auth 2.5.0__tar.gz → 2.5.2__tar.gz

{auth-2.5.0 → auth-2.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auth
-Version: 2.5.0
+Version: 2.5.2
 Summary: Authorization for humans
 Author-email: Farshid Ashouri <farsheed.ashouri@gmail.com>
 License-Expression: MIT
@@ -119,14 +119,18 @@ with Client(api_key=KEY, service_url="https://auth.rodmena.app") as c:
   mints `rak_...` secrets for *your users*, shows each exactly once, stores only
   a hash, and validates them inside your namespace — an identity UI fronts the
   lifecycle, backends validate then use the RBAC checks. Client methods:
-  `create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`.
+  `create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`,
+  `check_api_key_permission` (validate + permission in one round trip), plus
+  `get_settings`/`set_strict_users`. All of these also exist on the in-process
+  `Authorization` wrapper for embedded consumers.
 - **DEPRECATED — bare user strings.** Asserting a `<user>` that no validated API
   key backs is scheduled for decommission. The opt-in phase is live (2.5.0):
   `PUT /api/settings {"strict_users": true}` makes keyless users answer
   negatively (`user_not_key_backed`), and `POST /api/apikeys/check_permission`
-  does validate + permission in one round trip. **3.0.0 makes key-backed users
-  mandatory** — only after every consuming platform confirms.
-  Details: [docs/DEPRECATIONS.md](docs/DEPRECATIONS.md).
+  does validate + permission in one round trip. **3.0.0 makes strict identity
+  the default** (the audited per-tenant opt-out survives for validated
+  machine-subject architectures) — and ships only after every consuming
+  platform confirms. Details: [docs/DEPRECATIONS.md](docs/DEPRECATIONS.md).
 
 ## Documentation
 

{auth-2.5.0 → auth-2.5.2}/README.md

@@ -63,14 +63,18 @@ with Client(api_key=KEY, service_url="https://auth.rodmena.app") as c:
   mints `rak_...` secrets for *your users*, shows each exactly once, stores only
   a hash, and validates them inside your namespace — an identity UI fronts the
   lifecycle, backends validate then use the RBAC checks. Client methods:
-  `create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`.
+  `create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`,
+  `check_api_key_permission` (validate + permission in one round trip), plus
+  `get_settings`/`set_strict_users`. All of these also exist on the in-process
+  `Authorization` wrapper for embedded consumers.
 - **DEPRECATED — bare user strings.** Asserting a `<user>` that no validated API
   key backs is scheduled for decommission. The opt-in phase is live (2.5.0):
   `PUT /api/settings {"strict_users": true}` makes keyless users answer
   negatively (`user_not_key_backed`), and `POST /api/apikeys/check_permission`
-  does validate + permission in one round trip. **3.0.0 makes key-backed users
-  mandatory** — only after every consuming platform confirms.
-  Details: [docs/DEPRECATIONS.md](docs/DEPRECATIONS.md).
+  does validate + permission in one round trip. **3.0.0 makes strict identity
+  the default** (the audited per-tenant opt-out survives for validated
+  machine-subject architectures) — and ships only after every consuming
+  platform confirms. Details: [docs/DEPRECATIONS.md](docs/DEPRECATIONS.md).
 
 ## Documentation
 

{auth-2.5.0 → auth-2.5.2}/auth/__init__.py

@@ -38,12 +38,21 @@ api = app
 class Authorization:
     """Compatibility wrapper for old Authorization interface"""
 
-    def __init__(self, client: str, db_session=None):
+    def __init__(
+        self,
+        client: str,
+        db_session=None,
+        strict_users: Optional[bool] = None,
+    ):
         self.client = client
         # Use provided session or create a new one
         self.db = db_session if db_session else SessionLocal()
-        # Use legacy mode (no client validation) for backward compatibility
-        self.service = AuthorizationService(self.db, client, validate_client=False)
+        # Use legacy mode (no client validation) for backward compatibility.
+        # strict_users: None reads the tenant's stored setting (identical
+        # semantics to the REST layer); an explicit bool pins it per instance.
+        self.service = AuthorizationService(
+            self.db, client, validate_client=False, strict_users=strict_users
+        )
 
     @property
     def roles(self):
@@ -94,6 +103,30 @@ class Authorization:
     def which_users_can(self, name: str):
         return self.service.which_users_can(name)
 
+    # Tenant settings & strict user identity (SPEC 0010) — embedded consumers
+    # get the same semantics the REST layer serves.
+    def get_settings(self):
+        return self.service.get_settings()
+
+    def set_strict_users(self, enabled: bool):
+        return self.service.set_strict_users(enabled)
+
+    # Per-user API keys (SPEC 0004)
+    def create_api_key(self, user: str, label: Optional[str] = None):
+        return self.service.create_api_key(user, label)
+
+    def list_api_keys(self, user: str):
+        return self.service.list_api_keys(user)
+
+    def revoke_api_key(self, user: str, key_id: str):
+        return self.service.revoke_api_key(user, key_id)
+
+    def validate_api_key(self, api_key: str):
+        return self.service.validate_api_key(api_key)
+
+    def check_api_key_permission(self, api_key: str, permission: str):
+        return self.service.check_api_key_permission(api_key, permission)
+
 
 # Export the new client for users who want enhanced features
 __all__ = [

{auth-2.5.0 → auth-2.5.2}/auth/database.py

@@ -3,18 +3,39 @@
 SQLAlchemy database session management with enterprise-grade connection pooling
 """
 import logging
+import os
 import sqlite3
 import threading
 from contextlib import contextmanager
 from typing import Generator, Optional
 
 from sqlalchemy import create_engine, event, pool
-from sqlalchemy.engine import Engine
+from sqlalchemy.engine import Engine, make_url
 from sqlalchemy.orm import Session, sessionmaker
 from sqlalchemy.pool import Pool
 
 from auth.config import DatabaseType, get_settings
 
+
+def _forced_sslmode(database_url: str) -> Optional[str]:
+    """The sslmode to force via connect_args, or None to leave it alone.
+
+    Secure-by-default SSL for remote hosts — but never overriding an explicit
+    caller choice. connect_args beat URL conninfo in psycopg, so forcing
+    sslmode here would silently discard a ``?sslmode=...`` the caller wrote
+    (highway report, agent-mail thr-7745c815fd0a425cabac). Precedence:
+    URL sslmode param > PGSSLMODE env > require-for-remote. The host is
+    decided by component comparison, not URL substring — a URL carrying
+    ``?fallback_application_name=localhost`` must not skip SSL.
+    """
+    url = make_url(database_url)
+    if "sslmode" in url.query or os.environ.get("PGSSLMODE"):
+        return None
+    host = (url.host or "").lower()
+    if host in ("localhost", "127.0.0.1", "::1"):
+        return None
+    return "require"
+
 logger = logging.getLogger(__name__)
 
 
@@ -86,9 +107,9 @@ class DatabaseEngine(metaclass=SingletonMeta):
             "options": "-c statement_timeout=30000",  # 30 seconds
         }
 
-        # Enable SSL for remote connections
-        if "localhost" not in database_url and "127.0.0.1" not in database_url:
-            connect_args["sslmode"] = "require"
+        forced = _forced_sslmode(database_url)
+        if forced:
+            connect_args["sslmode"] = forced
 
         return create_engine(
             database_url,

{auth-2.5.0 → auth-2.5.2}/auth/docs_page.py

@@ -147,13 +147,24 @@ secrets keep validating afterwards.
 That is being retired. **Since 2.5.0 the opt-in phase is live**: enable strict
 mode with `PUT /api/settings` `{{"strict_users": true}}` and authorization
 decisions about users with no active API key answer negatively (same response
-shapes, additive reason `user_not_key_backed`); membership adds for key-less
-users return `{{"result": false}}` — create the key first, then grant roles.
-Strict mode never blocks key issuance or any delete/revoke path. 3.0.0 makes
-strict identity the default, and ships only after every consuming platform has
-confirmed readiness. Migrate now: issue keys to your users, derive the user
-from `/api/apikeys/validate` — or do both steps in one round trip with
-`POST /api/apikeys/check_permission`.
+shapes, additive reason `user_not_key_backed`). Gated decisions: has_permission,
+the membership check, user_permissions (answers `count: 0` + reason), workflow
+can_run. NOT gated: user_roles, members and every other listing. Membership
+adds for key-less subjects answer **409** `{{"result": false, "reason":
+"user_not_key_backed"}}` (since 2.5.1 — a refused grant must not look like
+success; check `result` on writes regardless). Create the key first, then grant
+roles: key creation committing before the grant is a contract, with no eventual
+consistency in between. Strict mode never blocks key issuance or any
+delete/revoke path. The `reason` field is **stable contract** (only ever
+present on strict blocks). A strict block on read decisions is an **HTTP
+200** — transport-failure handling (retries, breakers, fallbacks) will not
+fire on it; tenants that deliberately hold `strict_users: false` should assert
+that value in their deploy/health checks so an unexpected flip alarms instead
+of silently zeroing entitlements. 3.0.0 makes strict identity the default — the audited
+per-tenant opt-out survives for platforms that authenticate their own callers —
+and ships only after every consuming platform has confirmed readiness. Migrate
+now: issue keys to your users, derive the user from `/api/apikeys/validate` —
+or do both steps in one round trip with `POST /api/apikeys/check_permission`.
 
 ## 4. Endpoints
 

{auth-2.5.0 → auth-2.5.2}/auth/routes.py

@@ -194,7 +194,13 @@ def register_routes(app):
         if not result:
             reason = _strict_reason(auth_service, user)
             if reason:
-                return jsonify({"result": result, "reason": reason})
+                # 409, not 200-with-false: two consumers independently showed
+                # that a refused grant answering 200 gets written past
+                # (raise_for_status passes, result goes unchecked) and turns
+                # strict mode into silent dead-key provisioning. Strict mode is
+                # opt-in, so the shape may differ there; the documented
+                # missing-role 200-false below is untouched.
+                return jsonify({"result": False, "reason": reason}), 409
 
         return jsonify({"result": result})
 

{auth-2.5.0 → auth-2.5.2}/auth.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auth
-Version: 2.5.0
+Version: 2.5.2
 Summary: Authorization for humans
 Author-email: Farshid Ashouri <farsheed.ashouri@gmail.com>
 License-Expression: MIT
@@ -119,14 +119,18 @@ with Client(api_key=KEY, service_url="https://auth.rodmena.app") as c:
   mints `rak_...` secrets for *your users*, shows each exactly once, stores only
   a hash, and validates them inside your namespace — an identity UI fronts the
   lifecycle, backends validate then use the RBAC checks. Client methods:
-  `create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`.
+  `create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`,
+  `check_api_key_permission` (validate + permission in one round trip), plus
+  `get_settings`/`set_strict_users`. All of these also exist on the in-process
+  `Authorization` wrapper for embedded consumers.
 - **DEPRECATED — bare user strings.** Asserting a `<user>` that no validated API
   key backs is scheduled for decommission. The opt-in phase is live (2.5.0):
   `PUT /api/settings {"strict_users": true}` makes keyless users answer
   negatively (`user_not_key_backed`), and `POST /api/apikeys/check_permission`
-  does validate + permission in one round trip. **3.0.0 makes key-backed users
-  mandatory** — only after every consuming platform confirms.
-  Details: [docs/DEPRECATIONS.md](docs/DEPRECATIONS.md).
+  does validate + permission in one round trip. **3.0.0 makes strict identity
+  the default** (the audited per-tenant opt-out survives for validated
+  machine-subject architectures) — and ships only after every consuming
+  platform confirms. Details: [docs/DEPRECATIONS.md](docs/DEPRECATIONS.md).
 
 ## Documentation
 

{auth-2.5.0 → auth-2.5.2}/auth.egg-info/SOURCES.txt

@@ -41,6 +41,7 @@ tests/test_client_rest.py
 tests/test_cmd_server.py
 tests/test_config.py
 tests/test_correctness_hardening.py
+tests/test_database_sslmode.py
 tests/test_docs_page.py
 tests/test_encryption.py
 tests/test_encryption_integration.py

{auth-2.5.0 → auth-2.5.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "auth"
-version = "2.5.0"
+version = "2.5.2"
 description = "Authorization for humans"
 readme = "README.md"
 requires-python = ">=3.9"

auth-2.5.2/tests/test_database_sslmode.py

@@ -0,0 +1,47 @@
+"""sslmode precedence for the PostgreSQL engine factory (SPEC 0011, highway
+report thr-7745c815fd0a425cabac).
+
+Contract: explicit URL sslmode wins, then PGSSLMODE, then secure-by-default
+``require`` for genuinely remote hosts — decided by host component, never by
+URL substring.
+"""
+
+import pytest
+
+from auth.database import _forced_sslmode
+
+REMOTE = "postgresql+psycopg://app:pw@db:5432/x"
+
+
+@pytest.fixture(autouse=True)
+def _no_pgsslmode(monkeypatch):
+    monkeypatch.delenv("PGSSLMODE", raising=False)
+
+
+def test_remote_host_defaults_to_require():
+    # Known-positive first: the default CAN fire.
+    assert _forced_sslmode(REMOTE) == "require"
+    assert _forced_sslmode("postgresql://u@10.0.0.5/db") == "require"
+
+
+def test_explicit_url_sslmode_is_never_overridden():
+    assert _forced_sslmode(REMOTE + "?sslmode=disable") is None
+    assert _forced_sslmode(REMOTE + "?sslmode=verify-full") is None
+
+
+def test_pgsslmode_env_is_respected(monkeypatch):
+    monkeypatch.setenv("PGSSLMODE", "disable")
+    assert _forced_sslmode(REMOTE) is None
+
+
+def test_local_hosts_get_no_forced_sslmode():
+    assert _forced_sslmode("postgresql://u@localhost/db") is None
+    assert _forced_sslmode("postgresql://u@127.0.0.1:5432/db") is None
+
+
+def test_host_is_compared_as_component_not_substring():
+    # The old substring test skipped SSL for this remote URL; it must not.
+    tricky = "postgresql://app@db:5432/x?fallback_application_name=localhost"
+    assert _forced_sslmode(tricky) == "require"
+    # And a host merely CONTAINING 'localhost' is remote.
+    assert _forced_sslmode("postgresql://u@localhost.attacker.net/db") == "require"

{auth-2.5.0 → auth-2.5.2}/tests/test_strict_users.py

@@ -134,9 +134,19 @@ def test_strict_blocks_membership_add_but_never_removal(client):
     _seed_rbac(client, key, user="bob")  # bob is a member while strict is off
     client.put("/api/settings", headers=h, json={"strict_users": True})
 
-    # Adds for keyless users are refused with the 200-false convention.
-    add = client.post("/api/membership/carol/engineers", headers=h).get_json()
-    assert add == {"result": False, "reason": "user_not_key_backed"}
+    # Adds for keyless users are refused with an unmissable 409 (a 200 here
+    # was shown by two consumers to be silently written past).
+    add = client.post("/api/membership/carol/engineers", headers=h)
+    assert add.status_code == 409
+    assert add.get_json() == {"result": False, "reason": "user_not_key_backed"}
+    # The documented missing-role no-op keeps its 200-false shape even in
+    # strict tenants — only the key-less refusal is a 409.
+    ghost_role = client.post("/api/membership/carol/ghosts", headers=h)
+    assert ghost_role.status_code == 409  # carol is still key-less: strict wins
+    client.post("/api/apikeys/user/dave", headers=h)
+    keyed_ghost = client.post("/api/membership/dave/ghosts", headers=h)
+    assert keyed_ghost.status_code == 200
+    assert keyed_ghost.get_json() == {"result": False}
 
     # Removal is NEVER strict-gated: revocation must always work.
     rm = client.delete("/api/membership/bob/engineers", headers=h).get_json()
@@ -291,6 +301,51 @@ def test_settings_update_is_audited(client):
         session.close()
 
 
+def test_authorization_wrapper_embedded_strict_flow():
+    """Embedded consumers (Authorization wrapper) get REST-identical strict
+    semantics: same setting row, same gates, same release-on-key-issuance."""
+    import uuid as _uuid
+
+    from auth import Authorization
+    from auth.database import SessionLocal
+    from auth.main import create_app
+
+    create_app()
+    tenant = str(_uuid.uuid4())
+    db = SessionLocal()
+    try:
+        wrapper = Authorization(client=tenant, db_session=db)
+        assert wrapper.add_role("ops") is True
+        assert wrapper.add_permission("ops", "deploy") is True
+        assert wrapper.add_membership("erin", "ops") is True
+        assert wrapper.user_has_permission("erin", "deploy") is True
+
+        assert wrapper.get_settings() == {"strict_users": False}
+        wrapper.set_strict_users(True)
+        # Fresh wrapper (no per-instance cache) sees the flip and blocks.
+        strict = Authorization(client=tenant, db_session=db)
+        assert strict.user_has_permission("erin", "deploy") is False
+
+        created = strict.create_api_key("erin", label="svc erin")
+        assert created is not None and created["api_key"].startswith("rak_")
+        assert strict.user_has_permission("erin", "deploy") is True
+        checked = strict.check_api_key_permission(created["api_key"], "deploy")
+        assert checked["valid"] is True and checked["has_permission"] is True
+        assert strict.list_api_keys("erin")[0]["label"] == "svc erin"
+        assert (
+            strict.revoke_api_key("erin", created["key_id"]) == "revoked"
+        )
+        assert strict.validate_api_key(created["api_key"]) == {
+            "valid": False,
+            "reason": "revoked",
+        }
+        # Explicit per-instance override pins behavior regardless of the row.
+        pinned_off = Authorization(client=tenant, db_session=db, strict_users=False)
+        assert pinned_off.user_has_permission("erin", "deploy") is True
+    finally:
+        db.close()
+
+
 def test_in_process_service_override_param():
     """Library callers pin strict behavior explicitly, DB row ignored."""
     import uuid as _uuid