auth 3.1.0__tar.gz → 3.2.0__tar.gz

{auth-3.1.0 → auth-3.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auth
-Version: 3.1.0
+Version: 3.2.0
 Summary: Authorization for humans
 Author-email: Farshid Ashouri <farsheed.ashouri@gmail.com>
 License-Expression: MIT
@@ -29,14 +29,16 @@ Requires-Dist: flask<4,>=2.0.0
 Requires-Dist: flask-cors<7,>=3.0.0
 Requires-Dist: sqlalchemy<3,>=2.0.0
 Requires-Dist: waitress<4,>=2.0.0
-Requires-Dist: cryptography<48,>=3.0.0
+Requires-Dist: cryptography>=3.0.0
 Requires-Dist: APScheduler<4,>=3.0.0
-Requires-Dist: psycopg[binary]<4,>=3.0.0
+Requires-Dist: psycopg<4,>=3.0.0
 Requires-Dist: pydantic<3,>=2.0.0
 Requires-Dist: pydantic-settings<3,>=2.0.0
 Requires-Dist: requests<3,>=2.25.0
 Requires-Dist: bleach<7,>=5.0.0
 Requires-Dist: python-json-logger<4,>=3.1.0
+Provides-Extra: c
+Requires-Dist: psycopg[c]<4,>=3.0.0; extra == "c"
 Provides-Extra: ratelimit
 Requires-Dist: flask-limiter>=3.0.0; extra == "ratelimit"
 Provides-Extra: migrations

{auth-3.1.0 → auth-3.2.0}/auth/__init__.py

@@ -4,6 +4,7 @@ from importlib.metadata import PackageNotFoundError, version
 from typing import Optional
 
 from auth.client import (  # Import the new client
+    AuthRefused,
     AuthTransportError,
     Client,
     EnhancedAuthClient,
@@ -140,6 +141,7 @@ class Authorization:
 # Export the new client for users who want enhanced features
 __all__ = [
     "Authorization",
+    "AuthRefused",
     "AuthTransportError",
     "Client",
     "EnhancedAuthClient",

{auth-3.1.0 → auth-3.2.0}/auth/api_keys.py

@@ -15,7 +15,11 @@ import uuid
 from typing import Tuple
 
 API_KEY_PREFIX = "rak_"
+#: Recovery ("rotate") keys. A different prefix so a credential is never
+#: mistaken for the other kind, and so a leaked one is identifiable on sight.
+ROTATE_KEY_PREFIX = "rrk_"
 API_KEY_PATTERN = re.compile(r"^rak_[0-9A-Za-z]{43}$")
+ROTATE_KEY_PATTERN = re.compile(r"^rrk_[0-9A-Za-z]{43}$")
 
 # "rak_" + first 8 payload chars — safe to store and display in listings.
 KEY_PREFIX_LEN = 12
@@ -48,3 +52,21 @@ def generate_api_key() -> Tuple[str, str, str, str]:
 def hash_api_key(secret: str) -> str:
     """SHA-256 hex digest of the full secret string (equality-queryable)."""
     return hashlib.sha256(secret.encode()).hexdigest()
+
+
+def generate_rotate_key() -> Tuple[str, str]:
+    """Mint a recovery key: returns ``(secret, secret_hash)``.
+
+    Same construction and entropy as a user API key -- 256 bits from
+    ``secrets.token_bytes(32)`` -- because it guards more, not less: whoever
+    holds it can take over the namespace without the client key. Only the hash
+    is stored, and the secret is disclosed exactly once.
+    """
+    payload = _base62(secrets.token_bytes(32)).rjust(_PAYLOAD_LEN, _ALPHABET[0])
+    secret = ROTATE_KEY_PREFIX + payload
+    return secret, hash_api_key(secret)
+
+
+def validate_rotate_key_format(secret: str) -> bool:
+    """Shape check before any database work."""
+    return bool(ROTATE_KEY_PATTERN.match(secret))

{auth-3.1.0 → auth-3.2.0}/auth/audit.py

@@ -46,6 +46,8 @@ class AuditAction(Enum):
     GET_SETTINGS = "GET_SETTINGS"
     UPDATE_SETTINGS = "UPDATE_SETTINGS"
     GET_AUDIT = "GET_AUDIT"
+    GET_ROTATE_KEY = "GET_ROTATE_KEY"
+    RECOVER_KEY = "RECOVER_KEY"
 
 
 class AuditLog(Base):
@@ -176,6 +178,23 @@ def _emit_structured_log(
     audit_logger.info(json.dumps(log_msg))
 
 
+def _bind_audit(session, client_id: str) -> None:
+    """Bind the audit tenant so RLS admits the row (no-op off PostgreSQL).
+
+    audit_log's policy compares ``client_id`` against a session variable, and
+    the value is bound VERBATIM: every caller already passes a fingerprint (see
+    ``client_ref`` in auth/decorators.py), and ``_build_audit_entry`` stores it
+    unchanged. Fingerprinting it again here would bind a fingerprint OF a
+    fingerprint, which matches no row and rejects every audit write.
+    """
+    try:
+        from auth.rls import AUDIT_GUC, bind_session
+
+        bind_session(session, **{AUDIT_GUC: client_id})
+    except Exception:  # pragma: no cover - binding must never break an audit write
+        pass
+
+
 def record_audit(
     session,
     *,
@@ -196,6 +215,7 @@ def record_audit(
     surrounding request (fail-closed), never leave a committed mutation
     unaudited.
     """
+    _bind_audit(session, client_id)
     session.add(
         _build_audit_entry(
             client_id, user, action, resource, details, ip_address, user_agent, success
@@ -224,6 +244,7 @@ def log_audit_event(
     """
     session = SessionLocal()
     try:
+        _bind_audit(session, client_id)
         session.add(
             _build_audit_entry(
                 client_id, user, action, resource, details, ip_address, user_agent, success

auth-3.2.0/auth/client/__init__.py

@@ -0,0 +1,59 @@
+"""
+Enhanced client library with connection pooling, retry logic, and circuit breaker
+
+The implementation is split across :mod:`auth.client._transport`,
+:mod:`auth.client.base` and the per-resource mixins, but this package stays the
+public import path: ``from auth.client import EnhancedAuthClient`` resolves
+exactly as it did before the split, and both classes keep ``auth.client`` as
+their ``__module__``.
+"""
+
+# Re-exported so it still resolves through this module, as it did when the
+# client was a single file.
+from auth.circuit_breaker import circuit_breaker
+from auth.client._transport import (
+    _RETRY_METHODS,
+    AuthRefused,
+    AuthTransportError,
+    RetryableHTTPAdapter,
+    _build_retry,
+)
+from auth.client.base import ClientBase
+from auth.client.keys import ApiKeyMixin
+from auth.client.rbac import RbacMixin
+from auth.client.workflow import WorkflowMixin
+
+
+class EnhancedAuthClient(WorkflowMixin):
+    """Enhanced client with connection pooling, retry logic, and circuit breaker.
+
+    Error contract (3.0.0): every method raises :class:`AuthTransportError`
+    on transport failure — connection error, exhausted retries, open circuit
+    breaker, or a non-2xx status. A transport failure can therefore never
+    reach your authorization logic as a value: catch the exception and map it
+    to your unavailable/503 path, never to a denial. Success payloads are
+    unchanged from 2.x.
+    """
+
+
+# For backward compatibility with the old client
+class Client(EnhancedAuthClient):
+    """Legacy client class for backward compatibility"""
+
+    pass
+
+
+__all__ = [
+    "ApiKeyMixin",
+    "AuthRefused",
+    "AuthTransportError",
+    "Client",
+    "ClientBase",
+    "EnhancedAuthClient",
+    "RbacMixin",
+    "RetryableHTTPAdapter",
+    "WorkflowMixin",
+    "circuit_breaker",
+    "_RETRY_METHODS",
+    "_build_retry",
+]

auth-3.2.0/auth/client/_transport.py

@@ -0,0 +1,81 @@
+"""Transport layer for the REST client: retry policy, adapter, error type."""
+
+from requests.adapters import HTTPAdapter
+from urllib3.util.retry import Retry
+
+# Methods eligible for retry. The auth server's write endpoints are
+# idempotent upserts, so retrying POST/PUT/DELETE is safe here.
+_RETRY_METHODS = ["HEAD", "GET", "OPTIONS", "POST", "PUT", "DELETE"]
+
+
+class AuthTransportError(Exception):
+    """The client could not get an answer from the auth service.
+
+    Raised by every client method when no answer could be obtained:
+    connection failure, exhausted retries, open circuit breaker, or a 5xx.
+    A 4xx raises :class:`AuthRefused`, a subclass — the service DID answer,
+    it refused the request.
+    Distinguishes "we could not ask" from a genuine negative answer such as
+    ``has_permission: false`` — map it to your unavailable/503 path, never
+    to a denial.
+    """
+
+
+class AuthRefused(AuthTransportError):
+    """The auth service answered and refused the request (a 4xx).
+
+    Subclasses :class:`AuthTransportError` so existing handlers keep working,
+    but lets a caller tell "auth would not accept this" from "auth could not be
+    reached". Reported by a consumer whose platform-admin check logged "auth
+    unreachable at login" while auth was up, answering, and simply rejecting a
+    subject containing ``|``: that sends whoever reads the log to the health
+    endpoint and the network when the cause is the shape of a string.
+
+    ``status`` is the HTTP status; ``payload`` is the decoded body when there
+    was one, so actionable errors (such as the 409 ``user_not_key_backed`` hint)
+    survive instead of being flattened into a transport message.
+    """
+
+    def __init__(self, message: str, status: int, payload=None):
+        super().__init__(message)
+        self.status = status
+        self.payload = payload
+
+
+def _build_retry(total, backoff_factor, status_forcelist) -> Retry:
+    """Build a Retry that works on both urllib3 1.x and 2.x.
+
+    urllib3 renamed ``method_whitelist`` to ``allowed_methods`` in 1.26 and
+    removed the old name in 2.0.
+    """
+    kwargs = {
+        "total": total,
+        "backoff_factor": backoff_factor,
+        "status_forcelist": list(status_forcelist),
+    }
+    try:
+        return Retry(allowed_methods=_RETRY_METHODS, **kwargs)
+    except TypeError:  # urllib3 < 1.26
+        return Retry(method_whitelist=_RETRY_METHODS, **kwargs)  # type: ignore[call-arg]
+
+
+class RetryableHTTPAdapter(HTTPAdapter):
+    """HTTP adapter with retry logic"""
+
+    def __init__(
+        self, retries=3, backoff_factor=0.3, status_forcelist=(500, 502, 504), **kwargs
+    ):
+        self.retries = retries
+        self.backoff_factor = backoff_factor
+        self.status_forcelist = status_forcelist
+        super().__init__(**kwargs)
+
+    def init_poolmanager(self, *args, **kwargs):
+        kwargs["retries"] = Retry(
+            total=self.retries,
+            read=self.retries,
+            connect=self.retries,
+            backoff_factor=self.backoff_factor,
+            status_forcelist=self.status_forcelist,
+        )
+        return super().init_poolmanager(*args, **kwargs)

auth-3.2.0/auth/client/base.py

@@ -0,0 +1,241 @@
+"""The client's request machinery: session setup, request/response, teardown."""
+
+import json
+import warnings
+from typing import Any, Dict, NoReturn, Optional
+from urllib.parse import urljoin
+
+import requests
+from requests.adapters import HTTPAdapter
+from requests.exceptions import ConnectionError
+
+from auth.circuit_breaker import circuit_breaker
+from auth.client._transport import (
+    AuthRefused,
+    AuthTransportError,
+    RetryableHTTPAdapter,
+    _build_retry,
+)
+
+
+class ClientBase:
+    """Enhanced client with connection pooling, retry logic, and circuit breaker.
+
+    Error contract (3.0.0): every method raises :class:`AuthTransportError`
+    on transport failure — connection error, exhausted retries, open circuit
+    breaker, or a non-2xx status. A transport failure can therefore never
+    reach your authorization logic as a value: catch the exception and map it
+    to your unavailable/503 path, never to a denial. Success payloads are
+    unchanged from 2.x.
+    """
+
+    def __init__(
+        self,
+        api_key: str,
+        service_url: str,
+        max_retries: int = 3,
+        pool_connections: int = 10,
+        pool_maxsize: int = 64,
+        timeout: int = 30,
+        circuit_breaker_enabled: bool = True,
+        raise_on_error: Optional[bool] = None,
+    ):
+        """
+        Initialize the enhanced client
+
+        Args:
+            api_key: The API key for authentication
+            service_url: The base URL for the auth service
+            max_retries: Number of times to retry failed requests
+            pool_connections: Number of connection pools (passed to the HTTP adapter)
+            pool_maxsize: Max connections per pool (passed to the HTTP adapter;
+                size it to your caller concurrency — an exhausted pool surfaces
+                as transport failures under load)
+            timeout: Request timeout in seconds
+            circuit_breaker_enabled: Whether circuit breaker is enabled
+            raise_on_error: DEPRECATED no-op kept so 2.x constructor calls
+                keep working — since 3.0.0 the client ALWAYS raises
+                AuthTransportError on transport failure
+        """
+        if raise_on_error is not None:
+            warnings.warn(
+                "raise_on_error is deprecated and ignored: since auth 3.0.0 "
+                "the client always raises AuthTransportError on transport "
+                "failure.",
+                DeprecationWarning,
+                stacklevel=2,
+            )
+        self.api_key = api_key
+        self.service_url = service_url
+        self.timeout = timeout
+        self.circuit_breaker_enabled = circuit_breaker_enabled
+
+        # Create session with connection pooling
+        self.session = requests.Session()
+
+        # Configure retries
+        retry_strategy = _build_retry(
+            total=max_retries,
+            backoff_factor=0.3,
+            status_forcelist=[429, 500, 502, 503, 504],
+        )
+
+        # Use our custom adapter for more control
+        adapter = RetryableHTTPAdapter(
+            retries=max_retries,
+            status_forcelist=[429, 500, 502, 503, 504],
+            max_retries=retry_strategy,
+            pool_connections=pool_connections,
+            pool_maxsize=pool_maxsize,
+        )
+
+        self.session.mount("http://", adapter)
+        self.session.mount("https://", adapter)
+
+        # Set default headers
+        self.session.headers.update(
+            {
+                "Authorization": f"Bearer {self.api_key}",
+                "Content-Type": "application/json",
+            }
+        )
+
+        # API endpoints
+        self.endpoints = {
+            "ping": "/ping",
+            "membership": "/api/membership/{user}/{group}",
+            "permission": "/api/permission/{group}/{name}",
+            "has_permission": "/api/has_permission/{user}/{name}",
+            "user_permissions": "/api/user_permissions/{user}",
+            "role_permissions": "/api/role_permissions/{role}",
+            "user_roles": "/api/user_roles/{user}",
+            "role_members": "/api/members/{role}",
+            "roles": "/api/roles",
+            "which_roles_can": "/api/which_roles_can/{name}",
+            "which_users_can": "/api/which_users_can/{name}",
+            "role": "/api/role/{role}",
+            "workflow_users": "/api/workflow/users/{workflow_name}",
+            "workflow_permission": "/api/workflow/user/{user}/can_run/{workflow_name}",
+            "rotate_key": "/api/keys/rotate",
+            "apikeys_user": "/api/apikeys/user/{user}",
+            "apikey_revoke": "/api/apikeys/user/{user}/{key_id}",
+            "apikey_validate": "/api/apikeys/validate",
+            "apikey_check_permission": "/api/apikeys/check_permission",
+            "settings": "/api/settings",
+        }
+
+        # Built on first use: a session without retries for non-idempotent
+        # calls (create_api_key). Shares the auth headers with the main
+        # session so rotate_key() updates both.
+        self._no_retry: Optional[requests.Session] = None
+
+    def _no_retry_session(self) -> requests.Session:
+        """Session for non-idempotent calls: same auth headers, zero retries."""
+        if self._no_retry is None:
+            session = requests.Session()
+            session.mount("http://", HTTPAdapter(max_retries=0))
+            session.mount("https://", HTTPAdapter(max_retries=0))
+            # Shared mapping, not a copy: rotate_key() must apply to both.
+            session.headers = self.session.headers
+            self._no_retry = session
+        return self._no_retry
+
+    def _make_request(
+        self, method: str, endpoint: str, retry: bool = True, **kwargs
+    ) -> Dict[str, Any]:
+        """
+        Make an HTTP request with circuit breaker, retry logic, and error handling
+        """
+        url = urljoin(self.service_url, endpoint)
+        session = self.session if retry else self._no_retry_session()
+
+        # Prepare the request function for the circuit breaker
+        def request_func():
+            try:
+                response = session.request(
+                    method=method, url=url, timeout=self.timeout, **kwargs
+                )
+
+                # Raise an exception for bad status codes
+                response.raise_for_status()
+
+                # Try to parse JSON response
+                try:
+                    json_response: Dict[str, Any] = response.json()
+                    return json_response
+                except json.JSONDecodeError:
+                    # If JSON parsing fails, return the text content
+                    text_response: Dict[str, Any] = {"result": response.text}
+                    return text_response
+
+            except requests.exceptions.RequestException as e:
+                # A 4xx means the service ANSWERED and refused. Collapsing that
+                # into a transport failure sends the reader to the health
+                # endpoint and the network when the cause is the request itself.
+                resp = getattr(e, "response", None)
+                if resp is not None and 400 <= resp.status_code < 500:
+                    try:
+                        payload = resp.json()
+                    except Exception:
+                        payload = None
+                    raise AuthRefused(
+                        f"auth refused the request: HTTP {resp.status_code}",
+                        resp.status_code,
+                        payload,
+                    ) from e
+                # Convert to our expected exception type
+                raise ConnectionError(f"Request failed: {str(e)}") from e
+
+        if self.circuit_breaker_enabled:
+            # Use circuit breaker to wrap the request
+            try:
+                cb_result: Dict[str, Any] = circuit_breaker("api_call")(request_func)()
+                return cb_result
+            except AuthRefused:
+                raise  # a refusal is an answer; it is not a breaker event
+            except Exception as e:
+                raise ConnectionError(
+                    f"Circuit breaker prevented request: {str(e)}"
+                ) from e
+        else:
+            direct_result: Dict[str, Any] = request_func()
+            return direct_result
+
+    def _transport_failure(
+        self, exc: Exception, data: Optional[Dict[str, Any]] = None
+    ) -> NoReturn:
+        """Raise :class:`AuthTransportError` for a transport-level failure.
+
+        Since 3.0.0 this ALWAYS raises — the 2.x error-dict return (an
+        answer-shaped payload without the answer field) is gone, so an outage
+        can never be misread as a denial. ``data`` is accepted for call-site
+        compatibility and intentionally unused: inputs like key material must
+        never ride on an exception.
+        """
+        if isinstance(exc, AuthRefused):
+            raise exc
+        raise AuthTransportError(str(exc)) from exc
+
+    def ping(self) -> Dict[str, Any]:
+        """Health check.
+
+        Transport failure raises :class:`AuthTransportError` — map it to
+        your unavailable/503 path, never to a denial.
+        """
+        try:
+            return self._make_request("GET", self.endpoints["ping"])
+        except Exception as e:
+            return self._transport_failure(e)
+
+    def close(self):
+        """Close the session"""
+        if self.session:
+            self.session.close()
+        if self._no_retry is not None:
+            self._no_retry.close()
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        self.close()

auth-3.2.0/auth/client/keys.py

@@ -0,0 +1,142 @@
+"""Client key rotation, per-user API keys, and tenant settings."""
+
+from typing import Any, Dict, Optional
+
+from auth.client.rbac import RbacMixin
+
+
+class ApiKeyMixin(RbacMixin):
+    """Key rotation, per-user API keys and tenant settings."""
+
+    def rotate_key(self) -> Dict[str, Any]:
+        """Rotate this client's API key (atomic cutover).
+
+        The server mints a fresh key, moves the whole namespace onto it, and
+        returns it in ``data.new_key``. On success this client is updated in
+        place — ``self.api_key`` and the session ``Authorization`` header switch
+        to the new key — so subsequent calls on this instance keep working. The
+        returned key is the ONLY copy: persist ``data.new_key`` (e.g. to your
+        secret store) or you lose access to the namespace.
+
+        Transport failure raises :class:`AuthTransportError` — map it to
+        your unavailable/503 path, never to a denial.
+        """
+        endpoint = self.endpoints["rotate_key"]
+        try:
+            response = self._make_request("POST", endpoint)
+        except Exception as e:
+            return self._transport_failure(e, data={})
+
+        new_key = (response or {}).get("data", {}).get("new_key")
+        if new_key:
+            self.api_key = new_key
+            self.session.headers["Authorization"] = f"Bearer {new_key}"
+        return response
+
+    # Per-user API keys (SPEC 0004)
+    def create_api_key(self, user: str, label: Optional[str] = None) -> Dict[str, Any]:
+        """Mint an API key for a user; ``data.api_key`` is shown only once.
+
+        Sent WITHOUT automatic retries: create is not idempotent, and a blind
+        retry after an ambiguous failure could mint a second key whose secret
+        nobody ever saw. On an ambiguous failure, list and revoke instead.
+
+        Transport failure raises :class:`AuthTransportError` — map it to
+        your unavailable/503 path, never to a denial.
+        """
+        endpoint = self.endpoints["apikeys_user"].format(user=user)
+        payload = {"label": label} if label is not None else None
+        try:
+            return self._make_request("POST", endpoint, retry=False, json=payload)
+        except Exception as e:
+            return self._transport_failure(e, data={"user": user, "label": label})
+
+    def list_api_keys(self, user: str) -> Dict[str, Any]:
+        """List a user's API keys (metadata only; never the secrets).
+
+        Transport failure raises :class:`AuthTransportError` — map it to
+        your unavailable/503 path, never to a denial.
+        """
+        endpoint = self.endpoints["apikeys_user"].format(user=user)
+        try:
+            return self._make_request("GET", endpoint)
+        except Exception as e:
+            return self._transport_failure(e, data={"user": user})
+
+    def revoke_api_key(self, user: str, key_id: str) -> Dict[str, Any]:
+        """Revoke one of a user's API keys by its public key_id (idempotent).
+
+        Transport failure raises :class:`AuthTransportError` — map it to
+        your unavailable/503 path, never to a denial.
+        """
+        endpoint = self.endpoints["apikey_revoke"].format(user=user, key_id=key_id)
+        try:
+            return self._make_request("DELETE", endpoint)
+        except Exception as e:
+            return self._transport_failure(e, data={"user": user, "key_id": key_id})
+
+    def validate_api_key(self, api_key: str) -> Dict[str, Any]:
+        """Validate an API-key secret; answers ``data.valid`` true/false.
+
+        The secret travels in the JSON body, never a URL, and never rides
+        on an exception.
+
+        Transport failure raises :class:`AuthTransportError` — map it to
+        your unavailable/503 path, never to a denial.
+        """
+        try:
+            return self._make_request(
+                "POST", self.endpoints["apikey_validate"], json={"api_key": api_key}
+            )
+        except Exception as e:
+            return self._transport_failure(e, data={"key_prefix": api_key[:12]})
+
+    def check_api_key_permission(self, api_key: str, permission: str) -> Dict[str, Any]:
+        """Validate a secret AND check its subject's permission in one call.
+
+        ``data.valid`` false → the key failed (reason as in validate_api_key);
+        true → ``data.has_permission`` answers for the key's user. The secret
+        travels in the JSON body and never rides on an exception.
+
+        Transport failure raises :class:`AuthTransportError` — map it to
+        your unavailable/503 path, never to a denial.
+        """
+        try:
+            return self._make_request(
+                "POST",
+                self.endpoints["apikey_check_permission"],
+                json={"api_key": api_key, "permission": permission},
+            )
+        except Exception as e:
+            return self._transport_failure(
+                e, data={"key_prefix": api_key[:12], "permission": permission}
+            )
+
+    # Tenant settings (SPEC 0010)
+    def get_settings(self) -> Dict[str, Any]:
+        """This tenant's settings (``data.strict_users``).
+
+        Transport failure raises :class:`AuthTransportError` — map it to
+        your unavailable/503 path, never to a denial.
+        """
+        try:
+            return self._make_request("GET", self.endpoints["settings"])
+        except Exception as e:
+            return self._transport_failure(e)
+
+    def set_strict_users(self, enabled: bool) -> Dict[str, Any]:
+        """Enable/disable strict user identity for this tenant (idempotent).
+
+        While enabled, authorization decisions about users with no live API
+        key answer negatively (``reason: user_not_key_backed``) — issue keys
+        before flipping this on.
+
+        Transport failure raises :class:`AuthTransportError` — map it to
+        your unavailable/503 path, never to a denial.
+        """
+        try:
+            return self._make_request(
+                "PUT", self.endpoints["settings"], json={"strict_users": enabled}
+            )
+        except Exception as e:
+            return self._transport_failure(e, data={"strict_users": enabled})