chore: version 1.3.2

.editorconfig

@@ -0,0 +1,16 @@
+# EditorConfig is awesome: https://EditorConfig.org
+
+# top-most EditorConfig file
+root = true
+
+[*]
+indent_style = space
+indent_size = 4
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[Makefile]
+indent_style = tab
+indent_size = 2

.github/workflows/docker.yml

@@ -1,26 +1,34 @@
 name: Docker CI
-on: [push]
+
+concurrency:
+  group: docker-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - '.github/workflows/docker.yml'
+      - 'pyproject.toml'
+      - 'uv.lock'
+      - 'stapler/*'
+      - 'Dockerfile'
+
+env:
+  BUILDKIT_VERSION: 'v0.29.0'
+
 jobs:
-  build:
+  docker-build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - name: Checkout repository
-      - uses: docker/setup-buildx-action@v1
+        uses: actions/checkout@v6
-      - uses: actions/cache@v4
+      - name: Set up buildkit cache
+        uses: actions/cache@v4
         with:
-          path: /tmp/.buildx-cache
+          path: /var/lib/buildkit
-          key: ${{ runner.os }}-buildx-${{ github.sha }}
+          key: ${{ runner.os }}-buildkit-${{ env.BUILDKIT_VERSION }}
-          restore-keys: |
+      - name: Test docker build
-            ${{ runner.os }}-buildx-
+        uses: klemek/dockerfile-test-build@v1
-      - uses: docker/build-push-action@v2
         with:
-          context: ./
+          buildkit_version: ${{ env.BUILDKIT_VERSION }}
-          file: ./Dockerfile
-          builder: ${{ steps.buildx.outputs.name }}
-          push: false
-          cache-from: type=local,src=/tmp/.buildx-cache
-          cache-to: type=local,dest=/tmp/.buildx-cache-new
-      - run: |
-          rm -rf /tmp/.buildx-cache
-          mv /tmp/.buildx-cache-new /tmp/.buildx-cache
-      - run: echo ${{ steps.docker_build.outputs.digest }}

.github/workflows/lint.yml

@@ -0,0 +1,46 @@
+name: Python Lint CI
+
+concurrency:
+  group: lint-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - '.github/workflows/lint.yml'
+      - 'pyproject.toml'
+      - 'uv.lock'
+      - '.python-version'
+      - '**/*.py'
+
+jobs:
+  ruff:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+      - name: Set up UV
+        uses: actions/setup-uv@v1
+      - name: Run Ruff check
+        run: uv run ruff check --output-format=github
+
+  ruff-format-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+      - name: Set up UV
+        uses: actions/setup-uv@v1
+      - name: Run Ruff format check
+        run: uv run ruff format --check --output-format=github
+
+  ty:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+      - name: Set up UV
+        uses: actions/setup-uv@v1
+      - name: Run ty check
+        run: uv run ty check --output-format=github

.github/workflows/pythonci.yml

@@ -1,37 +0,0 @@
-name: Python CI
-on: [push]
-jobs: 
-  ruff:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-      - uses: astral-sh/ruff-action@v3
-  
-  ruff-format-check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-      - uses: astral-sh/ruff-action@v3
-        with:
-          args: "format --check --diff"
-
-  ty:
-    runs-on: ubuntu-latest
-    steps:
-      - run: python3 -m pip install uv
-      - uses: actions/checkout@v5
-      - run: python3 -m uv sync
-      - run: python3 -m uv run ty check --output-format github
-  
-  coverage:
-    runs-on: ubuntu-latest
-    steps:
-      - run: python3 -m pip install uv
-      - uses: actions/checkout@v5
-      - run: python3 -m uv sync
-      - run: python3 -m uv run coverage run -m unittest -v
-      - run: python3 -m uv run coverage xml
-      - uses: irongut/CodeCoverageSummary@v1.3.0
-        with:
-          filename: coverage.xml
-

.github/workflows/test.yml

@@ -0,0 +1,32 @@
+name: Python Test CI
+
+concurrency:
+  group: test-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - '.github/workflows/test.yml'
+      - 'pyproject.toml'
+      - 'uv.lock'
+      - '.python-version'
+      - '**/*.py'
+
+jobs:
+  coverage:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+      - name: Set up UV
+        uses: actions/setup-uv@v1
+      - name: Run tests with coverage
+        run: uv run coverage run -m unittest -v
+      - name: Generate coverage XML report
+        run: uv run coverage xml
+      - name: Create coverage summary
+        uses: actions/code-coverage-summary@v1.3.0
+        with:
+          filename: coverage.xml

.gitignore

@@ -11,4 +11,5 @@ coverage.xml
 crontab
 *.egg-info
 build
-dist
+dist
+.pytest_cache

Makefile

@@ -15,6 +15,7 @@ COVERAGE ?= $(UV) run --active coverage
 DOCKER ?= docker
 DOCKER_TAG ?= localhost/stapler:latest
 PORT ?= 8080
+OPEN ?= xdg-open
 
 # DOCS
 
@@ -116,6 +117,7 @@ coverage-report: .venv ## coverage report
 .PHONY: coverage-html
 coverage-html: .venv ## coverage html
 	@$(COVERAGE) html
+	@$(OPEN) htmlcov/index.html || true
 
 .PHONY: coverage-xml
 coverage-xml: .venv ## coverage xml

README.md

@@ -1,3 +1,5 @@
+[![](https://git.klemek.fr/klemek/stapler/actions/workflows/lint.yml/badge.svg?branch=main&style=flat-square)](https://git.klemek.fr/klemek/stapler/actions?workflow=lint.yml) [![](https://git.klemek.fr/klemek/stapler/actions/workflows/test.yml/badge.svg?branch=main&style=flat-square)](https://git.klemek.fr/klemek/stapler/actions?workflow=test.yml) [![](https://git.klemek.fr/klemek/stapler/actions/workflows/docker.yml/badge.svg?branch=main&style=flat-square)](https://git.klemek.fr/klemek/stapler/actions?workflow=docker.yml)
+
 # Stapler <!-- omit in toc -->
 
 *Static pages as simple as a gzip file*
@@ -113,18 +115,21 @@ PUT /{page}/
 # create archive from 'dist' dir and upload it to /my-project/
 tar -czC dist -f dist.tar.gz .
 curl -X PUT \
+  --fail-with-body \
   -H 'X-Token: <TOKEN>' \
   --data-binary "@dist.tar.gz" \
   https://stapler-host/my-project/
 
 # same thing but one-liner
 tar -czC dist . | curl -X PUT \
+  --fail-with-body \
   -H 'X-Token: <TOKEN>' \
   --data-binary @- \
   https://stapler-host/my-project/
 
 # make stapler server identify myproject.example.com and /my-project/
 tar -czC dist . | curl -X PUT \
+  --fail-with-body \
   --data-binary @- \
   -H 'X-Token: <TOKEN>' \
   -H 'X-Host: myproject.example.com' \
@@ -132,6 +137,7 @@ tar -czC dist . | curl -X PUT \
 
 # make stapler server identifiers myproject.example.com only
 tar -czC dist . | curl -X PUT \
+  --fail-with-body \
   --data-binary @- \
   -H 'X-Token: <TOKEN>' \
   -H 'X-Host-Only: myproject.example.com' \
@@ -139,6 +145,7 @@ tar -czC dist . | curl -X PUT \
 
 # make a SPA site at /my-project/index.html
 tar -czC dist . | curl -X PUT \
+  --fail-with-body \
   --data-binary @- \
   -H 'X-Token: <TOKEN>' \
   -H 'X-SPA: index.html' \
@@ -161,12 +168,14 @@ PUT /{page}/
 ```bash
 # create /my-project/ that redirects to https://github.com/my-project
 curl -X PUT \
+  --fail-with-body \
   -H 'X-Token: <TOKEN>' \
   -H 'X-Redirect: https://github.com/my-project' \
   https://stapler-host/my-project/
 
 # simple redirect from root host to www
 curl -X PUT \
+  --fail-with-body \
   -H 'X-Token: <TOKEN>' \
   -H 'X-Proxy: https://www.my-website.com' \
   -H 'X-Host: my-website.com' \
@@ -186,6 +195,7 @@ PUT /{page}/
 ```bash
 # create /my-website/ that proxies to http://host.containers.internal:8000
 curl -X PUT \
+  --fail-with-body \
   -H 'X-Token: <TOKEN>' \
   -H 'X-Proxy: http://host.containers.internal:8000' \
   https://stapler-host/my-project/
@@ -201,6 +211,7 @@ DELETE /{page}/
 ```bash
 # delete /my-project/
 curl -X DELETE \
+  --fail-with-body \
   -H 'X-Token: <TOKEN>' \
   https://stapler-host/my-project/
 ```
@@ -227,7 +238,7 @@ curl -X DELETE \
         run: tar -czC dist -f dist.tar.gz .
       - name: Deploy to Stapler server
         run: |
-          curl -X PUT --data-binary "@dist.tar.gz" \
+          curl -X PUT --fail-with-body --data-binary "@dist.tar.gz" \
             -H 'X-Token: ${{ secrets.STAPLER_TOKEN }}' \
             -H 'X-Host: ${{ vars.TARGET_HOST }}' \
             ${{ vars.STAPLER_URL }}
@@ -263,4 +274,4 @@ $EDITOR .env # update HOST and TOKEN_SALT
 docker compose up
 # whenever you need a new token
 docker compose run --rm stapler token
-```
+```

crontab.example

@@ -1,3 +1,3 @@
 # do daily/weekly/monthly maintenance
 # min   hour    day     month   weekday command
-0       3       *       *       1       /app/main.py renew
+0       3       *       *       1       stapler renew

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stapler"
-version = "1.2.2"
+version = "1.3.2"
 description = "Static pages as simple as a gzip file"
 requires-python = ">=3.14"
 dependencies = [
@@ -21,13 +21,15 @@ module-name = "stapler"
 [dependency-groups]
 dev = [
     "coverage>=7.13.5",
+    "parameterized>=0.9.0",
+    "pytest>=9.0.3",
     "ruff>=0.15.10",
     "ty>=0.0.29",
 ]
 
 [tool.ruff.lint]
 select = ["ALL"]
-ignore = ["D", "E501", "S104", "PLR2004", "ANN401", "BLE001", "COM812", "S603", "PLR0911", "S101", "PT"]
+ignore = ["D", "E501", "S104", "PLR2004", "ANN401", "BLE001", "COM812", "S603", "PLR0911", "S101", "PT", "E722"]
 
 [tool.coverage.run]
 source = ["stapler"]

stapler/cert_manager.py

@@ -5,6 +5,8 @@ import ssl
 import subprocess
 import typing
 
+from stapler.strings import valid_host
+
 if typing.TYPE_CHECKING:
     from .params import Parameters
 
@@ -35,7 +37,7 @@ class CertManager:
         self.with_certbot: bool = params.with_certbot
         self.last_file_change: int | float = 0
 
-    def init(self, hosts: list[str]) -> None:
+    def init(self) -> None:
         self.logger.debug("Initializing...")
         if not self.certbot_www.exists():
             self.certbot_www.mkdir(parents=True)
@@ -43,8 +45,6 @@ class CertManager:
         if not self.self_signed_path.exists():
             self.self_signed_path.mkdir(parents=True)
             self.logger.debug("Created %s", self.self_signed_path)
-        for host in hosts:
-            self.init_cert(host)
 
     def exists(self, host: str) -> bool:
         return self.__exists_certbot(host) or self.__exists_self_signed(host)
@@ -57,7 +57,7 @@ class CertManager:
 
     def create_or_update(self, host: str) -> bool:
         created = self.init_cert(host)
-        if self.with_certbot and self.__create_certbot(host):
+        if self.with_certbot and valid_host(host) and self.__create_certbot(host):
             return True
         return created or self.__create_self_signed(host)
 
@@ -185,11 +185,16 @@ class CertManager:
             return False
         return self.__exists_certbot(host)
 
-    def sni_callback(
+    def servername_callback(
-        self, socket: ssl.SSLObject, host: str | None, _: ssl.SSLContext, /
+        self,
+        socket: ssl.SSLSocket | ssl.SSLObject,
+        host: str | None,
+        _: ssl.SSLSocket,
+        /,
     ) -> None | int:
         if host is None:
             return None
+        self.logger.debug("servername callback: %s", host)
         if not self.exists(host) and not self.create_or_update(host):
             return None
         cert_file = self.get_cert(host)
@@ -200,6 +205,7 @@ class CertManager:
                 cert_file,
                 key_file,
             )
+            new_context.set_alpn_protocols(["http/1.1"])
             socket.context = new_context
         except Exception:
             self.logger.exception("Could not create HTTPS context for %s", host)

stapler/data_dir.py

@@ -16,7 +16,7 @@ class DataDir:
     ]
 
     PATH_REGEX = re.compile(r"^[\w-]+$")
-    NEEDED_FILES: typing.ClassVar[list[str]] = ["favicon.ico"]
+    NEEDED_FILES: typing.ClassVar[list[str]] = ["favicon.ico", "robots.txt"]
 
     def __init__(self, root_path: str) -> None:
         self.logger: logging.Logger = logging.getLogger(self.__class__.__name__)

stapler/handlers.py

@@ -16,6 +16,7 @@ import requests
 
 from . import PKG_VERSION, STAPLER_ASCII, logs
 from .data_dir import DataDir
+from .strings import sanitize_string, valid_host
 
 if typing.TYPE_CHECKING:
     from .page import Page
@@ -25,6 +26,10 @@ if typing.TYPE_CHECKING:
 
 
 class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
+    timeout = 10
+    protocol_version = "HTTP/1.1"
+    REQUEST_COUNT = 0
+
     @typing.override
     def __init__(
         self,
@@ -38,7 +43,10 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
         self.__host: str | None = None
         self.__in_size: int | None = None
         self.https: bool = params.https
+        self.__class__.REQUEST_COUNT += 1
         super().__init__(*args, **kwargs)
+        with contextlib.suppress(Exception):
+            self.connection.close()
 
     @typing.override
     def send_error(
@@ -73,6 +81,10 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
         else:
             self.send_status_only(code, message)
 
+    @typing.override
+    def address_string(self) -> str:  # pragma: no cover
+        return sanitize_string(super().address_string())
+
     @typing.override
     def log_message(self, format: str, *args: typing.Any) -> None:  # pragma: no cover
         fmt = "%s - " + format
@@ -83,9 +95,25 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
         fmt = "%s - " + format
         self.logger.error(fmt, self.address_string(), *args)
 
+    def _pre_log_request(self) -> None:  # pragma: no cover
+        args = (
+            "...",
+            self.address_string(),
+            self.host,
+            format(self.__class__.REQUEST_COUNT, "07_d"),
+            sanitize_string(self.requestline),
+        )
+        fmt = "← %s - %s - %s - %s - %s"
+        if self.in_size > 0:
+            args = (*args, self.in_size)
+            fmt += " - %s"
+        self.logger.debug(fmt, *args)
+
     @typing.override
     def log_request(self, code: str = "?", size: str = "-") -> None:  # ty:ignore[invalid-method-override] # pragma: no cover
         if isinstance(code, http.HTTPStatus):
+            code = code.value
+        if isinstance(code, int):
             color = logs.TermColor.RED
             if 100 <= code < 200:
                 color = logs.TermColor.CYAN
@@ -95,11 +123,17 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
                 color = logs.TermColor.BLUE
             elif 400 <= code < 500:
                 color = logs.TermColor.YELLOW
-            code = color + str(code.value) + logs.TermColor.RESET
+            code = color + str(code) + logs.TermColor.RESET
         if size == "" and self.out_size > 0:
             size = str(self.out_size)
-        args = (code, self.address_string(), self.host, self.requestline)
+        args = (
-        fmt = "→ %s - %s - %s - %s"
+            code,
+            self.address_string(),
+            self.host,
+            format(self.__class__.REQUEST_COUNT, "07_d"),
+            sanitize_string(self.requestline),
+        )
+        fmt = "→ %s - %s - %s - %s - %s"
         if size != "":
             args = (*args, size)
             fmt += " - %s"
@@ -117,6 +151,7 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
         self.send_response(code, message)
         self.send_header("Content-Type", f"{content_type}; charset=UTF-8")
         self.send_header("Content-Length", str(len(encoded)))
+        self.send_header("Connection", "close")
         self.end_headers()
         self.wfile.write(encoded)
         self.close_connection = True
@@ -131,6 +166,7 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
             headers = {}
         self.send_response(code, message)
         self.send_header("Content-Length", "0")
+        self.send_header("Connection", "close")
         for header, value in headers.items():
             self.send_header(header, value)
         self.end_headers()
@@ -160,13 +196,19 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
                 headers=headers,
                 allow_redirects=False,
                 timeout=480,
+                stream=False,
             )
         except Exception as e:
             self.send_error(
                 http.HTTPStatus.BAD_GATEWAY, f"Could not reach {url}", explain=str(e)
             )
             return
-        self.send_response(response.status_code, response.reason)
+        self.send_response(
+            response.status_code
+            if type(response.status_code) is int
+            else http.HTTPStatus.BAD_GATEWAY,
+            response.reason,
+        )
         for header, value in response.headers.items():
             if header.lower() not in [
                 "content-length",
@@ -174,9 +216,11 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
                 "transfer-encoding",
                 "server",
                 "date",
+                "connection",
             ]:
                 self.send_header(header, value.replace(target_host, self.host))
         self.send_header("Content-Length", str(out_size := len(response.content)))
+        self.send_header("Connection", "close")
         self.end_headers()
         if out_size > 0:
             self.wfile.write(response.content)
@@ -213,14 +257,6 @@ class BaseHandler(abc.ABC, http.server.BaseHTTPRequestHandler):
             and len(self.headers[key]) > 0
         )
 
-    def _pre_log_request(self) -> None:  # pragma: no cover
-        args = ("...", self.address_string(), self.host, self.requestline)
-        fmt = "← %s - %s - %s - %s"
-        if self.in_size > 0:
-            args = (*args, self.in_size)
-            fmt += " - %s"
-        self.logger.debug(fmt, *args)
-
     def server_signature(self) -> str:
         return self.server_version + "\n\n" + STAPLER_ASCII + "\n"
 
@@ -240,7 +276,7 @@ class RequestHandler(http.server.SimpleHTTPRequestHandler, BaseHandler):
     UPDATE_PATH_REGEX = re.compile(r"^\/([\w-]+)\/?$")
     GET_PATH_REGEX = re.compile(r"^\/([\w-]+)($|\/)")
     HOST_PART_REGEX = re.compile(r"^([a-z0-9]|[a-z0-9][a-z0-9-]{,61}[a-z0-9])$")
-    AUTHORIZED_PATHS: typing.ClassVar[list[str]] = ["/favicon.ico"]
+    AUTHORIZED_PATHS: typing.ClassVar[list[str]] = ["/favicon.ico", "/robots.txt"]
     TOKEN_HEADER = "X-Token"  # noqa: S105
     HOST_HEADER = "X-Host"
     HOST_ONLY_HEADER = "X-Host-Only"
@@ -270,7 +306,12 @@ class RequestHandler(http.server.SimpleHTTPRequestHandler, BaseHandler):
         self.__target_redirect: str | None = None
         self.__target_proxy: str | None = None
         self.__target_spa: str | None = None
-        super().__init__(*args, directory=params.data_dir, **kwargs, params=params)  # ty:ignore[unknown-argument]
+        try:
+            super().__init__(*args, directory=params.data_dir, **kwargs, params=params)  # ty:ignore[unknown-argument]
+        except (BrokenPipeError, ConnectionResetError) as e:
+            self.logger.error("Connection lost: %s", str(e))  # noqa: TRY400
+        except:
+            self.logger.exception("Could not handle request")
 
     @property
     def token(self) -> str:
@@ -348,6 +389,7 @@ class RequestHandler(http.server.SimpleHTTPRequestHandler, BaseHandler):
             self._pre_log_request()
             if not self._proxy_or_redirect():
                 super().do_HEAD()
+            self.close_connection = True
 
     @typing.override
     def do_GET(self) -> None:
@@ -357,7 +399,9 @@ class RequestHandler(http.server.SimpleHTTPRequestHandler, BaseHandler):
                 return None
             if self.path == "/" and self.host == self.default_host:
                 return self.send_basic_body(self.server_signature())
-            return super().do_GET()
+            super().do_GET()
+            self.close_connection = True
+            return None
 
     def do_PUT(self) -> None:
         with self.handle_errors():
@@ -505,6 +549,11 @@ class RequestHandler(http.server.SimpleHTTPRequestHandler, BaseHandler):
                 return super().translate_path(path)
             return ""
         if self.host != self.default_host:
+            if (
+                not (self.root_path / page.path / path).is_file()
+                and path in self.AUTHORIZED_PATHS
+            ):
+                return super().translate_path(path)
             path = f"/{page.path}" + path
         if pathlib.Path(path).name.startswith("."):  # hidden files
             return ""
@@ -542,7 +591,7 @@ class RequestHandler(http.server.SimpleHTTPRequestHandler, BaseHandler):
                 f"Cannot use {self.HOST_ONLY_HEADER} with {self.HOST_HEADER}",
             )
             return None
-        if self.has_target_host and not self.__valid_host(self.target_host):
+        if self.has_target_host and not valid_host(self.target_host):
             self.send_error(http.HTTPStatus.BAD_REQUEST, "Invalid requested host")
             return None
         if self.has_target_proxy and self.has_target_redirect:
@@ -565,12 +614,6 @@ class RequestHandler(http.server.SimpleHTTPRequestHandler, BaseHandler):
             return match.group(1)
         return None
 
-    def __valid_host(self, host: str) -> bool:
-        return (
-            all(self.HOST_PART_REGEX.fullmatch(part) for part in host.split("."))
-            and len(host) < 256
-        )
-
     def __get_page(self, src_path: str) -> Page | None:
         if self.host == self.default_host:
             if (
@@ -584,16 +627,19 @@ class RequestHandler(http.server.SimpleHTTPRequestHandler, BaseHandler):
 
 
 class UpgradeHandler(RequestHandler):
+    protocol_version = "HTTP/1.0"
     server_version = "StaplerUpgradeServer/" + PKG_VERSION
 
     def do_HEAD(self) -> None:
         with self.handle_errors():
             self._pre_log_request()
             self.send_redirect(f"https://{self.host}{self.path}")
+            self.close_connection = True
 
     def do_GET(self) -> None:
         with self.handle_errors():
             if self.path.startswith(self.CERTBOT_CHALLENGE_PATH):
                 super().do_GET()
+                self.close_connection = True
             else:
                 self.do_HEAD()

stapler/robots.txt

@@ -0,0 +1,2 @@
+User-agent: *
+Disallow: /

stapler/server.py

@@ -29,7 +29,6 @@ class StaplerServer:
         "logger",
         "params",
         "registry",
-        "server",
         "token_manager",
     ]
 
@@ -41,7 +40,6 @@ class StaplerServer:
         self.token_manager: TokenManager = TokenManager(params, self.registry)
         self.data_dir: DataDir = DataDir(params.data_dir)
         self.default_host: str = params.host.split(":", maxsplit=2)[0]
-        self.server: http.server.ThreadingHTTPServer | None = None
 
     def __get_all_hosts(self) -> list[str]:
         return [self.default_host, *self.registry.get_hosts()]
@@ -50,7 +48,7 @@ class StaplerServer:
         self.logger.info("Starting up...")
         self.registry.load_pages()
         if self.params.with_certificates:
-            self.cert_manager.init(self.__get_all_hosts())
+            self.cert_manager.init()
         self.data_dir.init()
         self.token_manager.init()
 
@@ -75,7 +73,7 @@ class StaplerServer:
             )
             context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
             server.socket = context.wrap_socket(server.socket, server_side=True)
-            context.sni_callback = self.cert_manager.sni_callback
+            context.set_servername_callback(self.cert_manager.servername_callback)
         else:
             server = http.server.ThreadingHTTPServer(
                 (
@@ -131,7 +129,7 @@ class StaplerServer:
         for line in STAPLER_ASCII.split("\n"):
             self.logger.debug(line.ljust(36))
         self.__startup()
-        self.server = self.__create_base_server()
+        base_server = self.__create_base_server()
         upgrade_server = self.__start_upgrade_server() if self.params.https else None
         self.logger.info(
             "Server up and ready on %s://%s",
@@ -140,7 +138,7 @@ class StaplerServer:
         )
         self.__start_background_tasks()
         with contextlib.suppress(KeyboardInterrupt):
-            self.server.serve_forever()
+            base_server.serve_forever()
         self.logger.info("Shutting down...")
         if upgrade_server is not None:
             upgrade_server.shutdown()
@@ -152,7 +150,7 @@ class StaplerServer:
             self.logger.warning("Cannot renew without certificates")
             return 1
         self.registry.load_pages()
-        self.cert_manager.init(self.__get_all_hosts())
+        self.cert_manager.init()
         for host in self.__get_all_hosts():
             self.cert_manager.create_or_update(host)
         return 0

stapler/strings.py

@@ -0,0 +1,19 @@
+import re
+
+__HOST_PART_REGEX = re.compile(r"^([a-z0-9]|[a-z0-9][a-z0-9-]{,61}[a-z0-9])$")
+__SANITIZE_REGEX = re.compile(r"[^\x20-\x7F]")
+
+
+def valid_host(host: str) -> bool:
+    parts = host.split(".")
+    return (
+        len(parts) > 1
+        and len(parts[-1]) > 1
+        and all(__HOST_PART_REGEX.fullmatch(part) for part in parts)
+        and not all(part.isnumeric() for part in parts)
+        and len(host) < 256
+    )
+
+
+def sanitize_string(raw: str) -> str:
+    return __SANITIZE_REGEX.sub("?", raw)

tests/test_cert_manager.py

@@ -35,41 +35,33 @@ class TestRegistry(BaseTestCase):
             self.patch("shutil.which", count=0),
             self.patch("subprocess.check_output", count=0),
         ):
-            self.cert_manager.init([])
+            self.cert_manager.init()
             assert self.self_signed_path.is_dir()
             assert self.certbot_www.is_dir()
 
-    def test_init_with_hosts(self) -> None:
-        with (
-            self.patch("shutil.which", count=0),
-            self.patch("subprocess.check_output", count=0),
-        ):
-            self._make_self_signed("localhost")
-            self.cert_manager.init(["localhost"])
-
     def test_exists_self_signed(self) -> None:
-        self._make_self_signed("localhost")
+        self._make_self_signed("example.com")
-        assert self.cert_manager.exists("localhost")
+        assert self.cert_manager.exists("example.com")
 
     def test_exists_certbot(self) -> None:
-        self._make_certbot("localhost")
+        self._make_certbot("example.com")
-        assert self.cert_manager.exists("localhost")
+        assert self.cert_manager.exists("example.com")
 
     def test_exists_fail(self) -> None:
-        assert not self.cert_manager.exists("localhost")
+        assert not self.cert_manager.exists("example.com")
 
     def test_exists_fail_without_certbot(self) -> None:
         self.cert_manager.with_certbot = False
-        self._make_certbot("localhost")
+        self._make_certbot("example.com")
-        assert not self.cert_manager.exists("localhost")
+        assert not self.cert_manager.exists("example.com")
 
     def test_init_cert_existing(self) -> None:
         with (
             self.patch("shutil.which", count=0),
             self.patch("subprocess.check_output", count=0),
         ):
-            self._make_self_signed("localhost")
+            self._make_self_signed("example.com")
-            assert not self.cert_manager.init_cert("localhost")
+            assert not self.cert_manager.init_cert("example.com")
 
     def test_init_cert_fail(self) -> None:
         with (
@@ -77,7 +69,7 @@ class TestRegistry(BaseTestCase):
             self.patch("subprocess.check_output") as process_mock,
         ):
             process_mock.side_effect = subprocess.CalledProcessError(1, "", output=b"")
-            assert not self.cert_manager.init_cert("localhost")
+            assert not self.cert_manager.init_cert("example.com")
 
     def test_init_cert_new(self) -> None:
         with (
@@ -85,135 +77,139 @@ class TestRegistry(BaseTestCase):
             self.patch("subprocess.check_output") as process_mock,
         ):
             process_mock.side_effect = lambda *_, **__: self._make_self_signed(
-                "localhost"
+                "example.com"
             )
-            assert self.cert_manager.init_cert("localhost")
+            assert self.cert_manager.init_cert("example.com")
 
     def test_create_or_update_existing_no_certbot(self) -> None:
-        self._make_self_signed("localhost")
+        self._make_self_signed("example.com")
         self.cert_manager.with_certbot = False
         with (
             self.patch("shutil.which", return_value=""),
             self.patch("subprocess.check_output") as process_mock,
         ):
             process_mock.side_effect = lambda *_, **__: self._make_self_signed(
-                "localhost"
+                "example.com"
             )
-            assert self.cert_manager.create_or_update("localhost")
+            assert self.cert_manager.create_or_update("example.com")
 
     def test_create_or_update_existing_certbot(self) -> None:
-        self._make_certbot("localhost")
+        self._make_certbot("example.com")
         with (
             self.patch("shutil.which", return_value=""),
             self.patch("subprocess.check_output") as process_mock,
         ):
-            process_mock.side_effect = lambda *_, **__: self._make_certbot("localhost")
+            process_mock.side_effect = lambda *_, **__: self._make_certbot(
-            assert self.cert_manager.create_or_update("localhost")
+                "example.com"
+            )
+            assert self.cert_manager.create_or_update("example.com")
 
     def test_create_or_update_existing_fail_both(self) -> None:
-        self._make_certbot("localhost")
+        self._make_certbot("example.com")
         with (
             self.patch("shutil.which", return_value="", count=2),
             self.patch("subprocess.check_output", count=2) as process_mock,
         ):
             process_mock.side_effect = subprocess.CalledProcessError(1, "", output=b"")
-            assert not self.cert_manager.create_or_update("localhost")
+            assert not self.cert_manager.create_or_update("example.com")
 
     def test_create_or_update_existing_fail_both_binary(self) -> None:
-        self._make_certbot("localhost")
+        self._make_certbot("example.com")
         with (
             self.patch("shutil.which", count=2),
             self.patch("subprocess.check_output", count=0),
         ):
-            assert not self.cert_manager.create_or_update("localhost")
+            assert not self.cert_manager.create_or_update("example.com")
 
     def test_get_cert_certbot(self) -> None:
-        self._make_certbot("localhost")
+        self._make_certbot("example.com")
         self.assertEqual(
-            self.cert_manager.get_cert("localhost"),
+            self.cert_manager.get_cert("example.com"),
-            self.certbot_conf / "live" / "localhost" / CertManager.CRT_FILE,
+            self.certbot_conf / "live" / "example.com" / CertManager.CRT_FILE,
         )
 
     def test_get_cert_self_signed(self) -> None:
-        self._make_self_signed("localhost")
+        self._make_self_signed("example.com")
         self.assertEqual(
-            self.cert_manager.get_cert("localhost"),
+            self.cert_manager.get_cert("example.com"),
-            self.self_signed_path / "localhost" / CertManager.CRT_FILE,
+            self.self_signed_path / "example.com" / CertManager.CRT_FILE,
         )
 
     def test_get_cert_fail(self) -> None:
         self.assertRaises(
             CertManagerError,
-            lambda: self.cert_manager.get_cert("localhost"),
+            lambda: self.cert_manager.get_cert("example.com"),
         )
 
     def test_get_key_certbot(self) -> None:
-        self._make_certbot("localhost")
+        self._make_certbot("example.com")
         self.assertEqual(
-            self.cert_manager.get_key("localhost"),
+            self.cert_manager.get_key("example.com"),
-            self.certbot_conf / "live" / "localhost" / CertManager.KEY_FILE,
+            self.certbot_conf / "live" / "example.com" / CertManager.KEY_FILE,
         )
 
     def test_get_key_self_signed(self) -> None:
-        self._make_self_signed("localhost")
+        self._make_self_signed("example.com")
         self.assertEqual(
-            self.cert_manager.get_key("localhost"),
+            self.cert_manager.get_key("example.com"),
-            self.self_signed_path / "localhost" / CertManager.KEY_FILE,
+            self.self_signed_path / "example.com" / CertManager.KEY_FILE,
         )
 
     def test_get_key_fail(self) -> None:
         self.assertRaises(
             CertManagerError,
-            lambda: self.cert_manager.get_key("localhost"),
+            lambda: self.cert_manager.get_key("example.com"),
         )
 
-    def test_sni_callback_no_host(self) -> None:
+    def test_servername_callback_no_host(self) -> None:
-        self._make_self_signed("localhost")
+        self._make_self_signed("example.com")
         with (
             self.patch("ssl.create_default_context", count=0),
         ):
-            self.cert_manager.sni_callback(self.socket_mock, None, self.context_mock)
+            self.cert_manager.servername_callback(
+                self.socket_mock, None, self.context_mock
+            )
 
-    def test_sni_callback_fail(self) -> None:
+    def test_servername_callback_fail(self) -> None:
-        self._make_self_signed("localhost")
+        self._make_self_signed("example.com")
         with (
             self.patch("shutil.which", count=3),
             self.patch("ssl.create_default_context", count=0),
         ):
-            self.cert_manager.sni_callback(
+            self.cert_manager.servername_callback(
-                self.socket_mock, "new_host", self.context_mock
+                self.socket_mock, "example.fr", self.context_mock
             )
 
-    def test_sni_callback_create_context(self) -> None:
+    def test_servername_callback_create_context(self) -> None:
-        self._make_self_signed("localhost")
+        self._make_self_signed("example.com")
         with (
             self.patch("ssl.create_default_context", return_value=self.context_mock),
             self.mock_call(
                 self.context_mock.load_cert_chain,
                 [
-                    self.self_signed_path / "localhost" / CertManager.CRT_FILE,
+                    self.self_signed_path / "example.com" / CertManager.CRT_FILE,
-                    self.self_signed_path / "localhost" / CertManager.KEY_FILE,
+                    self.self_signed_path / "example.com" / CertManager.KEY_FILE,
                 ],
             ),
             self.patch("shutil.which", count=0),
         ):
-            self.cert_manager.sni_callback(
+            self.cert_manager.servername_callback(
-                self.socket_mock, "localhost", self.context_mock
+                self.socket_mock, "example.com", self.context_mock
             )
 
-    def test_sni_callback_create_context_fail(self) -> None:
+    def test_servername_callback_create_context_fail(self) -> None:
-        self._make_self_signed("localhost")
+        self._make_self_signed("example.com")
         with (
             self.patch("ssl.create_default_context", return_value=self.context_mock),
             self.patch("shutil.which", count=0),
         ):
             self.context_mock.load_cert_chain.side_effect = Exception
-            self.cert_manager.sni_callback(
+            self.cert_manager.servername_callback(
-                self.socket_mock, "localhost", self.context_mock
+                self.socket_mock, "example.com", self.context_mock
             )
             self.context_mock.load_cert_chain.assert_called_once_with(
-                self.self_signed_path / "localhost" / CertManager.CRT_FILE,
+                self.self_signed_path / "example.com" / CertManager.CRT_FILE,
-                self.self_signed_path / "localhost" / CertManager.KEY_FILE,
+                self.self_signed_path / "example.com" / CertManager.KEY_FILE,
             )
 
     def _make_self_signed(self, host: str) -> None:

tests/test_data_dir.py

@@ -59,11 +59,6 @@ class TestDataDir(BaseTestCase):
         self.__create_path("test_1")
         self.assertIsNone(self.data_dir.get_file("test_1", ".value"))
 
-    def test_get_file_cannot_read(self) -> None:
-        self.__create_path("test_1", {".value": "value"})
-        (self.tmp_path / "test_1" / ".value").chmod(0o333)
-        self.assertIsNone(self.data_dir.get_file("test_1", ".value"))
-
     def test_get_file_invalid_path(self) -> None:
         self.assertIsNone(self.data_dir.get_file("test_1", ".value"))
 

tests/test_handlers.py

@@ -162,6 +162,36 @@ class TestRequestHandler(BaseHandlerTestCase):
             handler.data_dir = self.data_dir
             return handler
 
+    def test_handle_errors_silently(self) -> None:
+        with self.patch("http.server.BaseHTTPRequestHandler.__init__") as mock:
+            mock.side_effect = Exception
+            logging.basicConfig(level=logging.CRITICAL)
+            RequestHandler(
+                unittest.mock.MagicMock(),
+                "127.0.0.1",
+                unittest.mock.MagicMock(),
+                params=Parameters(
+                    data_dir=self.get_tmp_dir(), certbot_www=str(self.certbot_www)
+                ),
+                registry=self.registry,
+                token_manager=self.token_manager,
+            )
+
+    def test_handle_disconnect_silently(self) -> None:
+        with self.patch("http.server.BaseHTTPRequestHandler.__init__") as mock:
+            mock.side_effect = BrokenPipeError
+            logging.basicConfig(level=logging.CRITICAL)
+            RequestHandler(
+                unittest.mock.MagicMock(),
+                "127.0.0.1",
+                unittest.mock.MagicMock(),
+                params=Parameters(
+                    data_dir=self.get_tmp_dir(), certbot_www=str(self.certbot_www)
+                ),
+                registry=self.registry,
+                token_manager=self.token_manager,
+            )
+
     def test_do_head_forward(self) -> None:
         handler = self._get_handler()
         with (
@@ -829,6 +859,7 @@ class TestRequestHandler(BaseHandlerTestCase):
                     },
                     "allow_redirects": False,
                     "timeout": 480,
+                    "stream": False,
                 },
             ),
             self.expects_status_only(handler, 200, "OK"),
@@ -873,6 +904,7 @@ class TestRequestHandler(BaseHandlerTestCase):
                     },
                     "allow_redirects": False,
                     "timeout": 480,
+                    "stream": False,
                 },
             ),
             self.expects_status_only(handler, 200, "OK"),
@@ -915,6 +947,7 @@ class TestRequestHandler(BaseHandlerTestCase):
                     },
                     "allow_redirects": False,
                     "timeout": 480,
+                    "stream": False,
                 },
             ),
             self.expects_basic_body(handler, "hello", message="OK"),
@@ -949,6 +982,7 @@ class TestRequestHandler(BaseHandlerTestCase):
                     },
                     "allow_redirects": False,
                     "timeout": 480,
+                    "stream": False,
                 },
             ) as request_mock,
             self.expects_status_only(
@@ -992,6 +1026,7 @@ class TestRequestHandler(BaseHandlerTestCase):
                     },
                     "allow_redirects": False,
                     "timeout": 480,
+                    "stream": False,
                 },
             ),
             self.expects_status_only(handler, 200, "OK"),
@@ -1032,6 +1067,7 @@ class TestRequestHandler(BaseHandlerTestCase):
                     },
                     "allow_redirects": False,
                     "timeout": 480,
+                    "stream": False,
                 },
             ),
             self.expects_status_only(handler, 200, "OK"),
@@ -1162,6 +1198,21 @@ class TestRequestHandler(BaseHandlerTestCase):
                 None,
             )
 
+    def test_translate_path_with_host_favicon(self) -> None:
+        handler = self._get_handler(headers={"Host": "example.com"})
+        with (
+            self.mock_call(self.registry.get_from_host, ["example.com"], Page("path")),
+            self.patch_call(
+                "http.server.SimpleHTTPRequestHandler.translate_path",
+                ["/favicon.ico"],
+            ),
+            self.seal_mocks(),
+        ):
+            self.assertEqual(
+                handler.translate_path("/favicon.ico"),
+                None,
+            )
+
     def test_translate_path_default_host(self) -> None:
         handler = self._get_handler()
         with (
@@ -1253,6 +1304,7 @@ class TestUpgradeHandler(BaseHandlerTestCase):
             handler.headers = collections.defaultdict(lambda: None, headers)  # ty:ignore[invalid-assignment]
             handler.rfile = rfile if rfile is not None else io.BytesIO()
             handler.wfile = io.BytesIO()
+            handler.client_address = ("127.0.0.1", 12345)
             handler.logger = unittest.mock.Mock(logging.Logger)
             handler.data_dir = self.data_dir
             return handler

tests/test_server.py

@@ -26,10 +26,8 @@ class TestStaplerServer(BaseTestCase):
     def test_renew(self) -> None:
         with (
             self.mock_call(self.registry.load_pages),
-            self.mock_calls(
+            self.mock_calls(self.registry.get_hosts, [[]], [["host_1"]]),
-                self.registry.get_hosts, [[], []], [["host_1"], ["host_1"]]
+            self.mock_call(self.cert_manager.init),
-            ),
-            self.mock_call(self.cert_manager.init, [["localhost", "host_1"]]),
             self.mock_calls(
                 self.cert_manager.create_or_update, [["localhost"], ["host_1"]]
             ),
@@ -67,16 +65,16 @@ class TestStaplerServer(BaseTestCase):
 
     def test_run_https(self) -> None:
         self.token_manager.detect_file_change.side_effect = KeyboardInterrupt
-        self.cert_manager.sni_callback = unittest.mock.Mock()
+        self.cert_manager.servername_callback = unittest.mock.Mock()
         with (
             self.mock_call(self.registry.load_pages),
-            self.mock_call(self.registry.get_hosts, [], []),
+            self.mock_call(self.cert_manager.init),
-            self.mock_call(self.cert_manager.init, [["localhost"]]),
             self.mock_call(self.data_dir.init),
             self.mock_call(self.token_manager.init),
             self.patch("ssl.create_default_context", return_value=self.context_mock),
             self.patch("http.server.ThreadingHTTPServer", self.server_mock, 2),
             self.mock_call_unchecked(self.context_mock.wrap_socket),
+            self.mock_call_unchecked(self.context_mock.set_servername_callback),
             self.mock_calls_unchecked(self.server_mock.serve_forever, 2),
             self.mock_call(self.server_mock.shutdown),
             self.seal_mocks(),

tests/test_strings.py

@@ -0,0 +1,22 @@
+import parameterized
+
+from stapler.strings import sanitize_string, valid_host
+
+from . import BaseTestCase
+
+
+class TestStrings(BaseTestCase):
+    def test_sanitize(self) -> None:
+        self.assertEqual("??A??", sanitize_string("\n\tA\x00\x99"))
+
+    @parameterized.parameterized.expand(
+        [("example.com"), ("test-test.com"), ("subdomain.example.com")]
+    )
+    def test_valid_host(self, host: str) -> None:
+        self.assertTrue(valid_host(host), host)
+
+    @parameterized.parameterized.expand(
+        [("example.c"), ("localhost"), ("127.0.0.1"), ("test..com"), ("www-.test.com")]
+    )
+    def test_invalid_host(self, host: str) -> None:
+        self.assertFalse(valid_host(host), host)

uv.lock

@@ -52,6 +52,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/db/8f/61959034484a4a7c527811f4721e75d02d653a35afb0b6054474d8185d4c/charset_normalizer-3.4.7-py3-none-any.whl", hash = "sha256:3dce51d0f5e7951f8bb4900c257dad282f49190fdbebecd4ba99bcc41fef404d", size = 61958, upload-time = "2026-04-02T09:28:37.794Z" },
 ]
 
+[[package]]
+name = "colorama"
+version = "0.4.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d8/53/6f443c9a4a8358a93a6792e2acffb9d9d5cb0a5cfd8802644b7b1c9a02e4/colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44", size = 27697, upload-time = "2022-10-25T02:36:22.414Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
+]
+
 [[package]]
 name = "coverage"
 version = "7.13.5"
@@ -100,6 +109,67 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/5d/13/ad7d7ca3808a898b4612b6fe93cde56b53f3034dcde235acb1f0e1df24c6/idna-3.13-py3-none-any.whl", hash = "sha256:892ea0cde124a99ce773decba204c5552b69c3c67ffd5f232eb7696135bc8bb3", size = 68629, upload-time = "2026-04-22T16:42:40.909Z" },
 ]
 
+[[package]]
+name = "iniconfig"
+version = "2.3.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/72/34/14ca021ce8e5dfedc35312d08ba8bf51fdd999c576889fc2c24cb97f4f10/iniconfig-2.3.0.tar.gz", hash = "sha256:c76315c77db068650d49c5b56314774a7804df16fee4402c1f19d6d15d8c4730", size = 20503, upload-time = "2025-10-18T21:55:43.219Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/cb/b1/3846dd7f199d53cb17f49cba7e651e9ce294d8497c8c150530ed11865bb8/iniconfig-2.3.0-py3-none-any.whl", hash = "sha256:f631c04d2c48c52b84d0d0549c99ff3859c98df65b3101406327ecc7d53fbf12", size = 7484, upload-time = "2025-10-18T21:55:41.639Z" },
+]
+
+[[package]]
+name = "packaging"
+version = "26.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d7/f1/e7a6dd94a8d4a5626c03e4e99c87f241ba9e350cd9e6d75123f992427270/packaging-26.2.tar.gz", hash = "sha256:ff452ff5a3e828ce110190feff1178bb1f2ea2281fa2075aadb987c2fb221661", size = 228134, upload-time = "2026-04-24T20:15:23.917Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/df/b2/87e62e8c3e2f4b32e5fe99e0b86d576da1312593b39f47d8ceef365e95ed/packaging-26.2-py3-none-any.whl", hash = "sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e", size = 100195, upload-time = "2026-04-24T20:15:22.081Z" },
+]
+
+[[package]]
+name = "parameterized"
+version = "0.9.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ea/49/00c0c0cc24ff4266025a53e41336b79adaa5a4ebfad214f433d623f9865e/parameterized-0.9.0.tar.gz", hash = "sha256:7fc905272cefa4f364c1a3429cbbe9c0f98b793988efb5bf90aac80f08db09b1", size = 24351, upload-time = "2023-03-27T02:01:11.592Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/00/2f/804f58f0b856ab3bf21617cccf5b39206e6c4c94c2cd227bde125ea6105f/parameterized-0.9.0-py2.py3-none-any.whl", hash = "sha256:4e0758e3d41bea3bbd05ec14fc2c24736723f243b28d702081aef438c9372b1b", size = 20475, upload-time = "2023-03-27T02:01:09.31Z" },
+]
+
+[[package]]
+name = "pluggy"
+version = "1.6.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f9/e2/3e91f31a7d2b083fe6ef3fa267035b518369d9511ffab804f839851d2779/pluggy-1.6.0.tar.gz", hash = "sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3", size = 69412, upload-time = "2025-05-15T12:30:07.975Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/54/20/4d324d65cc6d9205fabedc306948156824eb9f0ee1633355a8f7ec5c66bf/pluggy-1.6.0-py3-none-any.whl", hash = "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746", size = 20538, upload-time = "2025-05-15T12:30:06.134Z" },
+]
+
+[[package]]
+name = "pygments"
+version = "2.20.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/c3/b2/bc9c9196916376152d655522fdcebac55e66de6603a76a02bca1b6414f6c/pygments-2.20.0.tar.gz", hash = "sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f", size = 4955991, upload-time = "2026-03-29T13:29:33.898Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f4/7e/a72dd26f3b0f4f2bf1dd8923c85f7ceb43172af56d63c7383eb62b332364/pygments-2.20.0-py3-none-any.whl", hash = "sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176", size = 1231151, upload-time = "2026-03-29T13:29:30.038Z" },
+]
+
+[[package]]
+name = "pytest"
+version = "9.0.3"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+    { name = "iniconfig" },
+    { name = "packaging" },
+    { name = "pluggy" },
+    { name = "pygments" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/7d/0d/549bd94f1a0a402dc8cf64563a117c0f3765662e2e668477624baeec44d5/pytest-9.0.3.tar.gz", hash = "sha256:b86ada508af81d19edeb213c681b1d48246c1a91d304c6c81a427674c17eb91c", size = 1572165, upload-time = "2026-04-07T17:16:18.027Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d4/24/a372aaf5c9b7208e7112038812994107bc65a84cd00e0354a88c2c77a617/pytest-9.0.3-py3-none-any.whl", hash = "sha256:2c5efc453d45394fdd706ade797c0a81091eccd1d6e4bccfcd476e2b8e0ab5d9", size = 375249, upload-time = "2026-04-07T17:16:16.13Z" },
+]
+
 [[package]]
 name = "requests"
 version = "2.33.1"
@@ -142,7 +212,7 @@ wheels = [
 
 [[package]]
 name = "stapler"
-version = "1.2.2"
+version = "1.3.2"
 source = { editable = "." }
 dependencies = [
     { name = "requests" },
@@ -151,6 +221,8 @@ dependencies = [
 [package.dev-dependencies]
 dev = [
     { name = "coverage" },
+    { name = "parameterized" },
+    { name = "pytest" },
     { name = "ruff" },
     { name = "ty" },
 ]
@@ -161,32 +233,34 @@ requires-dist = [{ name = "requests", specifier = ">=2.33.1" }]
 [package.metadata.requires-dev]
 dev = [
     { name = "coverage", specifier = ">=7.13.5" },
+    { name = "parameterized", specifier = ">=0.9.0" },
+    { name = "pytest", specifier = ">=9.0.3" },
     { name = "ruff", specifier = ">=0.15.10" },
     { name = "ty", specifier = ">=0.0.29" },
 ]
 
 [[package]]
 name = "ty"
-version = "0.0.32"
+version = "0.0.34"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/85/7e/2aa791c9ae7b8cd5024cd4122e92267f664ca954cea3def3211919fa3c1f/ty-0.0.32.tar.gz", hash = "sha256:8743174c5f920f6700a4a0c9de140109189192ba16226884cd50095b43b8a45c", size = 5522294, upload-time = "2026-04-20T19:29:01.626Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c4/69/e24eefe2c35c0fdbdec9b60e162727af669bb76d64d993d982eb67b24c38/ty-0.0.34.tar.gz", hash = "sha256:a6efe66b0f13c03a65e6c72ec9abfe2792e2fd063c74fa67e2c4930e29d661be", size = 5585933, upload-time = "2026-05-01T23:06:46.388Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/62/eb/1075dc6a49d7acbe2584ae4d5b410c41b1f177a5adcc567e09eca4c69000/ty-0.0.32-py3-none-linux_armv6l.whl", hash = "sha256:dacbc2f6cd698d488ae7436838ff929570455bf94bfa4d9fe57a630c552aff83", size = 10902959, upload-time = "2026-04-20T19:28:31.907Z" },
+    { url = "https://files.pythonhosted.org/packages/83/7b/8b85003d6639ef17a97dcbb31f4511cfe78f1c81a964470db100c8c883e7/ty-0.0.34-py3-none-linux_armv6l.whl", hash = "sha256:9ecc3d14f07a95a6ceb88e07f8e62358dbd37325d3d5bd56da7217ff1fef7fb8", size = 11067094, upload-time = "2026-05-01T23:06:21.133Z" },
-    { url = "https://files.pythonhosted.org/packages/33/d2/c35fc8bc66e98d1ee9b0f8ed319bf743e450e1f1e997574b178fab75670f/ty-0.0.32-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:914bbc4f605ce2a9e2a78982e28fae1d3359a169d141f9dc3b4c7749cd5eca81", size = 10726172, upload-time = "2026-04-20T19:28:44.765Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/25/b0098f65b020b015c40567c763fc66fffbec88b2ba6f584bca1e92f05ebb/ty-0.0.34-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:0dccffd8a9d02321cd2dee3249df205e26d62694e741f4eeca36b157fd8b419f", size = 10840909, upload-time = "2026-05-01T23:06:18.409Z" },
-    { url = "https://files.pythonhosted.org/packages/96/32/c827da3ca480456fb02d8cea68a2609273b6c220fea0be9a4c8d8470b86e/ty-0.0.32-py3-none-macosx_11_0_arm64.whl", hash = "sha256:4787ac9fe1f86b1f3133f5c6732adbe2df5668b50c679ac6e2d98cd284da812f", size = 10163701, upload-time = "2026-04-20T19:28:27.005Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/55/5e4adcf7d2a1006b844903b27cb81244a9b748d850433a46a6c21776c401/ty-0.0.34-py3-none-macosx_11_0_arm64.whl", hash = "sha256:b0ea47a2998e167ab3b21d2f4b5309a9cf33c297809f6d7e3e753252223174d0", size = 10279378, upload-time = "2026-05-01T23:06:37.962Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/9e/2734478fbdb90c160cb2813a3916a16a2af5c1e231f87d635f6131d781fb/ty-0.0.32-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d8ea0a728af99fe40dd744cba6441a2404f80b7f4bde17aa6da393810af5ea57", size = 10656220, upload-time = "2026-04-20T19:29:03.814Z" },
+    { url = "https://files.pythonhosted.org/packages/4d/91/f537dca0db8fe2558e8ab04d8941d687b384fcc1df5eb9023b2db75ac26c/ty-0.0.34-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8b37da00b41a118a459ae56d8947e70651073fb33ebfbceb820e4a10b22d5023", size = 10817423, upload-time = "2026-05-01T23:06:26.247Z" },
-    { url = "https://files.pythonhosted.org/packages/44/9f/0007da2d35e424debe7e9f86ffbc1ab7f60983cfbc5f0411324ab2de5292/ty-0.0.32-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:2850561f9b018ae33d7e5bbfa0ac414d3c518513edcffe43877dc9801446b9c5", size = 10696086, upload-time = "2026-04-20T19:28:46.829Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/c4/55a3ad1da2815af1009bdc1b8c90dc11a364cd314e4b48c5128ba9d38859/ty-0.0.34-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:81cbbb93c2342fe3de43e625d3a9eb149633e9f485e816ebf6395d08685355d8", size = 10851826, upload-time = "2026-05-01T23:06:24.198Z" },
-    { url = "https://files.pythonhosted.org/packages/3b/5e/ce5fd4ec803222ae3e69a76d2a2db2eed55e19f5b131702b9789ef45f93d/ty-0.0.32-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:b5fa2fb3c614349ee211d36476b49d88c5ef79a687cdb91b2872ad023b94d2f8", size = 11184800, upload-time = "2026-04-20T19:28:42.57Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/8c/9c7606af22d73fb43ea4369472d9c66ece11231be73b0efe8e3c61655559/ty-0.0.34-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:4c5b4dea1594a021289e172582df9cde7089dce14b276fc650e7b212b1772e12", size = 11356318, upload-time = "2026-05-01T23:06:51.139Z" },
-    { url = "https://files.pythonhosted.org/packages/6c/46/ebcf67a5999421331214aac51a7464db42de2be15bbe929c612a3ed0b039/ty-0.0.32-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:2b89969307ab2417d41c9be8059dd79feea577234e1e10d35132f5495e0d42c6", size = 11718718, upload-time = "2026-04-20T19:28:36.433Z" },
+    { url = "https://files.pythonhosted.org/packages/20/54/bb423f663721ab4138b216425c6b55eaefd3a068243b24d6d8fe988f4e13/ty-0.0.34-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:030fb00aa2d2a5b5ae9d9183d574e0c82dae80566700a7490c43669d8ece40cd", size = 11902968, upload-time = "2026-05-01T23:06:35.82Z" },
-    { url = "https://files.pythonhosted.org/packages/18/2c/2141c86ed0ce0962b45cefb658a95e734f59759d47f20afdcd9c732910a1/ty-0.0.32-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:9b59868ede9b1d69a088f0d695df52a0061f95fa7baa1d5e0dc6fc9cf06e1334", size = 11346369, upload-time = "2026-04-20T19:28:48.967Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/22/01122b21ab6b534a2f618c6bbe5f1f7f49fd56f4b2ec8887cd6d40d08fb3/ty-0.0.34-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5ae9555e24e36c63a8218e037a5a63f15579eb6aa94f41017e57cd41d335cfb5", size = 11548860, upload-time = "2026-05-01T23:06:42.155Z" },
-    { url = "https://files.pythonhosted.org/packages/7a/da/ed6f772339cf29bd9a46def9d6db5084689eb574ee4d150ff704224c1ed8/ty-0.0.32-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8300caf35345498e9b9b03e550bba03cee8f5f5f8ab4c83c3b1ff1b7403b7d3a", size = 11280714, upload-time = "2026-04-20T19:28:51.516Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/50/86008b1392ec64bed1957bbcc7aaa43b466b50dfc91bb131841c21d7c5c3/ty-0.0.34-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:99eb23df9ed129fc26d1ab00d6f0b8dfe5253b09c2ac6abdb11523fa70d67f10", size = 11457097, upload-time = "2026-05-01T23:06:53.477Z" },
-    { url = "https://files.pythonhosted.org/packages/da/9b/c6813987edf4816a40e0c8e408b555f97d3f267c7b3a1688c8bbdf65609c/ty-0.0.32-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:583c7094f4574b02f724db924f98b804d1387a0bd9405ecb5e078cc0f47fbcfb", size = 10638806, upload-time = "2026-04-20T19:28:29.651Z" },
+    { url = "https://files.pythonhosted.org/packages/92/3e/4558b2296963ba99c58d8409c57d7db4f3061b656c3613cb21c02c1ef4c2/ty-0.0.34-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:85de45382016eceae69e104815eb2cfa200787df104002e262a86cbd43ed2c02", size = 10798192, upload-time = "2026-05-01T23:06:40.004Z" },
-    { url = "https://files.pythonhosted.org/packages/4e/d4/0cefcbd2ad0f3d51762ccf58e652ec7da146eb6ae34f87228f6254bbb8be/ty-0.0.32-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:e44ebe1bb4143a5628bc4db67ac0dfebe14594af671e4ee66f6f2e983da56501", size = 10726106, upload-time = "2026-04-20T19:29:06.3Z" },
+    { url = "https://files.pythonhosted.org/packages/76/bf/650d24402be2ef678528d60caac1d9477a40fc37e3792ecef07834fd7a4a/ty-0.0.34-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:14cb575fb8fa5131f5129d100cfe23c1575d23faf5dfc5158432749a3e38c9b5", size = 10890390, upload-time = "2026-05-01T23:06:33.076Z" },
-    { url = "https://files.pythonhosted.org/packages/32/ad/2c8a97f91f06311f4367400f7d13534bbda2522c73c99a3e4c0757dff9b8/ty-0.0.32-py3-none-musllinux_1_2_i686.whl", hash = "sha256:06f17ada3e069cba6148342ef88e9929156beca8473e8d4f101b68f66c75643e", size = 10872951, upload-time = "2026-04-20T19:28:34.077Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/ef/ccd2ca13906079f7935fd7e067661b24233017f57d987d51d6a121d85bb5/ty-0.0.34-py3-none-musllinux_1_2_i686.whl", hash = "sha256:c6fc0b69d8450e6910ba9db34572b959b81329a97ae273c391f70e9fb6c1aade", size = 11031564, upload-time = "2026-05-01T23:06:55.812Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/68/42293f9248106dd51875120971a5cc6ea315c2c4dcfb8e59aa063aa0af26/ty-0.0.32-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:e96e60fa556cec04f15d7ea62d2ceee5982bd389233e961ab9fd42304e278175", size = 11363334, upload-time = "2026-04-20T19:28:54.036Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/2d/d27b72005b6f43599e3bcabab0d7135ac0c230b7a307bb99f9eea02c1cda/ty-0.0.34-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:30dfcec2f0fde3993f4f912ed0e057dcbebc8615299f610a4c2ddb7b5a3e1e06", size = 11553430, upload-time = "2026-05-01T23:06:31.096Z" },
-    { url = "https://files.pythonhosted.org/packages/df/92/be9abf4d3e589ad5023e2ea965b93e204ec856420d46adf73c5c36c04678/ty-0.0.32-py3-none-win32.whl", hash = "sha256:2ff2ebb4986b24aebcf1444db7db5ca41b36086040e95eea9f8fb851c11e805c", size = 10260689, upload-time = "2026-04-20T19:28:56.541Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/12/20812e1ad930b8d4af70eebf19ad23cff6e31efcfa613ef884531fcdbaa1/ty-0.0.34-py3-none-win32.whl", hash = "sha256:97b77ddf007271b812a313a8f0a14929bc5590958433e1fb83ef585676f53342", size = 10436048, upload-time = "2026-05-01T23:06:49.108Z" },
-    { url = "https://files.pythonhosted.org/packages/14/61/dc86acea899349d2579cb8419aecedd83dc504d7d6a10df65eef546c8300/ty-0.0.32-py3-none-win_amd64.whl", hash = "sha256:ba7284a4a954b598c1b31500352b3ec1f89bff533825592b5958848226fdc7ee", size = 11255371, upload-time = "2026-04-20T19:28:39.917Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/6a/afa095c5987868fbda27c0f731146ac8e3d07b357adfa83daccaee5b1a16/ty-0.0.34-py3-none-win_amd64.whl", hash = "sha256:1f543968accb952705134028d1fda8656882787dbbc667ad4d6c3ba23791d604", size = 11462526, upload-time = "2026-05-01T23:06:28.514Z" },
-    { url = "https://files.pythonhosted.org/packages/43/01/beffec56d71ca25b343ede63adb076456b5b3e211f1c066452a44cd120b3/ty-0.0.32-py3-none-win_arm64.whl", hash = "sha256:7e10aadbdbda989a7d567ee6a37f8b98d4d542e31e3b190a2879fd581f75d658", size = 10658087, upload-time = "2026-04-20T19:28:59.286Z" },
+    { url = "https://files.pythonhosted.org/packages/63/8f/bf041a06260d77662c0605e56dacfe90b786bf824cbe1aed238d15fe5e84/ty-0.0.34-py3-none-win_arm64.whl", hash = "sha256:ea09108cbcb16b6b06d7596312b433bf49681e78d30e4dc7fb3c1b248a95e09a", size = 10846945, upload-time = "2026-05-01T23:06:44.428Z" },
 ]
 
 [[package]]