bustapi 0.13.5__tar.gz → 0.13.8__tar.gz

{bustapi-0.13.5 → bustapi-0.13.8}/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 All notable changes to this project will be documented here.
 
+## [0.13.8] - 2026-06-11
+
+### Added
+- **Auth Decorators**: Added a `require_all` flag to `@roles_required` and `@permission_required` decorators, enabling explicit AND/OR logic for multi-role/permission checks.
+
+### Fixed
+- **Auth Async Support**: Fixed a critical bug where `@roles_required` and `@permission_required` decorators failed to support `async def` routes.
+
+## [0.13.7] - 2026-06-10
+
+### Fixed
+- **Login Manager ID Resolution**: Improved `login_user()` to gracefully handle non-string `get_id()` returns (e.g. integer IDs from Peewee ORM) and added support for a conflict-free `get_login_id()` method to prevent overriding built-in ORM properties.
+- **Version Sync**: Synchronized package version in `__init__.py` which was previously out of sync with the package configuration.
+
+## [0.13.6] - 2026-06-08
+
+### Fixed
+- **Auth Login Context**: Fixed `login_manager` extraction by correcting the attribute check on the request from `_app` to `app` ([#26](https://github.com/RUSTxPY/BustAPI/issues/26)).
+- **Template Directory Handling**: Resolved duplicated fallback logic for template directories in `core/helpers.py` by streamlining the lookup against `current_app.template_folder` ([#25](https://github.com/RUSTxPY/BustAPI/issues/25)).
+
 ## [0.13.5] - 2026-06-04
 
 ### Added

{bustapi-0.13.5 → bustapi-0.13.8}/Cargo.lock

@@ -372,9 +372,9 @@ checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
 [[package]]
 name = "bitflags"
-version = "2.12.1"
+version = "2.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84d7ced0ae9557296835c32bf1b1e02b44c746701f898460fb000d7eaa84f00a"
+checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
 
 [[package]]
 name = "blake2"
@@ -396,9 +396,9 @@ dependencies = [
 
 [[package]]
 name = "block-buffer"
-version = "0.12.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
 dependencies = [
  "hybrid-array",
 ]
@@ -432,7 +432,7 @@ checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
 [[package]]
 name = "bustapi_core"
-version = "0.13.5"
+version = "0.13.8"
 dependencies = [
  "actix-files",
  "actix-http",
@@ -526,9 +526,9 @@ dependencies = [
 
 [[package]]
 name = "chrono"
-version = "0.4.44"
+version = "0.4.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
 dependencies = [
  "iana-time-zone",
  "js-sys",
@@ -779,7 +779,7 @@ version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
- "block-buffer 0.12.0",
+ "block-buffer 0.12.1",
  "const-oid",
  "crypto-common 0.2.2",
 ]
@@ -1329,13 +1329,12 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.99"
+version = "0.3.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "142bc4740e452c1e57ade0cbc129f139c9093e354346f0872ef985f4f5cf5f11"
+checksum = "f2025f20d7a4fa7785846e7b63d10a76d3f1cee98ee5cb79ea59703f95e42162"
 dependencies = [
  "cfg-if",
  "futures-util",
- "once_cell",
  "wasm-bindgen",
 ]
 
@@ -1432,9 +1431,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.31"
+version = "0.4.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "113b30b4cd05f7c06868fdb2854f66a7b9fece9a48425351cd532e810d74024f"
+checksum = "953f07c43838f8e6f9758cab68bf5bed85465e7587ebe0b823f1bcd81978ad3a"
 
 [[package]]
 name = "matchers"
@@ -1876,9 +1875,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.12.3"
+version = "1.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
+checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1905,9 +1904,9 @@ checksum = "cab834c73d247e67f4fae452806d17d3c7501756d98c8808d7c9c7aa7d18f973"
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.10"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
 [[package]]
 name = "rustc_version"
@@ -2457,9 +2456,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.122"
+version = "0.2.123"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ed04576f974d2b2fba0f38c51dbc5518011e38c36bf1143164be765528fd409"
+checksum = "a254a4b10c19a76f09a27640e7ffbf9bc30bf67e16a3bf28aaefa4920fe81563"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -2470,9 +2469,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.122"
+version = "0.2.123"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "916151b09da36bd82f6615cbf3a419e2f0ba23a03c6160e8e92eb6bd4aa1dec6"
+checksum = "24a40fc75b0ec6f3746ceb10d36f53a93dcd68a93b11b6445983945d79eba0dc"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -2480,9 +2479,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.122"
+version = "0.2.123"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "299047362ccbfce148b67ab7e73349f77748e00c8296f9542adfad2ad82c5c5e"
+checksum = "908f34bd9b9ce3d4caf07b72dfab63d61504d156856c6bd3cd87fa350cf3985b"
 dependencies = [
  "bumpalo",
  "proc-macro2",
@@ -2493,9 +2492,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.122"
+version = "0.2.123"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a929b2c61f11ba3e9bc35b50c1f25cb38e0e892c0c231ae2b8cf78d5dad4437"
+checksum = "7acbf7616c27b194bbb550bf77ed0c2c3e5b7fd1260a93082b95fb7f47959b92"
 dependencies = [
  "unicode-ident",
 ]
@@ -2892,18 +2891,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.50"
+version = "0.8.52"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b065d4f0e55f82fae73202e189638116a87c55ab6b8e6c2721e13dd9d854ad1"
+checksum = "ce1022995ff5ff5d841ad7d994facc23098cd40152f2c1d11cd607c6f530653f"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.50"
+version = "0.8.52"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b631b19d36a892ab55420c92dbc83ccd79274f25be714855d3074aa71cab639"
+checksum = "1ae7f38b72ec2a254e2b87ef277cf2cd4fb97cbebf944faa6f33354da0867930"
 dependencies = [
  "proc-macro2",
  "quote",

{bustapi-0.13.5 → bustapi-0.13.8}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "bustapi_core"
-version = "0.13.5"
+version = "0.13.8"
 edition = "2021"
 readme = "README.md"
 

{bustapi-0.13.5 → bustapi-0.13.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bustapi
-Version: 0.13.5
+Version: 0.13.8
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License

{bustapi-0.13.5 → bustapi-0.13.8}/docs/changelog.md

@@ -2,6 +2,26 @@
 
 All notable changes to this project will be documented here.
 
+## [0.13.8] - 2026-06-11
+
+### Added
+- **Auth Decorators**: Added a `require_all` flag to `@roles_required` and `@permission_required` decorators, enabling explicit AND/OR logic for multi-role/permission checks.
+
+### Fixed
+- **Auth Async Support**: Fixed a critical bug where `@roles_required` and `@permission_required` decorators failed to support `async def` routes.
+
+## [0.13.7] - 2026-06-10
+
+### Fixed
+- **Login Manager ID Resolution**: Improved `login_user()` to gracefully handle non-string `get_id()` returns (e.g. integer IDs from Peewee ORM) and added support for a conflict-free `get_login_id()` method to prevent overriding built-in ORM properties.
+- **Version Sync**: Synchronized package version in `__init__.py` which was previously out of sync with the package configuration.
+
+## [0.13.6] - 2026-06-08
+
+### Fixed
+- **Auth Login Context**: Fixed `login_manager` extraction by correcting the attribute check on the request from `_app` to `app` ([#26](https://github.com/RUSTxPY/BustAPI/issues/26)).
+- **Template Directory Handling**: Resolved duplicated fallback logic for template directories in `core/helpers.py` by streamlining the lookup against `current_app.template_folder` ([#25](https://github.com/RUSTxPY/BustAPI/issues/25)).
+
 ## [0.13.5] - 2026-06-04
 
 ### Added

{bustapi-0.13.5 → bustapi-0.13.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "bustapi"
-version = "0.13.5"
+version = "0.13.8"
 description = "High-performance Python web framework with Rust backend"
 authors = [
     {name = "GrandpaEJ", email = ""}

{bustapi-0.13.5 → bustapi-0.13.8}/python/bustapi/__init__.py

@@ -22,7 +22,7 @@ import platform
 import sys
 from http import HTTPStatus
 
-__version__ = "0.13.5"
+__version__ = "0.13.8"
 __author__ = "BustAPI"  # with GrandpaEJ
 __email__ = ""
 

{bustapi-0.13.5 → bustapi-0.13.8}/python/bustapi/auth/decorators.py

@@ -89,25 +89,17 @@ def fresh_login_required(fn: Callable) -> Callable:
     return wrapper
 
 
-def roles_required(*roles: str) -> Callable:
+def roles_required(*roles: str, require_all: bool = False) -> Callable:
     """
     Require user to have specific role(s).
 
-    Usage:
-        @app.get("/admin")
-        @roles_required("admin")
-        def admin_panel():
-            ...
-
-        @app.get("/moderator")
-        @roles_required("admin", "moderator")
-        def mod_panel():
-            ...
+    Args:
+        roles: The roles to check.
+        require_all: If True, user must have ALL specified roles (AND). If False, ANY role is sufficient (OR).
     """
 
     def decorator(fn: Callable) -> Callable:
-        @wraps(fn)
-        def wrapper(*args, **kwargs):
+        def check_roles():
             from ..core.exceptions import abort
             from .login import current_user
 
@@ -123,10 +115,25 @@ def roles_required(*roles: str) -> Callable:
                 else:
                     user_roles = []
 
-            # Check if user has any required role
-            if not any(r in user_roles for r in roles):
-                abort(403, f"Role required: {', '.join(roles)}")
+            if require_all:
+                if not all(r in user_roles for r in roles):
+                    abort(403, f"Roles required: {', '.join(roles)}")
+            else:
+                if not any(r in user_roles for r in roles):
+                    abort(403, f"Role required: {', '.join(roles)}")
+
+        if inspect.iscoroutinefunction(fn):
 
+            @wraps(fn)
+            async def async_wrapper(*args, **kwargs):
+                check_roles()
+                return await fn(*args, **kwargs)
+
+            return async_wrapper
+
+        @wraps(fn)
+        def wrapper(*args, **kwargs):
+            check_roles()
             return fn(*args, **kwargs)
 
         return wrapper
@@ -134,20 +141,17 @@ def roles_required(*roles: str) -> Callable:
     return decorator
 
 
-def permission_required(*permissions: str) -> Callable:
+def permission_required(*permissions: str, require_all: bool = True) -> Callable:
     """
     Require user to have specific permission(s).
 
-    Usage:
-        @app.post("/delete")
-        @permission_required("delete_posts")
-        def delete_post():
-            ...
+    Args:
+        permissions: The permissions to check.
+        require_all: If True, user must have ALL permissions (AND). If False, ANY permission is sufficient (OR).
     """
 
     def decorator(fn: Callable) -> Callable:
-        @wraps(fn)
-        def wrapper(*args, **kwargs):
+        def check_permissions():
             from ..core.exceptions import abort
             from .login import current_user
 
@@ -159,11 +163,26 @@ def permission_required(*permissions: str) -> Callable:
             if callable(user_perms):
                 user_perms = user_perms()
 
-            # Check all required permissions
-            for perm in permissions:
-                if perm not in user_perms:
-                    abort(403, f"Permission required: {perm}")
+            if require_all:
+                for perm in permissions:
+                    if perm not in user_perms:
+                        abort(403, f"Permission required: {perm}")
+            else:
+                if not any(perm in user_perms for perm in permissions):
+                    abort(403, f"Permission required: {', '.join(permissions)}")
+
+        if inspect.iscoroutinefunction(fn):
 
+            @wraps(fn)
+            async def async_wrapper(*args, **kwargs):
+                check_permissions()
+                return await fn(*args, **kwargs)
+
+            return async_wrapper
+
+        @wraps(fn)
+        def wrapper(*args, **kwargs):
+            check_permissions()
             return fn(*args, **kwargs)
 
         return wrapper

{bustapi-0.13.5 → bustapi-0.13.8}/python/bustapi/auth/login.py

@@ -107,15 +107,25 @@ def login_user(user, remember: bool = False, fresh: bool = True) -> bool:
         return False
 
     # Get user ID
-    user_id = getattr(user, "get_id", lambda: None)()
+    # 1. Support custom conflict-free get_login_id() first
+    user_id = getattr(user, "get_login_id", lambda: None)()
+
+    # 2. Fallback to standard get_id()
     if user_id is None:
+        user_id = getattr(user, "get_id", lambda: None)()
+
+    # 3. Ensure string conversion (e.g., Peewee get_id() returns int)
+    if user_id is not None:
+        user_id = str(user_id)
+    else:
+        # 4. Final fallback to .id attribute
         try:
             user_id = str(user.id)
         except AttributeError:
             return False
 
     # Get login manager config
-    login_manager = getattr(request, "_app", None)
+    login_manager = getattr(request, "app", None)
     if login_manager:
         login_manager = getattr(login_manager, "login_manager", None)
 
@@ -153,7 +163,7 @@ def logout_user() -> bool:
         return False
 
     # Get login manager config
-    login_manager = getattr(request, "_app", None)
+    login_manager = getattr(request, "app", None)
     if login_manager:
         login_manager = getattr(login_manager, "login_manager", None)
 

{bustapi-0.13.5 → bustapi-0.13.8}/python/bustapi/core/helpers.py

@@ -307,9 +307,7 @@ def render_template(template_name: str, **context) -> Response:
         if template_dir is None:
             try:
                 current_app = _get_current_object()
-                template_dir = (
-                    getattr(current_app, "template_folder", None) or "templates"
-                )
+                template_dir = getattr(current_app, "template_folder", "templates")
             except RuntimeError:
                 # No app context, use default
                 template_dir = "templates"

bustapi-0.13.8/tests/test_discussion_28.py

@@ -0,0 +1,87 @@
+from dataclasses import dataclass
+from unittest.mock import patch
+
+import pytest
+from bustapi import BustAPI
+from bustapi.auth.decorators import permission_required, roles_required
+from bustapi.testing import BustTestClient
+
+app = BustAPI()
+app.secret_key = "test_secret"
+
+
+@dataclass
+class MockUser:
+    is_authenticated: bool = True
+    roles: list = None
+    permissions: list = None
+
+    def get_id(self):
+        return "123"
+
+
+# Setup routes
+@app.route("/sync-role-or")
+@roles_required("admin", "editor")
+def sync_role_or():
+    return "ok"
+
+
+@app.route("/sync-role-and")
+@roles_required("admin", "editor", require_all=True)
+def sync_role_and():
+    return "ok"
+
+
+@app.route("/async-perm-and")
+@permission_required("read", "write")
+async def async_perm_and():
+    return "ok"
+
+
+@app.route("/async-perm-or")
+@permission_required("read", "write", require_all=False)
+async def async_perm_or():
+    return "ok"
+
+
+def test_roles_or():
+    with patch("bustapi.auth.login.current_user", MockUser(roles=["editor"])):
+        with BustTestClient(app) as client:
+            assert client.get("/sync-role-or").status_code == 200
+
+    with patch("bustapi.auth.login.current_user", MockUser(roles=["user"])):
+        with BustTestClient(app) as client:
+            assert client.get("/sync-role-or").status_code == 403
+
+
+def test_roles_and():
+    with patch("bustapi.auth.login.current_user", MockUser(roles=["admin", "editor"])):
+        with BustTestClient(app) as client:
+            assert client.get("/sync-role-and").status_code == 200
+
+    with patch("bustapi.auth.login.current_user", MockUser(roles=["admin"])):
+        with BustTestClient(app) as client:
+            assert client.get("/sync-role-and").status_code == 403
+
+
+def test_perms_and():
+    with patch(
+        "bustapi.auth.login.current_user", MockUser(permissions=["read", "write"])
+    ):
+        with BustTestClient(app) as client:
+            assert client.get("/async-perm-and").status_code == 200
+
+    with patch("bustapi.auth.login.current_user", MockUser(permissions=["read"])):
+        with BustTestClient(app) as client:
+            assert client.get("/async-perm-and").status_code == 403
+
+
+def test_perms_or():
+    with patch("bustapi.auth.login.current_user", MockUser(permissions=["read"])):
+        with BustTestClient(app) as client:
+            assert client.get("/async-perm-or").status_code == 200
+
+    with patch("bustapi.auth.login.current_user", MockUser(permissions=["delete"])):
+        with BustTestClient(app) as client:
+            assert client.get("/async-perm-or").status_code == 403