Harden resolver helpers and router exports

Author: stefankumarasinghe

api/routes/__init__.py

@@ -11,6 +11,51 @@
 
 from fastapi import APIRouter
 
-router = APIRouter()
+_router: APIRouter | None = None
+
+
+def _build_router() -> APIRouter:
+	router = APIRouter()
+
+	from api.routes.analyze import router as analyze_router
+	from api.routes.causal import router as causal_router
+	from api.routes.correlation import router as correlation_router
+	from api.routes.events import router as events_router
+	from api.routes.forecast import router as forecast_router
+	from api.routes.health import router as health_router
+	from api.routes.jobs import router as jobs_router
+	from api.routes.logs import router as logs_router
+	from api.routes.metrics import router as metrics_router
+	from api.routes.ml import router as ml_router
+	from api.routes.slo import router as slo_router
+	from api.routes.topology import router as topology_router
+	from api.routes.traces import router as traces_router
+
+	router.include_router(health_router)
+	router.include_router(analyze_router)
+	router.include_router(metrics_router)
+	router.include_router(logs_router)
+	router.include_router(traces_router)
+	router.include_router(correlation_router)
+	router.include_router(slo_router)
+	router.include_router(topology_router)
+	router.include_router(events_router)
+	router.include_router(forecast_router)
+	router.include_router(causal_router)
+	router.include_router(ml_router)
+	router.include_router(jobs_router)
+
+	return router
+
+
+def __getattr__(name: str) -> APIRouter:
+	if name != "router":
+		raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
+
+	global _router
+	if _router is None:
+		_router = _build_router()
+		globals()["router"] = _router
+	return _router
 
 __all__ = ["router"]

datasources/helpers.py

@@ -50,7 +50,7 @@ def _coerce_fetch_options(options: FetchRequestOptions | None) -> FetchRequestOp
     base = options or FetchRequestOptions()
     timeout = int(cast(int | str | bytes | bytearray, base.timeout))
     client_raw = base.client
-    client = client_raw if hasattr(client_raw, "get") else base.client
+    client = client_raw if callable(getattr(client_raw, "get", None)) else None
 
     return FetchRequestOptions(
         params=base.params,

middleware/runtime_ssl.py

@@ -21,7 +21,7 @@ class RuntimeSSLOptions:
 
     @classmethod
     def from_settings(cls, settings: object) -> RuntimeSSLOptions | None:
-        if not getattr(settings, "ssl_enabled"):
+        if not getattr(settings, "ssl_enabled", False):
             return None
 
         certfile = str(getattr(settings, "ssl_certfile", "")).strip()

tests/test_api_route_surface_edges.py

@@ -528,3 +528,12 @@ def test_runtime_ssl_options_requires_paths():
         match="RESOLVER_SSL_ENABLED=true requires RESOLVER_SSL_CERTFILE and RESOLVER_SSL_KEYFILE to be set",
     ):
         RuntimeSSLOptions.from_settings(types.SimpleNamespace(ssl_enabled=True, ssl_certfile="", ssl_keyfile=""))
+
+
+def test_aggregated_router_is_populated_and_ssl_defaults_disabled():
+    from api.routes import router as aggregated_router
+
+    route_paths = {route.path for route in aggregated_router.routes}
+
+    assert "/health" in route_paths
+    assert RuntimeSSLOptions.from_settings(types.SimpleNamespace()) is None

tests/test_helpers.py

@@ -77,3 +77,13 @@ async def test_fetch_text_success(monkeypatch):
     monkeypatch.setattr(httpx, "AsyncClient", lambda timeout: DummyClient(resp))
     got = await fetch_text("url")
     assert got == "hello"
+
+
+@pytest.mark.asyncio
+async def test_fetch_json_falls_back_to_owned_client_when_client_is_invalid(monkeypatch):
+    resp = DummyResponse(status_code=200, json_data={"ok": True})
+    monkeypatch.setattr(httpx, "AsyncClient", lambda timeout: DummyClient(resp))
+
+    got = await fetch_json("url", options=FetchRequestOptions(client=object()))
+
+    assert got == {"ok": True}