Guard global rate limiting against the FastAPI 0.137+ regression

.github/dependabot.yml

@@ -0,0 +1,24 @@
+version: 2
+updates:
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      python-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      actions:
+        update-types:
+          - "minor"
+          - "patch"
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/ci.yml

@@ -14,16 +14,16 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v9.0.0
       - run: uv sync
       - run: uv run ruff check .
       - run: uv run ruff format --check .
 
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v9.0.0
       - run: uv sync
       - run: uv run pytest

.github/workflows/deploy.yml

@@ -27,7 +27,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: google-github-actions/auth@v3
         with:

.pre-commit-config.yaml

@@ -1,9 +1,9 @@
 fail_fast: true
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.8.6
+    rev: v0.16.0
     hooks:
-      - id: ruff
+      - id: ruff-check
         args: [--fix]
       - id: ruff-format
   - repo: local

.python-version

@@ -1 +1 @@
-3.12
+3.14

Dockerfile

@@ -1,9 +1,9 @@
-FROM python:3.12-slim
+FROM python:3.14-slim
 
 WORKDIR /app
 
 # Install uv
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.11.32 /uv /usr/local/bin/uv
 
 # Copy dependency files
 COPY pyproject.toml uv.lock* ./

app/config.py

@@ -36,7 +36,7 @@ def cors_origin_regex(self) -> str | None:
         return r"https://([a-z0-9-]+\.)?criticalbit\.gg"
 
     @model_validator(mode="after")
-    def validate_production_settings(self) -> "Settings":
+    def validate_production_settings(self) -> Settings:
         if not self.is_development:
             if "postgres:postgres@" in self.database_url:
                 raise ValueError("Default database credentials must not be used in production")

app/database.py

@@ -42,7 +42,7 @@ class Base(DeclarativeBase):
 )
 
 
-async def get_async_session() -> AsyncGenerator[AsyncSession, None]:
+async def get_async_session() -> AsyncGenerator[AsyncSession]:
     """Dependency that provides an async database session."""
     async with async_session_maker() as session:
         yield session

app/models/inventory.py

@@ -24,7 +24,7 @@ class Inventory(Base):
     base_int: Mapped[int | None] = mapped_column(Integer, nullable=True)
     base_agi: Mapped[int | None] = mapped_column(Integer, nullable=True)
 
-    items: Mapped[list["InventoryItem"]] = relationship(
+    items: Mapped[list[InventoryItem]] = relationship(
         back_populates="inventory", cascade="all, delete-orphan", lazy="selectin"
     )
 
@@ -53,4 +53,4 @@ class InventoryItem(Base):
     pp_current: Mapped[int | None] = mapped_column(Integer, nullable=True)
     pp_max: Mapped[int | None] = mapped_column(Integer, nullable=True)
 
-    inventory: Mapped["Inventory"] = relationship(back_populates="items")
+    inventory: Mapped[Inventory] = relationship(back_populates="items")

app/schemas/game_data.py

@@ -426,7 +426,7 @@ class EnemyDetailRead(BaseModel):
     movement: int = 0
     is_boss: bool = False
     body_parts: list[EnemyBodyPartRead] = []
-    drops: list["EnemyDropRead"] = []
+    drops: list[EnemyDropRead] = []
     encounters: list[EnemyEncounterRead] = []
 
     model_config = {"from_attributes": True, "populate_by_name": True}

pyproject.toml

@@ -3,7 +3,7 @@ name = "vagrant-story-api"
 version = "0.3.0"
 description = "Public game data API for Vagrant Story"
 readme = "README.md"
-requires-python = ">=3.12"
+requires-python = ">=3.14"
 dependencies = [
     "fastapi>=0.135.0",
     "uvicorn[standard]>=0.41.0",
@@ -38,7 +38,7 @@ testpaths = ["tests"]
 asyncio_default_fixture_loop_scope = "function"
 
 [tool.ruff]
-target-version = "py312"
+target-version = "py314"
 line-length = 100
 
 [tool.ruff.lint]
@@ -58,3 +58,13 @@ ignore = [
 
 [tool.ruff.lint.isort]
 known-first-party = ["app"]
+
+[tool.uv]
+# FastAPI >=0.137 changed how included routers' routes are resolved, which
+# breaks slowapi's SlowAPIMiddleware enforcement of `default_limits` on
+# undecorated routes mounted via include_router (verified here: the global
+# rate-limit canary fails on 0.140.x and passes on 0.135.x). Known upstream
+# as slowapi issue #281 with fix PR #282; drop this hold once a slowapi
+# release containing that fix ships. Starlette is capped alongside it since
+# slowapi has never been validated against Starlette 1.x.
+constraint-dependencies = ["fastapi<0.136", "starlette<1.0"]

tests/conftest.py

@@ -13,6 +13,17 @@
 async_session_maker = async_sessionmaker(engine, class_=AsyncSession, expire_on_commit=False)
 
 
+@pytest.fixture(autouse=True)
+def reset_rate_limiter():
+    """Clear rate-limit buckets between tests so request counts don't leak
+    across tests (the limiter storage is process-global)."""
+    from app.rate_limit import limiter
+
+    limiter._storage.reset()
+    yield
+    limiter._storage.reset()
+
+
 @pytest.fixture(autouse=True)
 async def setup_database():
     async with engine.begin() as conn:
@@ -22,7 +33,7 @@ async def setup_database():
         await conn.run_sync(Base.metadata.drop_all)
 
 
-async def override_get_async_session() -> AsyncGenerator[AsyncSession, None]:
+async def override_get_async_session() -> AsyncGenerator[AsyncSession]:
     async with async_session_maker() as session:
         yield session
 
@@ -31,7 +42,7 @@ async def override_get_async_session() -> AsyncGenerator[AsyncSession, None]:
 
 
 @pytest.fixture
-async def client() -> AsyncGenerator[AsyncClient, None]:
+async def client() -> AsyncGenerator[AsyncClient]:
     async with AsyncClient(
         transport=ASGITransport(app=app),
         base_url="http://test",
@@ -40,6 +51,6 @@ async def client() -> AsyncGenerator[AsyncClient, None]:
 
 
 @pytest.fixture
-async def session() -> AsyncGenerator[AsyncSession, None]:
+async def session() -> AsyncGenerator[AsyncSession]:
     async with async_session_maker() as session:
         yield session

tests/test_rate_limiting.py

@@ -0,0 +1,27 @@
+"""Global rate limiting behaviour.
+
+The Limiter's ``default_limits`` (60/min, enforced by SlowAPIMiddleware)
+must apply to every route that isn't decorated or exempt, and the
+infrastructure routes must stay exempt. This is the canary for the class
+of regression where a framework upgrade silently disables middleware
+enforcement (see slowapi issue #281 for fastapi>=0.137).
+"""
+
+from httpx import AsyncClient
+
+
+class TestGlobalRateLimit:
+    async def test_default_limit_enforced_on_undecorated_route(self, client: AsyncClient):
+        # /v1/armor has no explicit @limiter.limit, so it gets the 60/min
+        # default. (Matches `default_limits` in app/rate_limit.py — bump
+        # both together if that changes.)
+        for _ in range(60):
+            assert (await client.get("/v1/armor")).status_code == 200
+        assert (await client.get("/v1/armor")).status_code == 429
+
+    async def test_infrastructure_routes_are_exempt(self, client: AsyncClient):
+        # / and /health are @limiter.exempt — many rapid hits (well past
+        # the 60/min default) never 429.
+        for _ in range(70):
+            assert (await client.get("/health")).status_code == 200
+        assert (await client.get("/")).status_code == 200