fix: framework diagnostics + dev CSP + login quick-login + test warnings - #28
Merged
Merged
Conversation
…users/login
Clears every spurious boot warning, unblocks the Vite dev server under CSP,
wires the dev-account quick-login buttons the .env.example promises, and
deletes the last pytest/Vite deprecation warnings.
- SM004: _check_phantom_renders now recurses into page subdirs (was missing
nested pages like Users/Users/Index.tsx) and skips lowercase helper dirs.
- SM012: snapshot app.state._state instead of vars(app.state), which only
ever contained '{'_state'}' and always reported an empty diff.
- SM007: treat locale_dirs/static_mounts/template_dirs/on_startup/on_shutdown
as legitimate overrides so shared-contract modules (Auth) don't warn.
- CSP: SecurityHeadersMiddleware.dev_csp() whitelists the Vite origin +
ws:// for HMR; install_middleware wires it when settings.is_development.
- Login: pass bootstrap admin/user creds as dev_accounts prop in dev, and
render "Dev quick-login" buttons under the sign-in form.
- Vite: swap vite-tsconfig-paths → resolve.tsconfigPaths: true, and
@vitejs/plugin-react-swc → @vitejs/plugin-react (SWC plugin warning).
- uv: [tool.uv] dev-dependencies → [dependency-groups] dev.
- Tests: stop pydantic-settings from leaking the repo's .env into users
fixtures; move TestClient/httpx per-request cookies onto the client;
bump JWT test secrets to ≥32 bytes; vitest 3 → 4 (esbuild→oxc warning).
antosubash
changed the title
- conftest: reorder the autouse fixture after the module imports, and delete unused hash_password/create_verified_user/create_unverified_user helpers that were dead code (nothing in the test suite imports them). Keeps the file under the 300-line cap after the env-isolation fixture. - Login.tsx: biome formatting tweak on the dev-quick-login <p>.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
'self'. AddedSecurityHeadersMiddleware.dev_csp(vite_dev_url)and wired it whensettings.is_development..env.exampledocumented a feature ("dev-only clickable login for seeded bootstrap accounts") that was never implemented.login_pagenow emitsdev_accountsprops in dev, andLogin.tsxrenders a "Dev quick-login" strip under the form.vite-tsconfig-pathsin favor of Vite 8's nativeresolve.tsconfigPaths: true; swapped@vitejs/plugin-react-swcfor@vitejs/plugin-react(SWC plugin warning); moved[tool.uv] dev-dependenciesto the standard[dependency-groups] dev..envinto users-module tests.Root causes, briefly
_check_phantom_rendersusedpages_dir.glob("*.tsx")(non-recursive), so nested pages likepages/Users/Index.tsxwere reported as missing. Now usesrglob+ relative-path keys, and skips lowercase helper dirs (components/,hooks/, …) so shared components aren't flagged as orphan pages.set(vars(app.state))always returned{'_state'}— Starlette'sStatestores every attribute in__dict__['_state']. The diff was always empty, so every module that overroderegister_settings()got warned. Now snapshotsapp.state._state.register_*hooks.Authis a shared-contract module that legitimately overrides onlylocale_dirs(). Addedlocale_dirs,static_mounts,template_dirs,on_startup, andon_shutdownto the "not empty" list..envexportsSM_USERS_BOOTSTRAP_EMAIL(needed for the new quick-login buttons), andUsersSettingswas auto-loading that file during tests. An autouse fixture inmodules/users/tests/conftest.pydisablesenv_fileand scrubs leakedSM_USERS_*vars for every test.Test plan
make test— 558 Python + 8 JS tests pass, zero warnings (was 9 warnings before).uv run ty check framework/core/simple_module_core/diagnostics framework/hosting/simple_module_hosting— clean.uv run ruff format --check+uv run ruff check— clean.npx tsc --noEmit -p host/client_app/tsconfig.json— clean.npm run build— production bundle succeeds; every module page chunk emitted via nativeresolve.tsconfigPaths.make dev) — no SM004/SM007/SM012/orphan warnings, and no Vitevite-tsconfig-paths/plugin-react-swcsuggestions./users/login— CSP header now allowshttp://localhost:5050+ws://localhost:5050;dev_accountsrenders two quick-login buttons (Admin / User) in dev.