merge: resolve middleware.py docstring conflict from origin/main

Take main's phrasing (#16 added a CI workflow; the conflict is only
in the top-of-file docstring line-length fix — both sides shortened
the same overlong docstring differently).

https://claude.ai/code/session_01KLjCnJoNbCbk8is6pVZcom

Author: claude

.github/workflows/pr.yml

@@ -0,0 +1,102 @@
+name: PR
+
+on:
+  pull_request:
+    branches: [main]
+
+# Cancel in-progress runs when new commits are pushed to the same PR
+# so we never waste minutes on outdated code.
+concurrency:
+  group: pr-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  NODE_VERSION: "24"
+  # Hash all workspace pyproject.toml files so cache invalidates when any
+  # member's deps change. uv.lock is gitignored, so this is the best key
+  # available; commit uv.lock to get true lockfile-based caching.
+  UV_CACHE_GLOB: |
+    pyproject.toml
+    framework/*/pyproject.toml
+    modules/*/pyproject.toml
+    host/pyproject.toml
+
+jobs:
+  python-lint:
+    name: Python lint & format
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: astral-sh/setup-uv@v8.0.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: ${{ env.UV_CACHE_GLOB }}
+      - run: make install-py
+      - run: make ci-python-lint
+
+  python-typecheck:
+    name: Python typecheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: astral-sh/setup-uv@v8.0.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: ${{ env.UV_CACHE_GLOB }}
+      - run: make install-py
+      - run: make ci-python-typecheck
+
+  python-tests:
+    name: Python tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: astral-sh/setup-uv@v8.0.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: ${{ env.UV_CACHE_GLOB }}
+      - run: make install-py
+      - run: make test
+
+  js-lint:
+    name: JS lint & format
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: "npm"
+      - run: make install-js
+      - run: make ci-js-lint
+
+  js-typecheck:
+    name: JS typecheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: "npm"
+      - run: make install-js
+      - run: make ci-js-typecheck
+
+  # Single required status check for branch protection.
+  # Protect `main` with this one check and every leaf job is required transitively.
+  pr-checks:
+    name: PR checks
+    runs-on: ubuntu-latest
+    needs:
+      - python-lint
+      - python-typecheck
+      - python-tests
+      - js-lint
+      - js-typecheck
+    if: always()
+    steps:
+      - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: exit 1

Makefile

@@ -1,10 +1,17 @@
-.PHONY: install dev dev-api dev-ui build test lint doctor migrate migration downgrade migration-history docker-up docker-down kill new-module
+.PHONY: install install-py install-js dev dev-api dev-ui build test lint doctor migrate migration downgrade migration-history docker-up docker-down kill new-module ci-python-lint ci-python-typecheck ci-js-lint ci-js-typecheck
 
 # Install
 install:
 	uv sync --all-packages
 	npm install
 
+# Install (granular — used by CI so Python jobs don't pull npm and vice versa)
+install-py:
+	uv sync --all-packages
+
+install-js:
+	npm ci
+
 # Development
 dev: docker-up
 	@echo "Starting API and UI dev servers..."
@@ -24,11 +31,20 @@ build:
 test:
 	uv run pytest
 
-lint:
+lint: ci-python-lint ci-python-typecheck ci-js-lint ci-js-typecheck
+
+# Kept granular so pr.yml can run them in parallel.
+ci-python-lint:
 	uv run ruff format --check .
 	uv run ruff check .
+
+ci-python-typecheck:
 	uv run ty check
-	npx biome check .
+
+ci-js-lint:
+	npx biome ci .
+
+ci-js-typecheck:
 	npx tsc --noEmit -p host/client_app/tsconfig.json
 
 # Diagnostics

framework/db/simple_module_db/listeners.py

@@ -35,7 +35,10 @@ def _entity_label(obj: object) -> str:
 def _entity_pk(obj: object) -> object:
     """Return the primary key value(s) if available, else None."""
     try:
-        identity = sa_inspect(obj).identity
+        inspector = sa_inspect(obj)
+        if inspector is None:
+            return None
+        identity = inspector.identity
         if identity and len(identity) == 1:
             return identity[0]
         return identity

framework/db/tests/test_db.py

@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+from collections.abc import AsyncGenerator
+
 import pytest
 from simple_module_db.base import create_module_base
 from simple_module_db.listeners import TenantIsolationError, current_tenant_id, register_listeners
@@ -16,13 +18,13 @@
 _TenantBase = create_module_base("mt_test", provider=DatabaseProvider.SQLITE)
 
 
-class _TenantItem(_TenantBase, MultiTenantMixin):  # type: ignore[misc]
+class _TenantItem(_TenantBase, MultiTenantMixin):  # ty: ignore[unsupported-base]
     __tablename__ = "mt_test_item"
     id: Mapped[int] = mapped_column(primary_key=True, autoincrement=True)
     name: Mapped[str] = mapped_column(String(100))
 
 
-class _TenantSoftItem(_TenantBase, MultiTenantMixin, SoftDeleteMixin):  # type: ignore[misc]
+class _TenantSoftItem(_TenantBase, MultiTenantMixin, SoftDeleteMixin):  # ty: ignore[unsupported-base]
     """Combines multi-tenant and soft-delete mixins to test filter composition."""
 
     __tablename__ = "mt_test_soft_item"
@@ -31,15 +33,15 @@ class _TenantSoftItem(_TenantBase, MultiTenantMixin, SoftDeleteMixin):  # type:
 
 
 @pytest.fixture
-async def tenant_session() -> AsyncSession:
+async def tenant_session() -> AsyncGenerator[AsyncSession, None]:
     """Session backed by in-memory SQLite with tenant listeners registered."""
     db_state = init_db("sqlite+aiosqlite:///:memory:")
     try:
         register_listeners(db_state)
         async with db_state.engine.begin() as conn:
             await conn.run_sync(_TenantBase.metadata.create_all)
         async with db_state.session_factory() as session:
-            yield session  # type: ignore[misc]
+            yield session
     finally:
         await db_state.engine.dispose()
 

framework/hosting/simple_module_hosting/app_builder.py

@@ -210,7 +210,7 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
     )
     app.add_exception_handler(HTTPException, _http_exception_handler)  # ty: ignore[invalid-argument-type]
     app.add_exception_handler(NotFoundError, _not_found_error_handler)  # ty: ignore[invalid-argument-type]
-    app.add_exception_handler(Exception, _unhandled_exception_handler)  # ty: ignore[invalid-argument-type]
+    app.add_exception_handler(Exception, _unhandled_exception_handler)
     for mod in modules:
         mod.register_exception_handlers(app)
 

framework/hosting/simple_module_hosting/middleware.py

@@ -1,4 +1,4 @@
-"""Middleware: security headers, tenants, correlation IDs, request logging, and Inertia layout.
+"""Middleware: security headers, tenant isolation, correlation IDs, request logging, layout data.
 
 All middleware classes use the raw ASGI pattern instead of ``BaseHTTPMiddleware``
 to avoid its known issues with streaming responses, extra task creation,

framework/hosting/simple_module_hosting/permissions.py

@@ -56,7 +56,7 @@ def __call__(self, request: Request) -> None:
             raise HTTPException(status_code=401, detail="Authentication required")
 
         # Use cached permissions from middleware if available
-        permissions: set[str] = getattr(request.state, "resolved_permissions", None)  # type: ignore[assignment]
+        permissions: set[str] | None = getattr(request.state, "resolved_permissions", None)
         if permissions is None:
             permissions = resolve_permissions(user.roles)
             request.state.resolved_permissions = permissions

framework/hosting/tests/test_logging.py

@@ -111,7 +111,7 @@ def test_injects_empty_string_by_default(self):
             name="x", level=logging.INFO, pathname="", lineno=0, msg="", args=None, exc_info=None
         )
         filt.filter(record)
-        assert record.correlation_id == ""  # type: ignore[attr-defined]
+        assert record.correlation_id == ""  # ty: ignore[unresolved-attribute]
 
     def test_injects_current_correlation_id(self):
         token = correlation_id.set("req-42")
@@ -127,7 +127,7 @@ def test_injects_current_correlation_id(self):
                 exc_info=None,
             )
             filt.filter(record)
-            assert record.correlation_id == "req-42"  # type: ignore[attr-defined]
+            assert record.correlation_id == "req-42"  # ty: ignore[unresolved-attribute]
         finally:
             correlation_id.reset(token)
 
@@ -219,7 +219,7 @@ async def test_log_records_have_extra_fields(self, client: httpx.AsyncClient, ca
         ]
         assert len(completed) == 1
         record = completed[0]
-        assert record.method == "GET"  # type: ignore[attr-defined]
-        assert record.path == "/dashboard"  # type: ignore[attr-defined]
+        assert record.method == "GET"  # ty: ignore[unresolved-attribute]
+        assert record.path == "/dashboard"  # ty: ignore[unresolved-attribute]
         assert hasattr(record, "status_code")
         assert hasattr(record, "duration_ms")

tests/integration/test_inertia_views.py

@@ -104,9 +104,7 @@ async def test_valid_submission_redirects_to_listing(
         listing = await authenticated_client.get("/api/products/")
         assert [p["name"] for p in listing.json()] == ["Formed"]
 
-    async def test_invalid_submission_redirects_back(
-        self, authenticated_client: httpx.AsyncClient
-    ):
+    async def test_invalid_submission_redirects_back(self, authenticated_client: httpx.AsyncClient):
         resp = await authenticated_client.post(
             "/products/",
             json={"name": "", "price": "0"},
@@ -146,9 +144,7 @@ async def test_delete_redirects_and_removes_product(
     ):
         product_id = await create_product(name="Doomed")
 
-        resp = await authenticated_client.delete(
-            f"/products/{product_id}", follow_redirects=False
-        )
+        resp = await authenticated_client.delete(f"/products/{product_id}", follow_redirects=False)
         assert resp.status_code == 303
         assert resp.headers["location"] == "/products"
 

tests/integration/test_products_journey.py

@@ -46,9 +46,7 @@ async def test_full_product_lifecycle(self, authenticated_client: httpx.AsyncCli
         assert final.status_code == 200
         assert all(p["id"] != product_id for p in final.json())
 
-    async def test_multiple_products_listed_in_order(
-        self, authenticated_client: httpx.AsyncClient
-    ):
+    async def test_multiple_products_listed_in_order(self, authenticated_client: httpx.AsyncClient):
         names = ["Alpha", "Beta", "Gamma"]
         ids = []
         for name in names: