auth 3.2.0__tar.gz → 3.3.0__tar.gz

{auth-3.2.0 → auth-3.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auth
-Version: 3.2.0
+Version: 3.3.0
 Summary: Authorization for humans
 Author-email: Farshid Ashouri <farsheed.ashouri@gmail.com>
 License-Expression: MIT
@@ -16,13 +16,12 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
-Requires-Python: >=3.9
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: flask<4,>=2.0.0

{auth-3.2.0 → auth-3.3.0}/auth/database.py

@@ -18,6 +18,7 @@ from auth.config import DatabaseType, get_settings, warn_on_weak_secrets
 from auth.schema_reconcile import (
     GRANDFATHER_MARKER,  # noqa: F401  - re-exported; tests and embedded callers import it from here
     _apply_tenant_rls,
+    _ensure_audit_partition_runway,
     _grandfather_strict_users,
     _reconcile_text_columns,
 )
@@ -350,6 +351,7 @@ def create_tables(raise_on_error: bool = False):
         # is how a fresh database came up with the junction tables unprotected
         # -- grandfathering raised, and the RLS step below it never ran.
         _apply_tenant_rls(engine)
+        _ensure_audit_partition_runway(engine)
         _reconcile_text_columns(engine)
         _grandfather_strict_users(engine)
         logger.info("Tables created successfully.")

{auth-3.2.0 → auth-3.3.0}/auth/routes/public.py

@@ -19,6 +19,26 @@ _COMMIT_PROBE_LOCK = threading.Lock()
 _last_commit_verdict = ["ready"]
 
 
+
+def _audit_partitions():
+    """What the boot-time runway check saw, for /readyz.
+
+    Reported as a FIELD, never as the verdict: rows stranded in the default
+    partition are a retention problem, and pulling a healthy node out of the
+    load balancer over one would turn a slow leak into an outage.
+
+    It exists at all because logging is not a channel everywhere -- vm-2
+    captures no application log line, so the CRITICAL this condition also emits
+    is unreachable there.
+    """
+    try:
+        from auth.schema_reconcile import audit_partition_state
+
+        return dict(audit_partition_state)
+    except Exception:
+        return {"checked": False, "stranded": None, "newest": None}
+
+
 def _pool_depth():
     """Connection-pool saturation. Needs no database round trip.
 
@@ -146,6 +166,7 @@ def register(app):
                 "status": _last_commit_verdict[0],
                 "reason": "commit probe already in flight",
                 "pool": pool_depth,
+                "audit_partitions": _audit_partitions(),
             }
             return jsonify(body), (200 if _last_commit_verdict[0] == "ready" else 503)
         try:
@@ -160,7 +181,16 @@ def register(app):
         except Exception:
             logger.exception("readiness check failed: commit path unavailable")
             _last_commit_verdict[0] = "unready"
-            return jsonify({"status": "unready", "reason": "commit path", "pool": pool_depth}), 503
+            return jsonify({
+                "status": "unready",
+                "reason": "commit path",
+                "pool": pool_depth,
+                "audit_partitions": _audit_partitions(),
+            }), 503
         finally:
             _COMMIT_PROBE_LOCK.release()
-        return jsonify({"status": "ready", "pool": pool_depth})
+        return jsonify({
+            "status": "ready",
+            "pool": pool_depth,
+            "audit_partitions": _audit_partitions(),
+        })

{auth-3.2.0 → auth-3.3.0}/auth/schema_reconcile.py

@@ -15,6 +15,7 @@ junction tables holding every tenant's authorization edges under no policy.
 """
 
 import logging
+from typing import Any
 
 from sqlalchemy.engine import Engine
 
@@ -22,6 +23,11 @@ from auth.config import DatabaseType, get_settings
 
 logger = logging.getLogger(__name__)
 
+#: What the last audit-partition runway check saw, so /readyz can report it.
+#: Logging is not a channel on every deployment -- vm-2 captures no application
+#: log line at all, which makes a CRITICAL there unreachable by anyone.
+audit_partition_state: dict = {"checked": False, "stranded": None, "newest": None}
+
 def _apply_tenant_rls(target_engine: Engine) -> None:
     """Secure any tenant-scoped table that ``create_all`` has just created.
 
@@ -50,7 +56,7 @@ def _apply_tenant_rls(target_engine: Engine) -> None:
     schema = settings.database_schema or "public"
     try:
         with target_engine.begin() as conn:
-            result = conn.execute(
+            result: Any = conn.execute(
                 text(f'SELECT {schema}.apply_tenant_rls()')  # noqa: S608
             ).scalar_one()
         logger.info("apply_tenant_rls: %s", result)
@@ -62,6 +68,92 @@ def _apply_tenant_rls(target_engine: Engine) -> None:
         )
 
 
+def _ensure_audit_partition_runway(target_engine: Engine, months: int = 6) -> None:
+    """Keep monthly audit_log partitions provisioned ahead of now.
+
+    Partitions are finite and nothing renewed them. When they run out, rows do
+    not fail -- they land in audit_log_default, which
+    drop_audit_log_partitions_before deliberately skips, so retention can never
+    reclaim them and the growth problem partitioning solved returns with no
+    visible symptom (issuedb #15; production runway ended 2027-08).
+
+    Called here rather than scheduled in-process: create_tables runs pre-fork
+    under preload_app, so this executes once per service start, not once per
+    worker, and holds no thread across fork. A cron on the database-adjacent
+    host is still the durable answer for a deployment that runs longer than its
+    runway without restarting; this removes the cliff for one that restarts.
+
+    Non-raising, like everything beside it. A deployment whose role cannot
+    create partitions still starts, and rows in the default partition are
+    reported loudly below rather than silently absorbed.
+    """
+    from sqlalchemy import text
+
+    settings = get_settings()
+    if settings.database_type != DatabaseType.POSTGRESQL:
+        return
+    schema = settings.database_schema or "public"
+    try:
+        with target_engine.begin() as conn:
+            if conn.execute(
+                text("SELECT to_regproc(:fn) IS NULL"),
+                {"fn": f"{schema}.provision_audit_log_partition"},
+            ).scalar():
+                logger.info(
+                    "audit partition runway: provisioner absent, skipping"
+                )
+                return
+            created = []
+            for ahead in range(months + 1):
+                result: Any = conn.execute(
+                    text(
+                        f"SELECT {schema}.provision_audit_log_partition("  # noqa: S608
+                        "(date_trunc('month', now()) + make_interval(months => :n))::date)"
+                    ),
+                    {"n": ahead},
+                ).scalar_one()
+                if "created" in str(result):
+                    created.append(str(result))
+            stranded: int = conn.execute(
+                text(f"SELECT count(*) FROM {schema}.audit_log_default")  # noqa: S608
+            ).scalar_one()
+            newest = conn.execute(
+                text(
+                    "SELECT c.relname FROM pg_class c "
+                    "JOIN pg_inherits i ON i.inhrelid = c.oid "
+                    "WHERE i.inhparent = to_regclass(:p) "
+                    "AND c.relname <> 'audit_log_default' "
+                    "ORDER BY c.relname DESC LIMIT 1"
+                ),
+                {"p": f"{schema}.audit_log"},
+            ).scalar()
+    except Exception as exc:
+        logger.warning(
+            "audit partition runway could not be ensured (%s); "
+            "if partitions run out, rows land in audit_log_default and "
+            "retention cannot reclaim them",
+            exc.__class__.__name__,
+        )
+        return
+
+    audit_partition_state.update(
+        {"checked": True, "stranded": int(stranded), "newest": newest}
+    )
+    logger.info(
+        "audit partition runway: %d month(s) ahead, %d created this start",
+        months,
+        len(created),
+    )
+    if stranded:
+        logger.critical(
+            "AUDIT PARTITION RUNWAY WAS EXHAUSTED: %d row(s) are in "
+            "audit_log_default. Retention skips that partition, so they can "
+            "never be reclaimed. They must be moved into a real partition by "
+            "hand once one covers their timestamps.",
+            stranded,
+        )
+
+
 def _reconcile_text_columns(target_engine: Engine) -> None:
     """Widen live ``character varying`` columns to TEXT where the current models
     declare :class:`~sqlalchemy.Text` (issuedb #21).

{auth-3.2.0 → auth-3.3.0}/auth/services/rbac.py

@@ -1,7 +1,7 @@
 """Roles, memberships and permissions — the mutating RBAC core."""
 
 import logging
-from typing import Optional
+from typing import Any, Optional
 
 from sqlalchemy import func, select
 
@@ -139,7 +139,7 @@ class RbacMixin(QueryMixin):
                 set_={"is_active": True, "modified": func.now()},
             )
             self.db.execute(stmt)
-            membership_id = self.db.execute(
+            membership_id: Any = self.db.execute(
                 select(m_table.c.id).where(
                     m_table.c.creator == self.client,
                     m_table.c.user == encrypted_user,
@@ -258,7 +258,7 @@ class RbacMixin(QueryMixin):
                 )
             )
             self.db.execute(stmt)
-            perm_id = self.db.execute(
+            perm_id: Any = self.db.execute(
                 select(p_table.c.id).where(
                     p_table.c.creator == self.client,
                     p_table.c.name == encrypted_name,

{auth-3.2.0 → auth-3.3.0}/auth/services/tenant.py

@@ -4,6 +4,8 @@ import json
 from datetime import datetime
 from typing import Any, Dict, List, Optional, Tuple, cast
 
+from sqlalchemy import desc, or_
+
 from auth.api_keys import generate_rotate_key
 from auth.audit import AuditLog, client_fingerprint
 from auth.models.sql import (
@@ -12,6 +14,8 @@ from auth.models.sql import (
 )
 from auth.services.base import ServiceBase, _utcnow
 
+_api_key_table = AuthApiKey.__table__
+
 
 class TenantMixin(ServiceBase):
     """Per-tenant settings, strict-identity checks and audit reads."""
@@ -112,7 +116,7 @@ class TenantMixin(ServiceBase):
         if action:
             query = query.filter(AuditLog.action == action.upper())
         total = query.count()
-        rows = query.order_by(AuditLog.id.desc()).offset(offset).limit(limit).all()
+        rows: List[Any] = query.order_by(desc(AuditLog.id)).offset(offset).limit(limit).all()
         entries = [
             {
                 "id": row.id,
@@ -131,15 +135,23 @@ class TenantMixin(ServiceBase):
 
     def user_is_key_backed(self, user: str) -> bool:
         """True when the user holds ≥1 active, unexpired API key here."""
-        row = (
+        row: Any = (
             self.db.query(AuthApiKey.id)
             .filter(
                 AuthApiKey.creator == self.client,
                 AuthApiKey._user == self._get_encrypted_user(user),
-                AuthApiKey.is_active,
+                # Core column rather than the mapped attribute. SQLAlchemy 2.1's
+                # stubs resolve a legacy `x = Column(...)` attribute to Never, so
+                # the bare `AuthApiKey.is_active` poisons the whole chain and every
+                # statement after it reads as unreachable. __table__.c types as a
+                # KeyedColumnElement and emits byte-identical SQL, verified.
+                _api_key_table.c.is_active.is_(True),
             )
             .filter(
-                (AuthApiKey.expires_at.is_(None)) | (AuthApiKey.expires_at > _utcnow())
+                or_(
+                    _api_key_table.c.expires_at.is_(None),
+                    _api_key_table.c.expires_at > _utcnow(),
+                )
             )
             .first()
         )

{auth-3.2.0 → auth-3.3.0}/auth.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auth
-Version: 3.2.0
+Version: 3.3.0
 Summary: Authorization for humans
 Author-email: Farshid Ashouri <farsheed.ashouri@gmail.com>
 License-Expression: MIT
@@ -16,13 +16,12 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
-Requires-Python: >=3.9
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: flask<4,>=2.0.0

{auth-3.2.0 → auth-3.3.0}/auth.egg-info/SOURCES.txt

@@ -65,11 +65,13 @@ tests/test_api_keys.py
 tests/test_api_keys_encryption.py
 tests/test_audit_integrity.py
 tests/test_client.py
+tests/test_client_exceptions_do_not_render_payload.py
 tests/test_client_rest.py
 tests/test_cmd_server.py
 tests/test_config.py
 tests/test_correctness_hardening.py
 tests/test_database_sslmode.py
+tests/test_degraded_response_is_a_contract.py
 tests/test_docs_page.py
 tests/test_encryption.py
 tests/test_encryption_integration.py
@@ -79,10 +81,12 @@ tests/test_key_rotation.py
 tests/test_log_redaction.py
 tests/test_no_bundled_libpq.py
 tests/test_phase_a_hardening.py
+tests/test_provision_script_no_dsn_leak.py
 tests/test_reencryption.py
 tests/test_routes_errors.py
 tests/test_self_service_audit.py
 tests/test_server.py
 tests/test_service_lifecycle.py
+tests/test_settings_do_not_echo_secrets.py
 tests/test_strict_default.py
 tests/test_strict_users.py

{auth-3.2.0 → auth-3.3.0}/pyproject.toml

@@ -4,10 +4,10 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "auth"
-version = "3.2.0"
+version = "3.3.0"
 description = "Authorization for humans"
 readme = "README.md"
-requires-python = ">=3.9"
+requires-python = ">=3.10"
 license = "MIT"
 authors = [
     {name = "Farshid Ashouri", email = "farsheed.ashouri@gmail.com"}
@@ -25,7 +25,6 @@ classifiers = [
     "Programming Language :: Python",
     "Programming Language :: Python :: Implementation :: CPython",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
@@ -185,7 +184,7 @@ line_length = 88
 
 [tool.mypy]
 # Lowest version current mypy can target; the service deploys on 3.11 and CI
-# also runs 3.12. (Package metadata still advertises >=3.9 for older installs.)
+# also runs 3.12. (Package metadata advertises >=3.10.)
 python_version = "3.10"
 # `python -m build` leaves a copy of the package under build/lib/, which mypy
 # would otherwise report as a duplicate module — so `make build` broke the next

auth-3.3.0/tests/test_client_exceptions_do_not_render_payload.py

@@ -0,0 +1,52 @@
+import pytest
+
+from auth.client._transport import AuthRefused, AuthTransportError
+
+SENTINEL = "Zq7SentinelCredential9xK"
+PAYLOAD = {"message": "denied", "details": {"echoed": SENTINEL}}
+
+
+def test_refusal_renders_only_its_message():
+    """auth ships this client; other platforms run it and log its exceptions.
+
+    A three-argument exception normally renders its whole args tuple through
+    Exception.__str__, which would put the upstream response body into every
+    ``log.error(e)`` a consumer writes. AuthRefused passes only the message to
+    super().__init__ and keeps status and payload as attributes, so the safe
+    rendering is the default one and the body is opt-in.
+    """
+    exc = AuthRefused("auth refused the request: HTTP 401", 401, PAYLOAD)
+
+    assert SENTINEL not in str(exc)
+    assert SENTINEL not in repr(exc)
+    assert SENTINEL not in str(exc.args)
+    assert str(exc) == "auth refused the request: HTTP 401"
+
+
+def test_the_payload_is_still_reachable_deliberately():
+    """The other direction: redaction must not cost the caller the detail.
+
+    A guard that only proved the body is absent would pass equally if payload
+    were dropped entirely, which would break the 409 hints this argument exists
+    to carry.
+    """
+    exc = AuthRefused("auth refused the request: HTTP 409", 409, PAYLOAD)
+    assert exc.payload == PAYLOAD
+    assert exc.status == 409
+
+
+def test_the_detector_would_see_a_leak():
+    """Known-positive control.
+
+    If Exception.__str__ ever stopped rendering extra args, the assertions
+    above would hold for a reason that has nothing to do with AuthRefused, and
+    the guard would be protecting nothing.
+    """
+    leaky = AuthTransportError("upstream said", PAYLOAD)
+    assert SENTINEL in str(leaky)
+
+
+def test_refusal_is_still_a_transport_error_subclass():
+    assert issubclass(AuthRefused, AuthTransportError)
+    with pytest.raises(AuthTransportError):
+        raise AuthRefused("m", 400, None)

auth-3.3.0/tests/test_degraded_response_is_a_contract.py

@@ -0,0 +1,82 @@
+import uuid
+
+import pytest
+
+import auth.keycheck as keycheck
+from auth.main import create_app
+
+MARKER = "Service degraded"
+MARKER_OFFSET = 102
+
+REAL_DETAILS = [
+    "the configured AUTH_ENCRYPTION_KEY cannot decrypt this deployment's canary "
+    "- every authorization lookup would miss and answer negatively",
+    "row level security is not in force on: auth_api_key, auth_group, auth_membership, "
+    "auth_permission, auth_tenant_settings, membership_groups, permission_groups "
+    "- tenant isolation would rest on query convention alone",
+]
+
+
+@pytest.fixture
+def client():
+    application = create_app()
+    application.config["TESTING"] = True
+    return application.test_client()
+
+
+@pytest.fixture
+def client_key():
+    return str(uuid.uuid4())
+
+
+@pytest.fixture
+def degraded():
+    saved = (keycheck.state(), keycheck.detail())
+
+    def _set(detail):
+        keycheck._state, keycheck._detail = keycheck.MISMATCH, detail
+
+    yield _set
+    keycheck._state, keycheck._detail = saved
+
+
+def test_healthy_api_is_not_degraded(client, client_key):
+    """Known-positive control: without this, every assertion below could pass
+    because the route is broken rather than because degraded mode works."""
+    resp = client.get("/api/roles", headers={"Authorization": f"Bearer {client_key}"})
+    assert resp.status_code == 200
+
+
+@pytest.mark.parametrize("detail", REAL_DETAILS)
+def test_degraded_api_carries_the_marker_at_a_stable_offset(client, client_key, degraded, detail):
+    """RODMENA L10n classify this response by scanning for MARKER in the first
+    200 bytes. That was a heuristic they inferred from a body I sent them; this
+    makes it a contract, so moving it fails here instead of silently changing
+    how a consumer logs an encryption-key mismatch.
+
+    The offset is asserted rather than mere presence: the marker precedes the
+    variable detail, which is the property that makes a fixed-size scan window
+    safe regardless of which failure produced it.
+    """
+    degraded(detail)
+    resp = client.get("/api/roles", headers={"Authorization": f"Bearer {client_key}"})
+    body = resp.get_data(as_text=True)
+
+    assert resp.status_code == 503
+    assert body.index(MARKER) == MARKER_OFFSET
+    assert MARKER_OFFSET < 200
+    # Werkzeug HTML-escapes the description, so an apostrophe in the detail
+    # arrives as &#39; -- markupsafe's form, not the stdlib's &#x27;. A consumer
+    # matching raw detail text against a real response will miss; the marker,
+    # which contains no escapable character, will not.
+    from markupsafe import escape
+
+    assert str(escape(detail)) in body
+
+
+def test_degraded_readyz_and_health_also_refuse(client, degraded):
+    degraded(REAL_DETAILS[0])
+    assert client.get("/health").status_code == 503
+    assert client.get("/readyz").status_code == 503
+    assert client.head("/health").status_code == 503
+    assert client.head("/readyz").status_code == 503

auth-3.3.0/tests/test_provision_script_no_dsn_leak.py

@@ -0,0 +1,53 @@
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+SCRIPT = Path(__file__).resolve().parent.parent / "scripts" / "provision_audit_partitions.py"
+SENTINEL = "Zq7SentinelPw9xK"
+
+MALFORMED = {
+    "typod_scheme": f"postgres!!!://u:{SENTINEL}@127.0.0.1:1/db",
+    "sqlalchemy_url": f"postgresql+psycopg://u:{SENTINEL}@127.0.0.1:1/db",
+    "unreachable": f"postgresql://u:{SENTINEL}@127.0.0.1:1/db",
+}
+
+
+def _run(dsn):
+    env = {k: v for k, v in os.environ.items() if k not in ("AUDIT_DB_URL", "MG_DATABASE_URL", "AUTH_DATABASE_URL", "DATABASE_URL")}
+    env["AUTH_DATABASE_URL"] = dsn
+    return subprocess.run(
+        [sys.executable, str(SCRIPT), "--months", "1"],
+        capture_output=True, text=True, env=env, timeout=60,
+    )
+
+
+def test_the_trigger_still_exists():
+    """Known-positive control.
+
+    psycopg must still quote a malformed conninfo string back in full, or the
+    assertions below pass because the danger vanished rather than because the
+    script defends against it -- a check that cannot go red.
+    """
+    psycopg = pytest.importorskip("psycopg")
+    with pytest.raises(psycopg.Error) as caught:
+        psycopg.connect(MALFORMED["typod_scheme"], connect_timeout=1)
+    assert SENTINEL in str(caught.value)
+
+
+@pytest.mark.parametrize("name", sorted(MALFORMED))
+def test_script_never_prints_the_dsn(name):
+    pytest.importorskip("psycopg")
+    proc = _run(MALFORMED[name])
+    assert SENTINEL not in proc.stdout
+    assert SENTINEL not in proc.stderr
+    assert proc.returncode == 2
+
+
+def test_failure_is_still_diagnosable():
+    pytest.importorskip("psycopg")
+    proc = _run(MALFORMED["typod_scheme"])
+    assert "AUTH_DATABASE_URL" in proc.stderr
+    assert "Error" in proc.stderr

auth-3.3.0/tests/test_settings_do_not_echo_secrets.py

@@ -0,0 +1,59 @@
+import os
+import traceback
+
+import pytest
+
+from auth.config import Settings
+
+SENTINEL = "Zq7SentinelSecret9xK"
+
+SECRET_FIELDS = ("database_url", "postgresql_url", "jwt_secret_key", "audit_pepper", "encryption_key")
+
+
+def test_secret_fields_are_plain_str():
+    """The reason a secret cannot reach a ValidationError, asserted directly.
+
+    pydantic appends ``input_value=<raw value>`` to a validation error. Settings
+    are populated from the environment, where every value is a string, so a
+    plain ``str`` field cannot fail and cannot be echoed. Give one of these a
+    constrained type or a validator and that stops being true silently -- so the
+    property itself is the test, not the symptom.
+    """
+    for name in SECRET_FIELDS:
+        field = Settings.model_fields[name]
+        assert field.annotation is str, (
+            f"{name} is no longer a plain str. A constrained secret field can fail "
+            f"validation, and pydantic will echo its value. Set "
+            f"hide_input_in_errors=True on Settings.model_config before changing this."
+        )
+
+
+def test_a_failure_elsewhere_does_not_echo_secrets(monkeypatch):
+    for key in [k for k in os.environ if k.startswith("AUTH_")]:
+        monkeypatch.delenv(key, raising=False)
+    monkeypatch.setenv("AUTH_DEBUG_MODE", "true")
+    monkeypatch.setenv("AUTH_DATABASE_URL", f"postgresql://u:{SENTINEL}@h:5432/db")
+    monkeypatch.setenv("AUTH_ENCRYPTION_KEY", SENTINEL)
+    monkeypatch.setenv("AUTH_AUDIT_PEPPER", SENTINEL)
+    monkeypatch.setenv("AUTH_DATABASE_TYPE", "not-a-valid-enum-value")
+
+    with pytest.raises(Exception) as caught:
+        Settings()  # type: ignore[call-arg]
+
+    exc = caught.value
+    rendered = str(exc) + "".join(traceback.format_exception(type(exc), exc, exc.__traceback__))
+
+    assert "not-a-valid-enum-value" in str(exc)
+    assert SENTINEL not in rendered
+
+
+def test_the_echo_mechanism_is_real():
+    """Known-positive control.
+
+    If pydantic ever stops echoing input values, the assertions above would pass
+    because the danger vanished rather than because Settings avoids it -- and
+    the guard in the first test would be protecting nothing.
+    """
+    with pytest.raises(Exception) as caught:
+        Settings(encryption_key=[SENTINEL])  # type: ignore[call-arg,arg-type]
+    assert SENTINEL in str(caught.value)