fastapi-rtk 2.6.1__tar.gz → 2.7.1__tar.gz

{fastapi_rtk-2.6.1 → fastapi_rtk-2.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-rtk
-Version: 2.6.1
+Version: 2.7.1
 Summary: A package that provides a set of tools to build a FastAPI application with a Class-Based CRUD API.
 Project-URL: Homepage, https://codeberg.org/datatactics/fastapi-rtk
 Project-URL: Issues, https://codeberg.org/datatactics/fastapi-rtk/issues

fastapi_rtk-2.7.1/fastapi_rtk/_version.py

@@ -0,0 +1 @@
+__version__ = "2.7.1"

{fastapi_rtk-2.6.1 → fastapi_rtk-2.7.1}/fastapi_rtk/cli/commands/security.py

@@ -129,7 +129,7 @@ async def import_users(
     ] = False,
 ):
     """
-    Import users from a file produced by export-users. Existing usernames are skipped.
+    Import users from a file produced by export-users, skipping case-insensitive username/email matches.
     """
     payload = _load_import_payload(
         file_path,

{fastapi_rtk-2.6.1 → fastapi_rtk-2.7.1}/fastapi_rtk/cli/decorators.py

@@ -1,6 +1,7 @@
 import functools
 import inspect
 
+import click
 import fastapi_cli.discover
 import fastapi_cli.exceptions
 import typer
@@ -58,13 +59,35 @@ def ensure_fastapi_rtk_tables_exist(f):
     return ensure_app_loaded(wrapper)
 
 
+def _current_command_path() -> str | None:
+    """Build the full CLI command path from the active Click context.
+
+    Walks from the invoked command up to (but excluding) the program root and
+    joins the names with spaces (group then subcommand).
+
+    Returns:
+        str | None: The space-joined command names, or `None` when there is no active Click context.
+    """
+    ctx = click.get_current_context(silent=True)
+    if ctx is None:
+        return None
+    names = []
+    node = ctx
+    while node is not None and node.parent is not None:
+        names.append(node.info_name)
+        node = node.parent
+    return " ".join(reversed(names)) or None
+
+
 def _check_existing_app(f, *, silent=False):
     @functools.wraps(f)
     def wrapper(*args, **kwargs):
         # No app loaded -> CLI invocation: flag cli (before import, so the
-        # toolkit skips the lifespan) and import from path. Else reuse it.
+        # toolkit skips the lifespan), record the command, then import from
+        # path. Else reuse it.
         if g.current_app is None:
             g.is_cli = True
+            g.cli_command = _current_command_path()
             try:
                 fastapi_cli.discover.get_import_data(path=g.path)
             except fastapi_cli.exceptions.FastAPICLIException as e:

{fastapi_rtk-2.6.1 → fastapi_rtk-2.7.1}/fastapi_rtk/const.py

@@ -148,6 +148,7 @@ BEARER_STRATEGY_CONFIG = {
 class ErrorCode(str, enum.Enum):
     GET_USER_MISSING_TOKEN_OR_INACTIVE_USER = "GET_USER_MISSING_TOKEN_OR_INACTIVE_USER"
     GET_USER_NO_ROLES = "GET_USER_NO_ROLES"
+    USER_ALREADY_EXISTS = "USER_ALREADY_EXISTS"
     PERMISSION_DENIED = "PERMISSION_DENIED"
     FEATURE_NOT_IMPLEMENTED = "FEATURE_NOT_IMPLEMENTED"
     PAGE_NOT_FOUND = "PAGE_NOT_FOUND"

{fastapi_rtk-2.6.1 → fastapi_rtk-2.7.1}/fastapi_rtk/globals.py

@@ -87,6 +87,10 @@ class Globals:
     """
     A boolean value to indicate if the application is loaded by the CLI. `True` when you are running a command from `fastapi-rtk` CLI.
     """
+    cli_command: str | None
+    """
+    The full CLI command path currently running (group and subcommand, space-joined), or `None` outside the CLI. Set before the app module is imported.
+    """
     sensitive_data: dict[str, list[str]]
     """
     A dictionary used to store list of sensitive columns for each model that should not be returned in the list and get endpoints. Default is `{"User": ["password", "hashed_password"]}`.
@@ -283,6 +287,7 @@ g.set_default(
 )
 g.set_default("config", Config())
 g.set_default("is_cli", False)
+g.set_default("cli_command", None)
 g.set_default("sensitive_data", {"User": ["password", "hashed_password"]})
 g.set_default(
     "file_manager",

{fastapi_rtk-2.6.1 → fastapi_rtk-2.7.1}/fastapi_rtk/security/sqla/apis.py

@@ -238,6 +238,9 @@ class UsersApi(ModelRestApi):
             if col.name == "password":
                 col.required = False
 
+    async def pre_add(self, item, params):
+        await self._check_user_unique(params.session, item.email, item.username)
+
     async def post_add(self, item, params):
         await g.current_app.sm.update_user(
             user_update={"password": item.password},
@@ -246,6 +249,14 @@ class UsersApi(ModelRestApi):
         )
         await self.datamodel.add(params.session, item)
 
+    async def pre_update_merge(self, item, data, params):
+        await self._check_user_unique(
+            params.session,
+            data.get("email", item.email),
+            data.get("username", item.username),
+            current_id=item.id,
+        )
+
     async def post_update(self, item, params):
         if params.body.password:
             await g.current_app.sm.update_user(
@@ -255,6 +266,41 @@ class UsersApi(ModelRestApi):
             )
         await self.datamodel.add(params.session, item)
 
+    @classmethod
+    async def _check_user_unique(
+        cls,
+        session: SQLASession,
+        email: str,
+        username: str,
+        current_id: int | None = None,
+    ):
+        """
+        Reject a create/update that collides with an existing user.
+
+        Matching is case-insensitive (mirrors `get_by_email` /
+        `get_by_username`), so `A.b@x.com` and `a.b@x.com` are the same
+        user and cannot both exist via the API.
+
+        Args:
+            session (SQLASession): The active database session.
+            email (str): The email to check for an existing owner.
+            username (str): The username to check for an existing owner.
+            current_id (int | None, optional): Id of the row being updated, excluded from the conflict check. Defaults to None.
+
+        Raises:
+            fastapi.HTTPException: 400 when another user already owns the email or username.
+        """
+        user_db = UserDatabase(session, User)
+        for existing in (
+            await user_db.get_by_email(email),
+            await user_db.get_by_username(username),
+        ):
+            if existing is not None and existing.id != current_id:
+                raise fastapi.HTTPException(
+                    fastapi.status.HTTP_400_BAD_REQUEST,
+                    ErrorCode.USER_ALREADY_EXISTS,
+                )
+
 
 class RolesApi(ModelRestApi):
     resource_name = "roles"

{fastapi_rtk-2.6.1 → fastapi_rtk-2.7.1}/fastapi_rtk/security/sqla/security_manager/_import.py

@@ -17,7 +17,10 @@ inserts rather than N reads plus N inserts.
 import collections.abc
 import typing
 
+import sqlalchemy
+
 from ....backends.sqla.session import SQLASession
+from ....utils import smart_run
 
 if typing.TYPE_CHECKING:
     from ..models import Role
@@ -43,12 +46,14 @@ async def import_users(
 
     The payload's top-level keys are usernames; each value is the user record
     dict (email, password hash, first/last name, roles list, optional active
-    flag). Existing usernames are skipped. Password hashes are written
-    verbatim: callers are responsible for ensuring the source dump matches
-    the destination's hashing scheme.
+    flag). A record is skipped when its username or email case-insensitively
+    matches an existing user or an already-imported record, so a case-variant
+    of an existing account is never inserted as a second row. Password hashes
+    are written verbatim: callers are responsible for ensuring the source dump
+    matches the destination's hashing scheme.
 
-    Bulk lookups: one `where_in` query for existing usernames and one for
-    referenced roles, regardless of payload size.
+    Bulk lookups: one case-insensitive query for existing usernames/emails and
+    one for referenced roles, regardless of payload size.
 
     Args:
         sm (SecurityManager): The owning security manager (provides
@@ -71,17 +76,28 @@ async def import_users(
     if not payload:
         return {"imported": [], "skipped": []}
 
-    usernames = list(payload.keys())
-    existing_users = await sm.user_interface.get_many(
-        session,
-        {"list_columns": ["username"], "where_in": ("username", usernames)},
+    user_model = sm.user_model
+    lowered_usernames = [username.lower() for username in payload]
+    lowered_emails = [
+        (record.get("email") or "").lower() for record in payload.values()
+    ]
+    statement = sqlalchemy.select(user_model.username, user_model.email).where(
+        sqlalchemy.or_(
+            sqlalchemy.func.lower(user_model.username).in_(lowered_usernames),
+            sqlalchemy.func.lower(user_model.email).in_(lowered_emails),
+        )
     )
-    existing_usernames = {u.username for u in existing_users}
+    existing = await smart_run(session.execute, statement)
+    existing_usernames_lc: set[str] = set()
+    existing_emails_lc: set[str] = set()
+    for username, email in existing.all():
+        existing_usernames_lc.add(username.lower())
+        existing_emails_lc.add((email or "").lower())
 
     per_user_role_names: dict[str, list[str]] = {
         username: _normalize_role_names(record.get("roles") or [])
         for username, record in payload.items()
-        if username not in existing_usernames
+        if username.lower() not in existing_usernames_lc
     }
     referenced_role_names: set[str] = set()
     for names in per_user_role_names.values():
@@ -96,10 +112,21 @@ async def import_users(
 
     imported: list[str] = []
     skipped: list[str] = []
+    seen_usernames_lc: set[str] = set()
+    seen_emails_lc: set[str] = set()
     for username, record in payload.items():
-        if username in existing_usernames:
+        username_lc = username.lower()
+        email_lc = (record.get("email") or "").lower()
+        if (
+            username_lc in existing_usernames_lc
+            or username_lc in seen_usernames_lc
+            or email_lc in existing_emails_lc
+            or email_lc in seen_emails_lc
+        ):
             skipped.append(username)
             continue
+        seen_usernames_lc.add(username_lc)
+        seen_emails_lc.add(email_lc)
         role_objs = [role_map[name] for name in per_user_role_names[username]]
         user = sm.user_model(
             username=username,

{fastapi_rtk-2.6.1 → fastapi_rtk-2.7.1}/tests/unit/cli/test_decorators.py

@@ -3,10 +3,10 @@
 import asyncio
 import unittest.mock
 
+import click
 import fastapi_cli.exceptions
 import pytest
 import typer
-
 from fastapi_rtk.cli.decorators import (
     _check_existing_app,
     check_existing_app_silent,
@@ -102,6 +102,63 @@ class TestEnsureAppLoaded:
                 g.is_cli = False
 
 
+class TestCommandRecording:
+    """`g.cli_command` holds the full CLI path and is set before the app import."""
+
+    def test_records_full_command_path_before_import(self, global_setter):
+        global_setter("is_cli", False)
+
+        from fastapi_rtk.globals import g
+
+        captured = {}
+
+        def _capture(*args, **kwargs):
+            # Grab g.cli_command at import time: the guard runs during this import.
+            captured["cli_command"] = g.cli_command
+
+        root = click.Context(click.Command("fastapi-rtk"), info_name="fastapi-rtk")
+        export = click.Context(click.Command("export"), parent=root, info_name="export")
+        leaf = click.Context(
+            click.Command("licenses"), parent=export, info_name="licenses"
+        )
+
+        with unittest.mock.patch(
+            "fastapi_cli.discover.get_import_data", side_effect=_capture
+        ):
+
+            @ensure_app_loaded
+            def fn():
+                return "done"
+
+            try:
+                with leaf:
+                    assert fn() == "done"
+                assert captured["cli_command"] == "export licenses"
+                assert g.cli_command == "export licenses"
+            finally:
+                g.is_cli = False
+                g.cli_command = None
+
+    def test_command_is_none_without_click_context(self, global_setter):
+        global_setter("is_cli", False)
+
+        from fastapi_rtk.globals import g
+
+        g.cli_command = "stale"
+        with unittest.mock.patch("fastapi_cli.discover.get_import_data"):
+
+            @ensure_app_loaded
+            def fn():
+                return "done"
+
+            try:
+                assert fn() == "done"
+                assert g.cli_command is None
+            finally:
+                g.is_cli = False
+                g.cli_command = None
+
+
 class TestInProcessReusesLoadedApp:
     """When `g.current_app` is set (in-process, e.g. the app lifespan) the
     decorators reuse the loaded app: no import, no CLI flag, no table-init.

{fastapi_rtk-2.6.1 → fastapi_rtk-2.7.1}/tests/unit/security/sqla/test_apis.py

@@ -11,6 +11,8 @@ can be tested with a constructed UsersApi without going through
 
 import types
 
+import fastapi
+import pytest
 
 from fastapi_rtk.security.sqla.apis import (
     AuthApi,
@@ -161,3 +163,57 @@ class TestAuthApiSchemas:
         api = object.__new__(AuthApi)
         schema = api.update_user_schema
         assert schema is not None
+
+
+@pytest.mark.asyncio
+class TestUsersApiUniquenessGuard:
+    def _seed(self, session, username, email):
+        user = User(username=username, email=email, password="h")
+        session.add(user)
+        session.commit()
+        return user
+
+    def _api(self):
+        return object.__new__(UsersApi)
+
+    async def test_pre_add_rejects_case_variant_email(self, session):
+        self._seed(session, "existing", "Foo@X.com")
+        item = User(username="brandnew", email="foo@x.com", password="h")
+        with pytest.raises(fastapi.HTTPException) as exc:
+            await self._api().pre_add(item, types.SimpleNamespace(session=session))
+        assert exc.value.status_code == 400
+
+    async def test_pre_add_rejects_case_variant_username(self, session):
+        self._seed(session, "Admin", "admin@x.com")
+        item = User(username="admin", email="fresh@x.com", password="h")
+        with pytest.raises(fastapi.HTTPException):
+            await self._api().pre_add(item, types.SimpleNamespace(session=session))
+
+    async def test_pre_add_allows_unique_user(self, session):
+        self._seed(session, "existing", "foo@x.com")
+        item = User(username="brandnew", email="bar@x.com", password="h")
+        assert (
+            await self._api().pre_add(item, types.SimpleNamespace(session=session))
+            is None
+        )
+
+    async def test_pre_update_merge_rejects_other_users_email(self, session):
+        self._seed(session, "aa", "a@x.com")
+        target = self._seed(session, "bb", "b@x.com")
+        with pytest.raises(fastapi.HTTPException):
+            await self._api().pre_update_merge(
+                target,
+                {"email": "A@X.com"},
+                types.SimpleNamespace(session=session),
+            )
+
+    async def test_pre_update_merge_allows_own_email(self, session):
+        target = self._seed(session, "aa", "A@x.com")
+        assert (
+            await self._api().pre_update_merge(
+                target,
+                {"email": "a@x.com"},
+                types.SimpleNamespace(session=session),
+            )
+            is None
+        )

{fastapi_rtk-2.6.1 → fastapi_rtk-2.7.1}/tests/unit/security/sqla/test_security_manager.py

@@ -382,6 +382,61 @@ class TestImportData:
         result = await sm.import_data("users", payload, session=session)
         assert result["imported"] == ["admin"]
 
+    async def test_import_users_skips_case_variant_username(self, sm, session):
+        base = {
+            "password": "$2b$12$x",
+            "first_name": "",
+            "last_name": "",
+            "roles": [],
+        }
+        await sm.import_data(
+            "users",
+            {"Admin": {"email": "a@x.com", "username": "Admin", **base}},
+            session=session,
+        )
+        result = await sm.import_data(
+            "users",
+            {"admin": {"email": "different@x.com", "username": "admin", **base}},
+            session=session,
+        )
+        assert result["imported"] == []
+        assert result["skipped"] == ["admin"]
+
+    async def test_import_users_skips_case_variant_email(self, sm, session):
+        base = {
+            "password": "$2b$12$x",
+            "first_name": "",
+            "last_name": "",
+            "roles": [],
+        }
+        await sm.import_data(
+            "users",
+            {"admin": {"email": "Admin@Example.com", "username": "admin", **base}},
+            session=session,
+        )
+        result = await sm.import_data(
+            "users",
+            {"other": {"email": "admin@example.com", "username": "other", **base}},
+            session=session,
+        )
+        assert result["imported"] == []
+        assert result["skipped"] == ["other"]
+
+    async def test_import_users_dedups_case_variant_within_payload(self, sm, session):
+        base = {
+            "password": "$2b$12$x",
+            "first_name": "",
+            "last_name": "",
+            "roles": [],
+        }
+        payload = {
+            "first": {"email": "Dup@x.com", "username": "first", **base},
+            "second": {"email": "dup@x.com", "username": "second", **base},
+        }
+        result = await sm.import_data("users", payload, session=session)
+        assert result["imported"] == ["first"]
+        assert result["skipped"] == ["second"]
+
 
 class TestShouldReraise:
     """Behavior of the `_should_reraise` helper that backs `raise_exception`."""

fastapi_rtk-2.6.1/fastapi_rtk/_version.py

@@ -1 +0,0 @@
-__version__ = "2.6.1"