fastapi-m8 3.2.0__tar.gz → 3.3.0__tar.gz

{fastapi_m8-3.2.0 → fastapi_m8-3.3.0}/.github/workflows/CI.yaml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: ["main"]
 
+permissions:
+  contents: read
+
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
@@ -13,10 +16,10 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.14"
           cache: "pip"
@@ -33,10 +36,10 @@ jobs:
   typecheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.14"
           cache: "pip"
@@ -50,10 +53,10 @@ jobs:
   security:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.14"
 
@@ -84,10 +87,10 @@ jobs:
         python-version: ["3.11", "3.12", "3.13", "3.14"]
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: ${{ matrix.python-version }}
           cache: "pip"
@@ -100,7 +103,7 @@ jobs:
 
       - name: Upload coverage to Codecov
         if: matrix.python-version == '3.11' && github.actor != 'dependabot[bot]'
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage.xml
@@ -112,3 +115,17 @@ jobs:
         with:
           project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
           coverage-reports: coverage.xml
+
+  secret-scan:
+    name: Secret scan (gitleaks)
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+
+      - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

{fastapi_m8-3.2.0 → fastapi_m8-3.3.0}/.github/workflows/PiPy.yml

@@ -12,9 +12,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.x"
 
@@ -52,8 +52,6 @@ jobs:
 
       - name: Publish release distributions to PyPI
         uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
-        with:
-          password: ${{ secrets.PYPI_API_TOKEN }}
 
   sbom:
     name: Generate & attach SBOM
@@ -65,16 +63,16 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.x"
 
       - name: Install package
         run: pip install -e ".[all]"
 
-      - uses: anchore/sbom-action@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0.18.0
+      - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
         with:
           artifact-name: fastapi-m8-${{ github.event.release.tag_name }}.sbom.spdx.json
           format: spdx-json

{fastapi_m8-3.2.0 → fastapi_m8-3.3.0}/CHANGELOG.md

@@ -5,6 +5,67 @@ Format: [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) · Versioning:
 
 ---
 
+## [Unreleased]
+
+---
+
+## [3.3.0] — 2026-07-02 · legacy consumer private-auth is development-only (item 11.2b) + supply-chain hardening (11.6/11.7/11.8)
+
+> **MINOR — security remediation, no public API removed.** The only runtime behaviour change
+> is a new fail-closed boot check: a production/strict consumer (`ENVIRONMENT=production` or
+> `STRICT_PRODUCTION_MODE=true`) that still runs legacy single-shared-secret private auth
+> (`INTROSPECTION_URL` set, `INTERNAL_CLIENT_ID` unset) now raises at settings construction.
+> Such a consumer already could not authenticate against a hardened `fa-auth-m8` issuer
+> (item 11.2a retired the shared-secret fallback), so this converts a latent deployment fault
+> into an explicit error rather than changing any working configuration. Local/development is
+> unaffected. `auth-sdk-m8` floor raised to `>=2.1.1,<3.0.0` (carries the SDK's latest
+> dependency/CI maintenance release; no new SDK API is required).
+
+### Security
+
+- **Legacy single-shared-secret private-auth mode is now development-only (OWASP remediation
+  item 11.2b).** `ConsumerServiceSettings` gained a `model_validator` that fails settings
+  construction when a production/strict consumer (`ENVIRONMENT=production` or
+  `STRICT_PRODUCTION_MODE=true`) has `INTROSPECTION_URL` configured but no
+  `INTERNAL_CLIENT_ID`. `fa-auth-m8` has retired the issuer's legacy single-shared-secret
+  private-API fallback (item 11.2a), so a production/strict consumer left in legacy
+  token-only mode is guaranteed to fail against a hardened issuer — this turns that latent
+  deployment fault into an explicit, fail-closed boot error. Legacy mode remains valid for
+  local/development.
+- **Coherent per-consumer private-auth group validation.** The same validator now rejects
+  (in every environment) `SERVICE_TOKEN_EXCHANGE_ENABLED=true` without `INTERNAL_CLIENT_ID`
+  (exchange has no identity to present and would silently downgrade to legacy) and
+  `INTERNAL_CLIENT_ID` set without `PRIVATE_API_SECRET` (per-consumer mode needs its
+  bootstrap secret). No validation message echoes a secret value.
+- **PyPI Trusted Publishing is now the sole publish mechanism (item 11.6).** The long-lived
+  `PYPI_API_TOKEN` secret was removed from `PiPy.yml`; the release job publishes via OIDC
+  (`id-token: write`) into a protected `pypi` environment. No API token is stored in the repo
+  or referenced by any workflow.
+- **CI policy tests (item 11.7).** New `tests/test_ci_policy.py` asserts the supply-chain
+  posture in CI: no `PYPI_API_TOKEN` reference, `id-token: write` present, the protected
+  `pypi` environment is used, the duplicate `ci.yml` is gone, the secret-scan job is present,
+  every action is SHA-pinned in both workflows, and key runtime packages are pinned in
+  `constraints-all.txt`.
+- **Locked dependency constraints (item 11.8).** `constraints.txt` and `constraints-all.txt`
+  are generated via `pip-compile` from public PyPI only (no custom index), giving CI a
+  reproducible, fully-pinned install closure.
+
+### Changed
+
+- CI workflows consolidated — the secret-scan job was absorbed into `CI.yaml` and the
+  duplicate `ci.yml` removed; dependabot SHA bumps for `checkout`, `setup-python`,
+  `sbom-action`, `codecov-action`, and `gitleaks-action` applied across both workflows.
+- `COMPAT_MATRIX` gains a `3.3` entry (`auth-sdk-m8 >=2.1.0,<3.0.0`, unchanged floor).
+
+### Docs
+
+- README *Per-consumer internal auth* section and the defaults-by-layer table now document
+  that legacy mode is development-only and fatal under production/strict; removed wording
+  that implied the issuer still offers a shared-secret fallback. Compatibility table updated
+  with the `3.1.0`–`3.3.0` rows.
+
+---
+
 ## [3.2.0] — 2026-06-28 · ungated `/health` constant liveness body (item 9.4 Design B)
 
 > **MINOR — additive, backward-compatible.** The only behaviour change is in the ungated

{fastapi_m8-3.2.0 → fastapi_m8-3.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-m8
-Version: 3.2.0
+Version: 3.3.0
 Summary: FastAPI application framework for m8 consumer microservices.
 Author-email: Eli Serra <e.serra173@gmail.com>
 License:                                  Apache License
@@ -216,7 +216,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Software Development :: Libraries
 Requires-Python: >=3.11
 Requires-Dist: anyio>=4.0
-Requires-Dist: auth-sdk-m8[config,events,fastapi,observability,security]<3.0.0,>=2.1.0
+Requires-Dist: auth-sdk-m8[config,events,fastapi,observability,security]<3.0.0,>=2.1.1
 Requires-Dist: fastapi>=0.136.3
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: packaging>=24.0
@@ -620,18 +620,27 @@ Required only when `TOKEN_MODE=stateful` and `AUTH_SERVICE_ROLE=consumer`.
 #### Per-consumer internal auth (item 9.1)
 
 By default a consumer authenticates private calls with the single shared
-`PRIVATE_API_SECRET` (legacy mode), which matches fa-auth's fallback when it has no
-`PRIVATE_API_CONSUMERS` registry. Set `INTERNAL_CLIENT_ID` to switch to the
-**per-consumer** model: `PRIVATE_API_SECRET` becomes this service's *bootstrap*
-secret, fa-auth authorizes each private route by the credential's granted scope
-(deny-by-default), and the blast radius collapses from the whole fleet to one
-consumer. Optionally exchange the bootstrap credential for short-TTL `Authorization:
-Bearer` service tokens so rotation comes for free from the token TTL. Selection is
-purely by config — the home lab keeps working untouched.
+`PRIVATE_API_SECRET` (legacy mode). **Legacy mode is development-only.** `fa-auth-m8`
+has retired the issuer's legacy single-shared-secret fallback — its
+`PRIVATE_API_CONSUMERS` registry is required in production/strict (item 11.2a) — so a
+production/strict consumer left in legacy mode is guaranteed to fail against a hardened
+issuer. Set `INTERNAL_CLIENT_ID` to switch to the **per-consumer** model:
+`PRIVATE_API_SECRET` becomes this service's *bootstrap* secret, fa-auth authorizes each
+private route by the credential's granted scope (deny-by-default), and the blast radius
+collapses from the whole fleet to one consumer. Optionally exchange the bootstrap
+credential for short-TTL `Authorization: Bearer` service tokens so rotation comes for
+free from the token TTL. Selection is purely by config — the home lab keeps working
+untouched.
+
+> **Fatal under production/strict (item 11.2b).** When `ENVIRONMENT=production` or
+> `STRICT_PRODUCTION_MODE=true`, settings validation fails at construction if
+> `INTROSPECTION_URL` is set but `INTERNAL_CLIENT_ID` is unset. Two coherence rules
+> apply in every environment: `SERVICE_TOKEN_EXCHANGE_ENABLED=true` requires
+> `INTERNAL_CLIENT_ID`, and setting `INTERNAL_CLIENT_ID` requires `PRIVATE_API_SECRET`.
 
 | Variable | Required | Default | Description |
 |---|---|---|---|
-| `INTERNAL_CLIENT_ID` | No | — | This consumer's `X-Internal-Client` id. Unset = legacy single-secret mode; set = per-consumer bootstrap mode. |
+| `INTERNAL_CLIENT_ID` | No (Yes in prod/strict when `INTROSPECTION_URL` is set) | — | This consumer's `X-Internal-Client` id. Unset = legacy single-secret mode (development-only; rejected under production/strict once `INTROSPECTION_URL` is set); set = per-consumer bootstrap mode. |
 | `SERVICE_TOKEN_EXCHANGE_ENABLED` | No | `false` | Exchange the bootstrap credential for short-TTL Bearer service tokens at `{issuer}/private/v1/service-token` (requires `INTERNAL_CLIENT_ID`). |
 | `SERVICE_TOKEN_SCOPES` | No | `["introspection"]` | Scopes requested when minting a service token; fa-auth narrows to the subset the bootstrap credential was granted. |
 | `SERVICE_TOKEN_REFRESH_LEEWAY_SECONDS` | No | `30` | Refresh a cached service token this many seconds before its `exp` so a call never races expiry. |
@@ -836,7 +845,7 @@ inherited from `auth-sdk-m8`, and made *fatal* only when pointed at production.
 | `EVENT_SIGNING_ENABLED` / `EVENT_SIGNING_ACCEPT_UNSIGNED` | inherited secure defaults (signing on, unsigned rejected); the gate fires through the consumer's auto-run config-health (item 7.x.1) | `ENABLED=false` under strict; `ACCEPT_UNSIGNED=true` under production or strict |
 | `METRICS_SCRAPE_CREDENTIAL` | unset = `/metrics` relies on network isolation only; set = constant-time `Authorization: Bearer` gate. **Must not equal `PRIVATE_API_SECRET`** (fatal reuse check at startup). | never fatal (network-isolation is a valid posture); reuse of `PRIVATE_API_SECRET` is fatal |
 | `HEALTH_DETAIL_CREDENTIAL` (items 9.3 + 9.4) | unset = `/health` returns a constant `{"status":"ok"}` to all callers (fail-closed liveness; real status never leaked); set = `X-Internal-Token` must match to receive the real aggregate status, per-check breakdown, and correct HTTP code. **Must not equal `PRIVATE_API_SECRET`** (fatal reuse check at startup). | never fatal (no credential = constant liveness response, which is a valid posture); reuse of `PRIVATE_API_SECRET` is fatal |
-| `INTERNAL_CLIENT_ID` (item 9.1) | unset = legacy single `PRIVATE_API_SECRET`; set = per-consumer bootstrap / service-token auth on private calls | never fatal (must be coordinated with the issuer's `PRIVATE_API_CONSUMERS`) |
+| `INTERNAL_CLIENT_ID` (items 9.1 + 11.2b) | unset = legacy single `PRIVATE_API_SECRET` (development-only); set = per-consumer bootstrap / service-token auth on private calls (must be coordinated with the issuer's `PRIVATE_API_CONSUMERS`) | **fatal** under production/strict when `INTROSPECTION_URL` is set but `INTERNAL_CLIENT_ID` is unset; also fatal (any env) when `SERVICE_TOKEN_EXCHANGE_ENABLED=true` without `INTERNAL_CLIENT_ID`, or `INTERNAL_CLIENT_ID` set without `PRIVATE_API_SECRET` |
 | `_FILE` secret mounts | **inherited** from `CommonSettings` — every secret (`PRIVATE_API_SECRET_FILE`, `DB_PASSWORD_FILE`, `METRICS_SCRAPE_CREDENTIAL_FILE`, `HEALTH_DETAIL_CREDENTIAL_FILE`, …) can be sourced from `/run/secrets/*` with no code change | a referenced `<FIELD>_FILE` path is missing (fails closed at construction) |
 
 ---
@@ -1413,6 +1422,9 @@ async def test_health(client):
 
 | `fastapi-m8` | `auth-sdk-m8` | Python |
 |---|---|---|
+| `3.3.0` | `>=2.1.1, <3.0.0` | 3.11, 3.12, 3.13, 3.14 |
+| `3.2.0` | `>=2.1.0, <3.0.0` | 3.11, 3.12, 3.13, 3.14 |
+| `3.1.0` | `>=2.1.0, <3.0.0` | 3.11, 3.12, 3.13, 3.14 |
 | `3.0.0` | `>=2.0.1, <3.0.0` | 3.11, 3.12, 3.13, 3.14 |
 | `2.1.0` | `>=1.5.0, <2.0.0` | 3.11, 3.12, 3.13 |
 | `2.0.0` | `>=1.4.0, <2.0.0` | 3.11, 3.12, 3.13 |

{fastapi_m8-3.2.0 → fastapi_m8-3.3.0}/README.md

@@ -364,18 +364,27 @@ Required only when `TOKEN_MODE=stateful` and `AUTH_SERVICE_ROLE=consumer`.
 #### Per-consumer internal auth (item 9.1)
 
 By default a consumer authenticates private calls with the single shared
-`PRIVATE_API_SECRET` (legacy mode), which matches fa-auth's fallback when it has no
-`PRIVATE_API_CONSUMERS` registry. Set `INTERNAL_CLIENT_ID` to switch to the
-**per-consumer** model: `PRIVATE_API_SECRET` becomes this service's *bootstrap*
-secret, fa-auth authorizes each private route by the credential's granted scope
-(deny-by-default), and the blast radius collapses from the whole fleet to one
-consumer. Optionally exchange the bootstrap credential for short-TTL `Authorization:
-Bearer` service tokens so rotation comes for free from the token TTL. Selection is
-purely by config — the home lab keeps working untouched.
+`PRIVATE_API_SECRET` (legacy mode). **Legacy mode is development-only.** `fa-auth-m8`
+has retired the issuer's legacy single-shared-secret fallback — its
+`PRIVATE_API_CONSUMERS` registry is required in production/strict (item 11.2a) — so a
+production/strict consumer left in legacy mode is guaranteed to fail against a hardened
+issuer. Set `INTERNAL_CLIENT_ID` to switch to the **per-consumer** model:
+`PRIVATE_API_SECRET` becomes this service's *bootstrap* secret, fa-auth authorizes each
+private route by the credential's granted scope (deny-by-default), and the blast radius
+collapses from the whole fleet to one consumer. Optionally exchange the bootstrap
+credential for short-TTL `Authorization: Bearer` service tokens so rotation comes for
+free from the token TTL. Selection is purely by config — the home lab keeps working
+untouched.
+
+> **Fatal under production/strict (item 11.2b).** When `ENVIRONMENT=production` or
+> `STRICT_PRODUCTION_MODE=true`, settings validation fails at construction if
+> `INTROSPECTION_URL` is set but `INTERNAL_CLIENT_ID` is unset. Two coherence rules
+> apply in every environment: `SERVICE_TOKEN_EXCHANGE_ENABLED=true` requires
+> `INTERNAL_CLIENT_ID`, and setting `INTERNAL_CLIENT_ID` requires `PRIVATE_API_SECRET`.
 
 | Variable | Required | Default | Description |
 |---|---|---|---|
-| `INTERNAL_CLIENT_ID` | No | — | This consumer's `X-Internal-Client` id. Unset = legacy single-secret mode; set = per-consumer bootstrap mode. |
+| `INTERNAL_CLIENT_ID` | No (Yes in prod/strict when `INTROSPECTION_URL` is set) | — | This consumer's `X-Internal-Client` id. Unset = legacy single-secret mode (development-only; rejected under production/strict once `INTROSPECTION_URL` is set); set = per-consumer bootstrap mode. |
 | `SERVICE_TOKEN_EXCHANGE_ENABLED` | No | `false` | Exchange the bootstrap credential for short-TTL Bearer service tokens at `{issuer}/private/v1/service-token` (requires `INTERNAL_CLIENT_ID`). |
 | `SERVICE_TOKEN_SCOPES` | No | `["introspection"]` | Scopes requested when minting a service token; fa-auth narrows to the subset the bootstrap credential was granted. |
 | `SERVICE_TOKEN_REFRESH_LEEWAY_SECONDS` | No | `30` | Refresh a cached service token this many seconds before its `exp` so a call never races expiry. |
@@ -580,7 +589,7 @@ inherited from `auth-sdk-m8`, and made *fatal* only when pointed at production.
 | `EVENT_SIGNING_ENABLED` / `EVENT_SIGNING_ACCEPT_UNSIGNED` | inherited secure defaults (signing on, unsigned rejected); the gate fires through the consumer's auto-run config-health (item 7.x.1) | `ENABLED=false` under strict; `ACCEPT_UNSIGNED=true` under production or strict |
 | `METRICS_SCRAPE_CREDENTIAL` | unset = `/metrics` relies on network isolation only; set = constant-time `Authorization: Bearer` gate. **Must not equal `PRIVATE_API_SECRET`** (fatal reuse check at startup). | never fatal (network-isolation is a valid posture); reuse of `PRIVATE_API_SECRET` is fatal |
 | `HEALTH_DETAIL_CREDENTIAL` (items 9.3 + 9.4) | unset = `/health` returns a constant `{"status":"ok"}` to all callers (fail-closed liveness; real status never leaked); set = `X-Internal-Token` must match to receive the real aggregate status, per-check breakdown, and correct HTTP code. **Must not equal `PRIVATE_API_SECRET`** (fatal reuse check at startup). | never fatal (no credential = constant liveness response, which is a valid posture); reuse of `PRIVATE_API_SECRET` is fatal |
-| `INTERNAL_CLIENT_ID` (item 9.1) | unset = legacy single `PRIVATE_API_SECRET`; set = per-consumer bootstrap / service-token auth on private calls | never fatal (must be coordinated with the issuer's `PRIVATE_API_CONSUMERS`) |
+| `INTERNAL_CLIENT_ID` (items 9.1 + 11.2b) | unset = legacy single `PRIVATE_API_SECRET` (development-only); set = per-consumer bootstrap / service-token auth on private calls (must be coordinated with the issuer's `PRIVATE_API_CONSUMERS`) | **fatal** under production/strict when `INTROSPECTION_URL` is set but `INTERNAL_CLIENT_ID` is unset; also fatal (any env) when `SERVICE_TOKEN_EXCHANGE_ENABLED=true` without `INTERNAL_CLIENT_ID`, or `INTERNAL_CLIENT_ID` set without `PRIVATE_API_SECRET` |
 | `_FILE` secret mounts | **inherited** from `CommonSettings` — every secret (`PRIVATE_API_SECRET_FILE`, `DB_PASSWORD_FILE`, `METRICS_SCRAPE_CREDENTIAL_FILE`, `HEALTH_DETAIL_CREDENTIAL_FILE`, …) can be sourced from `/run/secrets/*` with no code change | a referenced `<FIELD>_FILE` path is missing (fails closed at construction) |
 
 ---
@@ -1157,6 +1166,9 @@ async def test_health(client):
 
 | `fastapi-m8` | `auth-sdk-m8` | Python |
 |---|---|---|
+| `3.3.0` | `>=2.1.1, <3.0.0` | 3.11, 3.12, 3.13, 3.14 |
+| `3.2.0` | `>=2.1.0, <3.0.0` | 3.11, 3.12, 3.13, 3.14 |
+| `3.1.0` | `>=2.1.0, <3.0.0` | 3.11, 3.12, 3.13, 3.14 |
 | `3.0.0` | `>=2.0.1, <3.0.0` | 3.11, 3.12, 3.13, 3.14 |
 | `2.1.0` | `>=1.5.0, <2.0.0` | 3.11, 3.12, 3.13 |
 | `2.0.0` | `>=1.4.0, <2.0.0` | 3.11, 3.12, 3.13 |

fastapi_m8-3.3.0/constraints-all.txt

@@ -0,0 +1,237 @@
+#
+# This file is autogenerated by pip-compile with Python 3.12
+# by the following command:
+#
+#    pip-compile --extra=all --extra=dev --no-emit-index-url --output-file=constraints-all.txt pyproject.toml
+#
+alembic==1.18.5
+    # via fastapi-m8
+annotated-doc==0.0.4
+    # via fastapi
+annotated-types==0.7.0
+    # via pydantic
+anyio[trio]==4.14.1
+    # via
+    #   fastapi-m8
+    #   fastapi-m8 (pyproject.toml)
+    #   httpx
+    #   pytest-anyio
+    #   starlette
+asgi-lifespan==2.1.0
+    # via fastapi-m8 (pyproject.toml)
+ast-serialize==0.6.0
+    # via mypy
+attrs==26.1.0
+    # via
+    #   outcome
+    #   trio
+auth-sdk-m8[config,events,fastapi,observability,security]==2.1.1
+    # via
+    #   fastapi-m8
+    #   fastapi-m8 (pyproject.toml)
+bandit==1.9.4
+    # via fastapi-m8 (pyproject.toml)
+boolean-py==5.0
+    # via license-expression
+cachecontrol[filecache]==0.14.4
+    # via
+    #   cachecontrol
+    #   pip-audit
+certifi==2026.6.17
+    # via
+    #   httpcore
+    #   httpx
+    #   requests
+cffi==2.0.0
+    # via cryptography
+charset-normalizer==3.4.7
+    # via requests
+coverage[toml]==7.14.3
+    # via
+    #   fastapi-m8 (pyproject.toml)
+    #   pytest-cov
+cryptography==49.0.0
+    # via auth-sdk-m8
+cyclonedx-python-lib==11.11.0
+    # via pip-audit
+defusedxml==0.7.1
+    # via py-serializable
+dnspython==2.8.0
+    # via email-validator
+email-validator==2.3.0
+    # via auth-sdk-m8
+fastapi==0.139.0
+    # via
+    #   auth-sdk-m8
+    #   fastapi-m8
+    #   fastapi-m8 (pyproject.toml)
+fastapi-m8[all,db,mysql,postgres] @ file:///workspace/fastapi-m8
+    # via fastapi-m8 (pyproject.toml)
+filelock==3.29.4
+    # via cachecontrol
+greenlet==3.5.3
+    # via sqlalchemy
+h11==0.16.0
+    # via httpcore
+httpcore==1.0.9
+    # via httpx
+httpx==0.28.1
+    # via
+    #   auth-sdk-m8
+    #   fastapi-m8
+    #   fastapi-m8 (pyproject.toml)
+idna==3.18
+    # via
+    #   anyio
+    #   email-validator
+    #   httpx
+    #   requests
+    #   trio
+iniconfig==2.3.0
+    # via pytest
+librt==0.12.0
+    # via mypy
+license-expression==30.4.4
+    # via cyclonedx-python-lib
+mako==1.3.12
+    # via alembic
+markdown-it-py==4.2.0
+    # via rich
+markupsafe==3.0.3
+    # via mako
+mdurl==0.1.2
+    # via markdown-it-py
+msgpack==1.2.1
+    # via cachecontrol
+mypy==2.1.0
+    # via fastapi-m8 (pyproject.toml)
+mypy-extensions==1.1.0
+    # via mypy
+outcome==1.3.0.post0
+    # via trio
+packageurl-python==0.17.6
+    # via cyclonedx-python-lib
+packaging==26.2
+    # via
+    #   fastapi-m8
+    #   fastapi-m8 (pyproject.toml)
+    #   pip-audit
+    #   pip-requirements-parser
+    #   pytest
+pathspec==1.1.1
+    # via mypy
+pip-api==0.0.34
+    # via pip-audit
+pip-audit==2.10.1
+    # via fastapi-m8 (pyproject.toml)
+pip-requirements-parser==32.0.1
+    # via pip-audit
+platformdirs==4.10.0
+    # via pip-audit
+pluggy==1.6.0
+    # via
+    #   pytest
+    #   pytest-cov
+prometheus-client==0.25.0
+    # via auth-sdk-m8
+psycopg2-binary==2.9.12
+    # via fastapi-m8
+py-serializable==2.1.0
+    # via cyclonedx-python-lib
+pycparser==3.0
+    # via cffi
+pydantic==2.13.4
+    # via
+    #   auth-sdk-m8
+    #   fastapi
+    #   pydantic-settings
+    #   sqlmodel
+pydantic-core==2.46.4
+    # via pydantic
+pydantic-settings==2.14.2
+    # via auth-sdk-m8
+pygments==2.20.0
+    # via
+    #   pytest
+    #   rich
+pyjwt==2.13.0
+    # via auth-sdk-m8
+pymysql==1.2.0
+    # via fastapi-m8
+pyparsing==3.3.2
+    # via pip-requirements-parser
+pytest==9.1.1
+    # via
+    #   fastapi-m8 (pyproject.toml)
+    #   pytest-anyio
+    #   pytest-cov
+pytest-anyio==0.0.0
+    # via fastapi-m8 (pyproject.toml)
+pytest-cov==7.1.0
+    # via fastapi-m8 (pyproject.toml)
+python-dotenv==1.2.2
+    # via pydantic-settings
+pyyaml==6.0.3
+    # via bandit
+requests==2.34.2
+    # via
+    #   cachecontrol
+    #   pip-audit
+rich==15.0.0
+    # via
+    #   bandit
+    #   pip-audit
+ruff==0.15.20
+    # via fastapi-m8 (pyproject.toml)
+sniffio==1.3.1
+    # via
+    #   asgi-lifespan
+    #   trio
+sortedcontainers==2.4.0
+    # via
+    #   cyclonedx-python-lib
+    #   trio
+sqlalchemy==2.0.51
+    # via
+    #   alembic
+    #   fastapi-m8
+    #   sqlmodel
+sqlmodel==0.0.39
+    # via fastapi-m8
+starlette==1.3.1
+    # via
+    #   auth-sdk-m8
+    #   fastapi
+stevedore==5.8.0
+    # via bandit
+tenacity==9.1.4
+    # via fastapi-m8 (pyproject.toml)
+tomli==2.4.1
+    # via pip-audit
+tomli-w==1.2.0
+    # via pip-audit
+trio==0.33.0
+    # via anyio
+typing-extensions==4.16.0
+    # via
+    #   alembic
+    #   anyio
+    #   cyclonedx-python-lib
+    #   fastapi
+    #   mypy
+    #   pydantic
+    #   pydantic-core
+    #   sqlalchemy
+    #   sqlmodel
+    #   starlette
+    #   typing-inspection
+typing-inspection==0.4.2
+    # via
+    #   fastapi
+    #   pydantic
+    #   pydantic-settings
+urllib3==2.7.0
+    # via requests
+
+# The following packages are considered to be unsafe in a requirements file:
+# pip

fastapi_m8-3.3.0/constraints.txt

@@ -0,0 +1,114 @@
+#
+# This file is autogenerated by pip-compile with Python 3.12
+# by the following command:
+#
+#    pip-compile --extra=all --output-file=constraints.txt pyproject.toml
+#
+alembic==1.18.5
+    # via fastapi-m8
+annotated-doc==0.0.4
+    # via fastapi
+annotated-types==0.7.0
+    # via pydantic
+anyio==4.14.1
+    # via
+    #   fastapi-m8
+    #   fastapi-m8 (pyproject.toml)
+    #   httpx
+    #   starlette
+auth-sdk-m8[config,events,fastapi,observability,security]==2.1.1
+    # via
+    #   fastapi-m8
+    #   fastapi-m8 (pyproject.toml)
+certifi==2026.6.17
+    # via
+    #   httpcore
+    #   httpx
+cffi==2.0.0
+    # via cryptography
+cryptography==49.0.0
+    # via auth-sdk-m8
+dnspython==2.8.0
+    # via email-validator
+email-validator==2.3.0
+    # via auth-sdk-m8
+fastapi==0.139.0
+    # via
+    #   auth-sdk-m8
+    #   fastapi-m8
+    #   fastapi-m8 (pyproject.toml)
+fastapi-m8[db,mysql,postgres] @ file:///workspace/fastapi-m8
+    # via fastapi-m8 (pyproject.toml)
+greenlet==3.5.3
+    # via sqlalchemy
+h11==0.16.0
+    # via httpcore
+httpcore==1.0.9
+    # via httpx
+httpx==0.28.1
+    # via
+    #   auth-sdk-m8
+    #   fastapi-m8
+    #   fastapi-m8 (pyproject.toml)
+idna==3.18
+    # via
+    #   anyio
+    #   email-validator
+    #   httpx
+mako==1.3.12
+    # via alembic
+markupsafe==3.0.3
+    # via mako
+packaging==26.2
+    # via
+    #   fastapi-m8
+    #   fastapi-m8 (pyproject.toml)
+prometheus-client==0.25.0
+    # via auth-sdk-m8
+psycopg2-binary==2.9.12
+    # via fastapi-m8
+pycparser==3.0
+    # via cffi
+pydantic==2.13.4
+    # via
+    #   auth-sdk-m8
+    #   fastapi
+    #   pydantic-settings
+    #   sqlmodel
+pydantic-core==2.46.4
+    # via pydantic
+pydantic-settings==2.14.2
+    # via auth-sdk-m8
+pyjwt==2.13.0
+    # via auth-sdk-m8
+pymysql==1.2.0
+    # via fastapi-m8
+python-dotenv==1.2.2
+    # via pydantic-settings
+sqlalchemy==2.0.51
+    # via
+    #   alembic
+    #   fastapi-m8
+    #   sqlmodel
+sqlmodel==0.0.39
+    # via fastapi-m8
+starlette==1.3.1
+    # via
+    #   auth-sdk-m8
+    #   fastapi
+typing-extensions==4.16.0
+    # via
+    #   alembic
+    #   anyio
+    #   fastapi
+    #   pydantic
+    #   pydantic-core
+    #   sqlalchemy
+    #   sqlmodel
+    #   starlette
+    #   typing-inspection
+typing-inspection==0.4.2
+    # via
+    #   fastapi
+    #   pydantic
+    #   pydantic-settings

{fastapi_m8-3.2.0 → fastapi_m8-3.3.0}/fastapi_m8/_compat.py

@@ -74,6 +74,16 @@ COMPAT_MATRIX: dict[str, dict[str, str]] = {
     # status, per-check detail, and the 503 HTTP code on FAIL. No SDK change required;
     # auth-sdk-m8 floor stays at >=2.1.0. See CHANGELOG.
     "3.2": {"auth-sdk-m8": ">=2.1.0,<3.0.0"},
+    # 3.3 (MINOR) makes legacy single-shared-secret consumer private-auth
+    # development-only (item 11.2b): ConsumerServiceSettings fails closed at
+    # construction when a production/strict consumer has INTROSPECTION_URL set but
+    # no INTERNAL_CLIENT_ID (fa-auth-m8 retired the issuer's legacy fallback,
+    # item 11.2a), and rejects incoherent per-consumer config groups. Also lands
+    # PyPI Trusted Publishing (OIDC, no long-lived token), CI policy tests, and
+    # pip-compiled locked constraints (items 11.6/11.7/11.8). Floor raised to
+    # auth-sdk-m8 >=2.1.1 to carry the SDK's latest dependency/CI maintenance
+    # release (no new SDK API is required by 3.3). See CHANGELOG.
+    "3.3": {"auth-sdk-m8": ">=2.1.1,<3.0.0"},
 }
 
 _EXTRAS = "[config,security,fastapi,observability]"

{fastapi_m8-3.2.0 → fastapi_m8-3.3.0}/fastapi_m8/_internal_auth.py

@@ -6,8 +6,11 @@ JTI-status / revocation introspection endpoint — by one of three modes, select
 purely by configuration so the home lab keeps working unchanged:
 
 * **legacy** — ``INTERNAL_CLIENT_ID`` unset: send the single shared
-  ``PRIVATE_API_SECRET`` as ``X-Internal-Token`` (the pre-9.1 behaviour; matches
-  the issuer's legacy fallback when it has no per-consumer registry).
+  ``PRIVATE_API_SECRET`` as ``X-Internal-Token`` (the pre-9.1 behaviour).
+  **Development-only:** ``fa-auth-m8`` has retired the issuer's legacy
+  single-shared-secret fallback, so this mode is rejected under production/strict
+  once introspection is configured (see
+  ``ConsumerServiceSettings._validate_consumer_private_auth``, item 11.2b).
 * **bootstrap** — ``INTERNAL_CLIENT_ID`` set, exchange disabled: send the
   per-consumer ``X-Internal-Client`` + ``X-Internal-Token`` bootstrap pair on
   every private call. The blast radius is now one consumer, and the issuer gates

{fastapi_m8-3.2.0 → fastapi_m8-3.3.0}/fastapi_m8/_version.py

@@ -1,3 +1,3 @@
 """Single source of truth for the package version."""
 
-__version__ = "3.2.0"
+__version__ = "3.3.0"

{fastapi_m8-3.2.0 → fastapi_m8-3.3.0}/fastapi_m8/config.py

@@ -23,7 +23,7 @@ from auth_sdk_m8.core.config import CommonSettings
 from auth_sdk_m8.core.consumer import ConsumerAuthMixin
 from auth_sdk_m8.observability.settings import ObservabilitySettingsMixin
 from auth_sdk_m8.schemas.meta import ServiceContract, ServiceMeta
-from pydantic import Field, SecretStr
+from pydantic import Field, SecretStr, model_validator
 
 
 class ConsumerServiceSettings(
@@ -81,16 +81,23 @@ class ConsumerServiceSettings(
     # ── Per-consumer internal-auth (9.1, consumer side) ──────────────────────
     # Identity this consumer presents on private calls to fa-auth. Unset
     # (default) keeps the legacy single-secret mode: PRIVATE_API_SECRET is sent
-    # as X-Internal-Token, matching the issuer's legacy fallback when it has no
-    # PRIVATE_API_CONSUMERS registry. Set to this service's registered consumer
-    # id to switch to the per-consumer model — PRIVATE_API_SECRET then carries
-    # *this consumer's* bootstrap secret, and the issuer gates each private route
-    # by the credential's granted scope (deny-by-default).
+    # as X-Internal-Token. This mode is DEVELOPMENT-ONLY and unsafe for a
+    # hardened deployment — fa-auth-m8 has retired the issuer's legacy
+    # single-shared-secret fallback (its PRIVATE_API_CONSUMERS registry is now
+    # required in production/strict, item 11.2a), so a production/strict consumer
+    # left in legacy mode is guaranteed to fail against a hardened issuer. That is
+    # why ``_validate_consumer_private_auth`` (item 11.2b) makes legacy mode fatal
+    # once INTROSPECTION_URL is configured under production/strict. Set this to
+    # the service's registered consumer id to switch to the per-consumer model —
+    # PRIVATE_API_SECRET then carries *this consumer's* bootstrap secret, and the
+    # issuer gates each private route by the credential's granted scope
+    # (deny-by-default).
     INTERNAL_CLIENT_ID: str | None = Field(
         None,
         description=(
             "This consumer's X-Internal-Client id for per-consumer private auth. "
-            "Unset = legacy single shared PRIVATE_API_SECRET mode."
+            "Unset = legacy single shared PRIVATE_API_SECRET mode "
+            "(development-only; rejected under production/strict)."
         ),
     )
     # When INTERNAL_CLIENT_ID is set, opt into exchanging the bootstrap
@@ -184,3 +191,57 @@ class ConsumerServiceSettings(
                 range=self.CONTRACT_RANGE,
             ),
         )
+
+    @model_validator(mode="after")
+    def _validate_consumer_private_auth(self) -> "ConsumerServiceSettings":
+        """
+        Enforce a coherent per-consumer private-auth configuration (item 11.2b).
+
+        Three rules, checked at settings construction so a misconfigured consumer
+        fails closed before it can serve traffic. None of the messages echo a
+        secret value.
+
+        1. **Coherent group — exchange needs an identity.**
+           ``SERVICE_TOKEN_EXCHANGE_ENABLED`` selects a *per-consumer* mode; with
+           no ``INTERNAL_CLIENT_ID`` the exchange has nothing to present and
+           ``build_internal_auth`` would silently fall back to legacy, so it is a
+           configuration error rather than a valid state.
+        2. **Coherent group — per-consumer mode needs its bootstrap secret.**
+           When ``INTERNAL_CLIENT_ID`` is set, ``PRIVATE_API_SECRET`` carries this
+           consumer's bootstrap secret and must be present.
+        3. **Legacy mode is development-only.** ``fa-auth-m8`` has retired the
+           issuer's legacy single-shared-secret private-API fallback (its
+           ``PRIVATE_API_CONSUMERS`` registry is required in production/strict,
+           item 11.2a). A production/strict consumer that still runs legacy
+           token-only mode (``INTROSPECTION_URL`` configured, ``INTERNAL_CLIENT_ID``
+           unset) is therefore guaranteed to fail against a hardened issuer — a
+           deployment fault, not a runtime mode — so it is rejected here. Legacy
+           mode stays valid for local/development only.
+        """
+        if self.SERVICE_TOKEN_EXCHANGE_ENABLED and not self.INTERNAL_CLIENT_ID:
+            raise ValueError(
+                "CONFIG: SERVICE_TOKEN_EXCHANGE_ENABLED=true requires "
+                "INTERNAL_CLIENT_ID — service-token exchange is a per-consumer "
+                "private-auth mode and has no identity to present without it."
+            )
+        if self.INTERNAL_CLIENT_ID and self.PRIVATE_API_SECRET is None:
+            raise ValueError(
+                "CONFIG: INTERNAL_CLIENT_ID is set but PRIVATE_API_SECRET is "
+                "missing — per-consumer private auth needs this consumer's "
+                "bootstrap secret."
+            )
+        is_production = self.ENVIRONMENT == "production" or self.STRICT_PRODUCTION_MODE
+        if (
+            is_production
+            and self.INTROSPECTION_URL is not None
+            and not self.INTERNAL_CLIENT_ID
+        ):
+            raise ValueError(
+                "CONFIG: production/strict consumer has INTROSPECTION_URL set but "
+                "no INTERNAL_CLIENT_ID — the legacy single-shared-secret private "
+                "API mode is development-only and is rejected by a hardened "
+                "fa-auth-m8 issuer (item 11.2b). Set INTERNAL_CLIENT_ID to this "
+                "service's registered consumer id; its PRIVATE_API_SECRET then "
+                "carries the per-consumer bootstrap secret."
+            )
+        return self

{fastapi_m8-3.2.0 → fastapi_m8-3.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "fastapi-m8"
-version = "3.2.0"
+version = "3.3.0"
 description = "FastAPI application framework for m8 consumer microservices."
 readme = "README.md"
 license = { file = "LICENSE" }
@@ -27,7 +27,7 @@ dependencies = [
     "httpx>=0.27.0",
     "packaging>=24.0",
     "anyio>=4.0",
-    "auth-sdk-m8[config,security,fastapi,observability,events]>=2.1.0,<3.0.0",
+    "auth-sdk-m8[config,security,fastapi,observability,events]>=2.1.1,<3.0.0",
 ]
 
 [project.optional-dependencies]

fastapi_m8-3.3.0/tests/test_ci_policy.py

@@ -0,0 +1,136 @@
+"""CI and release-workflow policy tests — findings 11.6, 11.7, 11.8."""
+
+import re
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+WORKFLOWS = REPO_ROOT / ".github" / "workflows"
+CI_YAML = WORKFLOWS / "CI.yaml"
+PIPY_YML = WORKFLOWS / "PiPy.yml"
+
+_SHA_RE = re.compile(r"^[0-9a-f]{40}$")
+_USES_RE = re.compile(r"uses:\s+([a-zA-Z0-9_.-]+/[a-zA-Z0-9_.-]+@(\S+))")
+
+
+def _load_yaml(path: Path) -> dict[str, Any]:
+    with path.open() as fh:
+        return yaml.safe_load(fh)  # type: ignore[no-any-return]
+
+
+def _action_refs(path: Path) -> list[tuple[str, str]]:
+    """Return (full-ref, sha-candidate) for every action ``uses:`` in a workflow."""
+    results: list[tuple[str, str]] = []
+    for m in _USES_RE.finditer(path.read_text()):
+        full_ref = m.group(1)
+        sha_part = m.group(2).split("#")[0].strip()
+        results.append((full_ref, sha_part))
+    return results
+
+
+# ── 11.6  PyPI Trusted Publishing — no long-lived API token ─────────────────
+
+
+def test_pypi_workflow_no_api_token() -> None:
+    """PiPy.yml must not reference PYPI_API_TOKEN; OIDC Trusted Publishing only."""
+    assert "PYPI_API_TOKEN" not in PIPY_YML.read_text()
+
+
+def test_pypi_publish_job_has_oidc_permission() -> None:
+    """The pypi-publish job must declare id-token: write for OIDC."""
+    wf = _load_yaml(PIPY_YML)
+    perms = wf["jobs"]["pypi-publish"].get("permissions", {})
+    assert perms.get("id-token") == "write"
+
+
+def test_pypi_publish_job_uses_protected_environment() -> None:
+    """The pypi-publish job must target a named protected environment."""
+    wf = _load_yaml(PIPY_YML)
+    env = wf["jobs"]["pypi-publish"].get("environment")
+    assert env is not None, "pypi-publish must declare an environment."
+    name = env.get("name") if isinstance(env, dict) else env
+    assert name, "pypi-publish environment must have a non-empty name."
+
+
+# ── 11.7  CI workflow consolidation — one canonical gate ────────────────────
+
+
+def test_no_duplicate_ci_yml() -> None:
+    """ci.yml must not exist — CI.yaml is the single canonical quality gate."""
+    assert not (WORKFLOWS / "ci.yml").exists(), (
+        "Found duplicate ci.yml; the canonical workflow is CI.yaml."
+    )
+
+
+def test_ci_yaml_has_secret_scan_job() -> None:
+    """CI.yaml must contain the gitleaks secret-scan job."""
+    wf = _load_yaml(CI_YAML)
+    assert "secret-scan" in wf["jobs"], "CI.yaml must include a secret-scan job."
+
+
+def test_ci_yaml_actions_are_sha_pinned() -> None:
+    """Every action reference in CI.yaml must be pinned to a full 40-char commit SHA."""
+    refs = _action_refs(CI_YAML)
+    assert refs, "No action references found in CI.yaml."
+    for full_ref, sha_part in refs:
+        assert _SHA_RE.match(sha_part), (
+            f"CI.yaml: '{full_ref}' is not SHA-pinned — use a full 40-char commit hash."
+        )
+
+
+def test_pipy_yml_actions_are_sha_pinned() -> None:
+    """Every action reference in PiPy.yml must be pinned to a full 40-char commit SHA."""
+    refs = _action_refs(PIPY_YML)
+    assert refs, "No action references found in PiPy.yml."
+    for full_ref, sha_part in refs:
+        assert _SHA_RE.match(sha_part), (
+            f"PiPy.yml: '{full_ref}' is not SHA-pinned — use a full 40-char commit hash."
+        )
+
+
+# ── 11.8  Locked resolver outputs / package index policy ────────────────────
+
+
+def test_constraints_all_exists() -> None:
+    """constraints-all.txt must exist as the locked all+dev dependency snapshot."""
+    assert (REPO_ROOT / "constraints-all.txt").exists()
+
+
+def test_constraints_all_pins_key_runtime_deps() -> None:
+    """constraints-all.txt must pin every key runtime package from the closure."""
+    content = (REPO_ROOT / "constraints-all.txt").read_text().lower()
+    # Packages may appear with extras: pkg[extras]==version, so match name + optional extras + ==
+    required = [
+        "fastapi",
+        "httpx",
+        "pydantic",
+        "anyio",
+        "sqlmodel",
+        "auth-sdk-m8",
+        "pyjwt",
+        "cryptography",
+        "prometheus-client",
+    ]
+    for pkg in required:
+        # Match "pkg==" or "pkg[...]==" (extras bracket)
+        assert re.search(rf"\b{re.escape(pkg)}(?:\[[^\]]*\])?==", content), (
+            f"constraints-all.txt is missing a pin for '{pkg}'. "
+            "Re-run pip-compile to regenerate."
+        )
+
+
+def test_constraints_no_custom_index_url() -> None:
+    """Constraint files must reference only the public PyPI index."""
+    for name in ("constraints.txt", "constraints-all.txt"):
+        path = REPO_ROOT / name
+        if not path.exists():
+            continue
+        content = path.read_text()
+        assert "--index-url" not in content, (
+            f"{name}: must not contain --index-url (public PyPI only)."
+        )
+        assert "--extra-index-url" not in content, (
+            f"{name}: must not contain --extra-index-url (public PyPI only)."
+        )

{fastapi_m8-3.2.0 → fastapi_m8-3.3.0}/tests/test_config.py

@@ -84,3 +84,83 @@ def test_event_stream_read_timeout_rejects_out_of_range() -> None:
     """A read timeout above the ceiling fails validation (le=3600)."""
     with pytest.raises(ValidationError, match="EVENT_STREAM_READ_TIMEOUT"):
         make_settings(EVENT_STREAM_READ_TIMEOUT=99999)
+
+
+# ── Per-consumer private-auth validation (item 11.2b) ─────────────────────────
+
+_INTROSPECTION = "http://auth:8000/user/private/v1/jti-status"
+
+
+@pytest.mark.parametrize(
+    "prod_overrides",
+    [
+        {"ENVIRONMENT": "production"},
+        {"STRICT_PRODUCTION_MODE": True},
+    ],
+)
+def test_production_introspection_without_client_id_raises(
+    prod_overrides: dict,
+) -> None:
+    """Prod/strict + INTROSPECTION_URL + no INTERNAL_CLIENT_ID is fatal (item 11.2b)."""
+    with pytest.raises(ValidationError, match="INTERNAL_CLIENT_ID"):
+        make_settings(
+            INTROSPECTION_URL=_INTROSPECTION,
+            PRIVATE_API_SECRET=SecretStr("bootstrap-secret"),
+            **prod_overrides,
+        )
+
+
+def test_production_introspection_with_client_id_ok() -> None:
+    """Prod + INTROSPECTION_URL + per-consumer identity is accepted."""
+    s = make_settings(
+        ENVIRONMENT="production",
+        INTROSPECTION_URL=_INTROSPECTION,
+        INTERNAL_CLIENT_ID="test-svc",
+        PRIVATE_API_SECRET=SecretStr("bootstrap-secret"),
+    )
+    assert s.INTERNAL_CLIENT_ID == "test-svc"
+
+
+def test_local_legacy_mode_allowed() -> None:
+    """Development (local) legacy token-only mode remains valid (item 11.2b)."""
+    s = make_settings(
+        ENVIRONMENT="local",
+        INTROSPECTION_URL=_INTROSPECTION,
+        PRIVATE_API_SECRET=SecretStr("shared-secret"),
+    )
+    assert s.INTERNAL_CLIENT_ID is None
+
+
+def test_production_without_introspection_allowed() -> None:
+    """A prod consumer with no private calls at all is unaffected by 11.2b."""
+    s = make_settings(ENVIRONMENT="production")
+    assert s.INTROSPECTION_URL is None
+    assert s.INTERNAL_CLIENT_ID is None
+
+
+def test_service_token_exchange_without_client_id_raises() -> None:
+    """Coherent-group: exchange has no identity to present without a client id."""
+    with pytest.raises(ValidationError, match="SERVICE_TOKEN_EXCHANGE_ENABLED"):
+        make_settings(
+            INTROSPECTION_URL=_INTROSPECTION,
+            PRIVATE_API_SECRET=SecretStr("bootstrap-secret"),
+            SERVICE_TOKEN_EXCHANGE_ENABLED=True,
+        )
+
+
+def test_client_id_without_private_secret_raises() -> None:
+    """Coherent-group: per-consumer mode needs this consumer's bootstrap secret."""
+    with pytest.raises(ValidationError, match="PRIVATE_API_SECRET"):
+        make_settings(INTERNAL_CLIENT_ID="test-svc")
+
+
+def test_private_auth_validation_error_hides_secret() -> None:
+    """The fatal 11.2b message must not echo the bootstrap secret value."""
+    secret = "super-secret-bootstrap-value"
+    with pytest.raises(ValidationError) as exc:
+        make_settings(
+            ENVIRONMENT="production",
+            INTROSPECTION_URL=_INTROSPECTION,
+            PRIVATE_API_SECRET=SecretStr(secret),
+        )
+    assert secret not in str(exc.value)

fastapi_m8-3.2.0/.github/workflows/ci.yml

@@ -1,54 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-permissions:
-  contents: read
-
-jobs:
-  test:
-    name: Test & lint
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-
-      - name: Install dependencies
-        run: pip install -e ".[dev]"
-
-      - name: Lint (ruff)
-        run: ruff check .
-
-      - name: Type check (mypy)
-        run: mypy fastapi_m8
-
-      - name: Security scan (bandit)
-        run: bandit -r fastapi_m8 -x tests
-
-      - name: Test (pytest)
-        run: pytest
-
-      - name: Dependency audit (pip-audit)
-        run: pip-audit
-
-  secret-scan:
-    name: Secret scan (gitleaks)
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          fetch-depth: 0
-
-      - uses: gitleaks/gitleaks-action@1938557f6a58837331b99822ab17b8e536e7bef9 # v2.3.0
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}