Metadata-Version: 2.4
Name: wiregraph-fastapi
Version: 0.1.0
Summary: ASGI middleware for runtime PII leak detection — FastAPI/Starlette host for the wiregraph detection core
Author: Giorgio Chin
License-Expression: MIT
Keywords: asgi,data-loss-prevention,fastapi,pii,privacy,security,starlette
Classifier: Development Status :: 3 - Alpha
Classifier: Framework :: FastAPI
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Requires-Python: >=3.10
Requires-Dist: starlette>=0.37
Requires-Dist: wiregraph>=0.1.0
Provides-Extra: dev
Requires-Dist: fastapi>=0.110; extra == 'dev'
Requires-Dist: httpx>=0.27; extra == 'dev'
Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
Requires-Dist: pytest>=8.0; extra == 'dev'
Description-Content-Type: text/markdown

# wiregraph-fastapi

ASGI middleware for runtime PII leak detection in FastAPI/Starlette apps. Reuses the framework-agnostic detection core from [`wiregraph`](https://pypi.org/project/wiregraph/) — no Django at runtime.

## Status

`0.1.0` — log-only release. Detections are emitted to a configurable logger. Storage (`SQLAlchemySink`, alembic migrations) and a DRF-compatible read API land in `0.2.0` / `0.3.0`. 

## Install

```bash
pip install wiregraph-fastapi
```

## Quick start

```python
from fastapi import FastAPI
from wiregraph_fastapi import LoggingSink, WiregraphMiddleware

app = FastAPI()
app.add_middleware(WiregraphMiddleware, sink=LoggingSink())
```

POST a request with PII in the body and a structured log line is emitted per match.

## What's covered in 0.1.0

- Ingress: scans request bodies for PII before your handler sees them.
- Egress: scans response bodies after your handler returns (non-streaming only).
- JSON path enrichment: matches in JSON bodies are annotated with their dotted path.
- Admin-path exclusion: configurable URL prefixes are skipped.
- Tenant resolution: single-tenant by default; bring your own resolver for multi-tenant.

## What's not covered in 0.1.0

- Streaming responses (`StreamingResponse`) — skipped, logged at debug.
- Websocket frames.
- Outbound HTTP interception (planned post-v1).
- Presidio async pass (regex-only).
- Persistent storage and dashboard — coming in 0.2.0 / 0.3.0.
