[thorwhalen]

Closes #30. Mirrors #29 (class endpoints) for instance endpoints: a handler whose endpoint is an object, dispatched through attr_names.

Change

• Owner. An instance endpoint is one object that every client shares. It now needs obj_owner:
  • either a (request) -> owner hook, which refuses requests it does not identify (401);
  • or the named opt-in obj_owner=shared_objects (anyone).
  • Without one, building the service raises a ValueError naming both options.
  • Module endpoints are unchanged: a module's functions are like plain function endpoints.
• Size. max_obj_size (default DFLT_MAX_OBJ_SIZE) and obj_sizeof (default bounded_deep_sizeof) apply to the instance.
  • It is measured when the service is built: an object already over the limit is refused there, so the error comes immediately, not on the first request.
  • It is measured again after every dispatched call, failed ones included.
  • A pre-built instance cannot be dropped the way a class endpoint's object is. So the call that takes it over the limit gets a 400, and the object is kept.
  • Every later call is refused before it runs until the object is back under the limit.
  • Memory is therefore bounded by the limit plus what the calls already running allocate.
  • Data kept outside the process (files, a database) is not measured. The docstring says so.
• The issue's two smaller items:
  • AuthorizationError now maps to 401, and its subclasses ForbiddenError and OverwritesNotAllowed to 403. Before, all three got 400. Bottle and aiohttp now share one status table (error_status).
  • aiohttp_handle_request now resets current_request.

Breaking default

This is the same decision as #28, extended to instance endpoints: the safe default plus a named opt-in. The fleet has two such handlers, both in addaix/raglab_app and both exposing writes to anyone; an issue is filed there. examples/object_dispatch.py now passes obj_owner=shared_objects, with a comment.

Gates

• pytest --doctest-modules py2http: 136 passed.
• priv test-dependents py2http --transitive: py2http and extrude pass.

Adversarial review

Two fresh Opus passes.

Pass 1: SHIP-WITH-FIXES. It found no way past the owner gate. Fixed:

• One client could lock everyone out once the object was over its limit. Fix: obj_shrinkers, names still callable while it is over.
• bounded_deep_sizeof did not follow bound methods, partials or closures.
• A comment said every AuthorizationError subclass gets 403.
• With 401, http2py raised RuntimeError. Fixed in binary_loads passthrough for mk_cli and api_pkg_maker; the generated package compiles (#21) http2py#22, which maps 401 to AuthorizationError.
• Documented: the per-call cost of measuring, and generator or coroutine results being measured early.
• Deferred to Object endpoints: measuring after every call costs CPU; module endpoints and 401 headers left open #32: an obj_mutators performance knob, module endpoints, and WWW-Authenticate.
• The size refusal stays 400 InputError (it was not changed to 507), so existing http2py clients keep getting InputError.

Pass 2, on those fixes: SHIP-WITH-FIXES. Fixed:

• A str passed as obj_shrinkers was split into letters, and unknown names were accepted. Both are now refused at build.
• A stale clear could erase a newer over-limit flag. Measuring and flagging now happen under one lock.
• Untraversed holders (MethodType.__func__, function __dict__ and defaults, static and class methods) are now followed.
• Exotic objects (a mock, a __getattr__ raising KeyError) made the measurement raise. They are now measured plainly.
• Documented: a shrinker that also adds defeats the bound.

Behaviour change for class endpoints: an object holding a bound method of another object is now charged that whole object, as holding the object itself already was. If that is not wanted, raise max_obj_size or pass an obj_sizeof.

🤖 Generated with Claude Code