Repository navigation
Conversation
chore: sync dev with master after 0.2.1
chore: uv.lock follows the 0.2.1 bump
The dict config loader dropped any `auth:` value other than "jwt" or "basic" and served the endpoint with no backend at all, as v0.1.29 did. It is a ConfigurationError naming the value and the valid kinds.
build_app() logged "Table creation warning" when create_all failed and the app then served a 500 on every request; the async lifespan did the same. Both raise ConfigurationError with the database's text and the cause attached. The B1-010 pin test, which asserted the warning's traceback, now asserts the error's cause.
docs/advanced/caching.md promised "only the listed query parameters contribute to the key" and the key always held the whole query string. With vary_on set, the key keeps the listed parameters only, sorted.
The field existed on the global Config and was never read; a backend without its own expiration fell back to a literal 3600.
EndpointGuard.check ran backend.authenticate on the event loop, so a Basic validate_credentials that queries a database stalled every other request. check() is async; a BasicAuthentication backend runs in run_in_threadpool, a JWT backend only decodes a token and stays put.
/auth/login called a sync login_validator (or validate_credentials) on the event loop. It runs in run_in_threadpool; an async def is awaited as before. A validator that returns something other than a dict or None is logged and treated as a failed login instead of leaking into the token.
…rigin LightApi(cors_origins=[...]) switched on allow_credentials=True with every method and header, as v0.1.29 did. Credentials are sent only with the new cors_allow_credentials=True (the last keyword, so documented call orders still hold), and that flag refuses a "*" origin, the combination browsers reject.
lightapi.core.CORSMiddleware defaulted to allow_origins=["*"]. It now raises ConfigurationError without them, and register() instantiates every middleware class once so that error (or any constructor error) surfaces at startup instead of as a 500 on the first request. The YAML and lifecycle tests that used the bare class now subclass it with origins or assert the error; the middleware guide says so.
_run_filter_backends instantiated every Meta.filtering backend on each request. The instances now live in the class's own __dict__, built on the first request that needs them, so a subclass with its own Meta never serves its parent's.
…iter Authentication(rate_limiter=...) was stored on the backend and never read; the login route used the app-wide limiter or the defaults. The backend's limiter comes first now, then the app-wide one, then the defaults.
audit: the ten open proposals, one fix per commit
…on bump pyproject.toml 0.2.1 to 0.3.0, uv.lock and the chart's appVersion follow, CHANGELOG's Unreleased block becomes [0.3.0] - 2026-10-12. A minor version because 0.2.1 users will notice: CORS credentials are opt-in, the compat CORSMiddleware needs its origins, build_app() raises on a table-creation failure, an unknown dict-config auth kind is refused. The "Update version" step of python-publish.yml added one to the last number before building, so a minor bump could never be published. It now publishes the version the tree declares when PyPI does not have it, and bumps the patch as before when it does (a merge with no bump of its own). Proven on the extracted script: 0.3.0 stays 0.3.0, 0.2.1 becomes 0.2.2.
chore: release 0.3.0; publish workflow honours a deliberate bump
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Everything merged into dev since 0.2.1: the ten audit proposals (#61, four of them visible changes: CORS credentials opt-in, compat CORSMiddleware needs origins, build_app raises on table-creation failure, unknown dict-config auth refused) and the version bump (#62). The publish workflow now releases the declared version when PyPI lacks it, so this merge publishes exactly 0.3.0, tags v0.3.0 and pushes iklob1/lightapi:0.3.0. Verified on dev: 647 tests under the locked and the runner's versions, ruff, mypy, mkdocs strict, e2e 21 ok.