
         return False
 
     def _reject_body(self, stream):
-        """Answer 413 before the body is complete, then stop the upload.
+        """Answer 413 before the body is complete, then stop the upload."""
+        self._refuse_early(stream, Response.text("Payload Too Large", status=413))
+
+    def _refuse_early(self, stream, response):
+        """Answer ``response`` without dispatching, then stop the upload.
 
         RFC 9113 section 8.1 lets a server respond early and reset the
         request stream with NO_ERROR so the client stops sending.
         """
         stream.body_rejected = True
         stream.body = bytearray()
-        self.send_response(stream, Response.text("Payload Too Large", status=413))
+        self.send_response(stream, response)
+        if stream.closed:
+            return  # The request had already ended; nothing left to stop.
         if not stream.pending_output:
             stream.state = CLOSED
             stream.reset_code = ERROR_NO_ERROR
@@ -688,8 +804,22 @@ class Http2Connection:
                 continue  # Section 8.2.2: these have no meaning in HTTP/2.
             fields.append((lowered, str(value)))
 
-        body = b"" if not send_body else self._response_body(response)
-        if send_body and not response.is_stream:
+        if send_body and response.is_stream:
+            # Sent as it is produced: joining it first would hold an endless
+            # stream forever and a large one entirely in memory.
+            self._send_header_block(stream.id, self.encoder.encode(fields), False)
+            producer = threading.Thread(
+                target=self._produce,
+                args=(stream, response),
+                name=f"http2-stream-{stream.id}",
+                daemon=True,
+            )
+            self._producers.append(producer)
+            producer.start()
+            return
+
+        body = bytes(response.body) if send_body else b""
+        if send_body:
             fields.append(("content-length", str(len(body))))
 
         block = self.encoder.encode(fields)
@@ -699,13 +829,51 @@ class Http2Connection:
         else:
             stream.end_local()
 
-    @staticmethod
-    def _response_body(response):
-        if not response.is_stream:
-            return bytes(response.body)
+    def _stream_abandoned(self, stream):
+        return self._abandoned or stream.closed
+
+    def _produce(self, stream, response):
+        """Send a streamed body chunk by chunk, within the peer's windows."""
         from .http import _iter_stream_chunks
 
-        return b"".join(_iter_stream_chunks(response.stream))
+        try:
+            for chunk in _iter_stream_chunks(response.stream):
+                with self._lock:
+                    if self._stream_abandoned(stream):
+                        return
+                    stream.pending_output.extend(chunk)
+                    self._flush_stream(stream)
+                    while len(stream.pending_output) >= self.MAX_PENDING_STREAM_BYTES:
+                        if self._stream_abandoned(stream) or not self._reading:
+                            return  # No window credit can arrive any more.
+                        self._output_ready.wait(0.5)
+            with self._lock:
+                if self._stream_abandoned(stream):
+                    return
+                if stream.pending_output:
+                    stream.pending_end_stream = True
+                    self._flush_stream(stream)
+                else:
+                    self._send(Frame(FRAME_DATA, FLAG_END_STREAM, stream.id, b""))
+                    stream.end_local()
+        except OSError:
+            pass  # The peer is gone; nothing more can be sent.
+        except Exception as exc:  # noqa: BLE001 - reported on the stream
+            get_log(self.app).exception("http2", f"stream {stream.id} body failed: {exc}", exc)
+            with self._lock:
+                if not stream.closed:
+                    stream.state = CLOSED
+                    stream.reset_code = ERROR_INTERNAL_ERROR
+                    self.send_rst_stream(stream.id, ERROR_INTERNAL_ERROR)
+        finally:
+            close = getattr(response.stream, "close", None)
+            if callable(close):
+                try:
+                    close()
+                except Exception as exc:  # noqa: BLE001 - cleanup only
+                    get_log(self.app).warning("http2", f"stream {stream.id} cleanup failed: {exc}")
+            with self._lock:
+                self._release_closed_streams()
 
     def _send_header_block(self, stream_id, block, end_stream):
         limit = self.peer_settings[SETTINGS_MAX_FRAME_SIZE]