fauth 0.4.0__tar.gz → 0.4.2__tar.gz

{fauth-0.4.0 → fauth-0.4.2}/.github/workflows/cicd.yml

@@ -80,7 +80,7 @@ jobs:
           git config --local user.name "github-actions[bot]"
           git add .pre-commit-config.yaml
           git diff --staged --quiet || git commit -m "chore(config): update pre-commit hooks"
-          git push origin HEAD:${{ github.head_ref }}
+          git push origin "HEAD:${GITHUB_HEAD_REF:-$GITHUB_REF_NAME}"
 
   versioning:
     name: Versioning

fauth-0.4.2/.github/workflows/semgrep.yml

@@ -0,0 +1,29 @@
+name: Semgrep
+
+on:
+  workflow_dispatch:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+  schedule:
+    - cron: "0 0 * * 0" # 00:00 every Sunday
+
+jobs:
+  semgrep_scan:
+    name: Semgrep Analysis
+    runs-on: ubuntu-latest
+    container:
+      image: returntocorp/semgrep
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          token: ${{ secrets.GH_TOKEN || secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
+
+      - name: Run Semgrep
+        run: |
+          semgrep \
+            --config auto \
+            --error \
+            --metrics=auto

fauth-0.4.2/.github/workflows/snyk.yml

@@ -0,0 +1,35 @@
+name: Snyk Security with uv
+
+on:
+  push:
+    branches: ["main"]
+  workflow_dispatch:
+  schedule:
+    - cron: "0 0 * * 0" # 00:00 every Sunday
+
+jobs:
+  snyk_scan:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          token: ${{ secrets.GH_TOKEN || secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
+
+      - name: Setup environment
+        uses: ./.github/actions/setup-python-env
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Export dependencies
+        run: uv export --format requirements-txt --output-file requirements.txt
+
+      - name: Run Snyk Open Source
+        uses: snyk/actions/python@master
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          command: test

{fauth-0.4.0 → fauth-0.4.2}/.pre-commit-config.yaml

@@ -10,6 +10,10 @@ repos:
       - id: trailing-whitespace
       - id: end-of-file-fixer
       - id: detect-private-key
+      - id: check-yaml
+      - id: pretty-format-json
+        args: ['--autofix']
+      - id: check-merge-conflict
 
   - repo: https://github.com/gitleaks/gitleaks
     rev: v8.30.0
@@ -17,11 +21,12 @@ repos:
       - id: gitleaks
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: 'v0.15.10'
+    rev: 'v0.15.11'
     hooks:
       - id: ruff-check
         name: ruff
         args: ['--fix']
+      - id: ruff-format
 
   - repo: https://github.com/PyCQA/bandit
     rev: 1.9.4
@@ -56,3 +61,9 @@ repos:
           - fastapi==0.135.1
           - pyjwt==2.11.0
           - pwdlib==0.3.0
+
+  - repo: https://github.com/hadolint/hadolint
+    rev: v2.14.0
+    hooks:
+      - id: hadolint
+        args: ['--ignore', 'DL3008,DL3015,DL3002']

{fauth-0.4.0 → fauth-0.4.2}/CHANGELOG.md

@@ -1,6 +1,74 @@
 # CHANGELOG
 
 
+## v0.4.2 (2026-04-18)
+
+### Bug Fixes
+
+- Update require_roles to support singular role fields and enum types with regression tests
+  ([#39](https://github.com/justmatias/fauth/pull/39),
+  [`0d2c646`](https://github.com/justmatias/fauth/commit/0d2c646729fcfffe9e10b047e117636b97530620))
+
+
+## v0.4.1 (2026-04-18)
+
+### Bug Fixes
+
+- **ci**: Prevent shell injection in GitHub Actions workflow
+  ([#37](https://github.com/justmatias/fauth/pull/37),
+  [`11835f1`](https://github.com/justmatias/fauth/commit/11835f16cedd3f064c9ffe2df26f02a53f9b81f9))
+
+Fix potential shell injection vulnerability in CI/CD workflow by avoiding GitHub expression
+  interpolation.
+
+## Changes - Removed `env:` block that used `${{ github.head_ref || github.ref_name }}`
+  interpolation - Changed git push command to use GitHub's built-in environment variables
+  (`GITHUB_HEAD_REF` and `GITHUB_REF_NAME`) directly in the shell - Properly quoted the variable to
+  prevent word splitting
+
+## Why Using `${{ }}` expression interpolation with `github.head_ref` in a workflow step can be
+  exploited by attackers who create pull requests with maliciously crafted branch names. By using
+  the shell environment variables `GITHUB_HEAD_REF` and `GITHUB_REF_NAME` (which GitHub Actions
+  automatically provides), we avoid the expression interpolation while maintaining the same
+  functionality. The shell handles these variables safely when properly quoted.
+
+## Semgrep Finding Details Using variable interpolation `${{...}}` with `github` context data in a
+  `run:` step could allow an attacker to inject their own code into the runner. This would allow
+  them to steal secrets and code. `github` context data can have arbitrary user input and should be
+  treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the
+  data and use the environment variable in the `run:` script. Be sure to use double-quotes the
+  environment variable, like this: "$ENVVAR".
+
+Semgrep Assistant generated this pull request to fix [a
+  finding](https://semgrep.dev/orgs/justmatias/findings/756619268) from the detection rule
+  [yaml.github-actions.security.run-shell-injection.run-shell-injection](https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection).
+
+Co-authored-by: Semgrep Autofix <autofix@semgrep.com>
+
+### Chores
+
+- Add Snyk and Semgrep security scanning workflows
+  ([#35](https://github.com/justmatias/fauth/pull/35),
+  [`768b38b`](https://github.com/justmatias/fauth/commit/768b38b2880b9a52cb8a7d8d3a5c6200dc456db9))
+
+* ci: add Snyk and Semgrep security scanning workflows
+
+* chore(config): update pre-commit hooks
+
+* chore: update autotrigger
+
+* chore: change semgrep metrics option from off to auto
+
+* ci: fix shell injection vulnerability in cicd workflow
+
+---------
+
+Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
+
+- Remove pre-commit autoupdate workflow ([#36](https://github.com/justmatias/fauth/pull/36),
+  [`7022909`](https://github.com/justmatias/fauth/commit/7022909b390658add76bb9bf767b0fdf9fcf4657))
+
+
 ## v0.4.0 (2026-04-15)
 
 ### Chores

{fauth-0.4.0 → fauth-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fauth
-Version: 0.4.0
+Version: 0.4.2
 Summary: Ergonomic, lightweight JWT authentication for FastAPI. Secure your routes instantly with plug-and-play dependency injection
 Project-URL: Homepage, https://github.com/justmatias/fauth
 Project-URL: Repository, https://github.com/justmatias/fauth

{fauth-0.4.0 → fauth-0.4.2}/fauth/providers/provider.py

@@ -1,3 +1,4 @@
+import enum
 from collections.abc import Callable
 from typing import Annotated, Any, Generic, TypeVar
 
@@ -111,16 +112,21 @@ class AuthProvider(Generic[T]):
             )
         return user
 
-    def require_roles(self, roles: list[str]) -> Callable:
+    def require_roles(self, required_roles: list[str | enum.Enum]) -> Callable:
         """Dependency demanding the current user has all specified roles."""
 
         async def role_checker(
             user: Annotated[T, Depends(self.require_active_user)],
         ) -> T:
-            user_roles = getattr(user, "roles", [])
-            required_roles = set(roles)
-            for role in required_roles:
-                if role not in user_roles:
+            roles = list(getattr(user, "roles", []))
+            role = getattr(user, "role", None)
+
+            if role is not None:
+                roles.append(role)
+
+            required_roles_set = set(required_roles)
+            for role in required_roles_set:
+                if role not in roles:
                     await logger.error(
                         "Authorization failed",
                         reason="Missing role",

{fauth-0.4.0 → fauth-0.4.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fauth"
-version = "0.4.0"
+version = "0.4.2"
 description = "Ergonomic, lightweight JWT authentication for FastAPI. Secure your routes instantly with plug-and-play dependency injection"
 readme = "README.md"
 requires-python = ">=3.12"

fauth-0.4.2/pytest.ini

@@ -0,0 +1,4 @@
+[pytest]
+pythonpath = fauth
+markers =
+    regression: marks tests as regression tests

{fauth-0.4.0 → fauth-0.4.2}/tests/providers/conftest.py

@@ -1,3 +1,4 @@
+import enum
 import time
 from typing import Any
 from uuid import UUID, uuid4
@@ -13,6 +14,11 @@ from fauth.providers import AuthProvider
 from fauth.testing import FakeIdentityLoader, FakeUserLoader
 
 
+class Role(enum.Enum):
+    ADMIN = "admin"
+    USER = "user"
+
+
 class DummyUser(BaseModel):
     id_: UUID = Field(default_factory=uuid4)
     hashed_password: str = Field(default=hash_password("secret_password"))
@@ -21,6 +27,25 @@ class DummyUser(BaseModel):
     permissions: list[str] = Field(default_factory=list)
 
 
+class StringRoleUser(BaseModel):
+    id_: UUID = Field(default_factory=uuid4)
+    is_active: bool = Field(default=True)
+    role: str = "admin"
+
+
+class EnumRoleUser(BaseModel):
+    id_: UUID = Field(default_factory=uuid4)
+    is_active: bool = Field(default=True)
+    role: Role = Role.ADMIN
+
+
+class CombinedRolesUser(BaseModel):
+    id_: UUID = Field(default_factory=uuid4)
+    is_active: bool = Field(default=True)
+    roles: list[str] = Field(default_factory=lambda: ["user"])
+    role: str = "admin"
+
+
 @pytest.fixture
 def user() -> DummyUser:
     return DummyUser(roles=["admin"], permissions=["read", "write"])
@@ -31,6 +56,21 @@ def inactive_user() -> DummyUser:
     return DummyUser(is_active=False)
 
 
+@pytest.fixture
+def string_role_user() -> StringRoleUser:
+    return StringRoleUser()
+
+
+@pytest.fixture
+def enum_role_user() -> EnumRoleUser:
+    return EnumRoleUser()
+
+
+@pytest.fixture
+def combined_roles_user() -> CombinedRolesUser:
+    return CombinedRolesUser()
+
+
 @pytest.fixture
 def user_loader() -> FakeUserLoader[DummyUser]:
     return FakeUserLoader()
@@ -132,9 +172,12 @@ def expired_refresh_token(auth_config: AuthConfig) -> str:
 
 
 @pytest.fixture
-def inactive_user_refresh_token(auth_config: AuthConfig, inactive_user: DummyUser) -> str:
+def inactive_user_refresh_token(
+    auth_config: AuthConfig, inactive_user: DummyUser
+) -> str:
     return create_refresh_token(sub=str(inactive_user.id_), config=auth_config)
 
+
 @pytest.fixture
 def _populate_user(user_loader: FakeUserLoader[DummyUser], user: DummyUser) -> None:
     user_loader.add_user(str(user.id_), user)
@@ -195,6 +238,25 @@ def _populate_identity_inactive_user(
     identity_loader.add_user("alice", inactive_user)
 
 
+@pytest.fixture
+def user_with_singular_role() -> DummyUser:
+    return DummyUser(roles=["admin"])
+
+
+@pytest.fixture
+def _populate_user_with_singular_role(
+    user_loader: FakeUserLoader[DummyUser], user_with_singular_role: DummyUser
+) -> None:
+    user_loader.add_user(str(user_with_singular_role.id_), user_with_singular_role)
+
+
+@pytest.fixture
+def user_with_singular_role_token(
+    auth_config: AuthConfig, user_with_singular_role: DummyUser
+) -> str:
+    return create_access_token(sub=str(user_with_singular_role.id_), config=auth_config)
+
+
 @pytest.fixture
 def password() -> str:
     return "secret_password"

{fauth-0.4.0 → fauth-0.4.2}/tests/providers/test_provider.py

@@ -8,7 +8,14 @@ from fauth.crypto import hash_password
 from fauth.providers import AuthProvider
 from fauth.testing import FakeIdentityLoader
 
-from .conftest import DummyUser, FakeUserLoader
+from .conftest import (
+    CombinedRolesUser,
+    DummyUser,
+    EnumRoleUser,
+    FakeUserLoader,
+    Role,
+    StringRoleUser,
+)
 
 
 def test_require_user_expired_token(client: TestClient, expired_token: str) -> None:
@@ -59,6 +66,50 @@ def test_require_roles_granted(client: TestClient, user_token: str) -> None:
     assert response.status_code == 200
 
 
+@pytest.mark.usefixtures("_populate_user_with_singular_role")
+@pytest.mark.regression
+def test_require_roles_with_singular_role_fallback(
+    client: TestClient, user_with_singular_role_token: str
+) -> None:
+    response = client.get(
+        "/admin", headers={"Authorization": f"Bearer {user_with_singular_role_token}"}
+    )
+    assert response.status_code == 200
+
+
+@pytest.mark.asyncio
+@pytest.mark.regression
+async def test_require_roles_with_string_role_fallback(
+    provider: AuthProvider[DummyUser],
+    string_role_user: StringRoleUser,
+) -> None:
+    role_checker = provider.require_roles(["admin"])
+    result = await role_checker(string_role_user)
+    assert result.id_ == string_role_user.id_
+
+
+@pytest.mark.asyncio
+@pytest.mark.regression
+async def test_require_roles_combined_roles_and_role(
+    provider: AuthProvider[DummyUser],
+    combined_roles_user: CombinedRolesUser,
+) -> None:
+    role_checker = provider.require_roles(["admin"])
+    result = await role_checker(combined_roles_user)
+    assert result.id_ == combined_roles_user.id_
+
+
+@pytest.mark.asyncio
+@pytest.mark.regression
+async def test_require_roles_with_enum_role_fallback(
+    provider: AuthProvider[DummyUser],
+    enum_role_user: EnumRoleUser,
+) -> None:
+    role_checker = provider.require_roles([Role.ADMIN])
+    result = await role_checker(enum_role_user)
+    assert result.id_ == enum_role_user.id_
+
+
 @pytest.mark.usefixtures("_populate_no_roles_user")
 def test_require_roles_denied(client: TestClient, no_roles_user_token: str) -> None:
     response = client.get(

{fauth-0.4.0 → fauth-0.4.2}/uv.lock

@@ -340,7 +340,7 @@ wheels = [
 
 [[package]]
 name = "fauth"
-version = "0.3.1"
+version = "0.4.1"
 source = { editable = "." }
 dependencies = [
     { name = "fastapi" },

fauth-0.4.0/.github/workflows/pre-commit-autoupdate.yml

@@ -1,45 +0,0 @@
-# The workflow checks out the repository, installs pre-commit, and runs the autoupdate command.
-# If there are any updates, it creates a pull request with the changes.
-
-name: Pre-commit Update
-
-on:
-  schedule:
-    - cron: '0 2 * * 1' # Mondays at 2 AM UTC
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  auto-update:
-    permissions:
-      contents: write
-      pull-requests: write
-
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          token: ${{ secrets.GH_TOKEN }}
-          fetch-depth: 0
-
-      - name: Setup environment
-        uses: ./.github/actions/setup-python-env
-        with:
-          python-version: '3.13'
-
-      - name: Autoupdate pre-commit hooks
-        run: uv run pre-commit autoupdate
-
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v8
-        with:
-          token: ${{ secrets.GH_TOKEN }}
-          branch: chore/pre-commit-autoupdate
-          title: Update pre-commit hooks
-          commit-message: 'chore(config): update pre-commit hooks'
-          body: |
-            This PR was created automatically by the pre-commit autoupdate workflow.
-            It updates the pre-commit hooks to their latest versions.
-          labels: update-hooks

fauth-0.4.0/pytest.ini

@@ -1,2 +0,0 @@
-[pytest]
-pythonpath = fauth