auth 3.4.0__tar.gz → 3.5.0__tar.gz

{auth-3.4.0 → auth-3.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auth
-Version: 3.4.0
+Version: 3.5.0
 Summary: Authorization for humans
 Author-email: Farshid Ashouri <farsheed.ashouri@gmail.com>
 License-Expression: MIT

{auth-3.4.0 → auth-3.5.0}/auth/__init__.py

@@ -10,6 +10,7 @@ from auth.client import (  # Import the new client
     EnhancedAuthClient,
 )
 from auth.database import SessionLocal
+from auth.schema_check import SchemaMismatchError, check_schema
 from auth.services.service import AuthorizationService
 
 try:
@@ -157,5 +158,7 @@ __all__ = [
     "Client",
     "EnhancedAuthClient",
     "SessionLocal",
+    "SchemaMismatchError",
+    "check_schema",
     "__version__",
 ]

{auth-3.4.0 → auth-3.5.0}/auth/database.py

@@ -15,6 +15,7 @@ from sqlalchemy.orm import Session, sessionmaker
 from sqlalchemy.pool import Pool
 
 from auth.config import DatabaseType, Settings, get_settings, warn_on_weak_secrets
+from auth.schema_check import check_schema
 from auth.schema_reconcile import (
     GRANDFATHER_MARKER,  # noqa: F401  - re-exported; tests and embedded callers import it from here
     _apply_tenant_rls,
@@ -379,6 +380,7 @@ def create_tables(raise_on_error: bool = False):
         _ensure_audit_partition_runway(engine)
         _reconcile_text_columns(engine)
         _grandfather_strict_users(engine)
+        check_schema(engine)
         logger.info("Tables created successfully.")
     except Exception:
         logger.exception("create_tables failed")

auth-3.5.0/auth/schema_check.py

@@ -0,0 +1,61 @@
+from typing import List, Optional, Sequence, Tuple, Union
+
+from sqlalchemy import Table, inspect
+from sqlalchemy.engine import Connection, Engine
+
+Bind = Union[Engine, Connection]
+
+
+class SchemaMismatchError(RuntimeError):
+    def __init__(
+        self, missing_tables: Sequence[str], missing_columns: Sequence[str]
+    ) -> None:
+        self.missing_tables = list(missing_tables)
+        self.missing_columns = list(missing_columns)
+        parts = []
+        if self.missing_tables:
+            parts.append("missing tables: " + ", ".join(self.missing_tables))
+        if self.missing_columns:
+            parts.append("missing columns: " + ", ".join(self.missing_columns))
+        super().__init__(
+            "the live database is behind the installed auth models ("
+            + "; ".join(parts)
+            + "). The auth changelog lists the DDL each release needs."
+        )
+
+
+def _qualified(table: Table) -> str:
+    return f"{table.schema}.{table.name}" if table.schema else table.name
+
+
+def find_schema_drift(bind: Bind) -> Tuple[List[str], List[str]]:
+    import auth.audit  # noqa: F401
+    from auth.models.sql import Base
+
+    inspector = inspect(bind)
+    missing_tables: List[str] = []
+    missing_columns: List[str] = []
+    for table in sorted(Base.metadata.tables.values(), key=_qualified):
+        if not inspector.has_table(table.name, schema=table.schema):
+            missing_tables.append(_qualified(table))
+            continue
+        live = {
+            column["name"]
+            for column in inspector.get_columns(table.name, schema=table.schema)
+        }
+        missing_columns.extend(
+            f"{_qualified(table)}.{column.name}"
+            for column in table.columns
+            if column.name not in live
+        )
+    return missing_tables, missing_columns
+
+
+def check_schema(bind: Optional[Bind] = None) -> None:
+    if bind is None:
+        from auth.database import engine
+
+        bind = engine
+    missing_tables, missing_columns = find_schema_drift(bind)
+    if missing_tables or missing_columns:
+        raise SchemaMismatchError(missing_tables, missing_columns)

{auth-3.4.0 → auth-3.5.0}/auth.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auth
-Version: 3.4.0
+Version: 3.5.0
 Summary: Authorization for humans
 Author-email: Farshid Ashouri <farsheed.ashouri@gmail.com>
 License-Expression: MIT

{auth-3.4.0 → auth-3.5.0}/auth.egg-info/SOURCES.txt

@@ -16,6 +16,7 @@ auth/main.py
 auth/response_format.py
 auth/rls.py
 auth/sanitizer.py
+auth/schema_check.py
 auth/schema_reconcile.py
 auth/server.py
 auth/validation.py
@@ -85,6 +86,7 @@ tests/test_phase_a_hardening.py
 tests/test_provision_script_no_dsn_leak.py
 tests/test_reencryption.py
 tests/test_routes_errors.py
+tests/test_schema_check.py
 tests/test_self_service_audit.py
 tests/test_server.py
 tests/test_service_lifecycle.py

{auth-3.4.0 → auth-3.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "auth"
-version = "3.4.0"
+version = "3.5.0"
 description = "Authorization for humans"
 readme = "README.md"
 requires-python = ">=3.10"

auth-3.5.0/tests/test_schema_check.py

@@ -0,0 +1,134 @@
+import logging
+
+import pytest
+from sqlalchemy import create_engine, event, text
+
+import auth
+import auth.audit  # noqa: F401
+import auth.database
+from auth.models.sql import Base
+from auth.schema_check import SchemaMismatchError, check_schema, find_schema_drift
+
+V310_TENANT_SETTINGS = (
+    "CREATE TABLE auth_tenant_settings ("
+    "id INTEGER PRIMARY KEY, creator VARCHAR(64) NOT NULL, "
+    "strict_users BOOLEAN NOT NULL, date_created DATETIME, modified DATETIME)"
+)
+V340_ADDED = [
+    "auth_tenant_settings.rotate_key_hash",
+    "auth_tenant_settings.rotate_key_issued_at",
+    "auth_tenant_settings.canary",
+]
+
+pytestmark = pytest.mark.skipif(
+    any(t.schema for t in Base.metadata.tables.values()),
+    reason="SQLite drift tests build unqualified tables",
+)
+
+
+@pytest.fixture
+def current_engine(tmp_path):
+    engine = create_engine(f"sqlite:///{tmp_path / 'current.sqlite3'}")
+    Base.metadata.create_all(engine)
+    yield engine
+    engine.dispose()
+
+
+@pytest.fixture
+def v310_engine(current_engine):
+    with current_engine.begin() as conn:
+        conn.execute(text("DROP TABLE auth_tenant_settings"))
+        conn.execute(text(V310_TENANT_SETTINGS))
+    return current_engine
+
+
+def _statements(engine):
+    seen = []
+    event.listen(
+        engine,
+        "before_cursor_execute",
+        lambda conn, cursor, statement, *a: seen.append(statement),
+    )
+    return seen
+
+
+def test_current_schema_passes(current_engine):
+    assert find_schema_drift(current_engine) == ([], [])
+    check_schema(current_engine)
+
+
+def test_v310_tenant_settings_names_the_three_missing_columns(v310_engine):
+    assert find_schema_drift(v310_engine) == ([], V340_ADDED)
+    with pytest.raises(SchemaMismatchError) as caught:
+        check_schema(v310_engine)
+    assert caught.value.missing_columns == V340_ADDED
+    assert caught.value.missing_tables == []
+    for name in V340_ADDED:
+        assert name in str(caught.value)
+
+
+def test_missing_table_is_named(current_engine):
+    with current_engine.begin() as conn:
+        conn.execute(text("DROP TABLE auth_tenant_settings"))
+    with pytest.raises(SchemaMismatchError) as caught:
+        check_schema(current_engine)
+    assert caught.value.missing_tables == ["auth_tenant_settings"]
+    assert caught.value.missing_columns == []
+    assert "missing tables: auth_tenant_settings" in str(caught.value)
+
+
+def test_extra_live_columns_are_allowed(current_engine):
+    with current_engine.begin() as conn:
+        conn.execute(text("ALTER TABLE auth_tenant_settings ADD COLUMN creator_fp TEXT"))
+    check_schema(current_engine)
+
+
+def test_check_issues_no_ddl_or_writes(v310_engine):
+    seen = _statements(v310_engine)
+    with v310_engine.begin() as conn:
+        conn.execute(text("ALTER TABLE auth_tenant_settings ADD COLUMN probe TEXT"))
+    assert any(s.startswith("ALTER TABLE") for s in seen)
+    seen.clear()
+    with pytest.raises(SchemaMismatchError):
+        check_schema(v310_engine)
+    assert seen
+    writes = ("CREATE", "ALTER", "DROP", "INSERT", "UPDATE", "DELETE")
+    assert [s for s in seen if s.lstrip().upper().startswith(writes)] == []
+
+
+def test_message_does_not_carry_the_database_location(v310_engine):
+    with pytest.raises(SchemaMismatchError) as caught:
+        check_schema(v310_engine)
+    assert str(v310_engine.url.database) not in str(caught.value)
+    assert "sqlite" not in str(caught.value)
+
+
+def test_create_tables_raises_on_drift_when_asked(v310_engine, monkeypatch):
+    monkeypatch.setattr(auth.database, "engine", v310_engine)
+    with pytest.raises(SchemaMismatchError) as caught:
+        auth.database.create_tables(raise_on_error=True)
+    assert caught.value.missing_columns == V340_ADDED
+
+
+def test_create_tables_logs_drift_by_default(v310_engine, monkeypatch, caplog):
+    monkeypatch.setattr(auth.database, "engine", v310_engine)
+    with caplog.at_level(logging.ERROR, logger=auth.database.logger.name):
+        auth.database.create_tables()
+    logged = "\n".join(r.getMessage() + (r.exc_text or "") for r in caplog.records)
+    assert "create_tables failed" in logged
+    for name in V340_ADDED:
+        assert name in logged
+    assert "Tables created successfully." not in caplog.text
+
+
+def test_create_tables_on_current_schema_reports_success(current_engine, monkeypatch, caplog):
+    monkeypatch.setattr(auth.database, "engine", current_engine)
+    with caplog.at_level(logging.INFO, logger=auth.database.logger.name):
+        auth.database.create_tables(raise_on_error=True)
+    assert "Tables created successfully." in caplog.text
+
+
+def test_public_exports():
+    assert auth.check_schema is check_schema
+    assert auth.SchemaMismatchError is SchemaMismatchError
+    assert {"check_schema", "SchemaMismatchError"} <= set(auth.__all__)