swadhin / justapi public

swadhinbiswas

[email protected]
2026-07-29 13:07:32 +0600 committed NaN years ago
1cd6cd7
commit 1cd6cd7
3 files changed
+71 -4
Showing 3 changed files+71-4
ARCHITECTURE.mdCHANGELOG.mdREADME.md
▼ARCHITECTURE.md
+8-0
@@ -107,6 +107,14 @@ JustAPI utilizes a **GIL-free async worker architecture** (ADR-021):
107
107
### Radix Router
108
108
Uses the radix-trie based `matchit` crate. Paths are resolved in `O(1)` time relative to the number of registered routes. Parameters are parsed into typed path variables during the routing step.
109
109
110
+### Server Module Structure
111
+The server is organized into focused modules for maintainability:
112
+- **`server/mod.rs`**: Server builder, accept loops, connection handling
113
+- **`server/handler_exec.rs`**: Route handler dispatch (maps Handler variants to responses)
114
+- **`server/ws.rs`**: WebSocket types and default echo handler
115
+- **`server/sse_ws.rs`**: SSE response and WebSocket dispatch helpers
116
+- **`server/crud.rs`**: Rust-native CRUD route handlers
117
+
110
118
### Request Validation
111
119
Request bodies are validated against their JSON Schema *entirely in Rust* using the `jsonschema` crate before Python is invoked. Invalid requests receive an RFC 9457 structured error response and are rejected at the FFI boundary, saving CPU cycles.
112
120
113
121
▼CHANGELOG.md
+59-0
@@ -5,6 +5,65 @@ All notable changes to JustAPI will be documented in this file.
5
5
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
6
6
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
7
8
+## [2.0.8] - 2026-07-28
9
+
10
+### Security Fixes
11
+- **CRITICAL:** Fixed global panic hook race condition in `panic.rs` (P0-1)
12
+- **CRITICAL:** Fixed RwLock poisoning panics in `PerRouteCircuitBreakerMiddleware` (P0-2)
13
+- **CRITICAL:** Fixed division by zero in rate limiter (P0-3)
14
+- **HIGH:** Added SQL identifier validation for CRUD table/column names (H-1)
15
+- **HIGH:** Fixed WebSocket unwrap on hot path (H-2)
16
+- **HIGH:** GraphiQL now gated on `JUSTAPI_ENABLE_GRAPHIQL` env var (H-3)
17
+- **HIGH:** Added 5-second per-check timeout in health checks (H-5)
18
+- **MEDIUM:** Added Mutex poison recovery to Python bindings (7 files) (M-5)
19
+- **MEDIUM:** Fixed ChaosMiddleware potential panic on misconfigured latency (M-6)
20
+- **MEDIUM:** Added `nosniff` header to large file streaming path (M-7)
21
+
22
+### Bug Fixes
23
+- Added GraphQL query depth/complexity limits (depth=10, complexity=200)
24
+- Added 4 MiB gRPC message size limit
25
+- Added 1024-route capacity for circuit breakers with FIFO eviction
26
+- Added symlink resolution in static file serving via `canonicalize()`
27
+- Added `x-content-type-options: nosniff` header to all static file responses
28
+- Fixed poisoned mutex cascading panics in request coalescer
29
+- Redis dependency now feature-gated behind `redis-rate-limit`
30
+
31
+### Performance
32
+- Router FIFO cache eviction now O(1) with `VecDeque`
33
+- Accept-Encoding now respects RFC 7231 quality values
34
+- Health checks now run in parallel
35
+- Metrics no longer misclassify 1xx status codes
36
+- Environment variables cached with `LazyLock`
37
+- CRUD query params now URL-decoded
38
+
39
+### Code Quality
40
+- Server code partially split: `ws.rs`, `sse_ws.rs`, `handler_exec.rs` extracted
41
+- Added `#[non_exhaustive]` to public enums for forward compatibility
42
+- ANSI injection prevention in diagnostics
43
+- Documented known limitations in code comments
44
+- Implemented `GatewayState::get_route()` (was a stub returning `None`)
45
+
46
+### CI/CD
47
+- Added `--tests` flag to clippy in CI
48
+- Added `--all-features` to cargo test in CI
49
+- Added `fuzz_pipeline`, `fuzz_websocket`, `fuzz_grpc` targets to fuzz workflow
50
+- Fuzzing duration increased from 60s to 5 minutes per target
51
+- Added benchmark regression gate to CI (95% threshold)
52
+- Added integration test job (server startup, health checks, endpoints)
53
+- Added PyPI publish workflow with OIDC trusted publishers
54
+
55
+### Documentation
56
+- Created troubleshooting guide (10 common issues)
57
+- Created performance tuning guide (10 optimization areas)
58
+- Created migration guide from Robyn/Granian
59
+- Created API stability guarantees document
60
+- All docs integrated into docs_site
61
+
62
+### Testing
63
+- 6 new edge case tests for SQL validation, health timeouts, chaos config
64
+- 2 new fuzz targets (WebSocket, gRPC)
65
+- 521 total tests passing
66
+
8
67
## [Unreleased]
9
68
10
69
### Added
11
70
▼README.md
+4-4
@@ -6,7 +6,7 @@
6
6
</p>
7
7
<p align="center">
8
8
<a href="https://github.com/swadhinbiswas/JustAPI/actions/workflows/ci.yml">
9
- <img src="https://github.com/swadhinbiswas/JustAPI/actions/workflows/ci.yml/badge.svg?branch=initial-setup" alt="CI">
9
+ <img src="https://github.com/swadhinbiswas/JustAPI/actions/workflows/ci.yml/badge.svg?branch=main" alt="CI">
10
10
</a>
11
11
<a href="https://github.com/swadhinbiswas/JustAPI/actions/workflows/wheels.yml">
12
12
<img src="https://github.com/swadhinbiswas/JustAPI/actions/workflows/wheels.yml/badge.svg" alt="Wheels">
@@ -14,7 +14,7 @@
14
14
<a href="https://github.com/swadhinbiswas/JustAPI/actions/workflows/publish.yml">
15
15
<img src="https://github.com/swadhinbiswas/JustAPI/actions/workflows/publish.yml/badge.svg" alt="Publish">
16
16
</a>
17
-<a href="https://github.com/swadhinbiswas/JustAPI/blob/initial-setup/LICENSE">
17
+<a href="https://github.com/swadhinbiswas/JustAPI/blob/main/LICENSE">
18
18
<img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="License: MIT">
19
19
</a>
20
20
<a href="https://www.python.org/downloads/">
@@ -23,7 +23,7 @@
23
23
<a href="https://www.rust-lang.org/">
24
24
<img src="https://img.shields.io/badge/rust-1.85+-E6522C.svg?logo=rust&logoColor=white" alt="Rust version">
25
25
</a>
26
-<a href="https://github.com/swadhinbiswas/JustAPI/blob/initial-setup/deny.toml">
26
+<a href="https://github.com/swadhinbiswas/JustAPI/blob/main/deny.toml">
27
27
<img src="https://img.shields.io/badge/cargo--deny-v0.20-passing-green.svg" alt="cargo-deny">
28
28
</a>
29
29
<a href="https://pypi.org/project/justapi/">
@@ -33,7 +33,7 @@
33
33
34
34
---
35
35
36
-**Documentation**: <a href="https://github.com/swadhinbiswas/JustAPI/tree/initial-setup/docs_site" target="_blank">https://github.com/swadhinbiswas/JustAPI/docs_site</a>
36
+**Documentation**: <a href="https://github.com/swadhinbiswas/JustAPI/tree/main/docs_site" target="_blank">https://github.com/swadhinbiswas/JustAPI/docs_site</a>
37
37
38
38
**Source Code**: <a href="https://github.com/swadhinbiswas/JustAPI" target="_blank">https://github.com/swadhinbiswas/JustAPI</a>
39
39
40
40