Fix 2250 (#2255)

* start new dev branch; add audit file

* Add failing tests: WebSocket compression config must be validated (#2250)

check_websocket_compression() is an empty "# FIXME" stub, yet it is wired into
check_websocket_options(), so WebSocket `compression` config is accepted
entirely unvalidated: unknown codecs, unknown deflate attributes, wrong types
and out-of-range window-bits / memory-level all pass silently and only surface
(if at all) as a run-time error deep inside the compression backend.

Add tests to CheckWebsocketTests covering what
crossbar.router.protocol.set_websocket_options actually reads for deflate
(request_no_context_takeover, request_max_window_bits, no_context_takeover,
max_window_bits, memory_level), asserting malformed blocks are rejected and
valid ones accepted. The permissible values mirror autobahn's
PerMessageDeflateMixin: window bits 9..15 (plus 0 = "not requested" for
request_max_window_bits) and memory level 1..9.

Seven rejection tests fail ("InvalidConfigException not raised") because the
validator is empty; the validator lands in the next commit.

Note: This work was completed with AI assistance (Claude Code).

* Implement the WebSocket compression config validator (#2250)

Fill the empty check_websocket_compression() stub, mirroring the structure of
check_websocket_options(): check_dict_args() for permitted keys and types, then
explicit range checks.

Only permessage-deflate is implemented in set_websocket_options(), so `deflate`
is the only accepted codec, and its accepted attributes are exactly the ones
set_websocket_options() reads. The permissible window-bits and memory-level
values are imported from autobahn's PerMessageDeflateMixin
(WINDOW_SIZE_PERMISSIBLE_VALUES / MEM_LEVEL_PERMISSIBLE_VALUES) rather than
duplicated, so the validator cannot drift from what autobahn actually accepts at
run-time. request_max_window_bits additionally accepts 0, matching autobahn's
"do not request a window size" semantics.

Makes the tests added in the previous commit pass.

Note: This work was completed with AI assistance (Claude Code).

Author: oberstet

.audit/oberstet_fix_2250.md

@@ -0,0 +1,8 @@
+- [ ] I did **not** use any AI-assistance tools to help create this pull request.
+- [x] I **did** use AI-assistance tools to *help* create this pull request.
+- [x] I have read, understood and followed the projects' [AI Policy](https://github.com/crossbario/autobahn-python/blob/main/AI_POLICY.md) when creating code, documentation etc. for this pull request.
+
+Submitted by: @oberstet
+Date: 2026-07-15
+Related issue(s): #2250
+Branch: oberstet:fix_2250

src/crossbar/common/checkconfig.py

@@ -27,6 +27,7 @@
     identify_realm_name_category,
 )
 from autobahn.wamp.uri import convert_starred_uri
+from autobahn.websocket.compress_deflate import PerMessageDeflateMixin
 from autobahn.websocket.util import parse_url
 from yaml import Dumper, Loader, SafeDumper, SafeLoader
 from yaml.constructor import ConstructorError
@@ -1594,10 +1595,56 @@ def check_websocket_compression(options):
     """
     Check options for WebSocket compression.
 
+    Only ``permessage-deflate`` is implemented (see
+    ``crossbar.router.protocol.set_websocket_options``). The permissible values
+    for the deflate parameters are taken from the WebSocket compression
+    implementation in autobahn, so this validator cannot drift from what is
+    actually accepted at run-time.
+
     http://crossbar.io/docs/
     https://github.com/crossbario/crossbar/blob/master/docs/pages/administration/router/transport/WebSocket-Compression.md
+
+    :param options: The options to check.
+    :type options: dict
     """
-    # FIXME
+    check_dict_args({"deflate": (False, [Mapping])}, options, "WebSocket compression options")
+
+    if "deflate" in options:
+        deflate = options["deflate"]
+
+        check_dict_args(
+            {
+                "request_no_context_takeover": (False, [bool]),
+                "request_max_window_bits": (False, [int]),
+                "no_context_takeover": (False, [bool]),
+                "max_window_bits": (False, [int]),
+                "memory_level": (False, [int]),
+            },
+            deflate,
+            "WebSocket permessage-deflate compression options",
+        )
+
+        for k in ["max_window_bits", "request_max_window_bits"]:
+            if k in deflate:
+                val = deflate[k]
+                # 0 on request_max_window_bits means "do not request a window size"
+                if k == "request_max_window_bits" and val == 0:
+                    continue
+                if val not in PerMessageDeflateMixin.WINDOW_SIZE_PERMISSIBLE_VALUES:
+                    raise InvalidConfigException(
+                        "invalid value {} for '{}' in WebSocket permessage-deflate options - permissible values {}".format(
+                            val, k, PerMessageDeflateMixin.WINDOW_SIZE_PERMISSIBLE_VALUES
+                        )
+                    )
+
+        if "memory_level" in deflate:
+            val = deflate["memory_level"]
+            if val not in PerMessageDeflateMixin.MEM_LEVEL_PERMISSIBLE_VALUES:
+                raise InvalidConfigException(
+                    "invalid value {} for 'memory_level' in WebSocket permessage-deflate options - permissible values {}".format(
+                        val, PerMessageDeflateMixin.MEM_LEVEL_PERMISSIBLE_VALUES
+                    )
+                )
 
 
 def check_web_path_service_websocket_reverseproxy(personality, config):

src/crossbar/test/test_checkconfig.py

@@ -216,6 +216,76 @@ def test_tiny_timeout_auto_ping(self):
 
         self.assertTrue("'auto_ping_timeout' is in milliseconds" in str(ctx.exception))
 
+    #
+    # WebSocket compression options (#2250). check_websocket_compression() was an
+    # empty stub, so malformed compression config was silently accepted. The
+    # permissible deflate values mirror autobahn's PerMessageDeflateMixin:
+    # window bits 9..15 (plus 0 = "not requested" for request_max_window_bits)
+    # and memory level 1..9.
+    #
+
+    def test_compression_must_be_dict(self):
+        with self.assertRaises(checkconfig.InvalidConfigException) as ctx:
+            checkconfig.check_websocket_options({"compression": {"deflate": "nope"}})
+        self.assertIn("deflate", str(ctx.exception))
+
+    def test_compression_unknown_codec(self):
+        with self.assertRaises(checkconfig.InvalidConfigException) as ctx:
+            checkconfig.check_websocket_options({"compression": {"bogus": {}}})
+        self.assertIn("bogus", str(ctx.exception))
+
+    def test_compression_deflate_unknown_attribute(self):
+        with self.assertRaises(checkconfig.InvalidConfigException) as ctx:
+            checkconfig.check_websocket_options({"compression": {"deflate": {"bogus": 1}}})
+        self.assertIn("bogus", str(ctx.exception))
+
+    def test_compression_deflate_bad_attribute_type(self):
+        with self.assertRaises(checkconfig.InvalidConfigException) as ctx:
+            checkconfig.check_websocket_options({"compression": {"deflate": {"no_context_takeover": "yes"}}})
+        self.assertIn("no_context_takeover", str(ctx.exception))
+
+    def test_compression_deflate_bad_max_window_bits(self):
+        # 8 is not a permissible deflate window size (9..15)
+        with self.assertRaises(checkconfig.InvalidConfigException) as ctx:
+            checkconfig.check_websocket_options({"compression": {"deflate": {"max_window_bits": 8}}})
+        self.assertIn("max_window_bits", str(ctx.exception))
+
+    def test_compression_deflate_bad_request_max_window_bits(self):
+        # 16 is out of range; 0 ("not requested") and 9..15 are the valid values
+        with self.assertRaises(checkconfig.InvalidConfigException) as ctx:
+            checkconfig.check_websocket_options({"compression": {"deflate": {"request_max_window_bits": 16}}})
+        self.assertIn("request_max_window_bits", str(ctx.exception))
+
+    def test_compression_deflate_bad_memory_level(self):
+        # 10 is out of range (1..9)
+        with self.assertRaises(checkconfig.InvalidConfigException) as ctx:
+            checkconfig.check_websocket_options({"compression": {"deflate": {"memory_level": 10}}})
+        self.assertIn("memory_level", str(ctx.exception))
+
+    def test_compression_deflate_valid(self):
+        # a fully-specified, valid deflate block is accepted
+        checkconfig.check_websocket_options(
+            {
+                "compression": {
+                    "deflate": {
+                        "request_no_context_takeover": True,
+                        "request_max_window_bits": 11,
+                        "no_context_takeover": False,
+                        "max_window_bits": 15,
+                        "memory_level": 4,
+                    }
+                }
+            }
+        )
+
+    def test_compression_deflate_request_max_window_bits_zero(self):
+        # 0 means "do not request a window size" and must be accepted
+        checkconfig.check_websocket_options({"compression": {"deflate": {"request_max_window_bits": 0}}})
+
+    def test_compression_deflate_empty(self):
+        # an empty deflate block (all defaults) is valid
+        checkconfig.check_websocket_options({"compression": {"deflate": {}}})
+
 
 class CheckRealmTests(TestCase):
     """