fix(adapters): set explicit text/plain content type on blocked responses

[rennf93]

Summary

• Blocked/error responses built by FlaskResponseFactory.create_response fell back to Flask's default text/html. Under X-Content-Type-Options: nosniff (applied by default), that is exactly the gap fastapi-guard fixed in #144: the block page should be explicit text/plain.
• create_response now passes mimetype="text/plain" (wire value: text/plain; charset=utf-8). Redirect responses are untouched (no body, no content type).
• Behavior beyond the default is preserved: custom_error_responses text stays text/plain, and a custom_response_modifier can still set its own content type.

Tests

• New tests/test_block_response_content_type.py, mirroring fastapi-guard's test of the same name: block response is plain text with nosniff, custom error message stays plain text, modifier override wins.
• Extended test_flask_response_factory_create with the header assertion.
• Full suite locally: 231 passed.

Summary by CodeRabbit

• Bug Fixes
  • Error responses now use text/plain; charset=utf-8 by default, including responses for blocked requests.
  • Response modifiers can set a different content type, such as application/problem+json.

[github-actions]

Thanks for opening your first pull request on flaskapi-guard!

Quick checklist before review (most of these are enforced by CI, but worth a glance):

• make lint — ruff format, ruff check, mypy, and vulture
• make test (or make local-test) — full test suite passes with 100% coverage
• make security — bandit, safety, and pip-audit all clean
• make quality — radon and xenon complexity thresholds respected
• No # noqa / # type: ignore shortcuts; pre-existing violations in touched files are fixed
• Added an entry under ## Unreleased in CHANGELOG.md
• If you touched a public API, updated the relevant page under docs/
• If the change involves engine logic, the corresponding fix landed in guard-core first

See CONTRIBUTING.md for the full workflow and the Code of Conduct for the community standards we follow.

Welcome aboard — a maintainer will review shortly.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: b550df3a-11af-4e16-bf2c-6a7f451b630e

📥 Commits

Reviewing files that changed from the base of the PR and between a046896 and 829b423.

📒 Files selected for processing (3)

• flaskapi_guard/adapters.py
• tests/test_adapters.py
• tests/test_block_response_content_type.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The response factory now sets blocked responses to text/plain. Tests check default and custom 403 responses, the nosniff header, and a response modifier that sets application/problem+json.

Changes

Blocked response content type

Layer / File(s)	Summary
Plain-text response behavior flaskapi_guard/adapters.py, tests/test_adapters.py, tests/test_block_response_content_type.py	The response factory sets the MIME type to text/plain. Tests check the content type for default and custom 403 responses and verify that a response modifier can set application/problem+json.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 829b4

The blocked-response content-type change appears ready to merge after normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 829b4

Blocked responses now declare plain text explicitly. The available tests show that nosniff and application-defined content-type overrides still work; no new access path or weakened control was identified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The affected surface is the content type of error responses constructed through the Flask response factory, not a new request entrypoint or privilege.

Trust Boundaries and Controls

• observed — The blocked-request test uses a forwarded IP header to exercise a 403 response and checks nosniff alongside the new content type. It does not establish production proxy-trust behavior.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 11 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: setting an explicit text/plain content type on blocked responses.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}