middleware.stack

One-call secure-by-default middleware stack helper.

secure_stackreturns the secure-by-default middleware list in the contract-passing order —SessionMiddleware -> CSRFMiddleware-> SecurityHeadersMiddleware— so an app author can wire the whole stack in one line without anything being force-injected:

from chirp.middleware.stack import secure_stack

for mw in secure_stack(app.config):
    app.add_middleware(mw)

Passauth=AuthConfig(...) to include AuthMiddlewarein the right place (after sessions, before CSRF) so login auth is part of the same one-line wiring:

for mw in secure_stack(app.config, auth=AuthConfig(load_user=load_user)):
    app.add_middleware(mw)

Passaudit=AuditConfig(level=...) to append an opt-in AuditMiddlewareas the outermost leg (afterSecurityHeadersMiddleware) so it observes the final status code of every audited request. Like the auth leg it is OFF unless you ask for it (AuditConfig defaults to level="none"):

for mw in secure_stack(app.config, audit=AuditConfig(level="metadata")):
    app.add_middleware(mw)

This is deliberately explicit-over-magic: it is a pure list-returning function (the most inspectable/testable shape), not an auto-injecting hook. The app author still callsadd_middlewarefor each piece, and can drop or reorder the list, swap in custom configs, or skip the helper entirely.

The generated stack passes thesecurity_stack and csrf_session order contracts (same classes, same order) and inherits the Wave 2 SessionConfig.secure="auto" posture: the session cookie's Secureflag is resolved at freeze fromconfig.env (Truefor staging/production), not fromconfig.debug. Coupling cookie security to debugis the footgun the env-aware design exists to avoid, so this helper never readsdebug.