Make AppHarness dependencies installable - #7008
Merged
Merged
Conversation
Contributor
Greptile SummaryThe PR makes
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| reflex/testing.py | Replaces the eager uvicorn import with guarded lazy imports across all runtime uses, resolving the previously reported production harness NameError. |
| pyproject.toml | Adds the testing extra containing the three optional AppHarness dependencies. |
| tests/units/test_testing.py | Adds regression coverage confirming that importing reflex.testing does not bind uvicorn at module load. |
| uv.lock | Synchronizes the package lock metadata with the new testing extra. |
Reviews (3): Last reviewed commit: "Merge branch 'main' into fix/6974-testin..." | Re-trigger Greptile
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 5 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Merging this PR will not alter performance
Comparing 
Footnotes
|
masenf
approved these changes
Sep 4, 2026
adhami3310
added a commit
that referenced
this pull request
Sep 4, 2026
Two unrelated things the same pre-commit run wanted. `ruff-format` also formats python blocks inside docs, and the sample I added in the previous commit was missing the blank line before its decorator. That is why the docs commit before it passed and this branch then went red on a change that touched one markdown file. The lock is stale against `pyproject.toml`, which has declared a `testing` extra since #7008 while `uv.lock` still says `provides-extras = ["db", "pydantic"]` and carries no `extra == 'testing'` entries at all. Nothing in this branch can affect dependency resolution -- it is two docs files -- so this is main's drift surfacing once `uv` began writing the field. Relocked rather than left, since every branch cut from here hits it.
3 tasks
masenf
added a commit
that referenced
this pull request
Sep 4, 2026
PR #7008 added the testing optional-dependency group but left uv.lock without the corresponding requires-dist entries and provides-extras entry, so every uv command rewrote the lock file. Regenerated with `uv lock`; only the reflex package metadata changed, no dependency versions were bumped. Claude-Session: https://claude.ai/code/session_01KpSPsdMoxxXp3xqsDUpvVS Co-authored-by: Claude <noreply@anthropic.com>
adhami3310
added a commit
that referenced
this pull request
Sep 5, 2026
* docs: add a User Authentication page for brokered app sign-in Documents letting people sign in to a generated app with their Reflex account: adding it, choosing who is admitted, the user list and export, blocking somebody, the sign-in page's presentation, and removing it. Four things the page is careful about, because each is a support ticket if it is left implicit: * **On Free, an app admits anyone with a Reflex account.** Adding sign-in makes an app know who somebody is, not private. Narrowing the audience is the Pro control, so that is said in the plan callout and again as a warning rather than left to be discovered. * **Narrowing signs everyone out**, not only the people it excludes. * **A session lasts at most 7 days** whatever the token lifetimes suggest, because the client stores its renewal credential in a cookie with that ceiling. "30 day refresh token" would be a promise we do not keep. * **A block takes up to 30 minutes** to reach a session already running, since the app re-checks identity on a schedule. The security note tells people to decide what somebody may do in backend code: the frontend can hide a page but cannot keep data out of reach, which is the mistake an agent-built app is most likely to make. Screenshots are captured from the real panel against seeded data. * docs: use the real current-user API, not the authz check's argument `auth_user.email` and friends are not a public surface. `auth_user` is the name of the argument an *authorization check* callable receives, and I lifted it out of an internal docstring and presented it as the way an app reads its signed-in user. Apps generated from that would fail on attribute access. The supported interface, per `docs/enterprise/auth/example-app.md` and `reflex_enterprise/auth/user_state.py` (where `User = AuthUserState`): * `User.name` / `.email` / `.sub` / `.picture` are Vars, for rendering. * `await User.current()` returns the claims dict inside an event handler, or `None` when anonymous. Both are shown, split by what the reader is doing rather than listed as one set, since which of the two is correct depends on where the code runs. Anything beyond the common claims wants a computed var on an `AuthUserState` subclass, so the page points at the Authentication guide rather than restating it. * docs: format the handler sample, and relock for the testing extra Two unrelated things the same pre-commit run wanted. `ruff-format` also formats python blocks inside docs, and the sample I added in the previous commit was missing the blank line before its decorator. That is why the docs commit before it passed and this branch then went red on a change that touched one markdown file. The lock is stale against `pyproject.toml`, which has declared a `testing` extra since #7008 while `uv.lock` still says `provides-extras = ["db", "pydantic"]` and carries no `extra == 'testing'` entries at all. Nothing in this branch can affect dependency resolution -- it is two docs files -- so this is main's drift surfacing once `uv` began writing the field. Relocked rather than left, since every branch cut from here hits it. * docs: make both identity samples runnable as written The handler sample called `@rxe.event` without importing `reflex_enterprise as rxe`, so copying it raises `NameError` at import, before the handler could run. The component sample above it had the same flaw and was not reported: `rx.hstack`, `rx.avatar` and `rx.text` with no `import reflex as rx`. Fixed both, since a reader copies whichever one matches what they are doing and neither would have worked. The page's own `python exec` block imports rx for the screenshot calls, which is what hid this: the samples render fine on the page while being incomplete for anyone pasting them into an app. * docs: state the block's availability plainly Per review. "Available on every plan, because being unable to revoke access is worse than being unable to configure it" imported the reasoning behind the decision into a page whose reader only needs the decision. Now just says blocking is available on every plan. Trimmed the same tic from the sign-out paragraph, which explained why the behaviour is what people expect rather than saying what it does. --------- Co-authored-by: Masen Furer <m_github@0x26.net>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes issue #6974 by making reflex.testing usable from a clean published Reflex installation.
Changes
Removed the top-level uvicorn import from reflex.testing.
Added lazy imports with actionable installation messages.
Added a reflex[testing] extra containing:
Updated uv.lock.
Added a regression test for importing reflex.testing without test dependencies.
Added a changelog fragment.
Testing