auth 2.5.1__tar.gz → 2.5.2__tar.gz

{auth-2.5.1 → auth-2.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auth
-Version: 2.5.1
+Version: 2.5.2
 Summary: Authorization for humans
 Author-email: Farshid Ashouri <farsheed.ashouri@gmail.com>
 License-Expression: MIT
@@ -119,7 +119,10 @@ with Client(api_key=KEY, service_url="https://auth.rodmena.app") as c:
   mints `rak_...` secrets for *your users*, shows each exactly once, stores only
   a hash, and validates them inside your namespace — an identity UI fronts the
   lifecycle, backends validate then use the RBAC checks. Client methods:
-  `create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`.
+  `create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`,
+  `check_api_key_permission` (validate + permission in one round trip), plus
+  `get_settings`/`set_strict_users`. All of these also exist on the in-process
+  `Authorization` wrapper for embedded consumers.
 - **DEPRECATED — bare user strings.** Asserting a `<user>` that no validated API
   key backs is scheduled for decommission. The opt-in phase is live (2.5.0):
   `PUT /api/settings {"strict_users": true}` makes keyless users answer

{auth-2.5.1 → auth-2.5.2}/README.md

@@ -63,7 +63,10 @@ with Client(api_key=KEY, service_url="https://auth.rodmena.app") as c:
   mints `rak_...` secrets for *your users*, shows each exactly once, stores only
   a hash, and validates them inside your namespace — an identity UI fronts the
   lifecycle, backends validate then use the RBAC checks. Client methods:
-  `create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`.
+  `create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`,
+  `check_api_key_permission` (validate + permission in one round trip), plus
+  `get_settings`/`set_strict_users`. All of these also exist on the in-process
+  `Authorization` wrapper for embedded consumers.
 - **DEPRECATED — bare user strings.** Asserting a `<user>` that no validated API
   key backs is scheduled for decommission. The opt-in phase is live (2.5.0):
   `PUT /api/settings {"strict_users": true}` makes keyless users answer

{auth-2.5.1 → auth-2.5.2}/auth/__init__.py

@@ -38,12 +38,21 @@ api = app
 class Authorization:
     """Compatibility wrapper for old Authorization interface"""
 
-    def __init__(self, client: str, db_session=None):
+    def __init__(
+        self,
+        client: str,
+        db_session=None,
+        strict_users: Optional[bool] = None,
+    ):
         self.client = client
         # Use provided session or create a new one
         self.db = db_session if db_session else SessionLocal()
-        # Use legacy mode (no client validation) for backward compatibility
-        self.service = AuthorizationService(self.db, client, validate_client=False)
+        # Use legacy mode (no client validation) for backward compatibility.
+        # strict_users: None reads the tenant's stored setting (identical
+        # semantics to the REST layer); an explicit bool pins it per instance.
+        self.service = AuthorizationService(
+            self.db, client, validate_client=False, strict_users=strict_users
+        )
 
     @property
     def roles(self):
@@ -94,6 +103,30 @@ class Authorization:
     def which_users_can(self, name: str):
         return self.service.which_users_can(name)
 
+    # Tenant settings & strict user identity (SPEC 0010) — embedded consumers
+    # get the same semantics the REST layer serves.
+    def get_settings(self):
+        return self.service.get_settings()
+
+    def set_strict_users(self, enabled: bool):
+        return self.service.set_strict_users(enabled)
+
+    # Per-user API keys (SPEC 0004)
+    def create_api_key(self, user: str, label: Optional[str] = None):
+        return self.service.create_api_key(user, label)
+
+    def list_api_keys(self, user: str):
+        return self.service.list_api_keys(user)
+
+    def revoke_api_key(self, user: str, key_id: str):
+        return self.service.revoke_api_key(user, key_id)
+
+    def validate_api_key(self, api_key: str):
+        return self.service.validate_api_key(api_key)
+
+    def check_api_key_permission(self, api_key: str, permission: str):
+        return self.service.check_api_key_permission(api_key, permission)
+
 
 # Export the new client for users who want enhanced features
 __all__ = [

{auth-2.5.1 → auth-2.5.2}/auth/database.py

@@ -3,18 +3,39 @@
 SQLAlchemy database session management with enterprise-grade connection pooling
 """
 import logging
+import os
 import sqlite3
 import threading
 from contextlib import contextmanager
 from typing import Generator, Optional
 
 from sqlalchemy import create_engine, event, pool
-from sqlalchemy.engine import Engine
+from sqlalchemy.engine import Engine, make_url
 from sqlalchemy.orm import Session, sessionmaker
 from sqlalchemy.pool import Pool
 
 from auth.config import DatabaseType, get_settings
 
+
+def _forced_sslmode(database_url: str) -> Optional[str]:
+    """The sslmode to force via connect_args, or None to leave it alone.
+
+    Secure-by-default SSL for remote hosts — but never overriding an explicit
+    caller choice. connect_args beat URL conninfo in psycopg, so forcing
+    sslmode here would silently discard a ``?sslmode=...`` the caller wrote
+    (highway report, agent-mail thr-7745c815fd0a425cabac). Precedence:
+    URL sslmode param > PGSSLMODE env > require-for-remote. The host is
+    decided by component comparison, not URL substring — a URL carrying
+    ``?fallback_application_name=localhost`` must not skip SSL.
+    """
+    url = make_url(database_url)
+    if "sslmode" in url.query or os.environ.get("PGSSLMODE"):
+        return None
+    host = (url.host or "").lower()
+    if host in ("localhost", "127.0.0.1", "::1"):
+        return None
+    return "require"
+
 logger = logging.getLogger(__name__)
 
 
@@ -86,9 +107,9 @@ class DatabaseEngine(metaclass=SingletonMeta):
             "options": "-c statement_timeout=30000",  # 30 seconds
         }
 
-        # Enable SSL for remote connections
-        if "localhost" not in database_url and "127.0.0.1" not in database_url:
-            connect_args["sslmode"] = "require"
+        forced = _forced_sslmode(database_url)
+        if forced:
+            connect_args["sslmode"] = forced
 
         return create_engine(
             database_url,

{auth-2.5.1 → auth-2.5.2}/auth/docs_page.py

@@ -155,7 +155,12 @@ adds for key-less subjects answer **409** `{{"result": false, "reason":
 success; check `result` on writes regardless). Create the key first, then grant
 roles: key creation committing before the grant is a contract, with no eventual
 consistency in between. Strict mode never blocks key issuance or any
-delete/revoke path. 3.0.0 makes strict identity the default — the audited
+delete/revoke path. The `reason` field is **stable contract** (only ever
+present on strict blocks). A strict block on read decisions is an **HTTP
+200** — transport-failure handling (retries, breakers, fallbacks) will not
+fire on it; tenants that deliberately hold `strict_users: false` should assert
+that value in their deploy/health checks so an unexpected flip alarms instead
+of silently zeroing entitlements. 3.0.0 makes strict identity the default — the audited
 per-tenant opt-out survives for platforms that authenticate their own callers —
 and ships only after every consuming platform has confirmed readiness. Migrate
 now: issue keys to your users, derive the user from `/api/apikeys/validate` —

{auth-2.5.1 → auth-2.5.2}/auth.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auth
-Version: 2.5.1
+Version: 2.5.2
 Summary: Authorization for humans
 Author-email: Farshid Ashouri <farsheed.ashouri@gmail.com>
 License-Expression: MIT
@@ -119,7 +119,10 @@ with Client(api_key=KEY, service_url="https://auth.rodmena.app") as c:
   mints `rak_...` secrets for *your users*, shows each exactly once, stores only
   a hash, and validates them inside your namespace — an identity UI fronts the
   lifecycle, backends validate then use the RBAC checks. Client methods:
-  `create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`.
+  `create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`,
+  `check_api_key_permission` (validate + permission in one round trip), plus
+  `get_settings`/`set_strict_users`. All of these also exist on the in-process
+  `Authorization` wrapper for embedded consumers.
 - **DEPRECATED — bare user strings.** Asserting a `<user>` that no validated API
   key backs is scheduled for decommission. The opt-in phase is live (2.5.0):
   `PUT /api/settings {"strict_users": true}` makes keyless users answer

{auth-2.5.1 → auth-2.5.2}/auth.egg-info/SOURCES.txt

@@ -41,6 +41,7 @@ tests/test_client_rest.py
 tests/test_cmd_server.py
 tests/test_config.py
 tests/test_correctness_hardening.py
+tests/test_database_sslmode.py
 tests/test_docs_page.py
 tests/test_encryption.py
 tests/test_encryption_integration.py

{auth-2.5.1 → auth-2.5.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "auth"
-version = "2.5.1"
+version = "2.5.2"
 description = "Authorization for humans"
 readme = "README.md"
 requires-python = ">=3.9"

auth-2.5.2/tests/test_database_sslmode.py

@@ -0,0 +1,47 @@
+"""sslmode precedence for the PostgreSQL engine factory (SPEC 0011, highway
+report thr-7745c815fd0a425cabac).
+
+Contract: explicit URL sslmode wins, then PGSSLMODE, then secure-by-default
+``require`` for genuinely remote hosts — decided by host component, never by
+URL substring.
+"""
+
+import pytest
+
+from auth.database import _forced_sslmode
+
+REMOTE = "postgresql+psycopg://app:pw@db:5432/x"
+
+
+@pytest.fixture(autouse=True)
+def _no_pgsslmode(monkeypatch):
+    monkeypatch.delenv("PGSSLMODE", raising=False)
+
+
+def test_remote_host_defaults_to_require():
+    # Known-positive first: the default CAN fire.
+    assert _forced_sslmode(REMOTE) == "require"
+    assert _forced_sslmode("postgresql://u@10.0.0.5/db") == "require"
+
+
+def test_explicit_url_sslmode_is_never_overridden():
+    assert _forced_sslmode(REMOTE + "?sslmode=disable") is None
+    assert _forced_sslmode(REMOTE + "?sslmode=verify-full") is None
+
+
+def test_pgsslmode_env_is_respected(monkeypatch):
+    monkeypatch.setenv("PGSSLMODE", "disable")
+    assert _forced_sslmode(REMOTE) is None
+
+
+def test_local_hosts_get_no_forced_sslmode():
+    assert _forced_sslmode("postgresql://u@localhost/db") is None
+    assert _forced_sslmode("postgresql://u@127.0.0.1:5432/db") is None
+
+
+def test_host_is_compared_as_component_not_substring():
+    # The old substring test skipped SSL for this remote URL; it must not.
+    tricky = "postgresql://app@db:5432/x?fallback_application_name=localhost"
+    assert _forced_sslmode(tricky) == "require"
+    # And a host merely CONTAINING 'localhost' is remote.
+    assert _forced_sslmode("postgresql://u@localhost.attacker.net/db") == "require"

{auth-2.5.1 → auth-2.5.2}/tests/test_strict_users.py

@@ -301,6 +301,51 @@ def test_settings_update_is_audited(client):
         session.close()
 
 
+def test_authorization_wrapper_embedded_strict_flow():
+    """Embedded consumers (Authorization wrapper) get REST-identical strict
+    semantics: same setting row, same gates, same release-on-key-issuance."""
+    import uuid as _uuid
+
+    from auth import Authorization
+    from auth.database import SessionLocal
+    from auth.main import create_app
+
+    create_app()
+    tenant = str(_uuid.uuid4())
+    db = SessionLocal()
+    try:
+        wrapper = Authorization(client=tenant, db_session=db)
+        assert wrapper.add_role("ops") is True
+        assert wrapper.add_permission("ops", "deploy") is True
+        assert wrapper.add_membership("erin", "ops") is True
+        assert wrapper.user_has_permission("erin", "deploy") is True
+
+        assert wrapper.get_settings() == {"strict_users": False}
+        wrapper.set_strict_users(True)
+        # Fresh wrapper (no per-instance cache) sees the flip and blocks.
+        strict = Authorization(client=tenant, db_session=db)
+        assert strict.user_has_permission("erin", "deploy") is False
+
+        created = strict.create_api_key("erin", label="svc erin")
+        assert created is not None and created["api_key"].startswith("rak_")
+        assert strict.user_has_permission("erin", "deploy") is True
+        checked = strict.check_api_key_permission(created["api_key"], "deploy")
+        assert checked["valid"] is True and checked["has_permission"] is True
+        assert strict.list_api_keys("erin")[0]["label"] == "svc erin"
+        assert (
+            strict.revoke_api_key("erin", created["key_id"]) == "revoked"
+        )
+        assert strict.validate_api_key(created["api_key"]) == {
+            "valid": False,
+            "reason": "revoked",
+        }
+        # Explicit per-instance override pins behavior regardless of the row.
+        pinned_off = Authorization(client=tenant, db_session=db, strict_users=False)
+        assert pinned_off.user_has_permission("erin", "deploy") is True
+    finally:
+        db.close()
+
+
 def test_in_process_service_override_param():
     """Library callers pin strict behavior explicitly, DB row ignored."""
     import uuid as _uuid