bustapi 0.13.6__tar.gz → 0.13.8__tar.gz

{bustapi-0.13.6 → bustapi-0.13.8}/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to this project will be documented here.
 
+## [0.13.8] - 2026-06-11
+
+### Added
+- **Auth Decorators**: Added a `require_all` flag to `@roles_required` and `@permission_required` decorators, enabling explicit AND/OR logic for multi-role/permission checks.
+
+### Fixed
+- **Auth Async Support**: Fixed a critical bug where `@roles_required` and `@permission_required` decorators failed to support `async def` routes.
+
+## [0.13.7] - 2026-06-10
+
+### Fixed
+- **Login Manager ID Resolution**: Improved `login_user()` to gracefully handle non-string `get_id()` returns (e.g. integer IDs from Peewee ORM) and added support for a conflict-free `get_login_id()` method to prevent overriding built-in ORM properties.
+- **Version Sync**: Synchronized package version in `__init__.py` which was previously out of sync with the package configuration.
+
 ## [0.13.6] - 2026-06-08
 
 ### Fixed

{bustapi-0.13.6 → bustapi-0.13.8}/Cargo.lock

@@ -396,9 +396,9 @@ dependencies = [
 
 [[package]]
 name = "block-buffer"
-version = "0.12.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
 dependencies = [
  "hybrid-array",
 ]
@@ -432,7 +432,7 @@ checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
 [[package]]
 name = "bustapi_core"
-version = "0.13.6"
+version = "0.13.8"
 dependencies = [
  "actix-files",
  "actix-http",
@@ -779,7 +779,7 @@ version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
- "block-buffer 0.12.0",
+ "block-buffer 0.12.1",
  "const-oid",
  "crypto-common 0.2.2",
 ]

{bustapi-0.13.6 → bustapi-0.13.8}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "bustapi_core"
-version = "0.13.6"
+version = "0.13.8"
 edition = "2021"
 readme = "README.md"
 

{bustapi-0.13.6 → bustapi-0.13.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bustapi
-Version: 0.13.6
+Version: 0.13.8
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License

{bustapi-0.13.6 → bustapi-0.13.8}/docs/changelog.md

@@ -2,6 +2,20 @@
 
 All notable changes to this project will be documented here.
 
+## [0.13.8] - 2026-06-11
+
+### Added
+- **Auth Decorators**: Added a `require_all` flag to `@roles_required` and `@permission_required` decorators, enabling explicit AND/OR logic for multi-role/permission checks.
+
+### Fixed
+- **Auth Async Support**: Fixed a critical bug where `@roles_required` and `@permission_required` decorators failed to support `async def` routes.
+
+## [0.13.7] - 2026-06-10
+
+### Fixed
+- **Login Manager ID Resolution**: Improved `login_user()` to gracefully handle non-string `get_id()` returns (e.g. integer IDs from Peewee ORM) and added support for a conflict-free `get_login_id()` method to prevent overriding built-in ORM properties.
+- **Version Sync**: Synchronized package version in `__init__.py` which was previously out of sync with the package configuration.
+
 ## [0.13.6] - 2026-06-08
 
 ### Fixed

{bustapi-0.13.6 → bustapi-0.13.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "bustapi"
-version = "0.13.6"
+version = "0.13.8"
 description = "High-performance Python web framework with Rust backend"
 authors = [
     {name = "GrandpaEJ", email = ""}

{bustapi-0.13.6 → bustapi-0.13.8}/python/bustapi/__init__.py

@@ -22,7 +22,7 @@ import platform
 import sys
 from http import HTTPStatus
 
-__version__ = "0.13.5"
+__version__ = "0.13.8"
 __author__ = "BustAPI"  # with GrandpaEJ
 __email__ = ""
 

{bustapi-0.13.6 → bustapi-0.13.8}/python/bustapi/auth/decorators.py

@@ -89,25 +89,17 @@ def fresh_login_required(fn: Callable) -> Callable:
     return wrapper
 
 
-def roles_required(*roles: str) -> Callable:
+def roles_required(*roles: str, require_all: bool = False) -> Callable:
     """
     Require user to have specific role(s).
 
-    Usage:
-        @app.get("/admin")
-        @roles_required("admin")
-        def admin_panel():
-            ...
-
-        @app.get("/moderator")
-        @roles_required("admin", "moderator")
-        def mod_panel():
-            ...
+    Args:
+        roles: The roles to check.
+        require_all: If True, user must have ALL specified roles (AND). If False, ANY role is sufficient (OR).
     """
 
     def decorator(fn: Callable) -> Callable:
-        @wraps(fn)
-        def wrapper(*args, **kwargs):
+        def check_roles():
             from ..core.exceptions import abort
             from .login import current_user
 
@@ -123,10 +115,25 @@ def roles_required(*roles: str) -> Callable:
                 else:
                     user_roles = []
 
-            # Check if user has any required role
-            if not any(r in user_roles for r in roles):
-                abort(403, f"Role required: {', '.join(roles)}")
+            if require_all:
+                if not all(r in user_roles for r in roles):
+                    abort(403, f"Roles required: {', '.join(roles)}")
+            else:
+                if not any(r in user_roles for r in roles):
+                    abort(403, f"Role required: {', '.join(roles)}")
+
+        if inspect.iscoroutinefunction(fn):
 
+            @wraps(fn)
+            async def async_wrapper(*args, **kwargs):
+                check_roles()
+                return await fn(*args, **kwargs)
+
+            return async_wrapper
+
+        @wraps(fn)
+        def wrapper(*args, **kwargs):
+            check_roles()
             return fn(*args, **kwargs)
 
         return wrapper
@@ -134,20 +141,17 @@ def roles_required(*roles: str) -> Callable:
     return decorator
 
 
-def permission_required(*permissions: str) -> Callable:
+def permission_required(*permissions: str, require_all: bool = True) -> Callable:
     """
     Require user to have specific permission(s).
 
-    Usage:
-        @app.post("/delete")
-        @permission_required("delete_posts")
-        def delete_post():
-            ...
+    Args:
+        permissions: The permissions to check.
+        require_all: If True, user must have ALL permissions (AND). If False, ANY permission is sufficient (OR).
     """
 
     def decorator(fn: Callable) -> Callable:
-        @wraps(fn)
-        def wrapper(*args, **kwargs):
+        def check_permissions():
             from ..core.exceptions import abort
             from .login import current_user
 
@@ -159,11 +163,26 @@ def permission_required(*permissions: str) -> Callable:
             if callable(user_perms):
                 user_perms = user_perms()
 
-            # Check all required permissions
-            for perm in permissions:
-                if perm not in user_perms:
-                    abort(403, f"Permission required: {perm}")
+            if require_all:
+                for perm in permissions:
+                    if perm not in user_perms:
+                        abort(403, f"Permission required: {perm}")
+            else:
+                if not any(perm in user_perms for perm in permissions):
+                    abort(403, f"Permission required: {', '.join(permissions)}")
+
+        if inspect.iscoroutinefunction(fn):
 
+            @wraps(fn)
+            async def async_wrapper(*args, **kwargs):
+                check_permissions()
+                return await fn(*args, **kwargs)
+
+            return async_wrapper
+
+        @wraps(fn)
+        def wrapper(*args, **kwargs):
+            check_permissions()
             return fn(*args, **kwargs)
 
         return wrapper

{bustapi-0.13.6 → bustapi-0.13.8}/python/bustapi/auth/login.py

@@ -107,8 +107,18 @@ def login_user(user, remember: bool = False, fresh: bool = True) -> bool:
         return False
 
     # Get user ID
-    user_id = getattr(user, "get_id", lambda: None)()
+    # 1. Support custom conflict-free get_login_id() first
+    user_id = getattr(user, "get_login_id", lambda: None)()
+
+    # 2. Fallback to standard get_id()
     if user_id is None:
+        user_id = getattr(user, "get_id", lambda: None)()
+
+    # 3. Ensure string conversion (e.g., Peewee get_id() returns int)
+    if user_id is not None:
+        user_id = str(user_id)
+    else:
+        # 4. Final fallback to .id attribute
         try:
             user_id = str(user.id)
         except AttributeError:

bustapi-0.13.8/tests/test_discussion_28.py

@@ -0,0 +1,87 @@
+from dataclasses import dataclass
+from unittest.mock import patch
+
+import pytest
+from bustapi import BustAPI
+from bustapi.auth.decorators import permission_required, roles_required
+from bustapi.testing import BustTestClient
+
+app = BustAPI()
+app.secret_key = "test_secret"
+
+
+@dataclass
+class MockUser:
+    is_authenticated: bool = True
+    roles: list = None
+    permissions: list = None
+
+    def get_id(self):
+        return "123"
+
+
+# Setup routes
+@app.route("/sync-role-or")
+@roles_required("admin", "editor")
+def sync_role_or():
+    return "ok"
+
+
+@app.route("/sync-role-and")
+@roles_required("admin", "editor", require_all=True)
+def sync_role_and():
+    return "ok"
+
+
+@app.route("/async-perm-and")
+@permission_required("read", "write")
+async def async_perm_and():
+    return "ok"
+
+
+@app.route("/async-perm-or")
+@permission_required("read", "write", require_all=False)
+async def async_perm_or():
+    return "ok"
+
+
+def test_roles_or():
+    with patch("bustapi.auth.login.current_user", MockUser(roles=["editor"])):
+        with BustTestClient(app) as client:
+            assert client.get("/sync-role-or").status_code == 200
+
+    with patch("bustapi.auth.login.current_user", MockUser(roles=["user"])):
+        with BustTestClient(app) as client:
+            assert client.get("/sync-role-or").status_code == 403
+
+
+def test_roles_and():
+    with patch("bustapi.auth.login.current_user", MockUser(roles=["admin", "editor"])):
+        with BustTestClient(app) as client:
+            assert client.get("/sync-role-and").status_code == 200
+
+    with patch("bustapi.auth.login.current_user", MockUser(roles=["admin"])):
+        with BustTestClient(app) as client:
+            assert client.get("/sync-role-and").status_code == 403
+
+
+def test_perms_and():
+    with patch(
+        "bustapi.auth.login.current_user", MockUser(permissions=["read", "write"])
+    ):
+        with BustTestClient(app) as client:
+            assert client.get("/async-perm-and").status_code == 200
+
+    with patch("bustapi.auth.login.current_user", MockUser(permissions=["read"])):
+        with BustTestClient(app) as client:
+            assert client.get("/async-perm-and").status_code == 403
+
+
+def test_perms_or():
+    with patch("bustapi.auth.login.current_user", MockUser(permissions=["read"])):
+        with BustTestClient(app) as client:
+            assert client.get("/async-perm-or").status_code == 200
+
+    with patch("bustapi.auth.login.current_user", MockUser(permissions=["delete"])):
+        with BustTestClient(app) as client:
+            assert client.get("/async-perm-or").status_code == 403