gramps-webapi 3.22.1__tar.gz → 3.22.2__tar.gz

{gramps_webapi-3.22.1 → gramps_webapi-3.22.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gramps-webapi
-Version: 3.22.1
+Version: 3.22.2
 Summary: A RESTful web API for the Gramps genealogical database.
 Author: Gramps Development Team
 Author-email: "David M. Straub" <straub@protonmail.com>

{gramps_webapi-3.22.1 → gramps_webapi-3.22.2}/gramps_webapi/_version.py

@@ -19,4 +19,4 @@
 
 """Version information."""
 
-__version__ = "3.22.1"
+__version__ = "3.22.2"

{gramps_webapi-3.22.1 → gramps_webapi-3.22.2}/gramps_webapi/api/media.py

@@ -390,6 +390,7 @@ def check_quota_media(
         usage_dict = get_tree_usage(tree)
         assert usage_dict is not None, "Unexpected error while looking up usage data."
     usage = usage_dict["usage_media"]
+    assert usage is not None, "Unexpected error while looking up usage data."
     quota = usage_dict.get("quota_media")
     if quota is None:
         return

{gramps_webapi-3.22.1 → gramps_webapi-3.22.2}/gramps_webapi/api/resources/trees.py

@@ -77,7 +77,7 @@ from .schemas import TreeConfigSchema, TreeSchema
 TREE_ID_REGEX = re.compile(r"^[a-zA-Z0-9_-]+$")
 
 
-def get_tree_details(tree_id: str) -> Dict[str, str | bool | int]:
+def get_tree_details(tree_id: str) -> Dict[str, str | bool | int | None]:
     """Get details about a tree."""
     try:
         dbmgr = WebDbManager(

{gramps_webapi-3.22.1 → gramps_webapi-3.22.2}/gramps_webapi/api/util.py

@@ -747,6 +747,7 @@ def check_quota_people(
         usage_dict = get_tree_usage(tree)
     assert usage_dict is not None, "Unexpected error while looking up usage data."
     usage = usage_dict["usage_people"]
+    assert usage is not None, "Unexpected error while looking up usage data."
     quota = usage_dict.get("quota_people")
     if quota is None:
         return

{gramps_webapi-3.22.1 → gramps_webapi-3.22.2}/gramps_webapi/auth/__init__.py

@@ -30,7 +30,7 @@ import sqlalchemy as sa
 from flask import current_app
 from flask_sqlalchemy import SQLAlchemy
 from sqlalchemy.exc import IntegrityError, StatementError
-from sqlalchemy.orm import mapped_column
+from sqlalchemy.orm import Mapped, mapped_column
 from sqlalchemy.sql.functions import coalesce
 
 
@@ -483,7 +483,7 @@ def config_get(key: str) -> Optional[str]:
     return config.value
 
 
-def config_get_all() -> Dict[str, str]:
+def config_get_all() -> Dict[str, str | None]:
     """Get all config items as dictionary."""
     query = user_db.session.query(Config)  # pylint: disable=no-member
     configs = query.all()
@@ -513,7 +513,7 @@ def config_delete(key: str) -> None:
         user_db.session.commit()  # pylint: disable=no-member
 
 
-def get_tree_usage(tree: str) -> Optional[dict[str, int]]:
+def get_tree_usage(tree: str) -> Optional[dict[str, int | None]]:
     """Get tree usage info."""
     query = user_db.session.query(Tree)  # pylint: disable=no-member
     tree_obj: Tree = query.filter_by(id=tree).scalar()
@@ -529,7 +529,7 @@ def get_tree_usage(tree: str) -> Optional[dict[str, int]]:
     }
 
 
-def get_tree_permissions(tree: str) -> Optional[dict[str, int]]:
+def get_tree_permissions(tree: str) -> Optional[dict[str, int | None]]:
     """Get tree permissions."""
     query = user_db.session.query(Tree)  # pylint: disable=no-member
     tree_obj: Tree = query.filter_by(id=tree).scalar()
@@ -667,13 +667,14 @@ class User(user_db.Model):  # type: ignore
 
     __tablename__ = "users"
 
-    id = mapped_column(GUID, primary_key=True)
-    name = mapped_column(sa.String, unique=True, nullable=False)
-    email = mapped_column(sa.String, index=True)
-    fullname = mapped_column(sa.String)
-    pwhash = mapped_column(sa.String, nullable=False)
-    role = mapped_column(sa.Integer, default=0)
-    tree = mapped_column(sa.String, index=True)
+    id: Mapped[uuid.UUID] = mapped_column(GUID, primary_key=True)
+    name: Mapped[str] = mapped_column(sa.String, unique=True, nullable=False)
+    email: Mapped[str | None] = mapped_column(sa.String, index=True)
+    fullname: Mapped[str | None] = mapped_column(sa.String)
+    pwhash: Mapped[str] = mapped_column(sa.String, nullable=False)
+    # nullable in the schema, but always set via the default
+    role: Mapped[int] = mapped_column(sa.Integer, nullable=True, default=0)
+    tree: Mapped[str | None] = mapped_column(sa.String, index=True)
 
     def __repr__(self):
         """Return string representation of instance."""
@@ -685,19 +686,19 @@ class AccessToken(user_db.Model):  # type: ignore
 
     __tablename__ = "access_tokens"
 
-    id = mapped_column(sa.Integer, primary_key=True, autoincrement=True)
-    user_id = mapped_column(
+    id: Mapped[int] = mapped_column(sa.Integer, primary_key=True, autoincrement=True)
+    user_id: Mapped[uuid.UUID] = mapped_column(
         GUID, sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
     )
-    scope = mapped_column(sa.String(64), nullable=False, index=True)
-    token_hash = mapped_column(sa.String(64), nullable=True)
-    created_at = mapped_column(
+    scope: Mapped[str] = mapped_column(sa.String(64), nullable=False, index=True)
+    token_hash: Mapped[str | None] = mapped_column(sa.String(64), nullable=True)
+    created_at: Mapped[datetime] = mapped_column(
         sa.DateTime, nullable=False, server_default=sa.func.now()
     )
-    updated_at = mapped_column(
+    updated_at: Mapped[datetime] = mapped_column(
         sa.DateTime, nullable=False, server_default=sa.func.now()
     )
-    revoked_at = mapped_column(sa.DateTime, nullable=True)
+    revoked_at: Mapped[datetime | None] = mapped_column(sa.DateTime, nullable=True)
 
     __table_args__ = (
         sa.UniqueConstraint("user_id", "scope", name="uq_access_tokens_user_scope"),
@@ -717,9 +718,9 @@ class Config(user_db.Model):  # type: ignore
 
     __tablename__ = "configuration"
 
-    id = mapped_column(sa.Integer, primary_key=True)
-    key = mapped_column(sa.String, unique=True, nullable=False)
-    value = mapped_column(sa.String)
+    id: Mapped[int] = mapped_column(sa.Integer, primary_key=True)
+    key: Mapped[str] = mapped_column(sa.String, unique=True, nullable=False)
+    value: Mapped[str | None] = mapped_column(sa.String)
 
     def __repr__(self):
         """Return string representation of instance."""
@@ -731,16 +732,18 @@ class Tree(user_db.Model):  # type: ignore
 
     __tablename__ = "trees"
 
-    id = mapped_column(sa.String, primary_key=True)
-    quota_media = mapped_column(sa.BigInteger)
-    quota_people = mapped_column(sa.Integer)
-    quota_ai = mapped_column(sa.Integer)
-    usage_media = mapped_column(sa.BigInteger)
-    usage_people = mapped_column(sa.Integer)
-    usage_ai = mapped_column(sa.Integer)
-    min_role_ai = mapped_column(sa.Integer)
-    enabled = mapped_column(sa.Integer, default=1, server_default="1")
-    config = mapped_column(sa.JSON, nullable=True)
+    id: Mapped[str] = mapped_column(sa.String, primary_key=True)
+    quota_media: Mapped[int | None] = mapped_column(sa.BigInteger)
+    quota_people: Mapped[int | None] = mapped_column(sa.Integer)
+    quota_ai: Mapped[int | None] = mapped_column(sa.Integer)
+    usage_media: Mapped[int | None] = mapped_column(sa.BigInteger)
+    usage_people: Mapped[int | None] = mapped_column(sa.Integer)
+    usage_ai: Mapped[int | None] = mapped_column(sa.Integer)
+    min_role_ai: Mapped[int | None] = mapped_column(sa.Integer)
+    enabled: Mapped[int | None] = mapped_column(
+        sa.Integer, default=1, server_default="1"
+    )
+    config: Mapped[dict | None] = mapped_column(sa.JSON, nullable=True)
 
     def __repr__(self):
         """Return string representation of instance."""
@@ -752,14 +755,14 @@ class OIDCAccount(user_db.Model):  # type: ignore
 
     __tablename__ = "oidc_accounts"
 
-    id = mapped_column(sa.Integer, primary_key=True, autoincrement=True)
-    user_id = mapped_column(
+    id: Mapped[int] = mapped_column(sa.Integer, primary_key=True, autoincrement=True)
+    user_id: Mapped[uuid.UUID] = mapped_column(
         GUID, sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
     )
-    provider_id = mapped_column(sa.String(64), nullable=False)
-    subject_id = mapped_column(sa.String(255), nullable=False)
-    email = mapped_column(sa.String(255), nullable=True, index=True)
-    created_at = mapped_column(
+    provider_id: Mapped[str] = mapped_column(sa.String(64), nullable=False)
+    subject_id: Mapped[str] = mapped_column(sa.String(255), nullable=False)
+    email: Mapped[str | None] = mapped_column(sa.String(255), nullable=True, index=True)
+    created_at: Mapped[datetime] = mapped_column(
         sa.DateTime, nullable=False, server_default=sa.func.now()
     )
 
@@ -779,11 +782,11 @@ class TaskTree(user_db.Model):  # type: ignore
 
     __tablename__ = "task_tree"
 
-    task_id = mapped_column(sa.String(155), primary_key=True)
-    tree = mapped_column(sa.String, index=True)
-    user_id = mapped_column(sa.String, index=True)
-    name = mapped_column(sa.String, nullable=False)
-    created_at = mapped_column(
+    task_id: Mapped[str] = mapped_column(sa.String(155), primary_key=True)
+    tree: Mapped[str | None] = mapped_column(sa.String, index=True)
+    user_id: Mapped[str | None] = mapped_column(sa.String, index=True)
+    name: Mapped[str] = mapped_column(sa.String, nullable=False)
+    created_at: Mapped[datetime] = mapped_column(
         sa.DateTime, nullable=False, server_default=sa.func.now()
     )
 

{gramps_webapi-3.22.1 → gramps_webapi-3.22.2}/gramps_webapi/auth/const.py

@@ -129,6 +129,15 @@ PERMISSIONS[ROLE_ADMIN] = PERMISSIONS[ROLE_OWNER] | {
     PERM_DISABLE_TREE,
 }
 
+# Users with a negative role (disabled or unconfirmed) hold no permissions,
+# but the role must still be a key here: get_permissions() looks up
+# PERMISSIONS[user.role] directly, and the OIDC callback resolves permissions
+# before it checks for a disabled account, so a missing key raises instead of
+# reaching the "Account Under Review" page. Local login is unaffected (it
+# rejects a negative role before any permission lookup).
+PERMISSIONS[ROLE_DISABLED] = set()
+PERMISSIONS[ROLE_UNCONFIRMED] = set()
+
 # keys/values for user claims
 CLAIM_LIMITED_SCOPE = "limited_scope"
 SCOPE_RESET_PW = "reset_password"

{gramps_webapi-3.22.1 → gramps_webapi-3.22.2}/gramps_webapi.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gramps-webapi
-Version: 3.22.1
+Version: 3.22.2
 Summary: A RESTful web API for the Gramps genealogical database.
 Author: Gramps Development Team
 Author-email: "David M. Straub" <straub@protonmail.com>

{gramps_webapi-3.22.1 → gramps_webapi-3.22.2}/tests/test_endpoints/test_oidc.py

@@ -934,6 +934,80 @@ class TestOIDCSingleTree(unittest.TestCase):
             )
         self.assertEqual(rv.status_code, 422)
 
+    @patch("gramps_webapi.api.resources.oidc.is_oidc_enabled", return_value=True)
+    @patch(
+        "gramps_webapi.api.resources.oidc.get_available_oidc_providers",
+        return_value=["custom"],
+    )
+    @patch("gramps_webapi.api.resources.oidc.create_or_update_oidc_user")
+    @patch("gramps_webapi.api.resources.oidc.get_name")
+    def test_callback_negative_role_renders_review_page(
+        self,
+        mock_get_name,
+        mock_create_user,
+        mock_providers,
+        mock_oidc_enabled,
+    ):
+        """A disabled or unconfirmed account sees the review page, not a 500.
+
+        New OIDC sign-ups default to ROLE_DISABLED when no group->role
+        mapping is configured, and an account may also be ROLE_UNCONFIRMED.
+        Resolving permissions for either negative role must not raise, so
+        that the callback reaches its "Account Under Review" branch and
+        renders it instead of returning 500.
+        """
+        from gramps_webapi.auth import add_user, delete_user, get_guid, get_tree
+        from gramps_webapi.auth.const import ROLE_DISABLED, ROLE_UNCONFIRMED
+
+        for role in (ROLE_DISABLED, ROLE_UNCONFIRMED):
+            with self.subTest(role=role):
+                username = f"oidc_negative_{role}"
+                with self.client.application.app_context():
+                    # Belong to the same tree as the seeded users, so tree
+                    # resolution succeeds and the login is not refused for
+                    # want of a tree; the account is simply not active.
+                    tree = get_tree(get_guid("owner"))
+                    add_user(
+                        name=username,
+                        password="disabled-pw",
+                        role=role,
+                        tree=tree,
+                    )
+                    account_guid = get_guid(username)
+
+                try:
+                    mock_create_user.return_value = account_guid
+                    mock_get_name.return_value = username
+
+                    mock_oauth = MagicMock()
+                    mock_oidc_client = MagicMock()
+                    mock_oauth.gramps_custom = mock_oidc_client
+                    mock_oidc_client.authorize_access_token.return_value = {
+                        "access_token": "t"
+                    }
+                    mock_oidc_client.userinfo.return_value = {
+                        "sub": f"negative-subject-{role}",
+                        "email": "inactive@example.com",
+                    }
+
+                    # get_tree_id_and_permissions() -> get_permissions()
+                    # runs for real here: that lookup is what used to raise
+                    # KeyError for a negative role.
+                    with patch.dict(
+                        self.client.application.extensions,
+                        {"authlib.integrations.flask_client": mock_oauth},
+                        clear=False,
+                    ):
+                        rv = self.client.get(
+                            BASE_URL + "/oidc/callback/custom?code=auth_code"
+                        )
+
+                    self.assertEqual(rv.status_code, 200)
+                    self.assertIn(b"Account Under Review", rv.data)
+                finally:
+                    with self.client.application.app_context():
+                        delete_user(username)
+
 
 class TestOIDCCodeExchange(unittest.TestCase):
     """Test cases for the single-use exchange code and its redemption."""