csrd-utils 0.3.92__tar.gz → 0.3.95__tar.gz

{csrd_utils-0.3.92 → csrd_utils-0.3.95}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: csrd-utils
-Version: 0.3.92
+Version: 0.3.95
 Summary: CLI utilities for csrd service generation and feature augmentation
 Project-URL: Repository, https://github.com/csrd-api/fastapi-common
 Project-URL: Documentation, https://github.com/csrd-api/fastapi-common/tree/main/packages/utils

{csrd_utils-0.3.92 → csrd_utils-0.3.95}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "csrd-utils"
-version = "0.3.92"
+version = "0.3.95"
 description = "CLI utilities for csrd service generation and feature augmentation"
 license = { text = "MIT" }
 requires-python = ">=3.12"

{csrd_utils-0.3.92 → csrd_utils-0.3.95}/src/csrd_utils/v2/AGENTS.md

@@ -123,12 +123,12 @@ User edits to scaffolded files are never overwritten on re-render.
   .gitignore                     ← rendered from spec
   .csrd-workspace                ← marker file
   Dockerfile.<service-name>      ← one per service, at root
-  src/<service-name>/            ← service source (kebab-case dir)
+  src/<service_snake>/           ← service source (snake_case dir)
   tests/unit/<service_snake>/    ← unit tests (snake_case dir)
   tests/acceptance/<service_snake>/  ← acceptance stubs (snake_case dir)
 ```
 
-- Service source dirs use **kebab-case** (matching `service.name`).
+- Service source dirs use **snake_case** (valid Python package names).
 - Test dirs use **snake_case** (valid Python package names).
 - Dockerfiles use kebab-case service name for the suffix, snake_case for the Python module reference in CMD.
 
@@ -345,5 +345,5 @@ When asked to "audit the menus or compose system", verify each of the following:
 20. `operations.py` functions load → mutate → save spec — no rendering.
 21. Workspace finalization uses `_finalize_workspace` — no duplicated create/add/render sequences in handlers.
 22. `detect_configured_db` is defined once in `infra.py` — not duplicated.
-23. Test dirs use snake_case, source dirs use kebab-case, Dockerfiles use kebab-case suffix.
+23. Test dirs use snake_case, source dirs use snake_case, Dockerfiles use kebab-case suffix.
 24. No shim modules or alias re-export files exist (pre-1.0 refactor policy).

{csrd_utils-0.3.92 → csrd_utils-0.3.95}/src/csrd_utils/v2/compose/augments.py

@@ -131,6 +131,15 @@ AUGMENT_REGISTRY: dict[str, AugmentDescriptor] = {
         template_dir="jwt-auth-consumer",
         # compose_env, compose_depends_on, settings_fields resolved from spec
     ),
+    "auth-passthrough": AugmentDescriptor(
+        name="auth-passthrough",
+        scope="service",
+        description="Unguarded signup/login proxy endpoints to the auth service",
+        requires_workspace_augment="jwt-auth-provider",
+        packages=["csrd-delegate", "csrd-models"],
+        template_dir="auth-passthrough",
+        # compose_env, compose_depends_on, settings_fields resolved from spec
+    ),
     "context-logging": AugmentDescriptor(
         name="context-logging",
         scope="service",

{csrd_utils-0.3.92 → csrd_utils-0.3.95}/src/csrd_utils/v2/compose/renderer.py

@@ -103,6 +103,18 @@ def _wire_augment(
             env["AUTH_JWKS_URL"] = f"http://{auth_svc.name}:{auth_svc.port}/.well-known/jwks.json"
             deps[auth_svc.name] = {"condition": "service_started"}
 
+    # ── Dynamic: auth-passthrough ────────────────────────────────────
+    #
+    # Resolve the auth service URL for signup/login proxy endpoints.
+    if augment.name == "auth-passthrough":
+        auth_svc = next(
+            (s for s in spec.services if s.role == "auth"),
+            None,
+        )
+        if auth_svc is not None and auth_svc.name != svc.name:
+            env["AUTH_SERVICE_URL"] = f"http://{auth_svc.name}:{auth_svc.port}"
+            deps[auth_svc.name] = {"condition": "service_started"}
+
     # ── Dynamic: delegate-config ────────────────────────────────────
     #
     # Resolve target service URLs from the spec and inject per-target
@@ -258,7 +270,7 @@ def _render_env_example(spec: ComposeSpec) -> str:
 
         lines.append("# JWT Authentication")
         lines.append("JWT_ISSUER=csrd-auth")
-        lines.append("JWT_AUDIENCE=csrd-services")
+        lines.append(f"JWT_AUDIENCE={spec.workspace.name}")
         lines.append("JWT_TTL_SECONDS=3600")
 
         if signing == "shared-secret":
@@ -310,7 +322,7 @@ def _render_gitignore() -> str:
 def _render_pyproject(spec: ComposeSpec) -> str:
     """Build a workspace-level ``pyproject.toml`` with pytest config."""
 
-    service_src_paths = [f"src/{svc.name}" for svc in spec.services]
+    service_src_paths = [f"src/{svc.name.replace('-', '_')}" for svc in spec.services]
 
     lines = [
         "[project]",
@@ -384,7 +396,7 @@ def render_workspace(output_dir: Path, *, git_init: bool = False) -> Path:
     # These are deterministic outputs of the spec — like docker-compose.yml.
     # User customization goes in scaffolded files (views, repositories, etc).
     for svc in spec.services:
-        svc_dir = output_dir / "src" / svc.name
+        svc_dir = output_dir / "src" / svc.name.replace("-", "_")
         if not svc_dir.exists():
             continue
         svc_dir.mkdir(parents=True, exist_ok=True)

{csrd_utils-0.3.92 → csrd_utils-0.3.95}/src/csrd_utils/v2/compose/scaffolder.py

@@ -3,7 +3,7 @@
 Workspace layout contract::
 
     <ws-root>/
-      src/<service-name>/              ← service source (views, settings, __init__)
+      src/<service_name_snake>/        ← service source (views, settings, __init__)
       tests/unit/<service_name_snake>/ ← unit tests (snake_case)
       tests/acceptance/<service_name_snake>/  ← acceptance test stub
       Dockerfile.<service-name>        ← per-service Dockerfile
@@ -33,15 +33,14 @@ _AUGMENT_TEMPLATE_DIR = Path(__file__).resolve().parent.parent / "templates" / "
 def scaffold_service(service: ServiceNode, workspace_root: Path) -> None:
     """Scaffold a single service into the workspace layout.
 
-    Skips silently if ``src/<service.name>/`` already exists (idempotent).
+    Skips silently if ``src/<service_name_snake>/`` already exists (idempotent).
     """
 
-    src_dest = workspace_root / "src" / service.name
+    service_name_snake = service.name.replace("-", "_")
+    src_dest = workspace_root / "src" / service_name_snake
     if src_dest.exists():
         return
 
-    service_name_snake = service.name.replace("-", "_")
-
     with tempfile.TemporaryDirectory() as tmp:
         tmp_path = Path(tmp)
 
@@ -190,6 +189,16 @@ def _augment_template_vars(
             variables["auth_service_name"] = auth_svc.name
             variables["auth_service_port"] = str(auth_svc.port)
 
+    # Dynamic: auth-passthrough — resolve auth service URL
+    if augment.name == "auth-passthrough":
+        auth_svc = next(
+            (s for s in spec.services if s.role == "auth"),
+            None,
+        )
+        if auth_svc is not None:
+            variables["auth_service_name"] = auth_svc.name
+            variables["auth_service_port"] = str(auth_svc.port)
+
     # Dynamic: delegate-config — resolve targets
     if augment.name == "delegate-config":
         targets = augment.options.get("targets", [])
@@ -235,7 +244,7 @@ def scaffold_augment(
         )
         return
 
-    svc_dest = workspace_root / "src" / service.name
+    svc_dest = workspace_root / "src" / service.name.replace("-", "_")
     if not svc_dest.exists():
         return
 
@@ -251,6 +260,10 @@ def scaffold_augment(
         relative = template_file.relative_to(template_dir)
         dest = svc_dest / relative
 
+        # Strip .template suffix so e.g. db.py.template → db.py
+        if dest.name.endswith(".template"):
+            dest = dest.with_name(dest.name.removesuffix(".template"))
+
         # Never overwrite existing files
         if dest.exists():
             continue

{csrd_utils-0.3.92 → csrd_utils-0.3.95}/src/csrd_utils/v2/compose/service_renderers.py

@@ -29,6 +29,7 @@ _BASE_PACKAGES: list[str] = [
     "fastapi>=0.115,<1",
     "uvicorn[standard]>=0.30,<1",
     "pydantic-settings>=2.6,<3",
+    "csrd-models>=0.3,<1",
     "csrd-versioning>=0.1.36,<1",
 ]
 
@@ -109,7 +110,7 @@ def _augment_settings_fields(
         if ws_aug.name == "jwt-auth-provider":
             ws_fields["jwt_algorithm"] = '"RS256"'
             ws_fields["jwt_issuer"] = '"csrd-auth"'
-            ws_fields["jwt_audience"] = '"csrd-services"'
+            ws_fields["jwt_audience"] = f'"{spec.workspace.name}"'
             ws_fields["jwt_ttl_seconds"] = "3600"
             ws_fields["jwt_key_size"] = "2048"
             ws_fields["jwt_key_rotation_interval"] = "86400"
@@ -152,7 +153,16 @@ def _augment_settings_fields(
                 )
             augment_fields["jwt_algorithm"] = '"RS256"'
             augment_fields["jwt_issuer"] = '"csrd-auth"'
-            augment_fields["jwt_audience"] = '"csrd-services"'
+            augment_fields["jwt_audience"] = f'"{spec.workspace.name}"'
+
+        # Dynamic: auth-passthrough
+        if augment.name == "auth-passthrough":
+            auth_svc = next(
+                (s for s in spec.services if s.role == "auth"),
+                None,
+            )
+            if auth_svc is not None:
+                augment_fields["auth_service_url"] = f'"http://{auth_svc.name}:{auth_svc.port}"'
 
         # Dynamic: delegate-config
         if augment.name == "delegate-config":
@@ -202,13 +212,10 @@ def render_settings(svc: ServiceNode, spec: ComposeSpec) -> str:
     augment_fields = _augment_settings_fields(svc, spec)
 
     lines = [
-        "from pydantic_settings import BaseSettings, SettingsConfigDict",
+        "from csrd.models import BaseSettings",
         "",
         "",
         "class Settings(BaseSettings):",
-        "    model_config = SettingsConfigDict("
-        'env_file=".env", env_file_encoding="utf-8", extra="ignore"'
-        ")",
         "",
         f'    app_name: str = "{svc.name}"',
         f"    port: int = {svc.port}",
@@ -281,6 +288,10 @@ def render_init(svc: ServiceNode, spec: ComposeSpec) -> str:
         imports.append("")
         imports.append("from csrd.context.middleware import RequestContextMiddleware")
 
+    if "auth-passthrough" in augment_names:
+        imports.append("")
+        imports.append("from .views.auth_passthrough_view import router as auth_passthrough_router")
+
     if "service-layer" in augment_names:
         imports.append("")
         imports.append("from csrd.service import service_exception_handler")
@@ -298,12 +309,17 @@ def render_init(svc: ServiceNode, spec: ComposeSpec) -> str:
         body.append("    unversioned_app.include_router(jwks_router)")
         body.append("")
 
+    if "auth-passthrough" in augment_names:
+        body.append("    unversioned_app.include_router(auth_passthrough_router)")
+        body.append("")
+
     body.extend(
         [
             "    app = compose_versioned_apps(",
             "        version_mapping={UNVERSIONED: unversioned_app},",
             "        config=VersionedAppComposeConfig(",
             f'            title="{svc.name}",',
+            '            app_state={"settings": settings},',
             "            api=VersionedApiConfig(",
             '                prefix="/",',
             "                include_actuator_endpoints=settings.include_actuator_endpoints,",

csrd_utils-0.3.95/src/csrd_utils/v2/templates/augments/auth-passthrough/delegates/auth_delegate.py

@@ -0,0 +1,35 @@
+"""Auth service delegate for signup and login.
+
+Proxies requests to the auth service's API endpoints.
+This file is scaffolded once and never overwritten.
+"""
+
+from csrd.delegate import BaseDelegate
+
+from ..models.auth_passthrough import TokenResponse, UserResponse
+
+
+class AuthDelegate(BaseDelegate):
+    """Delegate for the cluster auth service."""
+
+    def __init__(self, base_url: str) -> None:
+        super().__init__(base_url)
+
+    async def signup(self, username: str, password: str) -> UserResponse:
+        """Create a new user account via the auth service."""
+        return await self.post(
+            "/api/signup",
+            json={"username": username, "password": password},
+            response_model=UserResponse,
+        )
+
+    async def login(self, username: str, password: str) -> TokenResponse:
+        """Authenticate and obtain a JWT token via the auth service."""
+        return await self.post(
+            "/api/token",
+            json={"username": username, "password": password},
+            response_model=TokenResponse,
+        )
+
+
+__all__ = ("AuthDelegate",)

csrd_utils-0.3.95/src/csrd_utils/v2/templates/augments/auth-passthrough/dependencies/auth_passthrough.py

@@ -0,0 +1,21 @@
+"""FastAPI dependency for the auth passthrough delegate.
+
+This file is scaffolded once and never overwritten.
+"""
+
+from typing import Annotated
+
+from fastapi import Depends
+
+from ..delegates.auth_delegate import AuthDelegate
+from . import Settings
+
+
+def auth_delegate_factory(settings: Settings) -> AuthDelegate:
+    """Create an ``AuthDelegate`` bound to the configured auth service URL."""
+    return AuthDelegate(settings.auth_service_url)
+
+
+AuthDelegateDep = Annotated[AuthDelegate, Depends(auth_delegate_factory)]
+
+__all__ = ("AuthDelegateDep", "auth_delegate_factory")

csrd_utils-0.3.95/src/csrd_utils/v2/templates/augments/auth-passthrough/models/auth_passthrough.py

@@ -0,0 +1,32 @@
+"""Auth passthrough request/response models."""
+
+from csrd.models import BaseModel
+
+
+class SignupRequest(BaseModel):
+    """Signup request body."""
+
+    username: str
+    password: str
+
+
+class LoginRequest(BaseModel):
+    """Login request body."""
+
+    username: str
+    password: str
+
+
+class TokenResponse(BaseModel):
+    """Token response from the auth service."""
+
+    access_token: str
+    token_type: str = "bearer"
+    expires_in: int
+
+
+class UserResponse(BaseModel):
+    """User response from the auth service."""
+
+    id: str
+    username: str

csrd_utils-0.3.95/src/csrd_utils/v2/templates/augments/auth-passthrough/views/auth_passthrough_view.py

@@ -0,0 +1,25 @@
+"""Auth passthrough endpoints — unguarded signup and login.
+
+Proxies signup and login requests to the cluster auth service.
+No authentication required on these endpoints.
+This file is scaffolded once and never overwritten.
+"""
+
+from fastapi import APIRouter
+
+from ..dependencies.auth_passthrough import AuthDelegateDep
+from ..models.auth_passthrough import LoginRequest, SignupRequest, TokenResponse, UserResponse
+
+router = APIRouter(prefix="/api/auth", tags=["Auth"])
+
+
+@router.post("/signup", status_code=201, response_model=UserResponse)
+async def signup(body: SignupRequest, delegate: AuthDelegateDep) -> UserResponse:
+    """Create a new user account via the auth service."""
+    return await delegate.signup(body.username, body.password)
+
+
+@router.post("/login", response_model=TokenResponse)
+async def login(body: LoginRequest, delegate: AuthDelegateDep) -> TokenResponse:
+    """Authenticate and obtain a JWT token via the auth service."""
+    return await delegate.login(body.username, body.password)

csrd_utils-0.3.92/src/csrd_utils/v2/templates/augments/db-config/dependencies/db.py → csrd_utils-0.3.95/src/csrd_utils/v2/templates/augments/db-config/dependencies/db.py.template

@@ -1,15 +1,19 @@
-"""Database adapter factory for $service_name.
+"""Database adapter dependency for $service_name.
 
 This file is scaffolded once and never overwritten. Customize the
 adapter type, DSN construction, or add connection pooling here.
 """
 
+from typing import Annotated
+
+from fastapi import Depends
+
 $db_adapter_import
 
-from ..settings import settings
+from . import Settings
 
 
-def create_adapter() -> $db_adapter_class:
+def _create_adapter(settings: Settings) -> $db_adapter_class:
     """Create the database adapter for this service.
 
     Override this to switch adapter types (PGAdapter, MariaAdapter)
@@ -18,4 +22,6 @@ def create_adapter() -> $db_adapter_class:
     return $db_adapter_constructor
 
 
-__all__ = ("create_adapter",)
+Adapter = Annotated[$db_adapter_class, Depends(_create_adapter)]
+
+__all__ = ("Adapter",)

csrd_utils-0.3.92/src/csrd_utils/v2/templates/augments/jwt-auth-consumer/dependencies/auth.py → csrd_utils-0.3.95/src/csrd_utils/v2/templates/augments/jwt-auth-consumer/dependencies/auth.py.template

@@ -13,6 +13,11 @@ from ..settings import settings
 
 # Build the auth dependency — tokens are verified locally using
 # the public keys from the auth service's JWKS endpoint.
+#
+# Note: this is constructed at module level because FastAPI security
+# dependencies (Security / Depends) must be stable objects. The
+# settings singleton is appropriate here — auth config is fixed
+# for the lifetime of the process.
 auth_dep = create_jwt_bearer(
     key=JWKSKeyProvider(url=settings.auth_jwks_url),
     algorithms=[settings.jwt_algorithm],

csrd_utils-0.3.92/src/csrd_utils/v2/templates/augments/jwt-auth-provider/dependencies/db.py → csrd_utils-0.3.95/src/csrd_utils/v2/templates/augments/jwt-auth-provider/dependencies/db.py.template

@@ -5,12 +5,12 @@ This file is scaffolded once and never overwritten.
 
 $db_adapter_import
 
-from ..settings import settings
+from . import Settings
 
 _adapter: $db_adapter_class | None = None
 
 
-async def get_adapter() -> $db_adapter_class:
+async def get_adapter(settings: Settings) -> $db_adapter_class:
     """Get or create the database adapter (singleton per process)."""
     global _adapter
     if _adapter is None:

csrd_utils-0.3.95/src/csrd_utils/v2/templates/augments/jwt-auth-provider/models/auth.py

@@ -0,0 +1,39 @@
+"""Token issuance and verification models."""
+
+from csrd.models import BaseModel
+
+
+class TokenRequest(BaseModel):
+    username: str
+    password: str
+
+
+class TokenResponse(BaseModel):
+    """JWT token issuance response."""
+
+    access_token: str
+    token_type: str = "bearer"
+    expires_in: int
+
+
+class VerifyRequest(BaseModel):
+    token: str
+
+
+class VerifyClaims(BaseModel):
+    """JWT claim fields returned by the verify endpoint."""
+
+    sub: str
+    user_name: str
+    authorities: list[str]
+    iat: int
+    exp: int
+    iss: str
+    aud: str
+
+
+class VerifyResponse(BaseModel):
+    """Token verification response."""
+
+    active: bool
+    claims: VerifyClaims

csrd_utils-0.3.95/src/csrd_utils/v2/templates/augments/jwt-auth-provider/models/jwks.py

@@ -0,0 +1,11 @@
+"""JWKS response models."""
+
+from typing import Any
+
+from csrd.models import BaseModel
+
+
+class JWKSResponse(BaseModel):
+    """JSON Web Key Set response (RFC 7517)."""
+
+    keys: list[dict[str, Any]]

csrd_utils-0.3.95/src/csrd_utils/v2/templates/augments/jwt-auth-provider/models/users.py

@@ -0,0 +1,26 @@
+"""User management models."""
+
+from csrd.models import BaseModel
+
+
+class SignupRequest(BaseModel):
+    username: str
+    password: str
+
+
+class UserResponse(BaseModel):
+    """Basic user info returned after signup or lookup."""
+
+    id: str
+    username: str
+
+
+class UserRolesResponse(BaseModel):
+    """User with their assigned roles/authorities."""
+
+    user_id: str
+    roles: list[str]
+
+
+class RoleRequest(BaseModel):
+    role: str

{csrd_utils-0.3.92 → csrd_utils-0.3.95}/src/csrd_utils/v2/templates/augments/jwt-auth-provider/repositories/user_repository.py

@@ -7,85 +7,93 @@ This file is scaffolded once and never overwritten.
 import hashlib
 import secrets
 import uuid
-from typing import Any
 
+from fastapi import HTTPException
 
-class UserRepository:
-    """User, credential, and role storage backed by a database adapter."""
+from csrd.repository import BaseRepository
+
+from ..models.users import UserResponse, UserRolesResponse
 
-    def __init__(self, adapter: Any) -> None:
-        self._adapter = adapter
+
+class UserRepository(BaseRepository):
+    """User, credential, and role storage backed by a database adapter."""
 
     # ── User CRUD ────────────────────────────────────────────────────
 
-    async def create_user(self, username: str, password: str) -> dict:
+    async def create_user(self, username: str, password: str) -> UserResponse:
         """Create a new user with hashed credentials."""
         user_id = str(uuid.uuid4())
-        await self._adapter.execute(
+        await self.execute(
             "INSERT INTO users (id, username) VALUES (:id, :username)",
             {"id": user_id, "username": username},
         )
 
         password_hash = self._hash_password(password)
-        await self._adapter.execute(
+        await self.execute(
             "INSERT INTO user_credentials (user_id, password_hash) "
             "VALUES (:user_id, :password_hash)",
             {"user_id": user_id, "password_hash": password_hash},
         )
 
-        return {"id": user_id, "username": username}
+        return UserResponse(id=user_id, username=username)
 
-    async def get_user(self, user_id: str) -> dict | None:
-        """Get a user by ID."""
-        return await self._adapter.fetch_one(
-            "SELECT id, username, created_at FROM users WHERE id = :id",
+    async def get_user(self, user_id: str) -> UserResponse:
+        """Get a user by ID. Raises 404 if not found."""
+        return await self.require_one(
+            "SELECT id, username FROM users WHERE id = :id",
             {"id": user_id},
+            model=UserResponse,
+            detail="User not found",
         )
 
-    async def get_user_by_username(self, username: str) -> dict | None:
-        """Get a user by username."""
-        return await self._adapter.fetch_one(
-            "SELECT id, username, created_at FROM users WHERE username = :username",
+    async def get_user_by_username(self, username: str) -> UserResponse | None:
+        """Get a user by username, or ``None`` if not found."""
+        row = await self.fetch_one(
+            "SELECT id, username FROM users WHERE username = :username",
             {"username": username},
         )
+        if row is None:
+            return None
+        return self.apply_model(row, model=UserResponse)
 
     # ── Credential verification ──────────────────────────────────────
 
-    async def verify_credentials(self, username: str, password: str) -> dict | None:
-        """Verify username + password. Returns user dict or None."""
+    async def verify_credentials(self, username: str, password: str) -> UserResponse:
+        """Verify username + password. Raises 401 on failure."""
         user = await self.get_user_by_username(username)
         if user is None:
-            return None
+            raise HTTPException(status_code=401, detail="Invalid credentials")
 
-        cred = await self._adapter.fetch_one(
+        cred = await self.fetch_one(
             "SELECT password_hash FROM user_credentials WHERE user_id = :user_id",
-            {"user_id": user["id"]},
+            {"user_id": user.id},
         )
-        if cred is None:
-            return None
-
-        if not self._verify_password(password, cred["password_hash"]):
-            return None
+        if cred is None or not self._verify_password(password, cred["password_hash"]):
+            raise HTTPException(status_code=401, detail="Invalid credentials")
 
         return user
 
     # ── Role management ──────────────────────────────────────────────
 
-    async def get_roles(self, user_id: str) -> list[str]:
-        """Get all roles for a user."""
-        rows = await self._adapter.fetch_all(
+    async def get_user_roles(self, user_id: str) -> UserRolesResponse:
+        """Get all roles for a user. Raises 404 if user not found."""
+        await self.get_user(user_id)  # ensures user exists (raises 404)
+        rows = await self.fetch_all(
             "SELECT role FROM user_roles WHERE user_id = :user_id",
             {"user_id": user_id},
         )
-        return [row["role"] for row in rows]
+        roles = [row["role"] for row in rows]
+        return UserRolesResponse(user_id=user_id, roles=roles)
 
-    async def add_role(self, user_id: str, role: str) -> None:
-        """Add a role to a user. Idempotent."""
-        await self._adapter.execute(
+    async def add_role(self, user_id: str, role: str) -> UserRolesResponse:
+        """Add a role to a user. Idempotent. Returns updated roles."""
+        await self.get_user(user_id)  # ensures user exists (raises 404)
+        await self.execute(
             "INSERT OR IGNORE INTO user_roles (user_id, role) "
             "VALUES (:user_id, :role)",
             {"user_id": user_id, "role": role},
         )
+        return await self.get_user_roles(user_id)
 
     # ── Password hashing ─────────────────────────────────────────────
     #