bazis-users 2.3.0__tar.gz → 2.3.2__tar.gz

{bazis_users-2.3.0 → bazis_users-2.3.2}/.github/workflows/release.yml

@@ -42,9 +42,12 @@ jobs:
             echo "::error::Tag v$VERSION already exists"
             exit 1
           fi
-          LAST_TAG=$(git tag --list 'v*' --sort=-v:refname | head -n 1)
+          # versionsort.suffix: a pre-release (v2.4.0-rc1) sorts before its release (v2.4.0)
+          LAST_TAG=$(git -c versionsort.suffix=- tag --list 'v*' --sort=-v:refname | head -n 1)
           echo "Last release: ${LAST_TAG:-none}, new release: v$VERSION"
-          if [ -n "$LAST_TAG" ] && [ "$(printf '%s\n%s\n' "${LAST_TAG#v}" "$VERSION" | sort -V | tail -n 1)" != "$VERSION" ]; then
+          # sort -V orders "~" before anything, as versionsort.suffix does with "-"
+          NEWEST=$(printf '%s\n%s\n' "${LAST_TAG#v}" "$VERSION" | sed 's/-/~/' | sort -V | tail -n 1)
+          if [ -n "$LAST_TAG" ] && [ "$NEWEST" != "${VERSION/-/\~}" ]; then
             echo "::error::Version $VERSION is not newer than $LAST_TAG"
             exit 1
           fi

{bazis_users-2.3.0 → bazis_users-2.3.2}/.github/workflows/tests.yml

@@ -20,7 +20,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: astral-sh/setup-uv@v6
-      - run: uvx ruff check bazis tests
+      - run: uvx ruff check bazis tests sample
 
   tests:
     name: tests (python ${{ matrix.python }}, ${{ matrix.resolution }})

{bazis_users-2.3.0 → bazis_users-2.3.2}/CLAUDE.md

@@ -29,7 +29,7 @@ BS_MEDIA_ROOT=/tmp/bazis/media BS_STATIC_ROOT=/tmp/bazis/static BS_WEBAPP_ROOT=/
 python -m pytest ../tests -o addopts="" -p no:cacheprovider
 ```
 
-Lint: `ruff check bazis tests`. CI also runs `python manage.py makemigrations --check
+Lint: `ruff check bazis tests sample`. CI also runs `python manage.py makemigrations --check
 --dry-run` in `sample`: commit the migrations of model changes, including the sample apps.
 
 ## Releasing

{bazis_users-2.3.0 → bazis_users-2.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bazis-users
-Version: 2.3.0
+Version: 2.3.2
 Summary: User management module for Bazis framework.
 Author-email: Ilya Kharyn <ilya.tt07@gmail.com>
 Maintainer-email: Ilya Kharyn <ilya.tt07@gmail.com>
@@ -17,7 +17,7 @@ Classifier: Framework :: Django
 Classifier: Framework :: FastAPI
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
-Requires-Dist: bazis>=2.3.0
+Requires-Dist: bazis>=2.3.1
 Requires-Dist: python-multipart>=0.0.18
 Requires-Dist: PyJWT>=2.10
 Provides-Extra: test

{bazis_users-2.3.0 → bazis_users-2.3.2}/bazis/contrib/users/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '2.3.0'
-__version_tuple__ = version_tuple = (2, 3, 0)
+__version__ = version = '2.3.2'
+__version_tuple__ = version_tuple = (2, 3, 2)
 
-__commit_id__ = commit_id = 'g5959b6ec7'
+__commit_id__ = commit_id = 'gfa5e68bf1'

{bazis_users-2.3.0 → bazis_users-2.3.2}/bazis/contrib/users/conf.py

@@ -38,7 +38,11 @@ class Settings(BazisSettings):
     BAZIS_JWT_SESSION_ALG: Literal['HS256', 'HS384', 'HS512'] = Field(
         'HS256', title=_('JWT algorithm')
     )
-    BAZIS_JWT_SESSION_LIFETIME: int = Field(86400, title=_('JWT lifetime'), dynamic=True)
+    BAZIS_JWT_SESSION_LIFETIME: int = Field(
+        86400,
+        title=_('JWT lifetime'),
+        json_schema_extra={'dynamic': True},
+    )
 
 
 settings = Settings()

{bazis_users-2.3.0 → bazis_users-2.3.2}/bazis_users.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bazis-users
-Version: 2.3.0
+Version: 2.3.2
 Summary: User management module for Bazis framework.
 Author-email: Ilya Kharyn <ilya.tt07@gmail.com>
 Maintainer-email: Ilya Kharyn <ilya.tt07@gmail.com>
@@ -17,7 +17,7 @@ Classifier: Framework :: Django
 Classifier: Framework :: FastAPI
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
-Requires-Dist: bazis>=2.3.0
+Requires-Dist: bazis>=2.3.1
 Requires-Dist: python-multipart>=0.0.18
 Requires-Dist: PyJWT>=2.10
 Provides-Extra: test

{bazis_users-2.3.0 → bazis_users-2.3.2}/bazis_users.egg-info/SOURCES.txt

@@ -50,6 +50,8 @@ docs/_static/readthedocs-custom.css
 docs/_templates/custom-class-template.rst
 docs/_templates/custom-module-template.rst
 docs/releases/2.3.0.md
+docs/releases/2.3.1.md
+docs/releases/2.3.2.md
 sample/manage.py
 sample/project.env
 sample/pyproject.toml

{bazis_users-2.3.0 → bazis_users-2.3.2}/bazis_users.egg-info/requires.txt

@@ -1,4 +1,4 @@
-bazis>=2.3.0
+bazis>=2.3.1
 python-multipart>=0.0.18
 PyJWT>=2.10
 

{bazis_users-2.3.0 → bazis_users-2.3.2}/bazis_users.egg-info/scm_file_list.json

@@ -39,6 +39,8 @@
     "docs/manage.py",
     "docs/project.env",
     "docs/releases/2.3.0.md",
+    "docs/releases/2.3.1.md",
+    "docs/releases/2.3.2.md",
     "docs/requirements.txt",
     "docs/settings.py",
     "docs/structure.rst",

{bazis_users-2.3.0 → bazis_users-2.3.2}/bazis_users.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "2.3.0",
+  "tag": "2.3.2",
   "distance": 0,
-  "node": "g5959b6ec72f5fb36c16474b35bc9e8f2363459ce",
+  "node": "gfa5e68bf11f081b876fbfebf90cdac9a6b124dcb",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-10-01"

bazis_users-2.3.2/docs/releases/2.3.1.md

@@ -0,0 +1,6 @@
+# bazis-users 2.3.1
+
+- Requires Bazis 2.3.1. Its relationships endpoints changed any relation of any object:
+  every authenticated user could add himself to Django groups or permissions with
+  `POST /users/user/<id>/relationships/groups` (or `user_permissions`), which the user
+  schema excludes. A test now checks that both are refused.

bazis_users-2.3.2/docs/releases/2.3.2.md

@@ -0,0 +1,6 @@
+# bazis-users 2.3.2
+
+## Fixes
+
+- `BAZIS_JWT_SESSION_LIFETIME` is declared with `json_schema_extra` (an extra keyword
+  argument of `Field` is deprecated in Pydantic 2 and emitted a warning).

{bazis_users-2.3.0 → bazis_users-2.3.2}/pyproject.toml

@@ -33,7 +33,7 @@ classifiers = [
     "Framework :: FastAPI",
 ]
 dependencies = [
-    "bazis>=2.3.0",
+    "bazis>=2.3.1",
     "python-multipart>=0.0.18",
     "PyJWT>=2.10",
 ]

{bazis_users-2.3.0 → bazis_users-2.3.2}/sample/sample/main.py

@@ -17,4 +17,4 @@ import os
 
 os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'sample.settings')
 
-from bazis.core.app import app  # noqa: E401
+from bazis.core.app import app  # noqa: E402, F401

{bazis_users-2.3.0 → bazis_users-2.3.2}/sample/sample/settings.py

@@ -12,4 +12,4 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-import bazis.core.configure # noqa: F401
+import bazis.core.configure  # noqa: F401

{bazis_users-2.3.0 → bazis_users-2.3.2}/tests/test_tokens.py

@@ -133,3 +133,31 @@ def test_token_without_expiration_is_anonymous(sample_app, user):
     token = _token({'sub': user.username})
     assert get_token_data(token_header=None, token_param=None, token_cookie=token) == {}
     assert _get_me(sample_app, token).status_code == 401
+
+
+@pytest.mark.django_db(transaction=True)
+def test_user_cannot_grant_himself_groups(sample_app, user):
+    """
+    groups and user_permissions are excluded from the user schema: the relationships
+    endpoints must not change them (privilege escalation through Django permissions).
+    """
+    from django.contrib.auth.models import Group, Permission
+
+    admins = Group.objects.create(name='admins')
+    admins.permissions.set(Permission.objects.all())
+    client = get_api_client(sample_app, user.jwt_build())
+
+    response = client.post(
+        f'/api/v1/users/user/{user.id}/relationships/groups',
+        json_data={'data': [{'id': str(admins.id), 'type': 'auth.group'}]},
+    )
+    assert response.status_code == 403
+    assert not user.groups.exists()
+
+    permission = Permission.objects.first()
+    response = client.post(
+        f'/api/v1/users/user/{user.id}/relationships/user_permissions',
+        json_data={'data': [{'id': str(permission.id), 'type': 'auth.permission'}]},
+    )
+    assert response.status_code == 403
+    assert not user.user_permissions.exists()