fastapi-identity-model 0.2.0__tar.gz → 0.2.2__tar.gz

{fastapi_identity_model-0.2.0 → fastapi_identity_model-0.2.2}/.gitignore

@@ -135,6 +135,11 @@ dmypy.json
 # Allow test fixture env files (no secrets — local Docker only)
 !.env.node-oidc
 !.env.keycloak
+!.env.identityserver
+
+# Token characterization reports — generated by the integration suites,
+# uploaded as CI artifacts, never committed.
+token_characterization_*.md
 *.crt
 *.key
 *.pfx
@@ -158,6 +163,12 @@ conformance/results/hosted/rp-logs/
 .ralph/
 PROMPT.md
 
+# Load-report artifacts — written by the load-capacity / load-soak / load-smoke
+# runs, uploaded as CI artifacts, never committed.
+capacity-report.txt
+soak-report.txt
+load-smoke-report.txt
+
 # Terraform
 infra/**/.terraform/
 infra/**/*.tfstate*
@@ -170,3 +181,6 @@ infra/**/expired_token.txt
 mutants/
 mutmut-stats.json
 .mutmut-cache
+
+# moon build cache — never commit (tracked cache poisons affected-detection)
+.moon/cache/

{fastapi_identity_model-0.2.0 → fastapi_identity_model-0.2.2}/CHANGELOG.md

@@ -8,12 +8,29 @@ inserted below the marker.
 
 <!-- psr: next release -->
 
+## v0.2.2 (2026-08-22)
+
+### Bug Fixes
+
+- **fastapi**: Return 503 (not 401) when the OIDC provider is unreachable
+  ([`26f425d`](https://github.com/jamescrowley321/identity-model/commit/26f425d61ea5e21a365d9e71fbdac0292224d5b5))
+
+
+## v0.2.1 (2026-08-10)
+
+### Bug Fixes
+
+- **fastapi**: Uniform 401 body across validation failures (F-18, CWE-209)
+  ([#508](https://github.com/jamescrowley321/identity-model/pull/508),
+  [`d4e8aed`](https://github.com/jamescrowley321/identity-model/commit/d4e8aedcd9e2622aab9139ae5f6b09e2e2c1eaf0))
+
+
 ## v0.2.0 (2026-08-09)
 
 ### Features
 
 - **fastapi**: Opt-in access-token-marker enforcement (F-07)
-  ([`4e0eb10`](https://github.com/jamescrowley321/py-identity-model/commit/4e0eb10aea9c6451614b5b6cfaa4b2c410f3496b))
+  ([`4e0eb10`](https://github.com/jamescrowley321/identity-model/commit/4e0eb10aea9c6451614b5b6cfaa4b2c410f3496b))
 
 
 ## 0.1.0 (2026-07-08)

{fastapi_identity_model-0.2.0 → fastapi_identity_model-0.2.2}/PKG-INFO

@@ -1,10 +1,10 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: fastapi-identity-model
-Version: 0.2.0
+Version: 0.2.2
 Summary: FastAPI OIDC/OAuth2 middleware and relying-party router, built on py-identity-model
-Project-URL: Homepage, https://github.com/jamescrowley321/py-identity-model
-Project-URL: Repository, https://github.com/jamescrowley321/py-identity-model
-Project-URL: Issues, https://github.com/jamescrowley321/py-identity-model/issues
+Project-URL: Homepage, https://github.com/jamescrowley321/identity-model
+Project-URL: Repository, https://github.com/jamescrowley321/identity-model
+Project-URL: Issues, https://github.com/jamescrowley321/identity-model/issues
 Author-email: jamescrowley321 <jamescrowley151@gmail.com>
 License-Expression: Apache-2.0
 Keywords: authentication,fastapi,jwt,middleware,oauth2,oidc,openid-connect

{fastapi_identity_model-0.2.0 → fastapi_identity_model-0.2.2}/fastapi_identity_model/middleware.py

@@ -50,6 +50,33 @@ _ID_TOKEN_ONLY_CLAIMS = ("nonce", "at_hash", "c_hash")
 # a client_credentials token minted with no scopes) legitimately carry neither.
 _DEFAULT_ACCESS_TOKEN_MARKER_CLAIMS = ("scope", "scp")
 
+# F-18 (CWE-209): every token-validation failure returns this single generic 401
+# body so the response cannot be used as an oracle to distinguish the rejection
+# cause (invalid signature vs wrong audience vs expired). The specific cause is
+# logged server-side for operators, never returned to the caller.
+_GENERIC_401_DETAIL = "Invalid or unauthorized token"
+
+# Stable message prefixes the core library uses for discovery/JWKS *fetch*
+# failures (py_identity_model.core.error_handlers). The core wraps a failed
+# fetch in an unsuccessful response, so validate_token surfaces it as a
+# TokenValidationException — NOT a NetworkException — which would otherwise be
+# reported as a 401 "invalid token" for what is really a transient provider
+# outage. We match these prefixes to map such failures to 503 instead, so
+# callers back off and 5xx monitoring fires. This is a pragmatic bridge: the
+# clean fix is in py-identity-model (raise a NetworkException subtype from
+# validate_disco_response / validate_jwks_response), after which the
+# `except NetworkException` branch below handles it directly.
+_UPSTREAM_FETCH_FAILURE_PREFIXES = (
+    "Network error during discovery",
+    "Network error during JWKS",
+)
+
+
+def _is_upstream_fetch_failure(exc: Exception) -> bool:
+    """Whether a library exception is a transient upstream fetch failure."""
+    message = str(exc)
+    return any(message.startswith(p) for p in _UPSTREAM_FETCH_FAILURE_PREFIXES)
+
 
 class TokenValidationMiddleware(BaseHTTPMiddleware):
     """
@@ -207,21 +234,33 @@ class TokenValidationMiddleware(BaseHTTPMiddleware):
             request.state.claims = claims
             request.state.token = token
             return None
-        except NetworkException:
-            # Discovery/JWKS/network fetch failure is a transient server fault,
-            # not an authentication decision — surface 5xx so callers retry
-            # instead of treating a provider outage as a bad token.
-            logger.exception("Network error during token validation")
-            return JSONResponse(
-                status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
-                content={"detail": "Authentication temporarily unavailable"},
-            )
         except PyIdentityModelException as e:
-            return self._unauthorized(f"Token validation failed: {e!s}")
+            # A provider outage is a transient server fault, not an auth
+            # decision: surface 503 so callers retry instead of treating it as a
+            # bad token. This covers both a real NetworkException (a
+            # PyIdentityModelException subclass — the clean path if the core
+            # raises one) and a discovery/JWKS fetch failure the core currently
+            # surfaces as a TokenValidationException (_UPSTREAM_FETCH_FAILURE_
+            # PREFIXES). Checked here rather than a separate `except
+            # NetworkException` block so both share one 503 path.
+            if isinstance(e, NetworkException) or _is_upstream_fetch_failure(e):
+                logger.exception("Upstream fetch failure during token validation")
+                return JSONResponse(
+                    status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+                    content={"detail": "Authentication temporarily unavailable"},
+                )
+            # Uniform 401 body — do NOT echo the stage-specific cause
+            # (signature/audience/expiry), which would form a CWE-209 oracle
+            # (F-18). Log the real cause server-side for operators.
+            logger.info("Token rejected during validation: %s", e)
+            return self._unauthorized(_GENERIC_401_DETAIL)
         except InvalidTokenError as e:
             # A malformed/undecodable token (e.g. raw pyjwt DecodeError from
-            # header parsing during key lookup) is a client error, not a 500.
-            return self._unauthorized(f"Invalid token: {e!s}")
+            # header parsing during key lookup) is a client error, not a 500 —
+            # and returns the same generic body as any other rejection so the
+            # response can't distinguish "malformed" from "invalid".
+            logger.info("Malformed token rejected: %s", e)
+            return self._unauthorized(_GENERIC_401_DETAIL)
         except Exception:
             # A genuinely unexpected (non-library) failure is a server fault,
             # not an auth decision. Surface a 500 without leaking internals.

{fastapi_identity_model-0.2.0 → fastapi_identity_model-0.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fastapi-identity-model"
-version = "0.2.0"
+version = "0.2.2"
 description = "FastAPI OIDC/OAuth2 middleware and relying-party router, built on py-identity-model"
 authors = [{ name = "jamescrowley321", email = "jamescrowley151@gmail.com" }]
 requires-python = ">=3.12"
@@ -42,9 +42,9 @@ dependencies = [
 server = ["uvicorn[standard]>=0.23.0"]
 
 [project.urls]
-Homepage = "https://github.com/jamescrowley321/py-identity-model"
-Repository = "https://github.com/jamescrowley321/py-identity-model"
-Issues = "https://github.com/jamescrowley321/py-identity-model/issues"
+Homepage = "https://github.com/jamescrowley321/identity-model"
+Repository = "https://github.com/jamescrowley321/identity-model"
+Issues = "https://github.com/jamescrowley321/identity-model/issues"
 
 [tool.uv.sources]
 py-identity-model = { workspace = true }
@@ -57,12 +57,13 @@ requires = ["hatchling"]
 build-backend = "hatchling.build"
 
 # ── Release automation (python-semantic-release) ──────────────────────
-# Invoked from the REPO ROOT via
-#   semantic-release -c packages/fastapi-identity-model/pyproject.toml version
+# Invoked from py/ (CONS-2.1) via
+#   cd py && semantic-release -c packages/fastapi-identity-model/pyproject.toml version
 # (release.yml, after the root release job) — all paths below are
-# repo-root-relative. Only commits scoped "(fastapi)" drive this version;
-# every other commit belongs to the root py-identity-model pipeline.
-# See tools/release_parsers.py for the scope routing.
+# py/-relative (semantic-release resolves commit_parser + version_toml relative
+# to the CWD, not to this config file's directory). Only commits scoped
+# "(fastapi)" drive this version; every other commit belongs to the root
+# py-identity-model pipeline. See tools/release_parsers.py for the scope routing.
 [tool.semantic_release]
 commit_parser = "tools/release_parsers.py:FastapiCommitParser"
 tag_format = "fastapi-identity-model-v{version}"

{fastapi_identity_model-0.2.0 → fastapi_identity_model-0.2.2}/tests/test_middleware.py

@@ -74,7 +74,8 @@ async def test_invalid_token_returns_401(monkeypatch):
     async with _client(_app(monkeypatch, validate)) as client:
         resp = await client.get("/me", headers={"Authorization": "Bearer bad"})
     assert resp.status_code == 401
-    assert "Token validation failed" in resp.json()["detail"]
+    # F-18: uniform, non-oracular 401 body (does not echo the validation cause).
+    assert resp.json()["detail"] == mw._GENERIC_401_DETAIL
 
 
 async def test_unexpected_error_returns_500(monkeypatch):
@@ -85,13 +86,43 @@ async def test_unexpected_error_returns_500(monkeypatch):
     assert resp.json()["detail"] == "Internal server error during authentication"
 
 
-async def test_network_error_returns_503(monkeypatch):
+async def test_network_exception_returns_503(monkeypatch):
+    # The `except NetworkException` branch: if the core raises a NetworkException
+    # subtype, a provider outage is a 503.
     validate = AsyncMock(side_effect=DiscoveryException("provider unreachable"))
     async with _client(_app(monkeypatch, validate)) as client:
         resp = await client.get("/me", headers={"Authorization": "Bearer x"})
     assert resp.status_code == 503
 
 
+async def test_upstream_fetch_failure_returns_503(monkeypatch):
+    # The real path: a discovery/JWKS fetch failure surfaces from the core as a
+    # TokenValidationException carrying the "Network error during ..." message
+    # (NOT a NetworkException), so the middleware must still map it to 503 — a
+    # transient provider outage, not an "invalid token". (The prior test mocked
+    # DiscoveryException, which the real disco/JWKS path never raises, so this
+    # 401->503 gap went uncaught.)
+    validate = AsyncMock(
+        side_effect=TokenValidationException(
+            "Network error during discovery document request: connection refused"
+        )
+    )
+    async with _client(_app(monkeypatch, validate)) as client:
+        resp = await client.get("/me", headers={"Authorization": "Bearer x"})
+    assert resp.status_code == 503
+    assert resp.json()["detail"] == "Authentication temporarily unavailable"
+
+
+async def test_generic_validation_failure_still_returns_401(monkeypatch):
+    # The 503 mapping must be narrow: a genuinely invalid token (a non-network
+    # TokenValidationException) stays a 401.
+    validate = AsyncMock(side_effect=TokenValidationException("Invalid signature"))
+    async with _client(_app(monkeypatch, validate)) as client:
+        resp = await client.get("/me", headers={"Authorization": "Bearer x"})
+    assert resp.status_code == 401
+    assert resp.json()["detail"] == mw._GENERIC_401_DETAIL
+
+
 async def test_malformed_token_returns_401_not_500(monkeypatch):
     # A non-JWT ("invalid-token-123") makes the library's header parsing raise
     # a raw pyjwt DecodeError before validation wraps it; that is a client
@@ -100,7 +131,8 @@ async def test_malformed_token_returns_401_not_500(monkeypatch):
     async with _client(_app(monkeypatch, validate)) as client:
         resp = await client.get("/me", headers={"Authorization": "Bearer invalid"})
     assert resp.status_code == 401
-    assert "Invalid token" in resp.json()["detail"]
+    # F-18: malformed tokens return the same uniform body as any other rejection.
+    assert resp.json()["detail"] == mw._GENERIC_401_DETAIL
 
 
 async def test_id_token_rejected_as_access_token(monkeypatch):

{fastapi_identity_model-0.2.0 → fastapi_identity_model-0.2.2}/tests/test_security_error_oracle.py

@@ -54,11 +54,6 @@ def _client(app: FastAPI) -> httpx.AsyncClient:
     )
 
 
-@pytest.mark.xfail(
-    strict=True,
-    reason="F-18: 401 body echoes the stage-specific validation error, forming a "
-    "token-validation oracle (CWE-209)",
-)
 async def test_401_body_is_uniform_across_failure_stages(monkeypatch):
     # Three different validation failures, each a PyIdentityModelException.
     failures = [