mainsequence 9.0.24__tar.gz → 9.0.25__tar.gz

{mainsequence-9.0.24/mainsequence.egg-info → mainsequence-9.0.25}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.24
+Version: 9.0.25
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.24 → mainsequence-9.0.25}/agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md

@@ -167,8 +167,9 @@ a person: the requester. The platform signs the requester into the caller
 assertion it sends to the API, and the SDK verifies it before the handler runs.
 `User.get_logged_user()` still returns the caller, the acting application.
 `User.get_requester()` returns the requester, the checked delegation, with the
-person's own `uid`, `team_uids` and `is_organization_admin`, or `None` when the
-call carries no delegation. A requester-bound call carries the person's
+person's own `uid` and `is_organization_admin`, or `None` when the call carries
+no delegation. `in_teams(team_uids)` on either identity asks the platform which
+of those teams the person belongs to; `team_uids` is deprecated. A requester-bound call carries the person's
 ordinary permissions, including administrative ones.
 
 Each handler decides whether it needs a person. One that needs a person fails
@@ -191,7 +192,7 @@ def require_requester() -> RequestUserIdentity:
 @app.get("/team-reports/{team_uid}")
 def team_report(team_uid: str) -> dict[str, str]:
     requester = require_requester()
-    if not (requester.is_organization_admin or team_uid in requester.team_uids):
+    if not (requester.is_organization_admin or requester.in_teams([team_uid])):
         raise HTTPException(status_code=403, detail="The requester cannot read this report.")
     return {"team_uid": team_uid, "requested_by": requester.uid}
 

{mainsequence-9.0.24 → mainsequence-9.0.25}/agent_scaffold/skills/platform_operations/access_control_and_sharing/SKILL.md

@@ -271,8 +271,9 @@ The requester comes only from the platform. An application never accepts a
 person's UID from a request body, header or query parameter, never parses the
 assertion, headers or MCP `_meta` itself, and never lets a caller choose whom
 it acts for. A FastAPI application that receives a requester-bound call reads
-the requester with `User.get_requester()`, the person's own `uid`, `team_uids`
-and `is_organization_admin`, and authorizes reads and writes against that
+the requester with `User.get_requester()`, the person's own `uid` and
+`is_organization_admin`, checks the person's teams with `in_teams()`, and
+authorizes reads and writes against that
 person's object- and operation-specific permissions. Each handler or tool
 decides whether it needs a person. See
 `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`.

{mainsequence-9.0.24 → mainsequence-9.0.25}/mainsequence/_request_identity.py

@@ -24,6 +24,15 @@ class _RequestScope:
     # assertion; None on any other request. The user stays the caller, the
     # acting application (ADR-0036, requester-bound calls).
     requester: Any = None
+    # The release and Environment the verifier trusts, from deployment
+    # configuration, never from the request. They key membership answers (#225).
+    release_uid: str | None = None
+    environment_uid: str | None = None
+    # in_teams() answers within this request, and the application's cache of
+    # answers across requests with its lifetime (ADR-0036, #225).
+    team_memberships: dict = field(default_factory=dict, repr=False)
+    team_membership_cache: Any = field(default=None, repr=False)
+    team_membership_cache_seconds: float = 0
 
 
 _current_scope: ContextVar[_RequestScope | None] = ContextVar(
@@ -47,6 +56,8 @@ def _request_scope():
         scope.user = None
         scope.caller_assertion = None
         scope.requester = None
+        scope.team_memberships = {}
+        scope.team_membership_cache = None
         _current_scope.reset(token)
 
 
@@ -64,6 +75,24 @@ def _get_request_identity():
     return _authenticated_scope("User.get_logged_user()").user
 
 
+def _team_membership_scope(person_uid: str) -> _RequestScope:
+    """The request whose caller or requester ``person_uid`` is, for in_teams()."""
+    scope = _authenticated_scope("in_teams()")
+    if scope.caller_assertion is None:
+        raise RequestIdentityError(
+            "This request carries no caller assertion. Team membership checks need a "
+            "hosted HTTP request in assertion mode, not local mode or a WebSocket."
+        )
+    people = {scope.user.uid}
+    if scope.requester is not None:
+        people.add(scope.requester.uid)
+    if person_uid not in people:
+        raise RequestIdentityError(
+            "in_teams() answers only for the request's caller or its requester."
+        )
+    return scope
+
+
 def _get_requester():
     """The requester of the current request; None when it is not requester-bound."""
     return _authenticated_scope("User.get_requester()").requester

mainsequence-9.0.25/mainsequence/_team_memberships.py

@@ -0,0 +1,54 @@
+"""Team membership answers an application may reuse (ADR 0036, #225)."""
+
+from __future__ import annotations
+
+import threading
+import time
+from collections import OrderedDict
+
+# At most this many answers per process, and at most this many teams in one
+# call to the platform, which answers no more in one call.
+MAX_CACHED_ANSWERS = 10_000
+MAX_TEAMS_PER_CALL = 100
+
+# The trusted release UID, Environment UID, person UID and team UID.
+AnswerKey = tuple[str, str, str, str]
+
+
+def _now() -> float:
+    return time.monotonic()
+
+
+class TeamMembershipCache:
+    """Yes-or-no answers across requests, oldest dropped first.
+
+    The key starts with the release and Environment the verifier trusts, so an
+    answer obtained for one never answers the other.
+    """
+
+    def __init__(self, max_answers: int = MAX_CACHED_ANSWERS):
+        self._answers: OrderedDict[AnswerKey, tuple[bool, float]] = OrderedDict()
+        self._max_answers = max_answers
+        self._lock = threading.Lock()
+
+    def get(self, key: AnswerKey, *, max_age: float) -> bool | None:
+        """The stored answer when it is younger than ``max_age`` seconds."""
+        if max_age <= 0:
+            return None
+        with self._lock:
+            entry = self._answers.get(key)
+        if entry is None:
+            return None
+        answer, stored_at = entry
+        return answer if _now() - stored_at < max_age else None
+
+    def put(self, key: AnswerKey, answer: bool) -> None:
+        with self._lock:
+            self._answers[key] = (answer, _now())
+            self._answers.move_to_end(key)
+            while len(self._answers) > self._max_answers:
+                self._answers.popitem(last=False)
+
+    def __len__(self) -> int:
+        with self._lock:
+            return len(self._answers)

{mainsequence-9.0.24 → mainsequence-9.0.25}/mainsequence/client/models_user.py

@@ -1,17 +1,23 @@
 from __future__ import annotations
 
 import datetime
+import math
+import warnings
+from collections.abc import Iterable
 from typing import Any, ClassVar, Literal
 from uuid import UUID
 
 from pydantic import BaseModel, ConfigDict, Field, StrictBool, field_validator, model_validator
 
 from mainsequence._request_identity import (
+    CALLER_ASSERTION_HEADER,
     RequestIdentityError,
     _caller_read_headers,
     _get_request_identity,
     _get_requester,
+    _team_membership_scope,
 )
+from mainsequence._team_memberships import MAX_TEAMS_PER_CALL
 from mainsequence.defaults import STANDARD_BACKEND_URL
 
 from .base import (
@@ -33,11 +39,11 @@ class RequestUserIdentity(BaseModel):
     The caller is a person or a workload identity; ``User.get_by_uid(uid)``
     reads its User. ``User.get_requester()`` returns the same type for the
     requester of a requester-bound request, the person the calling
-    application works for, with that person's own ``team_uids`` and
-    ``is_organization_admin``.
+    application works for, with that person's own ``is_organization_admin``.
+    ``in_teams()`` asks the platform which teams either of them belongs to.
     """
 
-    model_config = ConfigDict(extra="forbid", frozen=True)
+    model_config = ConfigDict(extra="forbid", frozen=True, populate_by_name=True)
 
     uid: str = Field(
         ...,
@@ -52,13 +58,15 @@ class RequestUserIdentity(BaseModel):
         title="Username",
         description="Optional display name authenticated by the runtime gateway.",
     )
-    team_uids: tuple[str, ...] = Field(
+    signed_team_uids: tuple[str, ...] | None = Field(
         (),
-        title="Team UIDs",
+        alias="team_uids",
+        title="Signed team UIDs (deprecated)",
         description=(
             "Canonical UIDs of the active teams the platform signed in the caller "
-            "assertion: the caller's, or for the requester the person's own. Empty in "
-            "local mode and on WebSockets, which carry no such facts."
+            "assertion, None when it signed none. Deprecated: read membership with "
+            "in_teams() (#225). Empty in local mode and on WebSockets, which carry no "
+            "such facts."
         ),
     )
     is_organization_admin: bool = Field(
@@ -79,14 +87,64 @@ class RequestUserIdentity(BaseModel):
         except (AttributeError, TypeError, ValueError) as exc:
             raise ValueError("Request user UID must be a valid UUID.") from exc
 
-    @field_validator("team_uids", mode="before")
+    @field_validator("signed_team_uids", mode="before")
     @classmethod
-    def _canonicalize_team_uids(cls, value: Any) -> tuple[str, ...]:
+    def _canonicalize_team_uids(cls, value: Any) -> tuple[str, ...] | None:
+        if value is None:
+            return None
         try:
-            return tuple(str(UUID(str(item).strip())) for item in value or ())
+            return tuple(str(UUID(str(item).strip())) for item in value)
         except (AttributeError, TypeError, ValueError) as exc:
             raise ValueError("Team UIDs must be valid UUIDs.") from exc
 
+    @property
+    def team_uids(self) -> tuple[str, ...]:
+        """Deprecated: the team UIDs the platform signed. Use ``in_teams()``.
+
+        Warns when read. When the caller assertion carried no team list it
+        raises ``RequestIdentityError``; it never answers an empty list for
+        that. Empty in local mode and on WebSockets, as before (#225).
+        """
+        warnings.warn(
+            "RequestUserIdentity.team_uids is deprecated; check membership with "
+            "in_teams() instead.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
+        if self.signed_team_uids is None:
+            raise RequestIdentityError(
+                "The caller assertion carries no team list. Check team membership "
+                "with in_teams()."
+            )
+        return self.signed_team_uids
+
+    def in_teams(
+        self, team_uids: Iterable[str | UUID], *, max_age_seconds: float | None = None
+    ) -> frozenset[str]:
+        """Which of ``team_uids`` this person is an active member of.
+
+        Works on ``User.get_logged_user()`` and ``User.get_requester()`` inside
+        an authenticated hosted request, and asks the platform for the request's
+        caller or requester only. Returns canonical team UIDs; an empty set
+        means none. Teams the platform does not count, such as unknown or
+        inactive ones, are left out.
+
+        Reuse is the application's choice (``install_request_identity``):
+
+        - within one request the same question is asked once;
+        - across requests an answer is reused while it is younger than
+          ``team_membership_cache_seconds``, or than ``max_age_seconds`` when
+          given; ``0``, the default, reuses none across requests;
+        - ``max_age_seconds=0`` is a fresh check: it always asks the platform,
+          skips both kinds of reuse and stores the new answer. Ask for one
+          before acting on a membership that must be current.
+
+        Raises ``RequestIdentityError`` outside such a request, in local mode
+        and on WebSockets, and the SDK's API error when the platform cannot
+        answer; it never answers "not a member" because a call failed.
+        """
+        return _member_team_uids(self.uid, team_uids, max_age_seconds)
+
     @field_validator("username", mode="before")
     @classmethod
     def _normalize_username(cls, value: Any) -> str | None:
@@ -1314,8 +1372,9 @@ class User(_CallerDirectoryReadMixin, UserApiBaseObjectOrm, BasePydanticModel):
         an Agent, while it works for a person: the requester. The platform
         signs that person into the caller assertion, and the request identity
         integration verifies it before any handler or tool runs. The result is
-        that checked delegation: the person's own ``uid``, ``team_uids`` and
-        ``is_organization_admin``, as the platform signed them.
+        that checked delegation: the person's own ``uid`` and
+        ``is_organization_admin``, as the platform signed them, and
+        ``in_teams()`` for the person's teams.
         ``get_logged_user()`` still returns the caller, the acting application.
 
         Returns ``None`` when the request carries no delegation, including
@@ -1347,3 +1406,73 @@ class User(_CallerDirectoryReadMixin, UserApiBaseObjectOrm, BasePydanticModel):
         if requester is not None and not isinstance(requester, RequestUserIdentity):
             raise RequestIdentityError("Invalid request requester context value.")
         return requester
+
+    @classmethod
+    def _team_memberships(cls, person_uid: str, team_uids: list[str], assertion: str) -> set[str]:
+        """Which of ``team_uids`` the platform says the person belongs to (#225)."""
+        response = make_request(
+            s=cls.build_session(),
+            loaders=cls.LOADERS,
+            r_type="GET",
+            url=f"{cls.get_object_url()}/{person_uid}/team-memberships/",
+            payload={
+                "params": {"team_uid__in": ",".join(team_uids)},
+                "headers": {CALLER_ASSERTION_HEADER: assertion},
+            },
+        )
+        if response.status_code != 200:
+            # Never pass the payload: it holds the caller assertion.
+            raise_for_response(response)
+        answered = response.json().get("team_uids")
+        if not isinstance(answered, list):
+            raise ApiError("Invalid team membership answer.", response=response)
+        return set(_canonical_team_uids(answered)) & set(team_uids)
+
+
+def _canonical_team_uids(team_uids: Iterable[str | UUID]) -> list[str]:
+    if isinstance(team_uids, (str, bytes, UUID)):
+        raise TypeError("in_teams() takes a collection of team UIDs, not a single UID.")
+    try:
+        return sorted({str(UUID(str(team_uid).strip())) for team_uid in team_uids})
+    except (AttributeError, TypeError, ValueError) as exc:
+        raise ValueError("Team UIDs must be valid UUIDs.") from exc
+
+
+def _member_team_uids(
+    person_uid: str, team_uids: Iterable[str | UUID], max_age_seconds: float | None
+) -> frozenset[str]:
+    """RequestUserIdentity.in_teams(): reuse answers as allowed, ask for the rest."""
+    asked = _canonical_team_uids(team_uids)
+    if max_age_seconds is not None and (
+        isinstance(max_age_seconds, bool)
+        or not isinstance(max_age_seconds, (int, float))
+        or not math.isfinite(max_age_seconds)
+        or max_age_seconds < 0
+    ):
+        raise ValueError("max_age_seconds must be None or a non-negative number of seconds.")
+    scope = _team_membership_scope(person_uid)
+    fresh = max_age_seconds == 0
+    lifetime = scope.team_membership_cache_seconds if max_age_seconds is None else max_age_seconds
+    cache = scope.team_membership_cache
+    answers: dict[str, bool] = {}
+    unanswered: list[str] = []
+    for team_uid in asked:
+        key = (scope.release_uid, scope.environment_uid, person_uid, team_uid)
+        reused = None
+        if not fresh:
+            reused = scope.team_memberships.get(key)
+            if reused is None and cache is not None:
+                reused = cache.get(key, max_age=lifetime)
+        if reused is None:
+            unanswered.append(team_uid)
+        else:
+            answers[team_uid] = scope.team_memberships[key] = reused
+    for start in range(0, len(unanswered), MAX_TEAMS_PER_CALL):
+        batch = unanswered[start : start + MAX_TEAMS_PER_CALL]
+        members = User._team_memberships(person_uid, batch, scope.caller_assertion)
+        for team_uid in batch:
+            key = (scope.release_uid, scope.environment_uid, person_uid, team_uid)
+            answers[team_uid] = scope.team_memberships[key] = team_uid in members
+            if cache is not None:
+                cache.put(key, answers[team_uid])
+    return frozenset(team_uid for team_uid, member in answers.items() if member)

{mainsequence-9.0.24 → mainsequence-9.0.25}/mainsequence/server/caller_assertions.py

@@ -32,14 +32,13 @@ REQUIRED_CLAIMS = frozenset(
         "iat",
         "nbf",
         "exp",
-        # What the platform states about the caller: its active team UIDs and
-        # whether it is an admin of the application's Organization.
-        "team_uids",
+        # What the platform states about the caller: whether it is an admin of
+        # the application's Organization.
         "is_organization_admin",
     }
 )
-# The person a requester-bound call works for, with the person's own facts.
-REQUESTER_CLAIMS = frozenset({"sub", "team_uids", "is_organization_admin"})
+# The person a requester-bound call works for, with the person's own admin flag.
+REQUESTER_CLAIMS = frozenset({"sub", "is_organization_admin"})
 
 
 class InvalidCallerAssertion(ValueError):
@@ -64,7 +63,8 @@ class _VerifiedRequester:
     """The person a requester-bound call works for, as the platform signed it."""
 
     user_uid: str
-    team_uids: tuple[str, ...]
+    # None when the assertion carries no team list (#225).
+    team_uids: tuple[str, ...] | None
     is_organization_admin: bool
 
 
@@ -75,7 +75,8 @@ class AuthenticatedCaller:
     environment_uid: str
     issued_at: int
     expires_at: int
-    team_uids: tuple[str, ...]
+    # None when the assertion carries no team list (#225).
+    team_uids: tuple[str, ...] | None
     is_organization_admin: bool
     # The person a requester-bound call works for, None on any other call. The
     # fields above stay the caller's: the acting application (ADR-0036).
@@ -97,13 +98,24 @@ def _admin_flag(value: object, *, owner: str) -> bool:
     return value
 
 
-def _caller_facts(payload: dict) -> tuple[tuple[str, ...], bool]:
-    """The caller's team UIDs and admin flag, which every assertion carries."""
+def _signed_team_uids(claims: dict, *, owner: str) -> tuple[str, ...] | None:
+    """The deprecated ``team_uids`` while the platform still signs it, else None.
+
+    Membership is checked on demand with ``RequestUserIdentity.in_teams()``
+    (#225); a list that is still signed is checked as before.
+    """
+    if "team_uids" not in claims:
+        return None
+    return _team_uids(claims["team_uids"], owner=owner)
+
+
+def _caller_facts(payload: dict) -> tuple[tuple[str, ...] | None, bool]:
+    """The caller's admin flag, and its team UIDs while the platform signs them."""
     # A requester-bound call also carries "requester", which _requester() checks.
-    if set(payload) - {"requester"} != REQUIRED_CLAIMS:
+    if set(payload) - {"requester", "team_uids"} != REQUIRED_CLAIMS:
         raise InvalidCallerAssertion("Caller assertion claims are invalid.")
     return (
-        _team_uids(payload["team_uids"], owner="Caller"),
+        _signed_team_uids(payload, owner="Caller"),
         _admin_flag(payload["is_organization_admin"], owner="Caller"),
     )
 
@@ -111,17 +123,18 @@ def _caller_facts(payload: dict) -> tuple[tuple[str, ...], bool]:
 def _requester(payload: dict) -> _VerifiedRequester | None:
     """The person a requester-bound call works for, or None on any other call.
 
-    The claim has exactly ``sub``, ``team_uids`` and ``is_organization_admin``:
-    the person's own User UID, active team UIDs and Organization-admin flag.
+    The claim has exactly ``sub`` and ``is_organization_admin``, the person's
+    own User UID and Organization-admin flag, and may still carry the
+    deprecated ``team_uids`` (#225).
     """
     if "requester" not in payload:
         return None
     claim = payload["requester"]
-    if not isinstance(claim, dict) or set(claim) != REQUESTER_CLAIMS:
+    if not isinstance(claim, dict) or set(claim) - {"team_uids"} != REQUESTER_CLAIMS:
         raise InvalidCallerAssertion("Caller assertion requester is invalid.")
     return _VerifiedRequester(
         user_uid=_canonical_uid(claim["sub"]),
-        team_uids=_team_uids(claim["team_uids"], owner="Requester"),
+        team_uids=_signed_team_uids(claim, owner="Requester"),
         is_organization_admin=_admin_flag(claim["is_organization_admin"], owner="Requester"),
     )
 

{mainsequence-9.0.24 → mainsequence-9.0.25}/mainsequence/server/fastapi.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import asyncio
 import json
+import math
 import os
 import re
 from contextlib import asynccontextmanager, contextmanager
@@ -18,6 +19,7 @@ from mainsequence._request_identity import (
     _reads_as_caller,
     _request_scope,
 )
+from mainsequence._team_memberships import TeamMembershipCache
 from mainsequence.client.models_user import RequestUserIdentity
 
 from .caller_assertions import (
@@ -175,11 +177,16 @@ async def _deny(scope, receive, send, error):
 
 
 class _RequestIdentityMiddleware:
-    def __init__(self, app, *, mode, verifier, public_ingress, routes):
+    def __init__(
+        self, app, *, mode, verifier, public_ingress, routes, team_membership_cache_seconds=0
+    ):
         self.app = app
         self.mode = mode
         self.verifier = verifier
         self.public_ingress = frozenset(public_ingress)
+        # Membership answers reused across this application's requests (#225).
+        self.team_memberships = TeamMembershipCache()
+        self.team_membership_cache_seconds = team_membership_cache_seconds
         for method, path in public_ingress:
             if not any(
                 getattr(route, "path", None) == path
@@ -228,6 +235,11 @@ class _RequestIdentityMiddleware:
                         state["resource_release_uid"] = caller.release_uid
                         state["organization_environment_uid"] = caller.environment_uid
                         context.caller_assertion = assertion
+                        # The verifier's trusted target keys membership answers.
+                        context.release_uid = caller.release_uid
+                        context.environment_uid = caller.environment_uid
+                        context.team_membership_cache = self.team_memberships
+                        context.team_membership_cache_seconds = self.team_membership_cache_seconds
                         if caller._requester is not None:
                             # The person this call works for, with the person's own facts.
                             context.requester = RequestUserIdentity(
@@ -257,14 +269,28 @@ class _RequestIdentityMiddleware:
             await self.app(scope, receive, send)
 
 
-def install_request_identity(app):
+def install_request_identity(app, *, team_membership_cache_seconds=0):
     """Install once at application creation.
 
     Handlers use User.get_logged_user() for the caller and, on a
     requester-bound call, User.get_requester() for the person it works for.
+    ``in_teams()`` on either asks the platform about team membership.
+
+    ``team_membership_cache_seconds`` is how long a membership answer may be
+    reused across requests in this process. ``0``, the default, reuses an
+    answer only within the same request. A longer lifetime means fewer calls
+    and a membership change seen up to that much later; the choice belongs to
+    the application (ADR 0036, #225).
     """
     if getattr(app.state, _INSTALLATION, None) is not None:
         raise RuntimeError("Request identity is already installed.")
+    if (
+        isinstance(team_membership_cache_seconds, bool)
+        or not isinstance(team_membership_cache_seconds, (int, float))
+        or not math.isfinite(team_membership_cache_seconds)
+        or team_membership_cache_seconds < 0
+    ):
+        raise ValueError("team_membership_cache_seconds must be a non-negative number.")
     mode = _mode()
     public_ingress = _public_routes()
     verifier = CallerAssertionVerifier.from_environment() if mode == "assertion" else None
@@ -274,6 +300,7 @@ def install_request_identity(app):
         verifier=verifier,
         public_ingress=public_ingress,
         routes=app.routes,
+        team_membership_cache_seconds=team_membership_cache_seconds,
     )
     setattr(
         app.state,

{mainsequence-9.0.24 → mainsequence-9.0.25/mainsequence.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.24
+Version: 9.0.25
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.24 → mainsequence-9.0.25}/mainsequence.egg-info/SOURCES.txt

@@ -13,6 +13,7 @@ agent_scaffold/skills/sdk_code_repository_execution/SKILL.md
 mainsequence/__init__.py
 mainsequence/__main__.py
 mainsequence/_request_identity.py
+mainsequence/_team_memberships.py
 mainsequence/_transport.py
 mainsequence/bootstrap.py
 mainsequence/code_repository_context.py
@@ -103,6 +104,7 @@ tests/test_scaffold_skills.py
 tests/test_secret_client_model.py
 tests/test_source_ownership.py
 tests/test_ssh_utils.py
+tests/test_team_memberships.py
 tests/test_tolerant_response_reading.py
 tests/test_tolerant_value_sets.py
 tests/test_user_application_facts.py

{mainsequence-9.0.24 → mainsequence-9.0.25}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence"
-version = "9.0.24"
+version = "9.0.25"
 description = "Main Sequence SDK"
 readme = "README.md"
 requires-python = ">=3.13"

{mainsequence-9.0.24 → mainsequence-9.0.25}/tests/test_caller_assertions.py

@@ -100,16 +100,28 @@ def test_a_caller_in_no_team_who_is_not_an_admin(keys):
 
 @pytest.mark.parametrize(
     "omit",
-    [("team_uids", "is_organization_admin"), ("team_uids",), ("is_organization_admin",)],
-    ids=["no_facts", "no_team_uids", "no_admin_flag"],
+    [("team_uids", "is_organization_admin"), ("is_organization_admin",)],
+    ids=["no_facts", "no_admin_flag"],
 )
-def test_rejects_an_assertion_without_the_callers_facts(keys, omit):
-    """Every assertion states the caller's teams and admin flag; there is no older shape."""
+def test_rejects_an_assertion_without_the_callers_admin_flag(keys, omit):
+    """Every assertion states the caller's admin flag; there is no older shape."""
     key, public = keys[0]
     with pytest.raises(InvalidCallerAssertion):
         verifier(lambda: {"keys": [public]}).verify(token(key, omit=omit))
 
 
+def test_accepts_an_assertion_without_a_team_list(keys):
+    """The platform stops signing team lists; membership is checked with in_teams (#225)."""
+    key, public = keys[0]
+
+    caller = verifier(lambda: {"keys": [public]}).verify(
+        token(key, omit=("team_uids",), is_organization_admin=True)
+    )
+
+    assert caller.team_uids is None
+    assert caller.is_organization_admin is True
+
+
 @pytest.mark.parametrize(
     "changes",
     [
@@ -205,7 +217,6 @@ def test_a_call_that_is_not_requester_bound_has_no_requester(keys):
         [PERSON, TEAMS, True],
         {},
         {"sub": PERSON, "team_uids": TEAMS},
-        {"sub": PERSON, "is_organization_admin": True},
         {"team_uids": TEAMS, "is_organization_admin": True},
         {**REQUESTER, "username": "person"},
         {**REQUESTER, "requester": {"sub": PERSON}},
@@ -232,7 +243,6 @@ def test_a_call_that_is_not_requester_bound_has_no_requester(keys):
         "list",
         "empty",
         "two_field_without_admin_flag",
-        "missing_team_uids",
         "missing_sub",
         "extra_key",
         "nested_requester",
@@ -260,20 +270,35 @@ def test_rejects_a_malformed_requester(keys, requester):
         verifier(lambda: {"keys": [public]}).verify(token(key, requester=requester))
 
 
+def test_a_requester_and_caller_without_team_lists_are_accepted(keys):
+    """Neither the caller's facts nor the requester's need a team list (#225)."""
+    key, public = keys[0]
+
+    caller = verifier(lambda: {"keys": [public]}).verify(
+        token(
+            key,
+            omit=("team_uids",),
+            requester={"sub": PERSON, "is_organization_admin": True},
+        )
+    )
+
+    assert caller.team_uids is None
+    assert (caller._requester.user_uid, caller._requester.team_uids) == (PERSON, None)
+    assert caller._requester.is_organization_admin is True
+
+
 @pytest.mark.parametrize(
     ("changes", "omit"),
     [
         ({"extra": "not an identity claim"}, ()),
         ({"requester_is_organization_admin": True}, ()),
         ({}, ("team_uids", "is_organization_admin")),
-        ({}, ("team_uids",)),
         ({}, ("is_organization_admin",)),
     ],
     ids=[
         "unknown_claim",
         "requester_admin_claim",
         "no_caller_facts",
-        "no_caller_team_uids",
         "no_caller_admin_flag",
     ],
 )

{mainsequence-9.0.24 → mainsequence-9.0.25}/tests/test_fastapi_mcp.py

@@ -255,7 +255,6 @@ def test_a_tool_with_an_optional_person_never_combines_grants(signed):
 REJECTED_ASSERTIONS = {
     "missing": None,
     "two_field_requester": dict(requester={"sub": PERSON, "team_uids": []}),
-    "requester_missing_team_uids": dict(requester={"sub": PERSON, "is_organization_admin": False}),
     "requester_extra_key": dict(requester={**requester_claim(PERSON), "username": "person"}),
     "requester_integer_admin_flag": dict(
         requester=requester_claim(PERSON, is_organization_admin=1)