fastapi-m8 4.2.0__tar.gz → 4.2.2__tar.gz

{fastapi_m8-4.2.0 → fastapi_m8-4.2.2}/.github/workflows/CI.yaml

@@ -16,10 +16,10 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.14"
           cache: "pip"
@@ -36,10 +36,10 @@ jobs:
   typecheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.14"
           cache: "pip"
@@ -53,10 +53,10 @@ jobs:
   security:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.14"
 
@@ -87,10 +87,10 @@ jobs:
         python-version: ["3.12", "3.13", "3.14"]
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
           cache: "pip"
@@ -121,7 +121,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 

{fastapi_m8-4.2.0 → fastapi_m8-4.2.2}/.github/workflows/PiPy.yml

@@ -12,9 +12,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
 
@@ -51,7 +51,7 @@ jobs:
           path: dist/
 
       - name: Publish release distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
 
   sbom:
     name: Generate & attach SBOM
@@ -63,9 +63,9 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
 

fastapi_m8-4.2.2/CLAUDE.md

@@ -0,0 +1,8 @@
+# fastapi-m8
+
+## Claude instructions
+
+@REPOSITORY_CONTEXT.md
+
+A verified nearest workspace may provide optional supported enhancement; it is
+never required for standalone work.

{fastapi_m8-4.2.0 → fastapi_m8-4.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-m8
-Version: 4.2.0
+Version: 4.2.2
 Summary: FastAPI application framework for m8 consumer microservices.
 Author-email: Eli Serra <e.serra173@gmail.com>
 License:                                  Apache License
@@ -215,7 +215,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Software Development :: Libraries
 Requires-Python: >=3.12
 Requires-Dist: anyio>=4.0
-Requires-Dist: auth-sdk-m8[config,events,fastapi,observability,security]<4.0.0,>=3.1.0
+Requires-Dist: auth-sdk-m8[config,events,fastapi,observability,security]<4.0.0,>=3.1.2
 Requires-Dist: fastapi>=0.136.3
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: packaging>=24.0
@@ -659,6 +659,18 @@ untouched.
 | `SERVICE_TOKEN_SCOPES` | No | `["introspection"]` | Scopes requested when minting a service token; fa-auth narrows to the subset the bootstrap credential was granted. |
 | `SERVICE_TOKEN_REFRESH_LEEWAY_SECONDS` | No | `30` | Refresh a cached service token this many seconds before its `exp` so a call never races expiry. |
 
+> **Ordinary expiry never surfaces as a `503`.** The refresh check runs lazily
+> on every call, before the private request is sent: once past
+> `exp - SERVICE_TOKEN_REFRESH_LEEWAY_SECONDS`, the client re-exchanges first.
+> Continuous traffic therefore never presents an actually expired service
+> token to the issuer. The one case where a `503` legitimately occurs is a
+> withdrawn/rotated consumer secret, or a request whose latency races the
+> leeway margin — the issuer answers `401`, the cached token is dropped, and
+> that single request fails closed while the next one re-mints and succeeds
+> (never retried automatically — introspection consumes the caller's quota).
+> Accepted operational behavior; documented rather than pre-empted by a
+> second re-mint mechanism, since the proactive one above already covers it.
+
 ### Remote API-Key Principal
 
 Resolves a user API key presented by an external client to its owner's current
@@ -1168,6 +1180,21 @@ The value must match across the stack.
 **Stateless** — maximum scalability, simplest setup. Logout does not invalidate
 in-flight access tokens; they expire naturally.
 
+**Hybrid** — refresh-session state is revoked immediately (so a revoked user
+cannot mint a new access token), but an already-issued access token is not
+checked against the issuer and stays valid for the rest of its own lifetime.
+This is not a weaker or open-ended window: `TokenValidator.validate_access_token`
+enforces the JWT `exp` claim unconditionally, on every request, regardless of
+`TOKEN_MODE` (`auth_sdk_m8/security/token_validator.py`), and no `hybrid`/
+`stateless` code path in `build_auth_deps` skips or extends that check — only
+the *additional* revocation-client call is gated on `settings.is_stateful`. The
+stale-access-token window is therefore bounded by exactly
+`ACCESS_TOKEN_EXPIRE_MINUTES` and nothing longer; it must never be read as
+"immediate revocation" for the access token itself. Consumers that need
+immediate enforcement of a role/privilege downgrade — not just eventual
+expiry — must run `stateful` with `ACCESS_REVOCATION_FAILURE_MODE=fail_closed`
+instead of relying on hybrid/stateless.
+
 **Stateful** — highest security. On each request a consumer performs an HTTP call to
 `fa-auth-m8` to verify the JWT's JTI has not been revoked. Requires `INTROSPECTION_URL`
 and `PRIVATE_API_SECRET` in consumer settings.

{fastapi_m8-4.2.0 → fastapi_m8-4.2.2}/README.md

@@ -402,6 +402,18 @@ untouched.
 | `SERVICE_TOKEN_SCOPES` | No | `["introspection"]` | Scopes requested when minting a service token; fa-auth narrows to the subset the bootstrap credential was granted. |
 | `SERVICE_TOKEN_REFRESH_LEEWAY_SECONDS` | No | `30` | Refresh a cached service token this many seconds before its `exp` so a call never races expiry. |
 
+> **Ordinary expiry never surfaces as a `503`.** The refresh check runs lazily
+> on every call, before the private request is sent: once past
+> `exp - SERVICE_TOKEN_REFRESH_LEEWAY_SECONDS`, the client re-exchanges first.
+> Continuous traffic therefore never presents an actually expired service
+> token to the issuer. The one case where a `503` legitimately occurs is a
+> withdrawn/rotated consumer secret, or a request whose latency races the
+> leeway margin — the issuer answers `401`, the cached token is dropped, and
+> that single request fails closed while the next one re-mints and succeeds
+> (never retried automatically — introspection consumes the caller's quota).
+> Accepted operational behavior; documented rather than pre-empted by a
+> second re-mint mechanism, since the proactive one above already covers it.
+
 ### Remote API-Key Principal
 
 Resolves a user API key presented by an external client to its owner's current
@@ -911,6 +923,21 @@ The value must match across the stack.
 **Stateless** — maximum scalability, simplest setup. Logout does not invalidate
 in-flight access tokens; they expire naturally.
 
+**Hybrid** — refresh-session state is revoked immediately (so a revoked user
+cannot mint a new access token), but an already-issued access token is not
+checked against the issuer and stays valid for the rest of its own lifetime.
+This is not a weaker or open-ended window: `TokenValidator.validate_access_token`
+enforces the JWT `exp` claim unconditionally, on every request, regardless of
+`TOKEN_MODE` (`auth_sdk_m8/security/token_validator.py`), and no `hybrid`/
+`stateless` code path in `build_auth_deps` skips or extends that check — only
+the *additional* revocation-client call is gated on `settings.is_stateful`. The
+stale-access-token window is therefore bounded by exactly
+`ACCESS_TOKEN_EXPIRE_MINUTES` and nothing longer; it must never be read as
+"immediate revocation" for the access token itself. Consumers that need
+immediate enforcement of a role/privilege downgrade — not just eventual
+expiry — must run `stateful` with `ACCESS_REVOCATION_FAILURE_MODE=fail_closed`
+instead of relying on hybrid/stateless.
+
 **Stateful** — highest security. On each request a consumer performs an HTTP call to
 `fa-auth-m8` to verify the JWT's JTI has not been revoked. Requires `INTROSPECTION_URL`
 and `PRIVATE_API_SECRET` in consumer settings.

{fastapi_m8-4.2.0 → fastapi_m8-4.2.2}/constraints-all.txt

@@ -25,7 +25,7 @@ attrs==26.1.0
     # via
     #   outcome
     #   trio
-auth-sdk-m8[config,events,fastapi,observability,security]==3.1.0
+auth-sdk-m8[config,events,fastapi,observability,security]==3.1.2
     # via
     #   fastapi-m8
     #   fastapi-m8 (pyproject.toml)

{fastapi_m8-4.2.0 → fastapi_m8-4.2.2}/constraints.txt

@@ -16,7 +16,7 @@ anyio==4.14.1
     #   fastapi-m8 (pyproject.toml)
     #   httpx
     #   starlette
-auth-sdk-m8[config,events,fastapi,observability,security]==3.1.0
+auth-sdk-m8[config,events,fastapi,observability,security]==3.1.2
     # via
     #   fastapi-m8
     #   fastapi-m8 (pyproject.toml)

{fastapi_m8-4.2.0 → fastapi_m8-4.2.2}/fastapi_m8/_version.py

@@ -1,3 +1,3 @@
 """Single source of truth for the package version."""
 
-__version__ = "4.2.0"
+__version__ = "4.2.2"

{fastapi_m8-4.2.0 → fastapi_m8-4.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "fastapi-m8"
-version = "4.2.0"
+version = "4.2.2"
 description = "FastAPI application framework for m8 consumer microservices."
 readme = "README.md"
 license = { file = "LICENSE" }
@@ -26,7 +26,7 @@ dependencies = [
     "httpx>=0.27.0",
     "packaging>=24.0",
     "anyio>=4.0",
-    "auth-sdk-m8[config,security,fastapi,observability,events]>=3.1.0,<4.0.0",
+    "auth-sdk-m8[config,security,fastapi,observability,events]>=3.1.2,<4.0.0",
 ]
 
 [project.optional-dependencies]

fastapi_m8-4.2.0/CLAUDE.md

@@ -1,7 +0,0 @@
-# fastapi-m8
-
-# Claude instructions
-
-Read `REPOSITORY_CONTEXT.md` for the repository-local context. A verified nearest
-workspace may provide optional supported enhancement; it is never required for
-standalone work.