auth-gate 0.2.2__tar.gz → 0.2.3__tar.gz

{auth_gate-0.2.2/src/auth_gate.egg-info → auth_gate-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auth-gate
-Version: 0.2.2
+Version: 0.2.3
 Summary: Enterprise-grade authentication for microservices with Kong and Keycloak integration
 Home-page: https://github.com/tradelink-org/auth-gate
 Author: Brian Mburu
@@ -290,6 +290,44 @@ app.add_middleware(
 )
 ```
 
+### Parameterized Paths with UUID Matching
+
+You can exclude or make paths optional using UUID v4 parameters:
+
+```python
+app.add_middleware(
+    AuthMiddleware,
+    excluded_paths={
+        "/api/v1/categories/{category_id:uuid}": {"GET"},  # Public read
+        "/api/v1/products/{product_id:uuid}": {"GET"},
+    },
+    excluded_prefixes={
+        "/api/{version:uuid}": {"GET"},  # Version-specific docs
+    },
+    optional_auth_paths={
+        "/api/v1/recommendations/{user_id:uuid}": {"GET"},  # Personalized if authenticated
+    }
+)
+```
+
+**Pattern Syntax:**
+- `{param:uuid}` - Matches valid UUID v4 format (case-insensitive)
+- Works with exact paths, prefixes, and optional auth paths
+- Supports method-specific exclusions
+- Exact matches take precedence over patterns
+
+**Example Behavior:**
+```python
+# Matches: /api/v1/categories/7b5bcc8f-2c99-43c0-9c7d-e27c10881bd2
+# Does not match: /api/v1/categories/invalid-id
+# Does not match: /api/v1/categories/all
+```
+
+**UUID v4 Validation:**
+- Must have version digit "4" in the correct position
+- Must have variant bits (8, 9, a, or b) in the correct position
+- Accepts uppercase, lowercase, or mixed case
+
 ### Direct Validator Usage
 
 ```python

{auth_gate-0.2.2 → auth_gate-0.2.3}/README.md

@@ -249,6 +249,44 @@ app.add_middleware(
 )
 ```
 
+### Parameterized Paths with UUID Matching
+
+You can exclude or make paths optional using UUID v4 parameters:
+
+```python
+app.add_middleware(
+    AuthMiddleware,
+    excluded_paths={
+        "/api/v1/categories/{category_id:uuid}": {"GET"},  # Public read
+        "/api/v1/products/{product_id:uuid}": {"GET"},
+    },
+    excluded_prefixes={
+        "/api/{version:uuid}": {"GET"},  # Version-specific docs
+    },
+    optional_auth_paths={
+        "/api/v1/recommendations/{user_id:uuid}": {"GET"},  # Personalized if authenticated
+    }
+)
+```
+
+**Pattern Syntax:**
+- `{param:uuid}` - Matches valid UUID v4 format (case-insensitive)
+- Works with exact paths, prefixes, and optional auth paths
+- Supports method-specific exclusions
+- Exact matches take precedence over patterns
+
+**Example Behavior:**
+```python
+# Matches: /api/v1/categories/7b5bcc8f-2c99-43c0-9c7d-e27c10881bd2
+# Does not match: /api/v1/categories/invalid-id
+# Does not match: /api/v1/categories/all
+```
+
+**UUID v4 Validation:**
+- Must have version digit "4" in the correct position
+- Must have variant bits (8, 9, a, or b) in the correct position
+- Accepts uppercase, lowercase, or mixed case
+
 ### Direct Validator Usage
 
 ```python

{auth_gate-0.2.2 → auth_gate-0.2.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "auth-gate"
-version = "0.2.2"
+version = "0.2.3"
 description = "Enterprise-grade authentication for microservices with Kong and Keycloak integration"
 readme = "README.md"
 requires-python = ">=3.11"

{auth_gate-0.2.2 → auth_gate-0.2.3}/setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 name = auth-gate
-version = 0.2.2
+version = 0.2.3
 author = Brian Mburu
 author_email = brian.mburu@students.jkuat.ac.ke
 description = Enterprise-grade authentication for microservices with Kong and Keycloak integration

{auth_gate-0.2.2 → auth_gate-0.2.3}/src/auth_gate/__init__.py

@@ -4,46 +4,67 @@ Tradelink Authentication Client
 Enterprise authentication client for microservices with Kong/Keycloak integration.
 """
 
-from .config import AuthMode, AuthSettings
+from .config import AuthMode, AuthSettings, get_settings, reset_settings
 from .fastapi_utils import (
     get_current_auth,
     get_current_service,
     get_current_user,
     get_optional_auth,
     get_optional_user,
+    is_bypass_mode,
+    is_using_keycloak,
+    is_using_kong,
     require_admin,
     require_customer,
     require_moderator,
     require_roles,
     require_scopes,
+    require_service_roles,
     require_supplier,
     require_supplier_or_admin,
     require_user_admin,
     require_user_customer,
     require_user_moderator,
+    require_user_roles,
     require_user_supplier,
     verify_hmac_signature,
 )
 from .middleware import AuthMiddleware
-from .s2s_auth import CircuitBreaker, CircuitBreakerOpenError, ServiceAuthClient
-from .schemas import ServiceContext, UserContext
-from .user_auth import UserValidator
+from .s2s_auth import (
+    CircuitBreaker,
+    CircuitBreakerOpenError,
+    CircuitState,
+    ServiceAuthClient,
+    ServiceToken,
+    get_service_auth_client,
+)
+from .schemas import AuthContext, BaseAuthContext, ServiceContext, UserContext
+from .user_auth import HMACVerifier, UserValidator, get_user_validator
 
-__version__ = "0.2.2"
+__version__ = "0.2.3"
 
 __all__ = [
     # Configuration
     "AuthSettings",
     "AuthMode",
-    # Schemas
+    "get_settings",
+    "reset_settings",
+    # Schemas & Type Aliases
     "UserContext",
     "ServiceContext",
+    "AuthContext",
+    "BaseAuthContext",
     # User Authentication
     "UserValidator",
+    "HMACVerifier",
+    "get_user_validator",
     # Service-to-Service
     "ServiceAuthClient",
     "CircuitBreaker",
     "CircuitBreakerOpenError",
+    "CircuitState",
+    "ServiceToken",
+    "get_service_auth_client",
     # Middleware
     "AuthMiddleware",
     # FastAPI Dependencies
@@ -53,6 +74,8 @@ __all__ = [
     "get_optional_auth",
     "get_optional_user",
     "require_roles",
+    "require_user_roles",
+    "require_service_roles",
     "require_scopes",
     "require_admin",
     "require_supplier",
@@ -64,4 +87,8 @@ __all__ = [
     "require_user_customer",
     "require_user_supplier",
     "require_user_moderator",
+    # Mode Utilities
+    "is_using_kong",
+    "is_using_keycloak",
+    "is_bypass_mode",
 ]

{auth_gate-0.2.2 → auth_gate-0.2.3}/src/auth_gate/middleware.py

@@ -3,8 +3,9 @@ FastAPI middleware for authentication (with service-to-service support)
 """
 
 import logging
+import re
 import time
-from typing import Dict, Optional, Set, Union
+from typing import Dict, List, Optional, Pattern, Set, Tuple, Union
 
 from fastapi import HTTPException, Request, status
 from fastapi.responses import JSONResponse
@@ -16,6 +17,12 @@ from .user_auth import get_user_validator
 
 logger = logging.getLogger(__name__)
 
+# UUID v4 format: xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx
+# where y is 8, 9, a, or b (variant bits)
+TYPE_PATTERNS = {
+    "uuid": r"[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}",
+}
+
 
 class AuthMiddleware(BaseHTTPMiddleware):
     """
@@ -73,6 +80,16 @@ class AuthMiddleware(BaseHTTPMiddleware):
         # Paths where authentication is optional
         self.optional_auth_dict = self._normalize_paths(optional_auth_paths or set())
 
+        # Compile parameterized patterns
+        self._excluded_patterns = self._compile_patterns(self.excluded_paths_dict)
+        self._excluded_prefix_patterns = self._compile_patterns(
+            self.excluded_prefixes_dict, is_prefix=True
+        )
+        self._optional_patterns = self._compile_patterns(self.optional_auth_dict)
+
+        # Remove parameterized paths from literal dicts (they're now in pattern lists)
+        self._remove_parameterized_from_dicts()
+
         self.validator = get_user_validator()
         self.settings = get_settings()
 
@@ -94,25 +111,195 @@ class AuthMiddleware(BaseHTTPMiddleware):
             return normalized
         raise ValueError("Invalid type for paths: must be set or dict")
 
+    @staticmethod
+    def _has_parameters(path: str) -> bool:
+        """Check if path contains parameter placeholders like {param:type}"""
+        return "{" in path and "}" in path
+
+    def _compile_path_pattern(self, path: str, is_prefix: bool = False) -> Pattern:
+        """
+        Compile a parameterized path pattern to regex.
+
+        Supports syntax: /path/{param:type}/more
+
+        Types:
+            - uuid: UUID v4 format (case-insensitive)
+
+        Args:
+            path: Path pattern with {param:type} placeholders
+            is_prefix: If True, don't anchor end of pattern (for prefix matching)
+
+        Returns:
+            Compiled regex pattern
+
+        Raises:
+            ValueError: If syntax is invalid or type is unsupported
+
+        Examples:
+            >>> _compile_path_pattern('/api/{id:uuid}')
+            re.compile(r'^/api/[0-9a-f]{8}-...$', re.IGNORECASE)
+
+            >>> _compile_path_pattern('/api/{version:uuid}', is_prefix=True)
+            re.compile(r'^/api/[0-9a-f]{8}-...', re.IGNORECASE)
+        """
+        # Pattern to find parameter placeholders: {param:type}
+        param_pattern = r"\{([^}:]+)(?::([^}]+))?\}"
+
+        def replace_param(match: re.Match) -> str:
+            param_name = match.group(1).strip()
+            param_type = match.group(2).strip() if match.group(2) else None
+
+            if param_type is None:
+                raise ValueError(
+                    f"Parameter '{{{param_name}}}' missing type annotation. "
+                    f"Use {{param:type}} syntax (e.g., {{id:uuid}})"
+                )
+
+            if param_type not in TYPE_PATTERNS:
+                supported = ", ".join(TYPE_PATTERNS.keys())
+                raise ValueError(
+                    f"Unsupported type '{param_type}' for parameter '{{{param_name}}}'. "
+                    f"Supported types: {supported}"
+                )
+
+            return f"({TYPE_PATTERNS[param_type]})"
+
+        # Escape special regex characters in path
+        escaped_path = re.escape(path)
+
+        # Unescape { and } for parameter replacement
+        escaped_path = escaped_path.replace(r"\{", "{").replace(r"\}", "}")
+
+        # Replace parameters with regex patterns
+        regex_pattern = re.sub(param_pattern, replace_param, escaped_path)
+
+        # Anchor pattern
+        if is_prefix:
+            regex_pattern = f"^{regex_pattern}"
+        else:
+            regex_pattern = f"^{regex_pattern}$"
+
+        # Compile with case-insensitive flag for UUIDs
+        try:
+            return re.compile(regex_pattern, re.IGNORECASE)
+        except re.error as e:
+            raise ValueError(f"Failed to compile pattern for path '{path}': {e}")
+
+    def _compile_patterns(
+        self, paths_dict: Dict[str, Optional[Set[str]]], is_prefix: bool = False
+    ) -> List[Tuple[Pattern, Optional[Set[str]]]]:
+        """
+        Extract parameterized paths and compile them to regex patterns.
+
+        Args:
+            paths_dict: Dictionary of paths with optional method restrictions
+            is_prefix: If True, compile as prefix patterns (don't anchor end)
+
+        Returns:
+            List of (compiled_pattern, methods) tuples
+
+        Raises:
+            ValueError: If pattern syntax is invalid or type is unsupported
+        """
+        patterns = []
+
+        for path, methods in paths_dict.items():
+            if self._has_parameters(path):
+                try:
+                    compiled_pattern = self._compile_path_pattern(path, is_prefix)
+                    patterns.append((compiled_pattern, methods))
+                except ValueError as e:
+                    raise ValueError(f"Invalid pattern in path '{path}': {e}")
+
+        return patterns
+
+    def _remove_parameterized_from_dicts(self):
+        """
+        Remove parameterized paths from literal path dictionaries.
+        They are now stored in pattern lists.
+        """
+        for path_dict in [
+            self.excluded_paths_dict,
+            self.excluded_prefixes_dict,
+            self.optional_auth_dict,
+        ]:
+            parameterized_keys = [key for key in path_dict.keys() if self._has_parameters(key)]
+            for key in parameterized_keys:
+                del path_dict[key]
+
     def is_excluded(self, path: str, method: str) -> bool:
-        """Check if path is excluded from authentication for the given method"""
-        # Exact match
+        """
+        Check if path is excluded from authentication for the given method.
+
+        Matching order (highest to lowest priority):
+        1. Exact literal match in excluded_paths
+        2. Parameterized pattern match in excluded_paths
+        3. Prefix literal match in excluded_prefixes
+        4. Prefix pattern match in excluded_prefixes
+
+        Args:
+            path: Request path (e.g., '/api/v1/categories/7b5bcc8f-...')
+            method: HTTP method (e.g., 'GET', 'POST')
+
+        Returns:
+            True if path is excluded from authentication for this method
+        """
+        # 1. Exact literal match (O(1) dict lookup)
         for p, methods in self.excluded_paths_dict.items():
             if path == p and (methods is None or method in methods):
+                logger.debug(f"Exact match excluded: {path} [{method}]")
+                return True
+
+        # 2. Parameterized pattern match (O(n) pattern checks)
+        for pattern, methods in self._excluded_patterns:
+            if pattern.match(path) and (methods is None or method in methods):
+                logger.debug(f"Pattern match excluded: {path} [{method}] via {pattern.pattern}")
                 return True
 
-        # Prefix match
+        # 3. Prefix literal match (O(n) prefix checks)
         for p, methods in self.excluded_prefixes_dict.items():
             if path.startswith(p) and (methods is None or method in methods):
+                logger.debug(f"Prefix match excluded: {path} [{method}]")
+                return True
+
+        # 4. Prefix pattern match (O(n) pattern checks)
+        for pattern, methods in self._excluded_prefix_patterns:
+            # For prefix patterns, check if path starts with pattern match
+            match = pattern.match(path)
+            if match and (methods is None or method in methods):
+                logger.debug(
+                    f"Prefix pattern match excluded: {path} [{method}] via {pattern.pattern}"
+                )
                 return True
 
         return False
 
     def is_optional_auth(self, path: str, method: str) -> bool:
-        """Check if path has optional authentication for the given method"""
+        """
+        Check if path has optional authentication for the given method.
+
+        Checks both literal paths and parameterized patterns.
+
+        Args:
+            path: Request path
+            method: HTTP method
+
+        Returns:
+            True if authentication is optional for this path and method
+        """
+        # Exact literal match
         for p, methods in self.optional_auth_dict.items():
             if (path == p) and (methods is None or method in methods):
                 return True
+
+        # Parameterized pattern match
+        for pattern, methods in self._optional_patterns:
+            if pattern.match(path) and (methods is None or method in methods):
+                logger.debug(
+                    f"Pattern match optional auth: {path} [{method}] via {pattern.pattern}"
+                )
+                return True
+
         return False
 
     async def dispatch(self, request: Request, call_next):

{auth_gate-0.2.2 → auth_gate-0.2.3}/src/auth_gate/user_auth.py

@@ -347,7 +347,7 @@ class UserValidator:
             # Testing mode - return mock user
             logger.warning("SECURITY BYPASS MODE - FOR TESTING ONLY")
             return UserContext(
-                user_id="test_user",
+                user_id="00000000-0000-0000-0000-000000000000",
                 username="testuser",
                 roles=["admin"],
                 auth_source="bypass",

{auth_gate-0.2.2 → auth_gate-0.2.3/src/auth_gate.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auth-gate
-Version: 0.2.2
+Version: 0.2.3
 Summary: Enterprise-grade authentication for microservices with Kong and Keycloak integration
 Home-page: https://github.com/tradelink-org/auth-gate
 Author: Brian Mburu
@@ -290,6 +290,44 @@ app.add_middleware(
 )
 ```
 
+### Parameterized Paths with UUID Matching
+
+You can exclude or make paths optional using UUID v4 parameters:
+
+```python
+app.add_middleware(
+    AuthMiddleware,
+    excluded_paths={
+        "/api/v1/categories/{category_id:uuid}": {"GET"},  # Public read
+        "/api/v1/products/{product_id:uuid}": {"GET"},
+    },
+    excluded_prefixes={
+        "/api/{version:uuid}": {"GET"},  # Version-specific docs
+    },
+    optional_auth_paths={
+        "/api/v1/recommendations/{user_id:uuid}": {"GET"},  # Personalized if authenticated
+    }
+)
+```
+
+**Pattern Syntax:**
+- `{param:uuid}` - Matches valid UUID v4 format (case-insensitive)
+- Works with exact paths, prefixes, and optional auth paths
+- Supports method-specific exclusions
+- Exact matches take precedence over patterns
+
+**Example Behavior:**
+```python
+# Matches: /api/v1/categories/7b5bcc8f-2c99-43c0-9c7d-e27c10881bd2
+# Does not match: /api/v1/categories/invalid-id
+# Does not match: /api/v1/categories/all
+```
+
+**UUID v4 Validation:**
+- Must have version digit "4" in the correct position
+- Must have variant bits (8, 9, a, or b) in the correct position
+- Accepts uppercase, lowercase, or mixed case
+
 ### Direct Validator Usage
 
 ```python

{auth_gate-0.2.2 → auth_gate-0.2.3}/src/tests/test_intergration.py

@@ -299,7 +299,7 @@ class TestEndToEndIntegration:
                     # Mock the validator's get_current_user to return bypass user
                     mock_validator.return_value.get_current_user = AsyncMock(
                         return_value=UserContext(
-                            user_id="test_user",
+                            user_id="00000000-0000-0000-0000-000000000000",
                             username="testuser",
                             roles=["admin"],
                             auth_source="bypass",
@@ -314,7 +314,7 @@ class TestEndToEndIntegration:
                     # Should work without any headers
                     response = client.get("/api/profile")
                     assert response.status_code == 200
-                    assert response.json()["user_id"] == "test_user"
+                    assert response.json()["user_id"] == "00000000-0000-0000-0000-000000000000"
 
                     # Admin endpoint should work (due to "admin" role)
                     response = client.get("/api/admin/users")

{auth_gate-0.2.2 → auth_gate-0.2.3}/src/tests/test_middleware.py

@@ -162,7 +162,7 @@ class TestAuthMiddleware:
                 # Should work without any auth headers in bypass mode
                 response = client.get("/protected")
                 assert response.status_code == 200
-                assert response.json()["user_id"] == "test_user"
+                assert response.json()["user_id"] == "00000000-0000-0000-0000-000000000000"
 
 
 class TestMethodSpecificExclusions:
@@ -416,3 +416,346 @@ class TestMethodSpecificExclusions:
 
                 response = client.get("/protected", headers=kong_headers)
                 assert response.status_code == 200
+
+
+class TestParameterizedPathMatching:
+    """Test parameterized path matching with UUID v4 patterns"""
+
+    def test_uuid_path_parameter_basic(self, mock_settings, kong_headers):
+        """Test basic UUID parameter matching"""
+        mock_settings.AUTH_MODE = "kong_headers"
+
+        with patch("auth_gate.middleware.get_settings", return_value=mock_settings):
+            app = FastAPI()
+
+            valid_uuid = "7b5bcc8f-2c99-43c0-9c7d-e27c10881bd2"
+
+            @app.get(f"/api/v1/categories/{valid_uuid}")
+            async def get_category():
+                return {"id": valid_uuid}
+
+            app.add_middleware(
+                AuthMiddleware,
+                excluded_paths={
+                    "/api/v1/categories/{category_id:uuid}": None,
+                },
+            )
+
+            client = TestClient(app)
+
+            # Valid UUID should be excluded (no auth needed)
+            response = client.get(f"/api/v1/categories/{valid_uuid}")
+            assert response.status_code == 200
+            assert response.json()["id"] == valid_uuid
+
+    def test_uuid_path_parameter_with_methods(self, mock_settings, kong_headers):
+        """Test UUID parameters with method-specific exclusions"""
+        mock_settings.AUTH_MODE = "kong_headers"
+
+        with patch("auth_gate.middleware.get_settings", return_value=mock_settings):
+            app = FastAPI()
+
+            valid_uuid = "a1b2c3d4-e5f6-4789-abcd-ef0123456789"
+
+            @app.get(f"/api/v1/products/{valid_uuid}")
+            async def get_product():
+                return {"id": valid_uuid, "method": "GET"}
+
+            @app.post(f"/api/v1/products/{valid_uuid}")
+            async def update_product(request: Request):
+                user = request.state.user
+                return {"id": valid_uuid, "method": "POST", "user": user.user_id}
+
+            app.add_middleware(
+                AuthMiddleware,
+                excluded_paths={
+                    "/api/v1/products/{product_id:uuid}": {"GET"},  # Only GET excluded
+                },
+            )
+
+            client = TestClient(app)
+
+            # GET should work without auth (excluded)
+            response = client.get(f"/api/v1/products/{valid_uuid}")
+            assert response.status_code == 200
+            assert response.json()["method"] == "GET"
+
+            # POST should require auth (not excluded)
+            response = client.post(f"/api/v1/products/{valid_uuid}")
+            assert response.status_code == 401
+
+            # POST with auth should work
+            response = client.post(f"/api/v1/products/{valid_uuid}", headers=kong_headers)
+            assert response.status_code == 200
+            assert response.json()["user"] == "test-user-123"
+
+    def test_uuid_invalid_format_requires_auth(self, mock_settings):
+        """Test that invalid UUID formats don't match pattern"""
+        mock_settings.AUTH_MODE = "kong_headers"
+
+        with patch("auth_gate.middleware.get_settings", return_value=mock_settings):
+            app = FastAPI()
+
+            @app.get("/api/v1/categories/{category_id}")
+            async def get_category(category_id: str):
+                return {"id": category_id}
+
+            app.add_middleware(
+                AuthMiddleware,
+                excluded_paths={
+                    "/api/v1/categories/{category_id:uuid}": None,
+                },
+            )
+
+            client = TestClient(app)
+
+            # Invalid UUIDs should require auth
+            invalid_ids = [
+                "invalid-id",
+                "123",
+                "all",
+                "not-a-uuid",
+                "7b5bcc8f",  # Too short
+                "7b5bcc8f-2c99-43c0-9c7d-e27c10881bd2-extra",  # Too long
+                "7b5bcc8f-2c99-53c0-9c7d-e27c10881bd2",  # Wrong version (5 instead of 4)
+            ]
+
+            for invalid_id in invalid_ids:
+                response = client.get(f"/api/v1/categories/{invalid_id}")
+                assert response.status_code == 401, f"Expected 401 for {invalid_id}"
+
+    def test_exact_match_takes_precedence_over_pattern(self, mock_settings, kong_headers):
+        """Test that exact paths have higher priority than patterns"""
+        mock_settings.AUTH_MODE = "kong_headers"
+
+        with patch("auth_gate.middleware.get_settings", return_value=mock_settings):
+            app = FastAPI()
+
+            @app.get("/api/v1/categories/featured")
+            async def get_featured():
+                return {"type": "featured"}
+
+            @app.post("/api/v1/categories/featured")
+            async def update_featured():
+                return {"type": "updated"}
+
+            app.add_middleware(
+                AuthMiddleware,
+                excluded_paths={
+                    "/api/v1/categories/featured": None,  # Exact match - all methods
+                    "/api/v1/categories/{category_id:uuid}": {"GET"},  # Pattern - GET only
+                },
+            )
+
+            client = TestClient(app)
+
+            # Exact match should work for all methods (None = all methods)
+            response = client.get("/api/v1/categories/featured")
+            assert response.status_code == 200
+
+            response = client.post("/api/v1/categories/featured")
+            assert response.status_code == 200  # Exact match wins, POST excluded
+
+    def test_multiple_uuid_parameters(self, mock_settings):
+        """Test paths with multiple UUID parameters"""
+        mock_settings.AUTH_MODE = "kong_headers"
+
+        with patch("auth_gate.middleware.get_settings", return_value=mock_settings):
+            app = FastAPI()
+
+            store_id = "550e8400-e29b-41d4-a716-446655440000"
+            product_id = "7b5bcc8f-2c99-43c0-9c7d-e27c10881bd2"
+
+            @app.get(f"/api/v1/stores/{store_id}/products/{product_id}")
+            async def get_product():
+                return {"store_id": store_id, "product_id": product_id}
+
+            app.add_middleware(
+                AuthMiddleware,
+                excluded_paths={
+                    "/api/v1/stores/{store_id:uuid}/products/{product_id:uuid}": {"GET"},
+                },
+            )
+
+            client = TestClient(app)
+
+            # Valid UUIDs should match
+            response = client.get(f"/api/v1/stores/{store_id}/products/{product_id}")
+            assert response.status_code == 200
+            assert response.json()["store_id"] == store_id
+            assert response.json()["product_id"] == product_id
+
+            # Invalid UUID in either position should require auth
+            response = client.get(f"/api/v1/stores/invalid/products/{product_id}")
+            assert response.status_code == 401
+
+            response = client.get(f"/api/v1/stores/{store_id}/products/invalid")
+            assert response.status_code == 401
+
+    def test_pattern_match_with_optional_auth(self, mock_settings, kong_headers):
+        """Test parameterized paths with optional authentication"""
+        mock_settings.AUTH_MODE = "kong_headers"
+
+        with patch("auth_gate.middleware.get_settings", return_value=mock_settings):
+            app = FastAPI()
+
+            user_id = "123e4567-e89b-42d3-a456-426614174000"
+
+            @app.get(f"/api/v1/recommendations/{user_id}")
+            async def get_recommendations(request: Request):
+                user = getattr(request.state, "user", None)
+                if user:
+                    return {"personalized": True, "user_id": user.user_id}
+                return {"personalized": False}
+
+            app.add_middleware(
+                AuthMiddleware,
+                optional_auth_paths={
+                    "/api/v1/recommendations/{user_id:uuid}": {"GET"},
+                },
+            )
+
+            client = TestClient(app)
+
+            # Without auth - should work but not personalized
+            response = client.get(f"/api/v1/recommendations/{user_id}")
+            assert response.status_code == 200
+            assert response.json()["personalized"] is False
+
+            # With auth - should work and be personalized
+            response = client.get(f"/api/v1/recommendations/{user_id}", headers=kong_headers)
+            assert response.status_code == 200
+            assert response.json()["personalized"] is True
+            assert response.json()["user_id"] == "test-user-123"
+
+    def test_prefix_pattern_matching(self, mock_settings):
+        """Test parameterized prefix matching"""
+        mock_settings.AUTH_MODE = "kong_headers"
+
+        with patch("auth_gate.middleware.get_settings", return_value=mock_settings):
+            app = FastAPI()
+
+            version_id = "f47ac10b-58cc-4372-a567-0e02b2c3d479"
+
+            @app.get(f"/api/{version_id}/docs")
+            async def get_docs():
+                return {"version": version_id, "type": "docs"}
+
+            @app.get(f"/api/{version_id}/swagger")
+            async def get_swagger():
+                return {"version": version_id, "type": "swagger"}
+
+            app.add_middleware(
+                AuthMiddleware,
+                excluded_prefixes={
+                    "/api/{version:uuid}": {"GET"},
+                },
+            )
+
+            client = TestClient(app)
+
+            # Both should be excluded (prefix match)
+            response = client.get(f"/api/{version_id}/docs")
+            assert response.status_code == 200
+
+            response = client.get(f"/api/{version_id}/swagger")
+            assert response.status_code == 200
+
+    def test_backward_compatibility_no_regression(self, mock_settings, kong_headers):
+        """Test that existing configurations still work"""
+        mock_settings.AUTH_MODE = "kong_headers"
+
+        with patch("auth_gate.middleware.get_settings", return_value=mock_settings):
+            app = FastAPI()
+
+            @app.get("/health")
+            async def health():
+                return {"status": "ok"}
+
+            @app.get("/api/docs/swagger")
+            async def swagger():
+                return {"docs": "swagger"}
+
+            @app.get("/protected")
+            async def protected(request: Request):
+                user = request.state.user
+                return {"user_id": user.user_id}
+
+            app.add_middleware(
+                AuthMiddleware,
+                excluded_paths={"/health"},  # Set format (legacy)
+                excluded_prefixes={"/api/docs": {"GET"}},  # Dict with methods
+            )
+
+            client = TestClient(app)
+
+            # Exact path exclusion still works
+            response = client.get("/health")
+            assert response.status_code == 200
+
+            # Prefix exclusion still works
+            response = client.get("/api/docs/swagger")
+            assert response.status_code == 200
+
+            # Protected endpoint still requires auth
+            response = client.get("/protected")
+            assert response.status_code == 401
+
+            response = client.get("/protected", headers=kong_headers)
+            assert response.status_code == 200
+
+    def test_invalid_pattern_syntax_raises_error(self, mock_settings):
+        """Test that invalid patterns raise clear errors"""
+        mock_settings.AUTH_MODE = "kong_headers"
+
+        with patch("auth_gate.middleware.get_settings", return_value=mock_settings):
+            with patch("auth_gate.middleware.get_user_validator"):
+                # Missing type annotation
+                with pytest.raises(ValueError, match="missing type annotation"):
+                    AuthMiddleware(
+                        app=None,
+                        excluded_paths={
+                            "/api/{id}": None,  # No :type specified
+                        },
+                    )
+
+                # Unsupported type
+                with pytest.raises(ValueError, match="Unsupported type"):
+                    AuthMiddleware(
+                        app=None,
+                        excluded_paths={
+                            "/api/{id:invalid}": None,
+                        },
+                    )
+
+    def test_case_insensitive_uuid_matching(self, mock_settings):
+        """Test that UUID matching is case-insensitive"""
+        mock_settings.AUTH_MODE = "kong_headers"
+
+        with patch("auth_gate.middleware.get_settings", return_value=mock_settings):
+            app = FastAPI()
+
+            @app.get("/api/v1/items/{item_id}")
+            async def get_item(item_id: str):
+                return {"id": item_id}
+
+            app.add_middleware(
+                AuthMiddleware,
+                excluded_paths={
+                    "/api/v1/items/{item_id:uuid}": None,
+                },
+            )
+
+            client = TestClient(app)
+
+            # Test different case variations (all valid UUID v4)
+            uuids = [
+                "7b5bcc8f-2c99-43c0-9c7d-e27c10881bd2",  # lowercase
+                "7B5BCC8F-2C99-43C0-9C7D-E27C10881BD2",  # uppercase
+                "7b5bCc8f-2C99-43c0-9C7d-E27c10881bD2",  # mixed case
+            ]
+
+            for uuid_val in uuids:
+                response = client.get(f"/api/v1/items/{uuid_val}")
+                assert response.status_code == 200, f"Failed for UUID: {uuid_val}"
+                assert response.json()["id"] == uuid_val

{auth_gate-0.2.2 → auth_gate-0.2.3}/src/tests/test_user_auth.py

@@ -217,7 +217,7 @@ class TestUserValidator:
         user = await validator.get_current_user(request)
 
         assert isinstance(user, UserContext)
-        assert user.user_id == "test_user"
+        assert user.user_id == "00000000-0000-0000-0000-000000000000"
         assert user.username == "testuser"
         assert user.roles == ["admin"]
         assert user.auth_source == "bypass"