auth 2.4.0__tar.gz → 2.5.0__tar.gz

{auth-2.4.0 → auth-2.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auth
-Version: 2.4.0
+Version: 2.5.0
 Summary: Authorization for humans
 Author-email: Farshid Ashouri <farsheed.ashouri@gmail.com>
 License-Expression: MIT
@@ -41,11 +41,10 @@ Provides-Extra: ratelimit
 Requires-Dist: flask-limiter>=3.0.0; extra == "ratelimit"
 Provides-Extra: migrations
 Requires-Dist: migretti>=0.10.0; extra == "migrations"
-Requires-Dist: alembic>=1.13.0; extra == "migrations"
 Provides-Extra: dev
 Requires-Dist: pytest>=6.0; extra == "dev"
 Requires-Dist: pytest-cov>=2.0; extra == "dev"
-Requires-Dist: alembic>=1.13.0; extra == "dev"
+Requires-Dist: migretti>=0.10.0; extra == "dev"
 Requires-Dist: ruff>=0.0.260; extra == "dev"
 Requires-Dist: mypy>=1.0; extra == "dev"
 Requires-Dist: types-requests; extra == "dev"
@@ -121,6 +120,13 @@ with Client(api_key=KEY, service_url="https://auth.rodmena.app") as c:
   a hash, and validates them inside your namespace — an identity UI fronts the
   lifecycle, backends validate then use the RBAC checks. Client methods:
   `create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`.
+- **DEPRECATED — bare user strings.** Asserting a `<user>` that no validated API
+  key backs is scheduled for decommission. The opt-in phase is live (2.5.0):
+  `PUT /api/settings {"strict_users": true}` makes keyless users answer
+  negatively (`user_not_key_backed`), and `POST /api/apikeys/check_permission`
+  does validate + permission in one round trip. **3.0.0 makes key-backed users
+  mandatory** — only after every consuming platform confirms.
+  Details: [docs/DEPRECATIONS.md](docs/DEPRECATIONS.md).
 
 ## Documentation
 

{auth-2.4.0 → auth-2.5.0}/README.md

@@ -64,6 +64,13 @@ with Client(api_key=KEY, service_url="https://auth.rodmena.app") as c:
   a hash, and validates them inside your namespace — an identity UI fronts the
   lifecycle, backends validate then use the RBAC checks. Client methods:
   `create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`.
+- **DEPRECATED — bare user strings.** Asserting a `<user>` that no validated API
+  key backs is scheduled for decommission. The opt-in phase is live (2.5.0):
+  `PUT /api/settings {"strict_users": true}` makes keyless users answer
+  negatively (`user_not_key_backed`), and `POST /api/apikeys/check_permission`
+  does validate + permission in one round trip. **3.0.0 makes key-backed users
+  mandatory** — only after every consuming platform confirms.
+  Details: [docs/DEPRECATIONS.md](docs/DEPRECATIONS.md).
 
 ## Documentation
 

{auth-2.4.0 → auth-2.5.0}/auth/audit.py

@@ -42,6 +42,9 @@ class AuditAction(Enum):
     LIST_API_KEYS = "LIST_API_KEYS"
     REVOKE_API_KEY = "REVOKE_API_KEY"
     VALIDATE_API_KEY = "VALIDATE_API_KEY"
+    CHECK_API_KEY_PERMISSION = "CHECK_API_KEY_PERMISSION"
+    GET_SETTINGS = "GET_SETTINGS"
+    UPDATE_SETTINGS = "UPDATE_SETTINGS"
 
 
 class AuditLog(Base):

{auth-2.4.0 → auth-2.5.0}/auth/client.py

@@ -166,6 +166,8 @@ class EnhancedAuthClient:
             "apikeys_user": "/api/apikeys/user/{user}",
             "apikey_revoke": "/api/apikeys/user/{user}/{key_id}",
             "apikey_validate": "/api/apikeys/validate",
+            "apikey_check_permission": "/api/apikeys/check_permission",
+            "settings": "/api/settings",
         }
 
         # Built on first use: a session without retries for non-idempotent
@@ -543,6 +545,60 @@ class EnhancedAuthClient:
         except Exception as e:
             return self._transport_failure(e, data={"key_prefix": api_key[:12]})
 
+    def check_api_key_permission(
+        self, api_key: str, permission: str
+    ) -> Dict[str, Any]:
+        """Validate a secret AND check its subject's permission in one call.
+
+        ``data.valid`` false → the key failed (reason as in validate_api_key);
+        true → ``data.has_permission`` answers for the key's user. The secret
+        travels in the JSON body; failure payloads echo only its prefix.
+
+        Transport failure: error dict without the answer field (or
+        ``AuthTransportError`` if ``raise_on_error=True``); check ``success``
+        before reading ``data`` — a missing ``valid`` is an outage, not a
+        denial.
+        """
+        try:
+            return self._make_request(
+                "POST",
+                self.endpoints["apikey_check_permission"],
+                json={"api_key": api_key, "permission": permission},
+            )
+        except Exception as e:
+            return self._transport_failure(
+                e, data={"key_prefix": api_key[:12], "permission": permission}
+            )
+
+    # Tenant settings (SPEC 0010)
+    def get_settings(self) -> Dict[str, Any]:
+        """This tenant's settings (``data.strict_users``).
+
+        Transport failure: error dict without the answer field (or
+        ``AuthTransportError`` if ``raise_on_error=True``); check ``success``.
+        """
+        try:
+            return self._make_request("GET", self.endpoints["settings"])
+        except Exception as e:
+            return self._transport_failure(e)
+
+    def set_strict_users(self, enabled: bool) -> Dict[str, Any]:
+        """Enable/disable strict user identity for this tenant (idempotent).
+
+        While enabled, authorization decisions about users with no live API
+        key answer negatively (``reason: user_not_key_backed``) — issue keys
+        before flipping this on.
+
+        Transport failure: error dict without the answer field (or
+        ``AuthTransportError`` if ``raise_on_error=True``); check ``success``.
+        """
+        try:
+            return self._make_request(
+                "PUT", self.endpoints["settings"], json={"strict_users": enabled}
+            )
+        except Exception as e:
+            return self._transport_failure(e, data={"strict_users": enabled})
+
     # Workflow-related methods
     def get_users_for_workflow(self, workflow_name: str) -> Dict[str, Any]:
         """Get all users who can run a specific workflow.

{auth-2.4.0 → auth-2.5.0}/auth/docs_page.py

@@ -142,6 +142,19 @@ authenticate `/api/*` itself — the Bearer header always takes your client key.
 Rotating your client key moves your users' API keys with the namespace; the
 secrets keep validating afterwards.
 
+**DEPRECATION — bare user strings (decommission target: 3.0.0).** Today any
+`<user>` string answers authorization checks whether or not a key backs it.
+That is being retired. **Since 2.5.0 the opt-in phase is live**: enable strict
+mode with `PUT /api/settings` `{{"strict_users": true}}` and authorization
+decisions about users with no active API key answer negatively (same response
+shapes, additive reason `user_not_key_backed`); membership adds for key-less
+users return `{{"result": false}}` — create the key first, then grant roles.
+Strict mode never blocks key issuance or any delete/revoke path. 3.0.0 makes
+strict identity the default, and ships only after every consuming platform has
+confirmed readiness. Migrate now: issue keys to your users, derive the user
+from `/api/apikeys/validate` — or do both steps in one round trip with
+`POST /api/apikeys/check_permission`.
+
 ## 4. Endpoints
 
 All paths need the `Authorization` header except `/ping` and `/health`.
@@ -207,7 +220,7 @@ only copy — persist it. See section 3 for the full semantics and threat model.
 
 | Method | Path | Returns |
 |---|---|---|
-| POST | `/api/keys/rotate` | wrapped, `data` = `{{"new_key": "<uuid4>", "migrated": {{"roles": 1, "memberships": 1, "permissions": 1, "api_keys": 0}}}}` |
+| POST | `/api/keys/rotate` | wrapped, `data` = `{{"new_key": "<uuid4>", "migrated": {{"roles": 1, "memberships": 1, "permissions": 1, "api_keys": 0, "settings": 0}}}}` |
 
 ### Per-user API keys
 
@@ -224,6 +237,18 @@ active keys per user — revoke to free a slot.
 | GET | `/api/apikeys/user/<user>` | wrapped, `data` = `{{"count": 1, "keys": [{{"key_id": "<uuid4>", "key_prefix": "rak_ab12cd34", "label": "laptop", "is_active": true, "created": "<iso>", "revoked_at": null, "expires_at": null, "last_used_at": "<iso>"}}]}}` |
 | DELETE | `/api/apikeys/user/<user>/<key_id>` | wrapped, `data` = `{{"revoked": true, "already_revoked": false}}` (repeat calls idempotent; 404 JSON if no such key for that user in your namespace) |
 | POST | `/api/apikeys/validate` | body `{{"api_key": "rak_..."}}` → wrapped, `data` = `{{"valid": true, "user": "alice", "key_id": "<uuid4>", "label": "laptop", "expires_at": null}}` or `{{"valid": false, "reason": "revoked" | "expired" | "unknown_key"}}` |
+| POST | `/api/apikeys/check_permission` | body `{{"api_key": "rak_...", "permission": "deploy"}}` → wrapped, `data` = `{{"valid": true, "user": "alice", "key_id": "<uuid4>", "has_permission": true}}` or the validate-style `{{"valid": false, "reason": ...}}` — validate + permission check in ONE round trip |
+
+### Tenant settings
+
+Per-tenant switches. Today there is one: `strict_users` (see the deprecation
+note in section 3). Enabling it is how you opt in to strict user identity
+before 3.0.0 makes it the default.
+
+| Method | Path | Returns |
+|---|---|---|
+| GET | `/api/settings` | wrapped, `data` = `{{"strict_users": false}}` (defaults when never set) |
+| PUT | `/api/settings` | body `{{"strict_users": true}}` → wrapped, `data` = `{{"strict_users": true}}` (idempotent, audited) |
 
 ### Service
 
@@ -279,8 +304,10 @@ Methods mirror the endpoints: `create_role`, `delete_role`, `list_roles`,
 `remove_permission`, `has_permission`, `user_has_permission`,
 `get_user_permissions`, `get_role_permissions`, `get_user_roles`,
 `get_role_members`, `which_roles_can`, `which_users_can`,
-`get_users_for_workflow`, `rotate_key`, `ping`, and the per-user key lifecycle
-`create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`.
+`get_users_for_workflow`, `rotate_key`, `ping`, the per-user key lifecycle
+`create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`,
+`check_api_key_permission`, and tenant settings `get_settings` /
+`set_strict_users`.
 Each returns the parsed JSON body, so the shapes in section 4 still apply.
 `rotate_key()` also switches the live client (and its session header) to the new
 key on success and returns it — persist `data.new_key`, it is the only copy.

{auth-2.4.0 → auth-2.5.0}/auth/models/sql.py

@@ -271,3 +271,25 @@ class AuthApiKey(Base):
             )
         else:
             self._label = value  # type: ignore[assignment]
+
+
+class AuthTenantSettings(Base):
+    """Per-tenant settings (SPEC 0010). One row per creator; absence of a row
+    means every default. `strict_users` gates SPEC 0008 strict user identity:
+    while true, authorization decisions about users with no live API key
+    answer negatively. Key rotation moves this row with the namespace."""
+
+    __tablename__ = "auth_tenant_settings"
+    __table_args__ = (
+        UniqueConstraint("creator", name="uq_auth_tenant_settings_creator"),
+        {
+            "sqlite_autoincrement": True,
+            "schema": _SCHEMA,
+        },
+    )
+
+    id = Column(Integer, primary_key=True, index=True)
+    creator = Column(String(64), nullable=False)
+    strict_users = Column(Boolean, nullable=False, default=False)
+    date_created = Column(DateTime, default=func.now())
+    modified = Column(DateTime, default=func.now(), onupdate=func.now())

{auth-2.4.0 → auth-2.5.0}/auth/routes.py

@@ -142,6 +142,18 @@ def register_routes(app):
             return jsonify({"status": "unhealthy"}), 503
         return jsonify({"status": "healthy"})
 
+    def _strict_reason(auth_service, user):
+        """Additive reason for negative answers under strict user identity.
+
+        Computed only on negative paths; None whenever strict mode is off or
+        the user is key-backed (i.e. the negative is a genuine denial).
+        """
+        if auth_service.strict_users_enabled() and not auth_service.user_is_key_backed(
+            user
+        ):
+            return "user_not_key_backed"
+        return None
+
     @app.route("/api/membership/<user>/<group>", methods=["GET"])
     @with_db_session
     @audit_log(AuditAction.CHECK_MEMBERSHIP, resource_extractor=lambda kwargs: f"{client_fingerprint(kwargs['user'])}:{kwargs['group']}")
@@ -153,10 +165,17 @@ def register_routes(app):
             return APIResponse.bad_request(error_msg)
 
         auth_service = _get_auth_service(db)  # Use helper
-        result = auth_service.has_membership(user, group)
+        # Strict gate lives here (not in the service) so del_membership's
+        # internal has_membership call keeps working — revocation must never
+        # be blocked by strict mode.
+        reason = _strict_reason(auth_service, user)
+        result = False if reason else auth_service.has_membership(user, group)
+        data = format_permission_response(result)
+        if reason:
+            data["reason"] = reason
 
         return APIResponse.success(
-            data=format_permission_response(result),
+            data=data,
             message=f"Membership check for user '{user}' and group '{group}' completed",
         )
 
@@ -172,6 +191,10 @@ def register_routes(app):
 
         auth_service = _get_auth_service(db)  # Use helper
         result = auth_service.add_membership(user, group)
+        if not result:
+            reason = _strict_reason(auth_service, user)
+            if reason:
+                return jsonify({"result": result, "reason": reason})
 
         return jsonify({"result": result})
 
@@ -259,9 +282,14 @@ def register_routes(app):
 
         auth_service = _get_auth_service(db)  # Use helper
         result = auth_service.user_has_permission(user, name)
+        data = format_permission_response(result)
+        if not result:
+            reason = _strict_reason(auth_service, user)
+            if reason:
+                data["reason"] = reason
 
         return APIResponse.success(
-            data=format_permission_response(result),
+            data=data,
             message=f"Permission check for user '{user}' and permission '{name}' completed",
         )
 
@@ -277,9 +305,14 @@ def register_routes(app):
 
         auth_service = _get_auth_service(db)  # Use helper
         permissions = auth_service.get_user_permissions(user)
+        data = format_user_permissions_response(permissions)
+        if not permissions:
+            reason = _strict_reason(auth_service, user)
+            if reason:
+                data["reason"] = reason
 
         return APIResponse.success(
-            data=format_user_permissions_response(permissions),
+            data=data,
             message=f"Retrieved permissions for user '{user}'",
         )
 
@@ -436,9 +469,14 @@ def register_routes(app):
         auth_service = _get_auth_service(db)
 
         result = auth_service.user_has_permission(user, workflow_name)
+        data = format_permission_response(result)
+        if not result:
+            reason = _strict_reason(auth_service, user)
+            if reason:
+                data["reason"] = reason
 
         return APIResponse.success(
-            data=format_permission_response(result),
+            data=data,
             message=f"Workflow permission check for user '{user}' and workflow '{workflow_name}' completed",
         )
 
@@ -634,3 +672,77 @@ def register_routes(app):
         return APIResponse.success(
             data=result, message="API key validation completed"
         )
+
+    @app.route("/api/apikeys/check_permission", methods=["POST"])
+    @with_db_session
+    @audit_log(
+        AuditAction.CHECK_API_KEY_PERMISSION,
+        resource_extractor=lambda kwargs: "api_key",
+    )
+    def check_api_key_permission(db):
+        """Validate a secret AND answer its subject's permission in one call.
+
+        Body: ``{"api_key": "rak_...", "permission": "<name>"}``. An invalid
+        key answers like validate (``valid: false`` + reason, no permission
+        evaluation); a valid key adds ``has_permission`` for the key's user.
+        The recommended backend pattern under strict user identity.
+        """
+        body = request.get_json(silent=True, force=True)
+        if not isinstance(body, dict):
+            return APIResponse.bad_request(
+                'JSON body required: {"api_key": "rak_...", "permission": "<name>"}'
+            )
+        api_key = body.get("api_key")
+        permission = body.get("permission")
+        if not isinstance(api_key, str) or not API_KEY_PATTERN.match(api_key):
+            return APIResponse.bad_request(
+                "api_key must be a string matching rak_[0-9A-Za-z]{43}"
+            )
+        if not isinstance(permission, str) or not validate_permission_name(
+            permission
+        ):
+            return APIResponse.bad_request(f"Invalid permission name: {permission!r}")
+
+        auth_service = _get_auth_service(db)
+        result = auth_service.check_api_key_permission(api_key, permission)
+        return APIResponse.success(
+            data=result, message="API-key permission check completed"
+        )
+
+    # Tenant settings (SPEC 0010)
+    @app.route("/api/settings", methods=["GET"])
+    @with_db_session
+    @audit_log(
+        AuditAction.GET_SETTINGS, resource_extractor=lambda kwargs: "settings"
+    )
+    def get_tenant_settings(db):
+        """This tenant's settings; defaults when nothing was ever set."""
+        auth_service = _get_auth_service(db)
+        return APIResponse.success(
+            data=auth_service.get_settings(), message="Tenant settings"
+        )
+
+    @app.route("/api/settings", methods=["PUT"])
+    @with_db_session
+    @audit_log(
+        AuditAction.UPDATE_SETTINGS,
+        resource_extractor=lambda kwargs: "strict_users",
+    )
+    def update_tenant_settings(db):
+        """Update tenant settings. Body: ``{"strict_users": true|false}``.
+
+        Enabling strict_users makes authorization decisions answer negatively
+        for users with no live API key (SPEC 0008); disabling restores 2.4.x
+        behavior. Idempotent upsert, audited.
+        """
+        body = request.get_json(silent=True, force=True)
+        if not isinstance(body, dict) or not isinstance(
+            body.get("strict_users"), bool
+        ):
+            return APIResponse.bad_request(
+                'JSON body required: {"strict_users": true|false}'
+            )
+
+        auth_service = _get_auth_service(db)
+        result = auth_service.set_strict_users(body["strict_users"])
+        return APIResponse.success(data=result, message="Tenant settings updated")

{auth-2.4.0 → auth-2.5.0}/auth/services/service.py

@@ -18,6 +18,7 @@ from auth.models.sql import (
     AuthGroup,
     AuthMembership,
     AuthPermission,
+    AuthTenantSettings,
     membership_groups,
     permission_groups,
 )
@@ -58,6 +59,7 @@ class AuthorizationService:
         client: str,
         validate_client: bool = True,
         manage_transaction: bool = True,
+        strict_users: Optional[bool] = None,
     ):
         if validate_client and not validate_client_key(client):
             # Never echo the raw key (it is the credential) — it would land in
@@ -72,6 +74,10 @@ class AuthorizationService:
         # method commits its own transaction. The HTTP layer sets this False and
         # commits once itself, so the mutation and its audit row commit together.
         self.manage_transaction = manage_transaction
+        # SPEC 0008/0010: None reads the tenant's stored setting (HTTP path);
+        # an explicit bool overrides it for in-process/library callers.
+        self._strict_override = strict_users
+        self._strict_cache: Optional[bool] = None
 
     def _commit(self) -> None:
         """Commit only when this service owns the transaction (see __init__)."""
@@ -150,6 +156,8 @@ class AuthorizationService:
 
     def get_user_permissions(self, user: str) -> List[Dict[str, Any]]:
         """Get all permissions for a user"""
+        if self._strict_blocks(user):
+            return []
         membership = (
             self.db.query(AuthMembership)
             .filter(
@@ -324,8 +332,12 @@ class AuthorizationService:
         """Add user to a role - atomic idempotent upsert.
 
         Uses INSERT ... ON CONFLICT (PostgreSQL and SQLite) for
-        race-condition-free operations.
+        race-condition-free operations. Under strict user identity a user with
+        no live API key cannot be granted membership (create the key first);
+        removal is deliberately NOT strict-gated, so revocation always works.
         """
+        if self._strict_blocks(user):
+            return False
         self._lock_tenant()
         try:
             group_table = AuthGroup.__table__
@@ -547,6 +559,8 @@ class AuthorizationService:
 
     def user_has_permission(self, user: str, name: str) -> bool:
         """Check if user has permission"""
+        if self._strict_blocks(user):
+            return False
         membership = (
             self.db.query(AuthMembership)
             .filter(
@@ -565,6 +579,89 @@ class AuthorizationService:
                 return True
         return False
 
+    def check_api_key_permission(
+        self, api_key: str, permission: str
+    ) -> Dict[str, Any]:
+        """Validate a secret and answer its subject's permission in one call.
+
+        An invalid key returns the validate result unchanged; a valid key adds
+        the effective-permission answer. The subject is key-backed by
+        construction (this very key just validated), so strict mode never
+        blocks the second half.
+        """
+        validated = self.validate_api_key(api_key)
+        if not validated["valid"]:
+            return validated
+        user = cast(str, validated["user"])
+        return {
+            "valid": True,
+            "user": user,
+            "key_id": validated["key_id"],
+            "has_permission": self.user_has_permission(user, permission),
+        }
+
+    # --- Tenant settings & strict user identity (SPEC 0008/0010) ---------
+
+    def strict_users_enabled(self) -> bool:
+        """Whether strict user identity applies to this tenant.
+
+        Explicit constructor override wins; otherwise the tenant's stored
+        setting is read once per service instance (one PK-adjacent lookup,
+        cached for the request).
+        """
+        if self._strict_override is not None:
+            return self._strict_override
+        if self._strict_cache is None:
+            row = (
+                self.db.query(AuthTenantSettings)
+                .filter(AuthTenantSettings.creator == self.client)
+                .first()
+            )
+            self._strict_cache = bool(row.strict_users) if row else False
+        return self._strict_cache
+
+    def get_settings(self) -> Dict[str, Any]:
+        """This tenant's settings (defaults when no row exists)."""
+        return {"strict_users": self.strict_users_enabled()}
+
+    def set_strict_users(self, enabled: bool) -> Dict[str, Any]:
+        """Upsert this tenant's strict_users flag (serialized vs rotation)."""
+        self._lock_tenant()
+        row = (
+            self.db.query(AuthTenantSettings)
+            .filter(AuthTenantSettings.creator == self.client)
+            .first()
+        )
+        if row is None:
+            row = AuthTenantSettings(creator=self.client, strict_users=enabled)
+            self.db.add(row)
+        else:
+            row.strict_users = enabled  # type: ignore[assignment]
+        self._strict_cache = enabled
+        self._commit()
+        return {"strict_users": enabled}
+
+    def user_is_key_backed(self, user: str) -> bool:
+        """True when the user holds ≥1 active, unexpired API key here."""
+        row = (
+            self.db.query(AuthApiKey.id)
+            .filter(
+                AuthApiKey.creator == self.client,
+                AuthApiKey._user == self._get_encrypted_user(user),
+                AuthApiKey.is_active,
+            )
+            .filter(
+                (AuthApiKey.expires_at.is_(None))
+                | (AuthApiKey.expires_at > _utcnow())
+            )
+            .first()
+        )
+        return row is not None
+
+    def _strict_blocks(self, user: str) -> bool:
+        """Strict mode on AND the user has no live key → decision is negative."""
+        return self.strict_users_enabled() and not self.user_is_key_backed(user)
+
     # --- Per-user API keys (SPEC 0004) -----------------------------------
 
     @staticmethod
@@ -781,6 +878,7 @@ class AuthorizationService:
             ("memberships", cast(Table, AuthMembership.__table__), ["user"]),
             ("permissions", cast(Table, AuthPermission.__table__), ["name"]),
             ("api_keys", cast(Table, AuthApiKey.__table__), ["user", "label"]),
+            ("settings", cast(Table, AuthTenantSettings.__table__), []),
         ]
         migrated: Dict[str, int] = {}
         try:

{auth-2.4.0 → auth-2.5.0}/auth.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auth
-Version: 2.4.0
+Version: 2.5.0
 Summary: Authorization for humans
 Author-email: Farshid Ashouri <farsheed.ashouri@gmail.com>
 License-Expression: MIT
@@ -41,11 +41,10 @@ Provides-Extra: ratelimit
 Requires-Dist: flask-limiter>=3.0.0; extra == "ratelimit"
 Provides-Extra: migrations
 Requires-Dist: migretti>=0.10.0; extra == "migrations"
-Requires-Dist: alembic>=1.13.0; extra == "migrations"
 Provides-Extra: dev
 Requires-Dist: pytest>=6.0; extra == "dev"
 Requires-Dist: pytest-cov>=2.0; extra == "dev"
-Requires-Dist: alembic>=1.13.0; extra == "dev"
+Requires-Dist: migretti>=0.10.0; extra == "dev"
 Requires-Dist: ruff>=0.0.260; extra == "dev"
 Requires-Dist: mypy>=1.0; extra == "dev"
 Requires-Dist: types-requests; extra == "dev"
@@ -121,6 +120,13 @@ with Client(api_key=KEY, service_url="https://auth.rodmena.app") as c:
   a hash, and validates them inside your namespace — an identity UI fronts the
   lifecycle, backends validate then use the RBAC checks. Client methods:
   `create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`.
+- **DEPRECATED — bare user strings.** Asserting a `<user>` that no validated API
+  key backs is scheduled for decommission. The opt-in phase is live (2.5.0):
+  `PUT /api/settings {"strict_users": true}` makes keyless users answer
+  negatively (`user_not_key_backed`), and `POST /api/apikeys/check_permission`
+  does validate + permission in one round trip. **3.0.0 makes key-backed users
+  mandatory** — only after every consuming platform confirms.
+  Details: [docs/DEPRECATIONS.md](docs/DEPRECATIONS.md).
 
 ## Documentation
 

{auth-2.4.0 → auth-2.5.0}/auth.egg-info/SOURCES.txt

@@ -47,9 +47,9 @@ tests/test_encryption_integration.py
 tests/test_flask.py
 tests/test_key_rotation.py
 tests/test_log_redaction.py
-tests/test_migrations.py
 tests/test_phase_a_hardening.py
 tests/test_reencryption.py
 tests/test_routes_errors.py
 tests/test_server.py
-tests/test_service_lifecycle.py
+tests/test_service_lifecycle.py
+tests/test_strict_users.py

{auth-2.4.0 → auth-2.5.0}/auth.egg-info/requires.txt

@@ -14,7 +14,7 @@ python-json-logger<4,>=3.1.0
 [dev]
 pytest>=6.0
 pytest-cov>=2.0
-alembic>=1.13.0
+migretti>=0.10.0
 ruff>=0.0.260
 mypy>=1.0
 types-requests
@@ -25,7 +25,6 @@ responses>=0.23
 
 [migrations]
 migretti>=0.10.0
-alembic>=1.13.0
 
 [ratelimit]
 flask-limiter>=3.0.0

{auth-2.4.0 → auth-2.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "auth"
-version = "2.4.0"
+version = "2.5.0"
 description = "Authorization for humans"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -58,17 +58,15 @@ dependencies = [
 ratelimit = [
     "flask-limiter>=3.0.0",
 ]
-# Database schema migrations. migretti (house standard) authors and applies
-# NEW migrations; alembic remains only to read the retired legacy tree in
-# migrations_legacy_alembic/. Not required to import or serve the app.
+# Database schema migrations (migretti, SQL-first house standard). Not
+# required to import or serve the app.
 migrations = [
     "migretti>=0.10.0",
-    "alembic>=1.13.0",
 ]
 dev = [
     "pytest>=6.0",
     "pytest-cov>=2.0",
-    "alembic>=1.13.0",
+    "migretti>=0.10.0",
     "ruff>=0.0.260",
     "mypy>=1.0",
     "types-requests",

{auth-2.4.0 → auth-2.5.0}/tests/test_api_keys_encryption.py

@@ -15,8 +15,6 @@ from sqlalchemy import select
 
 from auth.models.sql import AuthApiKey
 
-pytestmark = []
-
 _SHA256_HEX = re.compile(r"^[0-9a-f]{64}$")
 
 

{auth-2.4.0 → auth-2.5.0}/tests/test_client.py

@@ -315,3 +315,41 @@ def test_create_api_key_raises_under_raise_on_error():
     with make_client(raise_on_error=True) as client:
         with pytest.raises(AuthTransportError):
             client.create_api_key("alice")
+
+
+@responses.activate
+def test_check_api_key_permission_and_settings_methods():
+    responses.post(
+        f"{BASE}/api/apikeys/check_permission",
+        json={
+            "success": True,
+            "data": {"valid": True, "user": "alice", "has_permission": True},
+        },
+    )
+    responses.get(
+        f"{BASE}/api/settings",
+        json={"success": True, "data": {"strict_users": False}},
+    )
+    responses.put(
+        f"{BASE}/api/settings",
+        json={"success": True, "data": {"strict_users": True}},
+    )
+    with make_client() as client:
+        checked = client.check_api_key_permission(SECRET, "deploy")
+        assert checked["data"]["has_permission"] is True
+        assert responses.calls[0].request.body == (
+            '{"api_key": "%s", "permission": "deploy"}' % SECRET
+        ).encode()
+        assert client.get_settings()["data"]["strict_users"] is False
+        flipped = client.set_strict_users(True)
+        assert flipped["data"]["strict_users"] is True
+        assert responses.calls[2].request.body == b'{"strict_users": true}'
+
+
+@responses.activate
+def test_check_api_key_permission_failure_echoes_prefix_never_secret():
+    with make_client() as client:  # nothing registered -> connection error
+        result = client.check_api_key_permission(SECRET, "deploy")
+    assert result["success"] is False and result["transport_error"] is True
+    assert result["data"] == {"key_prefix": SECRET[:12], "permission": "deploy"}
+    assert SECRET not in str(result)

{auth-2.4.0 → auth-2.5.0}/tests/test_key_rotation.py

@@ -76,6 +76,7 @@ def test_rotate_moves_the_namespace_to_a_fresh_key(client):
         "memberships": 1,
         "permissions": 1,
         "api_keys": 0,
+        "settings": 0,
     }
 
 
@@ -216,6 +217,7 @@ def test_rotation_reencrypts_bound_cells_when_encryption_is_on(app, monkeypatch)
             "memberships": 1,
             "permissions": 1,
             "api_keys": 1,
+            "settings": 0,
         }
 
         # Nothing left under the old key.

auth-2.5.0/tests/test_strict_users.py

@@ -0,0 +1,318 @@
+"""Strict user identity, opt-in phase (SPEC 0008/0010) — HTTP-level.
+
+The gate is tested in BOTH directions everywhere: strict mode blocks keyless
+users AND releases them the moment a key is issued (or the mode is disabled),
+and a tenant that never opts in behaves exactly like 2.4.1.
+"""
+
+import uuid
+
+import pytest
+
+from auth.main import create_app
+
+
+@pytest.fixture
+def app():
+    application = create_app()
+    application.config["TESTING"] = True
+    return application
+
+
+@pytest.fixture
+def client(app):
+    return app.test_client()
+
+
+def _h(key):
+    return {"Authorization": f"Bearer {key}"}
+
+
+def _seed_rbac(client, key, user="alice"):
+    h = _h(key)
+    assert client.post("/api/role/engineers", headers=h).get_json()["result"] is True
+    assert (
+        client.post("/api/permission/engineers/deploy", headers=h).get_json()["result"]
+        is True
+    )
+    assert (
+        client.post(f"/api/membership/{user}/engineers", headers=h).get_json()["result"]
+        is True
+    )
+
+
+def _has_permission(client, key, user="alice", perm="deploy"):
+    return client.get(f"/api/has_permission/{user}/{perm}", headers=_h(key)).get_json()[
+        "data"
+    ]
+
+
+def test_settings_default_and_toggle_roundtrip(client):
+    key = str(uuid.uuid4())
+    h = _h(key)
+    assert client.get("/api/settings", headers=h).get_json()["data"] == {
+        "strict_users": False
+    }
+    on = client.put("/api/settings", headers=h, json={"strict_users": True})
+    assert on.status_code == 200
+    assert on.get_json()["data"] == {"strict_users": True}
+    assert client.get("/api/settings", headers=h).get_json()["data"] == {
+        "strict_users": True
+    }
+    # Both directions: it turns off again.
+    off = client.put("/api/settings", headers=h, json={"strict_users": False})
+    assert off.get_json()["data"] == {"strict_users": False}
+    assert client.get("/api/settings", headers=h).get_json()["data"] == {
+        "strict_users": False
+    }
+
+
+def test_settings_input_validation(client):
+    key = str(uuid.uuid4())
+    h = _h(key)
+    assert client.put("/api/settings", headers=h).status_code == 400
+    assert (
+        client.put("/api/settings", headers=h, json={"strict_users": "yes"}).status_code
+        == 400
+    )
+    assert client.put("/api/settings", headers=h, json={}).status_code == 400
+    assert client.get("/api/settings").status_code == 401
+
+
+def test_strict_blocks_and_releases_permission_checks(client):
+    key = str(uuid.uuid4())
+    h = _h(key)
+    _seed_rbac(client, key)
+
+    # GREEN baseline: keyless user answers true while strict is off (2.4.1
+    # behavior) — proves the block below is strict mode, not a broken seed.
+    assert _has_permission(client, key) == {"has_permission": True}
+
+    client.put("/api/settings", headers=h, json={"strict_users": True})
+
+    blocked = _has_permission(client, key)
+    assert blocked == {
+        "has_permission": False,
+        "reason": "user_not_key_backed",
+    }
+    # user_permissions and membership check and workflow can_run agree.
+    perms = client.get("/api/user_permissions/alice", headers=h).get_json()["data"]
+    assert perms["count"] == 0 and perms["reason"] == "user_not_key_backed"
+    member = client.get("/api/membership/alice/engineers", headers=h).get_json()["data"]
+    assert member == {"has_permission": False, "reason": "user_not_key_backed"}
+    wf = client.get(
+        "/api/workflow/user/alice/can_run/deploy", headers=h
+    ).get_json()["data"]
+    assert wf == {"has_permission": False, "reason": "user_not_key_backed"}
+
+    # RELEASE direction 1: issuing a key restores every answer.
+    client.post("/api/apikeys/user/alice", headers=h)
+    assert _has_permission(client, key) == {"has_permission": True}
+    assert (
+        client.get("/api/user_permissions/alice", headers=h).get_json()["data"]["count"]
+        == 1
+    )
+    assert client.get("/api/membership/alice/engineers", headers=h).get_json()["data"][
+        "has_permission"
+    ] is True
+
+    # Revoking the only key blocks again (revocation is now end-to-end).
+    key_id = client.get("/api/apikeys/user/alice", headers=h).get_json()["data"][
+        "keys"
+    ][0]["key_id"]
+    client.delete(f"/api/apikeys/user/alice/{key_id}", headers=h)
+    assert _has_permission(client, key)["has_permission"] is False
+
+    # RELEASE direction 2: disabling strict mode restores 2.4.1 behavior.
+    client.put("/api/settings", headers=h, json={"strict_users": False})
+    assert _has_permission(client, key) == {"has_permission": True}
+
+
+def test_strict_blocks_membership_add_but_never_removal(client):
+    key = str(uuid.uuid4())
+    h = _h(key)
+    _seed_rbac(client, key, user="bob")  # bob is a member while strict is off
+    client.put("/api/settings", headers=h, json={"strict_users": True})
+
+    # Adds for keyless users are refused with the 200-false convention.
+    add = client.post("/api/membership/carol/engineers", headers=h).get_json()
+    assert add == {"result": False, "reason": "user_not_key_backed"}
+
+    # Removal is NEVER strict-gated: revocation must always work.
+    rm = client.delete("/api/membership/bob/engineers", headers=h).get_json()
+    assert rm == {"result": True}
+    client.put("/api/settings", headers=h, json={"strict_users": False})
+    assert (
+        client.get("/api/membership/bob/engineers", headers=h).get_json()["data"][
+            "has_permission"
+        ]
+        is False
+    )
+
+    # Bootstrap order under strict mode: key first, then membership works.
+    client.put("/api/settings", headers=h, json={"strict_users": True})
+    client.post("/api/apikeys/user/carol", headers=h)
+    assert (
+        client.post("/api/membership/carol/engineers", headers=h).get_json()["result"]
+        is True
+    )
+
+
+def test_strict_mode_is_tenant_scoped(client):
+    strict_tenant, normal_tenant = str(uuid.uuid4()), str(uuid.uuid4())
+    _seed_rbac(client, strict_tenant)
+    _seed_rbac(client, normal_tenant)
+    client.put(
+        "/api/settings", headers=_h(strict_tenant), json={"strict_users": True}
+    )
+
+    assert _has_permission(client, strict_tenant)["has_permission"] is False
+    # The other tenant is untouched — byte-identical 2.4.1 behavior.
+    assert _has_permission(client, normal_tenant) == {"has_permission": True}
+
+
+def test_denial_reason_only_appears_when_strict_blocked(client):
+    key = str(uuid.uuid4())
+    h = _h(key)
+    _seed_rbac(client, key)
+    client.put("/api/settings", headers=h, json={"strict_users": True})
+    client.post("/api/apikeys/user/alice", headers=h)
+
+    # A key-backed user lacking the permission is a plain denial — no reason
+    # key, so callers can distinguish denial from strict-block.
+    denied = _has_permission(client, key, perm="launch_missiles")
+    assert denied == {"has_permission": False}
+
+
+def test_check_permission_composite_endpoint(client):
+    key = str(uuid.uuid4())
+    h = _h(key)
+    _seed_rbac(client, key)
+    secret = client.post("/api/apikeys/user/alice", headers=h).get_json()["data"][
+        "api_key"
+    ]
+
+    ok = client.post(
+        "/api/apikeys/check_permission",
+        headers=h,
+        json={"api_key": secret, "permission": "deploy"},
+    ).get_json()["data"]
+    assert ok["valid"] is True
+    assert ok["user"] == "alice"
+    assert ok["has_permission"] is True
+
+    # Valid key, missing permission: valid stays true, answer is false.
+    no = client.post(
+        "/api/apikeys/check_permission",
+        headers=h,
+        json={"api_key": secret, "permission": "launch_missiles"},
+    ).get_json()["data"]
+    assert no == {
+        "valid": True,
+        "user": "alice",
+        "key_id": no["key_id"],
+        "has_permission": False,
+    }
+
+    # Works under strict mode too (the key IS the user's backing).
+    client.put("/api/settings", headers=h, json={"strict_users": True})
+    assert (
+        client.post(
+            "/api/apikeys/check_permission",
+            headers=h,
+            json={"api_key": secret, "permission": "deploy"},
+        ).get_json()["data"]["has_permission"]
+        is True
+    )
+
+    # Revoked key: validate-shaped red, no permission evaluation.
+    key_id = client.get("/api/apikeys/user/alice", headers=h).get_json()["data"][
+        "keys"
+    ][0]["key_id"]
+    client.delete(f"/api/apikeys/user/alice/{key_id}", headers=h)
+    revoked = client.post(
+        "/api/apikeys/check_permission",
+        headers=h,
+        json={"api_key": secret, "permission": "deploy"},
+    ).get_json()["data"]
+    assert revoked == {"valid": False, "reason": "revoked"}
+
+    # Input validation.
+    assert (
+        client.post(
+            "/api/apikeys/check_permission",
+            headers=h,
+            json={"api_key": secret, "permission": "bad name!"},
+        ).status_code
+        == 400
+    )
+    assert (
+        client.post(
+            "/api/apikeys/check_permission", headers=h, json={"api_key": "nope"}
+        ).status_code
+        == 400
+    )
+    assert client.post("/api/apikeys/check_permission", headers=h).status_code == 400
+
+
+def test_rotation_carries_strict_setting(client):
+    key = str(uuid.uuid4())
+    h = _h(key)
+    _seed_rbac(client, key)
+    client.post("/api/apikeys/user/alice", headers=h)
+    client.put("/api/settings", headers=h, json={"strict_users": True})
+
+    rotated = client.post("/api/keys/rotate", headers=h).get_json()["data"]
+    assert rotated["migrated"]["settings"] == 1
+    h_new = _h(rotated["new_key"])
+    # Strict survives rotation; the key-backed user still answers true.
+    assert client.get("/api/settings", headers=h_new).get_json()["data"] == {
+        "strict_users": True
+    }
+    assert (
+        client.get("/api/has_permission/alice/deploy", headers=h_new).get_json()[
+            "data"
+        ]["has_permission"]
+        is True
+    )
+
+
+def test_settings_update_is_audited(client):
+    from auth.audit import AuditLog
+    from auth.database import SessionLocal
+
+    key = str(uuid.uuid4())
+    client.put("/api/settings", headers=_h(key), json={"strict_users": True})
+    session = SessionLocal()
+    try:
+        actions = {row.action for row in session.query(AuditLog).all()}
+        assert "UPDATE_SETTINGS" in actions
+    finally:
+        session.close()
+
+
+def test_in_process_service_override_param():
+    """Library callers pin strict behavior explicitly, DB row ignored."""
+    import uuid as _uuid
+
+    from auth.database import SessionLocal
+    from auth.main import create_app
+    from auth.services.service import AuthorizationService
+
+    create_app()
+    tenant = str(_uuid.uuid4())
+    db = SessionLocal()
+    try:
+        svc = AuthorizationService(db, tenant)
+        svc.set_strict_users(True)
+        assert AuthorizationService(db, tenant).strict_users_enabled() is True
+        # Explicit override beats the stored row, both ways.
+        assert (
+            AuthorizationService(db, tenant, strict_users=False).strict_users_enabled()
+            is False
+        )
+        off = AuthorizationService(db, tenant, strict_users=True)
+        svc.set_strict_users(False)
+        assert off.strict_users_enabled() is True
+    finally:
+        db.close()

auth-2.4.0/tests/test_migrations.py

@@ -1,45 +0,0 @@
-"""The RETIRED Alembic migration stack still loads, applies, and reverses.
-
-Alembic is frozen at its single legacy revision (0001_widen_text, applied in
-production) and lives in migrations_legacy_alembic/; NEW migrations are
-migretti SQL files in migrations/ (see MIGRATIONS.md). These tests keep the
-legacy tree loadable so the recorded history stays reproducible.
-
-On SQLite the widening migration is a no-op (SQLite ignores varchar length), so
-these assert the framework wiring — env.py resolves the app's database, the
-revision imports, and upgrade/downgrade run without error. The real varchar->TEXT
-behaviour is exercised against PostgreSQL in the integration run.
-"""
-
-import os
-
-import pytest
-
-pytest.importorskip("alembic")
-
-from alembic import command  # noqa: E402
-from alembic.config import Config  # noqa: E402
-
-from auth.database import create_tables  # noqa: E402
-
-_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-
-
-def _config() -> Config:
-    cfg = Config(os.path.join(_ROOT, "alembic.ini"))
-    cfg.set_main_option(
-        "script_location", os.path.join(_ROOT, "migrations_legacy_alembic")
-    )
-    return cfg
-
-
-def test_upgrade_head_runs():
-    # Alembic owns changes; create_tables owns creation. Tables must exist first.
-    create_tables(raise_on_error=True)
-    command.upgrade(_config(), "head")  # must not raise
-
-
-def test_downgrade_then_upgrade_roundtrips():
-    cfg = _config()
-    command.downgrade(cfg, "base")
-    command.upgrade(cfg, "head")