auth 2.4.0__tar.gz → 2.4.1__tar.gz

{auth-2.4.0 → auth-2.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auth
-Version: 2.4.0
+Version: 2.4.1
 Summary: Authorization for humans
 Author-email: Farshid Ashouri <farsheed.ashouri@gmail.com>
 License-Expression: MIT
@@ -41,11 +41,10 @@ Provides-Extra: ratelimit
 Requires-Dist: flask-limiter>=3.0.0; extra == "ratelimit"
 Provides-Extra: migrations
 Requires-Dist: migretti>=0.10.0; extra == "migrations"
-Requires-Dist: alembic>=1.13.0; extra == "migrations"
 Provides-Extra: dev
 Requires-Dist: pytest>=6.0; extra == "dev"
 Requires-Dist: pytest-cov>=2.0; extra == "dev"
-Requires-Dist: alembic>=1.13.0; extra == "dev"
+Requires-Dist: migretti>=0.10.0; extra == "dev"
 Requires-Dist: ruff>=0.0.260; extra == "dev"
 Requires-Dist: mypy>=1.0; extra == "dev"
 Requires-Dist: types-requests; extra == "dev"
@@ -121,6 +120,11 @@ with Client(api_key=KEY, service_url="https://auth.rodmena.app") as c:
   a hash, and validates them inside your namespace — an identity UI fronts the
   lifecycle, backends validate then use the RBAC checks. Client methods:
   `create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`.
+- **DEPRECATED — bare user strings.** Asserting a `<user>` that no validated API
+  key backs is scheduled for decommission: 2.5.0 adds opt-in per-tenant strict
+  mode, **3.0.0 makes key-backed users mandatory** (each phase ships only after
+  every consuming platform confirms). Migrate backends to
+  `validate → user → has_permission` now. Details: [docs/DEPRECATIONS.md](docs/DEPRECATIONS.md).
 
 ## Documentation
 

{auth-2.4.0 → auth-2.4.1}/README.md

@@ -64,6 +64,11 @@ with Client(api_key=KEY, service_url="https://auth.rodmena.app") as c:
   a hash, and validates them inside your namespace — an identity UI fronts the
   lifecycle, backends validate then use the RBAC checks. Client methods:
   `create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`.
+- **DEPRECATED — bare user strings.** Asserting a `<user>` that no validated API
+  key backs is scheduled for decommission: 2.5.0 adds opt-in per-tenant strict
+  mode, **3.0.0 makes key-backed users mandatory** (each phase ships only after
+  every consuming platform confirms). Migrate backends to
+  `validate → user → has_permission` now. Details: [docs/DEPRECATIONS.md](docs/DEPRECATIONS.md).
 
 ## Documentation
 

{auth-2.4.0 → auth-2.4.1}/auth/docs_page.py

@@ -142,6 +142,16 @@ authenticate `/api/*` itself — the Bearer header always takes your client key.
 Rotating your client key moves your users' API keys with the namespace; the
 secrets keep validating afterwards.
 
+**DEPRECATION — bare user strings (decommission target: 3.0.0).** Today any
+`<user>` string answers authorization checks whether or not a key backs it.
+That is being retired: 2.5.0 adds per-tenant opt-in strict mode (a user with no
+active API key answers negatively, reason `user_not_key_backed`, same response
+shapes) plus `POST /api/apikeys/check_permission` (validate + permission check
+in one round trip); 3.0.0 makes strict identity the default. Each phase ships
+only after every consuming platform has confirmed readiness. Migrate now:
+issue keys to your users and derive the user from `/api/apikeys/validate`
+instead of asserting it.
+
 ## 4. Endpoints
 
 All paths need the `Authorization` header except `/ping` and `/health`.

{auth-2.4.0 → auth-2.4.1}/auth.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auth
-Version: 2.4.0
+Version: 2.4.1
 Summary: Authorization for humans
 Author-email: Farshid Ashouri <farsheed.ashouri@gmail.com>
 License-Expression: MIT
@@ -41,11 +41,10 @@ Provides-Extra: ratelimit
 Requires-Dist: flask-limiter>=3.0.0; extra == "ratelimit"
 Provides-Extra: migrations
 Requires-Dist: migretti>=0.10.0; extra == "migrations"
-Requires-Dist: alembic>=1.13.0; extra == "migrations"
 Provides-Extra: dev
 Requires-Dist: pytest>=6.0; extra == "dev"
 Requires-Dist: pytest-cov>=2.0; extra == "dev"
-Requires-Dist: alembic>=1.13.0; extra == "dev"
+Requires-Dist: migretti>=0.10.0; extra == "dev"
 Requires-Dist: ruff>=0.0.260; extra == "dev"
 Requires-Dist: mypy>=1.0; extra == "dev"
 Requires-Dist: types-requests; extra == "dev"
@@ -121,6 +120,11 @@ with Client(api_key=KEY, service_url="https://auth.rodmena.app") as c:
   a hash, and validates them inside your namespace — an identity UI fronts the
   lifecycle, backends validate then use the RBAC checks. Client methods:
   `create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`.
+- **DEPRECATED — bare user strings.** Asserting a `<user>` that no validated API
+  key backs is scheduled for decommission: 2.5.0 adds opt-in per-tenant strict
+  mode, **3.0.0 makes key-backed users mandatory** (each phase ships only after
+  every consuming platform confirms). Migrate backends to
+  `validate → user → has_permission` now. Details: [docs/DEPRECATIONS.md](docs/DEPRECATIONS.md).
 
 ## Documentation
 

{auth-2.4.0 → auth-2.4.1}/auth.egg-info/SOURCES.txt

@@ -47,7 +47,6 @@ tests/test_encryption_integration.py
 tests/test_flask.py
 tests/test_key_rotation.py
 tests/test_log_redaction.py
-tests/test_migrations.py
 tests/test_phase_a_hardening.py
 tests/test_reencryption.py
 tests/test_routes_errors.py

{auth-2.4.0 → auth-2.4.1}/auth.egg-info/requires.txt

@@ -14,7 +14,7 @@ python-json-logger<4,>=3.1.0
 [dev]
 pytest>=6.0
 pytest-cov>=2.0
-alembic>=1.13.0
+migretti>=0.10.0
 ruff>=0.0.260
 mypy>=1.0
 types-requests
@@ -25,7 +25,6 @@ responses>=0.23
 
 [migrations]
 migretti>=0.10.0
-alembic>=1.13.0
 
 [ratelimit]
 flask-limiter>=3.0.0

{auth-2.4.0 → auth-2.4.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "auth"
-version = "2.4.0"
+version = "2.4.1"
 description = "Authorization for humans"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -58,17 +58,15 @@ dependencies = [
 ratelimit = [
     "flask-limiter>=3.0.0",
 ]
-# Database schema migrations. migretti (house standard) authors and applies
-# NEW migrations; alembic remains only to read the retired legacy tree in
-# migrations_legacy_alembic/. Not required to import or serve the app.
+# Database schema migrations (migretti, SQL-first house standard). Not
+# required to import or serve the app.
 migrations = [
     "migretti>=0.10.0",
-    "alembic>=1.13.0",
 ]
 dev = [
     "pytest>=6.0",
     "pytest-cov>=2.0",
-    "alembic>=1.13.0",
+    "migretti>=0.10.0",
     "ruff>=0.0.260",
     "mypy>=1.0",
     "types-requests",

{auth-2.4.0 → auth-2.4.1}/tests/test_api_keys_encryption.py

@@ -15,8 +15,6 @@ from sqlalchemy import select
 
 from auth.models.sql import AuthApiKey
 
-pytestmark = []
-
 _SHA256_HEX = re.compile(r"^[0-9a-f]{64}$")
 
 

auth-2.4.0/tests/test_migrations.py

@@ -1,45 +0,0 @@
-"""The RETIRED Alembic migration stack still loads, applies, and reverses.
-
-Alembic is frozen at its single legacy revision (0001_widen_text, applied in
-production) and lives in migrations_legacy_alembic/; NEW migrations are
-migretti SQL files in migrations/ (see MIGRATIONS.md). These tests keep the
-legacy tree loadable so the recorded history stays reproducible.
-
-On SQLite the widening migration is a no-op (SQLite ignores varchar length), so
-these assert the framework wiring — env.py resolves the app's database, the
-revision imports, and upgrade/downgrade run without error. The real varchar->TEXT
-behaviour is exercised against PostgreSQL in the integration run.
-"""
-
-import os
-
-import pytest
-
-pytest.importorskip("alembic")
-
-from alembic import command  # noqa: E402
-from alembic.config import Config  # noqa: E402
-
-from auth.database import create_tables  # noqa: E402
-
-_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-
-
-def _config() -> Config:
-    cfg = Config(os.path.join(_ROOT, "alembic.ini"))
-    cfg.set_main_option(
-        "script_location", os.path.join(_ROOT, "migrations_legacy_alembic")
-    )
-    return cfg
-
-
-def test_upgrade_head_runs():
-    # Alembic owns changes; create_tables owns creation. Tables must exist first.
-    create_tables(raise_on_error=True)
-    command.upgrade(_config(), "head")  # must not raise
-
-
-def test_downgrade_then_upgrade_roundtrips():
-    cfg = _config()
-    command.downgrade(cfg, "base")
-    command.upgrade(cfg, "head")