fastapi-rtk 2.7.0__tar.gz → 2.8.0__tar.gz

{fastapi_rtk-2.7.0 → fastapi_rtk-2.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-rtk
-Version: 2.7.0
+Version: 2.8.0
 Summary: A package that provides a set of tools to build a FastAPI application with a Class-Based CRUD API.
 Project-URL: Homepage, https://codeberg.org/datatactics/fastapi-rtk
 Project-URL: Issues, https://codeberg.org/datatactics/fastapi-rtk/issues

fastapi_rtk-2.8.0/fastapi_rtk/_version.py

@@ -0,0 +1 @@
+__version__ = "2.8.0"

{fastapi_rtk-2.7.0 → fastapi_rtk-2.8.0}/fastapi_rtk/cli/commands/security.py

@@ -129,7 +129,7 @@ async def import_users(
     ] = False,
 ):
     """
-    Import users from a file produced by export-users. Existing usernames are skipped.
+    Import users from a file produced by export-users, skipping case-insensitive username/email matches.
     """
     payload = _load_import_payload(
         file_path,

{fastapi_rtk-2.7.0 → fastapi_rtk-2.8.0}/fastapi_rtk/const.py

@@ -148,6 +148,7 @@ BEARER_STRATEGY_CONFIG = {
 class ErrorCode(str, enum.Enum):
     GET_USER_MISSING_TOKEN_OR_INACTIVE_USER = "GET_USER_MISSING_TOKEN_OR_INACTIVE_USER"
     GET_USER_NO_ROLES = "GET_USER_NO_ROLES"
+    USER_ALREADY_EXISTS = "USER_ALREADY_EXISTS"
     PERMISSION_DENIED = "PERMISSION_DENIED"
     FEATURE_NOT_IMPLEMENTED = "FEATURE_NOT_IMPLEMENTED"
     PAGE_NOT_FOUND = "PAGE_NOT_FOUND"

{fastapi_rtk-2.7.0 → fastapi_rtk-2.8.0}/fastapi_rtk/security/sqla/apis.py

@@ -238,6 +238,9 @@ class UsersApi(ModelRestApi):
             if col.name == "password":
                 col.required = False
 
+    async def pre_add(self, item, params):
+        await self._check_user_unique(params.session, item.email, item.username)
+
     async def post_add(self, item, params):
         await g.current_app.sm.update_user(
             user_update={"password": item.password},
@@ -246,6 +249,14 @@ class UsersApi(ModelRestApi):
         )
         await self.datamodel.add(params.session, item)
 
+    async def pre_update_merge(self, item, data, params):
+        await self._check_user_unique(
+            params.session,
+            data.get("email", item.email),
+            data.get("username", item.username),
+            current_id=item.id,
+        )
+
     async def post_update(self, item, params):
         if params.body.password:
             await g.current_app.sm.update_user(
@@ -255,6 +266,41 @@ class UsersApi(ModelRestApi):
             )
         await self.datamodel.add(params.session, item)
 
+    @classmethod
+    async def _check_user_unique(
+        cls,
+        session: SQLASession,
+        email: str,
+        username: str,
+        current_id: int | None = None,
+    ):
+        """
+        Reject a create/update that collides with an existing user.
+
+        Matching is case-insensitive (mirrors `get_by_email` /
+        `get_by_username`), so `A.b@x.com` and `a.b@x.com` are the same
+        user and cannot both exist via the API.
+
+        Args:
+            session (SQLASession): The active database session.
+            email (str): The email to check for an existing owner.
+            username (str): The username to check for an existing owner.
+            current_id (int | None, optional): Id of the row being updated, excluded from the conflict check. Defaults to None.
+
+        Raises:
+            fastapi.HTTPException: 400 when another user already owns the email or username.
+        """
+        user_db = UserDatabase(session, User)
+        for existing in (
+            await user_db.get_by_email(email),
+            await user_db.get_by_username(username),
+        ):
+            if existing is not None and existing.id != current_id:
+                raise fastapi.HTTPException(
+                    fastapi.status.HTTP_400_BAD_REQUEST,
+                    ErrorCode.USER_ALREADY_EXISTS,
+                )
+
 
 class RolesApi(ModelRestApi):
     resource_name = "roles"

{fastapi_rtk-2.7.0 → fastapi_rtk-2.8.0}/fastapi_rtk/security/sqla/security_manager/_import.py

@@ -17,7 +17,10 @@ inserts rather than N reads plus N inserts.
 import collections.abc
 import typing
 
+import sqlalchemy
+
 from ....backends.sqla.session import SQLASession
+from ....utils import smart_run
 
 if typing.TYPE_CHECKING:
     from ..models import Role
@@ -43,12 +46,14 @@ async def import_users(
 
     The payload's top-level keys are usernames; each value is the user record
     dict (email, password hash, first/last name, roles list, optional active
-    flag). Existing usernames are skipped. Password hashes are written
-    verbatim: callers are responsible for ensuring the source dump matches
-    the destination's hashing scheme.
+    flag). A record is skipped when its username or email case-insensitively
+    matches an existing user or an already-imported record, so a case-variant
+    of an existing account is never inserted as a second row. Password hashes
+    are written verbatim: callers are responsible for ensuring the source dump
+    matches the destination's hashing scheme.
 
-    Bulk lookups: one `where_in` query for existing usernames and one for
-    referenced roles, regardless of payload size.
+    Bulk lookups: one case-insensitive query for existing usernames/emails and
+    one for referenced roles, regardless of payload size.
 
     Args:
         sm (SecurityManager): The owning security manager (provides
@@ -71,17 +76,28 @@ async def import_users(
     if not payload:
         return {"imported": [], "skipped": []}
 
-    usernames = list(payload.keys())
-    existing_users = await sm.user_interface.get_many(
-        session,
-        {"list_columns": ["username"], "where_in": ("username", usernames)},
+    user_model = sm.user_model
+    lowered_usernames = [username.lower() for username in payload]
+    lowered_emails = [
+        (record.get("email") or "").lower() for record in payload.values()
+    ]
+    statement = sqlalchemy.select(user_model.username, user_model.email).where(
+        sqlalchemy.or_(
+            sqlalchemy.func.lower(user_model.username).in_(lowered_usernames),
+            sqlalchemy.func.lower(user_model.email).in_(lowered_emails),
+        )
     )
-    existing_usernames = {u.username for u in existing_users}
+    existing = await smart_run(session.execute, statement)
+    existing_usernames_lc: set[str] = set()
+    existing_emails_lc: set[str] = set()
+    for username, email in existing.all():
+        existing_usernames_lc.add(username.lower())
+        existing_emails_lc.add((email or "").lower())
 
     per_user_role_names: dict[str, list[str]] = {
         username: _normalize_role_names(record.get("roles") or [])
         for username, record in payload.items()
-        if username not in existing_usernames
+        if username.lower() not in existing_usernames_lc
     }
     referenced_role_names: set[str] = set()
     for names in per_user_role_names.values():
@@ -96,10 +112,21 @@ async def import_users(
 
     imported: list[str] = []
     skipped: list[str] = []
+    seen_usernames_lc: set[str] = set()
+    seen_emails_lc: set[str] = set()
     for username, record in payload.items():
-        if username in existing_usernames:
+        username_lc = username.lower()
+        email_lc = (record.get("email") or "").lower()
+        if (
+            username_lc in existing_usernames_lc
+            or username_lc in seen_usernames_lc
+            or email_lc in existing_emails_lc
+            or email_lc in seen_emails_lc
+        ):
             skipped.append(username)
             continue
+        seen_usernames_lc.add(username_lc)
+        seen_emails_lc.add(email_lc)
         role_objs = [role_map[name] for name in per_user_role_names[username]]
         user = sm.user_model(
             username=username,

{fastapi_rtk-2.7.0 → fastapi_rtk-2.8.0}/tests/unit/security/sqla/test_apis.py

@@ -11,6 +11,8 @@ can be tested with a constructed UsersApi without going through
 
 import types
 
+import fastapi
+import pytest
 
 from fastapi_rtk.security.sqla.apis import (
     AuthApi,
@@ -161,3 +163,57 @@ class TestAuthApiSchemas:
         api = object.__new__(AuthApi)
         schema = api.update_user_schema
         assert schema is not None
+
+
+@pytest.mark.asyncio
+class TestUsersApiUniquenessGuard:
+    def _seed(self, session, username, email):
+        user = User(username=username, email=email, password="h")
+        session.add(user)
+        session.commit()
+        return user
+
+    def _api(self):
+        return object.__new__(UsersApi)
+
+    async def test_pre_add_rejects_case_variant_email(self, session):
+        self._seed(session, "existing", "Foo@X.com")
+        item = User(username="brandnew", email="foo@x.com", password="h")
+        with pytest.raises(fastapi.HTTPException) as exc:
+            await self._api().pre_add(item, types.SimpleNamespace(session=session))
+        assert exc.value.status_code == 400
+
+    async def test_pre_add_rejects_case_variant_username(self, session):
+        self._seed(session, "Admin", "admin@x.com")
+        item = User(username="admin", email="fresh@x.com", password="h")
+        with pytest.raises(fastapi.HTTPException):
+            await self._api().pre_add(item, types.SimpleNamespace(session=session))
+
+    async def test_pre_add_allows_unique_user(self, session):
+        self._seed(session, "existing", "foo@x.com")
+        item = User(username="brandnew", email="bar@x.com", password="h")
+        assert (
+            await self._api().pre_add(item, types.SimpleNamespace(session=session))
+            is None
+        )
+
+    async def test_pre_update_merge_rejects_other_users_email(self, session):
+        self._seed(session, "aa", "a@x.com")
+        target = self._seed(session, "bb", "b@x.com")
+        with pytest.raises(fastapi.HTTPException):
+            await self._api().pre_update_merge(
+                target,
+                {"email": "A@X.com"},
+                types.SimpleNamespace(session=session),
+            )
+
+    async def test_pre_update_merge_allows_own_email(self, session):
+        target = self._seed(session, "aa", "A@x.com")
+        assert (
+            await self._api().pre_update_merge(
+                target,
+                {"email": "a@x.com"},
+                types.SimpleNamespace(session=session),
+            )
+            is None
+        )

{fastapi_rtk-2.7.0 → fastapi_rtk-2.8.0}/tests/unit/security/sqla/test_security_manager.py

@@ -382,6 +382,61 @@ class TestImportData:
         result = await sm.import_data("users", payload, session=session)
         assert result["imported"] == ["admin"]
 
+    async def test_import_users_skips_case_variant_username(self, sm, session):
+        base = {
+            "password": "$2b$12$x",
+            "first_name": "",
+            "last_name": "",
+            "roles": [],
+        }
+        await sm.import_data(
+            "users",
+            {"Admin": {"email": "a@x.com", "username": "Admin", **base}},
+            session=session,
+        )
+        result = await sm.import_data(
+            "users",
+            {"admin": {"email": "different@x.com", "username": "admin", **base}},
+            session=session,
+        )
+        assert result["imported"] == []
+        assert result["skipped"] == ["admin"]
+
+    async def test_import_users_skips_case_variant_email(self, sm, session):
+        base = {
+            "password": "$2b$12$x",
+            "first_name": "",
+            "last_name": "",
+            "roles": [],
+        }
+        await sm.import_data(
+            "users",
+            {"admin": {"email": "Admin@Example.com", "username": "admin", **base}},
+            session=session,
+        )
+        result = await sm.import_data(
+            "users",
+            {"other": {"email": "admin@example.com", "username": "other", **base}},
+            session=session,
+        )
+        assert result["imported"] == []
+        assert result["skipped"] == ["other"]
+
+    async def test_import_users_dedups_case_variant_within_payload(self, sm, session):
+        base = {
+            "password": "$2b$12$x",
+            "first_name": "",
+            "last_name": "",
+            "roles": [],
+        }
+        payload = {
+            "first": {"email": "Dup@x.com", "username": "first", **base},
+            "second": {"email": "dup@x.com", "username": "second", **base},
+        }
+        result = await sm.import_data("users", payload, session=session)
+        assert result["imported"] == ["first"]
+        assert result["skipped"] == ["second"]
+
 
 class TestShouldReraise:
     """Behavior of the `_should_reraise` helper that backs `raise_exception`."""

fastapi_rtk-2.7.0/fastapi_rtk/_version.py

@@ -1 +0,0 @@
-__version__ = "2.7.0"