mainsequence 9.0.26__tar.gz → 9.0.27.dev71__tar.gz

{mainsequence-9.0.26/mainsequence.egg-info → mainsequence-9.0.27.dev71}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.26
+Version: 9.0.27.dev71
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.26 → mainsequence-9.0.27.dev71}/agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md

@@ -199,10 +199,8 @@ def publish_report(team_uid: str) -> dict[str, str]:
   Call it from a `def` handler, or from an `async def` handler with
   `await asyncio.to_thread(caller.in_teams, team_uids)`, which keeps the
   request's identity.
-- `team_uids` on the identity is deprecated and warns when read. In a signed
-  HTTP request it raises `RequestIdentityError` when the assertion carried no
-  team list, as every assertion will once the platform stops signing them.
-  Replace every check that reads it with `in_teams()`.
+- The identity has no `team_uids`; the platform signs no team list. Code
+  written for releases that had it reads `in_teams()` instead.
 - Membership is not team administration and not a grant on an object: check
   the exact object and action as well.
 

{mainsequence-9.0.26 → mainsequence-9.0.27.dev71}/agent_scaffold/skills/platform_operations/access_control_and_sharing/SKILL.md

@@ -137,7 +137,7 @@ Keep these separate:
 - administration of the team itself
 
 An application that checks whether its caller or requester belongs to a team
-uses `in_teams()`, never the deprecated `team_uids`; see
+uses `in_teams()`; the identity carries no team list. See
 `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`.
 
 ### 5. `Constant` vs `Secret` is a security boundary
@@ -308,9 +308,9 @@ When reviewing an access-control task, look for:
 - using direct user grants where a team should be used
 - using a team when the access is clearly one-off
 - treating team membership as team administration
-- team checks that read the deprecated `team_uids` instead of `in_teams()`,
-  that read an `in_teams()` error as "not a member", or that reuse an older
-  answer (no `max_age_seconds=0`) before a write that must see a removal
+- team checks that do not use `in_teams()`, that read an `in_teams()` error
+  as "not a member", or that reuse an older answer (no `max_age_seconds=0`)
+  before a write that must see a removal
 - storing sensitive data in a `Constant`
 - creating a `Constant` or `Secret` blindly without resolving whether the name already exists
 - weak or unverified claims about who can access a resource

{mainsequence-9.0.26 → mainsequence-9.0.27.dev71}/mainsequence/client/models_user.py

@@ -2,7 +2,6 @@ from __future__ import annotations
 
 import datetime
 import math
-import warnings
 from collections.abc import Iterable
 from typing import Any, ClassVar, Literal
 from uuid import UUID
@@ -43,7 +42,7 @@ class RequestUserIdentity(BaseModel):
     ``in_teams()`` asks the platform which teams either of them belongs to.
     """
 
-    model_config = ConfigDict(extra="forbid", frozen=True, populate_by_name=True)
+    model_config = ConfigDict(extra="forbid", frozen=True)
 
     uid: str = Field(
         ...,
@@ -58,17 +57,6 @@ class RequestUserIdentity(BaseModel):
         title="Username",
         description="Optional display name authenticated by the runtime gateway.",
     )
-    signed_team_uids: tuple[str, ...] | None = Field(
-        (),
-        alias="team_uids",
-        title="Signed team UIDs (deprecated)",
-        description=(
-            "Canonical UIDs of the active teams the platform signed in the caller "
-            "assertion, None when it signed none. Deprecated: read membership with "
-            "in_teams() (#225). Empty in local mode and on WebSockets, which carry no "
-            "such facts."
-        ),
-    )
     is_organization_admin: bool = Field(
         False,
         title="Organization admin",
@@ -87,37 +75,6 @@ class RequestUserIdentity(BaseModel):
         except (AttributeError, TypeError, ValueError) as exc:
             raise ValueError("Request user UID must be a valid UUID.") from exc
 
-    @field_validator("signed_team_uids", mode="before")
-    @classmethod
-    def _canonicalize_team_uids(cls, value: Any) -> tuple[str, ...] | None:
-        if value is None:
-            return None
-        try:
-            return tuple(str(UUID(str(item).strip())) for item in value)
-        except (AttributeError, TypeError, ValueError) as exc:
-            raise ValueError("Team UIDs must be valid UUIDs.") from exc
-
-    @property
-    def team_uids(self) -> tuple[str, ...]:
-        """Deprecated: the team UIDs the platform signed. Use ``in_teams()``.
-
-        Warns when read. When the caller assertion carried no team list it
-        raises ``RequestIdentityError``; it never answers an empty list for
-        that. Empty in local mode and on WebSockets, as before (#225).
-        """
-        warnings.warn(
-            "RequestUserIdentity.team_uids is deprecated; check membership with "
-            "in_teams() instead.",
-            DeprecationWarning,
-            stacklevel=2,
-        )
-        if self.signed_team_uids is None:
-            raise RequestIdentityError(
-                "The caller assertion carries no team list. Check team membership "
-                "with in_teams()."
-            )
-        return self.signed_team_uids
-
     def in_teams(
         self, team_uids: Iterable[str | UUID], *, max_age_seconds: float | None = None
     ) -> frozenset[str]:

{mainsequence-9.0.26 → mainsequence-9.0.27.dev71}/mainsequence/server/caller_assertions.py

@@ -63,8 +63,6 @@ class _VerifiedRequester:
     """The person a requester-bound call works for, as the platform signed it."""
 
     user_uid: str
-    # None when the assertion carries no team list (#225).
-    team_uids: tuple[str, ...] | None
     is_organization_admin: bool
 
 
@@ -75,66 +73,44 @@ class AuthenticatedCaller:
     environment_uid: str
     issued_at: int
     expires_at: int
-    # None when the assertion carries no team list (#225).
-    team_uids: tuple[str, ...] | None
     is_organization_admin: bool
     # The person a requester-bound call works for, None on any other call. The
     # fields above stay the caller's: the acting application (ADR-0036).
     _requester: _VerifiedRequester | None = None
 
 
-def _team_uids(value: object, *, owner: str) -> tuple[str, ...]:
-    if not isinstance(value, list):
-        raise InvalidCallerAssertion(f"{owner} team UIDs are invalid.")
-    team_uids = tuple(_canonical_uid(item) for item in value)
-    if list(team_uids) != sorted(set(team_uids)):
-        raise InvalidCallerAssertion(f"{owner} team UIDs must be sorted and unique.")
-    return team_uids
-
-
 def _admin_flag(value: object, *, owner: str) -> bool:
     if type(value) is not bool:
         raise InvalidCallerAssertion(f"{owner} admin flag is invalid.")
     return value
 
 
-def _signed_team_uids(claims: dict, *, owner: str) -> tuple[str, ...] | None:
-    """The deprecated ``team_uids`` while the platform still signs it, else None.
+def _caller_admin_flag(payload: dict) -> bool:
+    """The caller's admin flag, after checking the exact claim set.
 
-    Membership is checked on demand with ``RequestUserIdentity.in_teams()``
-    (#225); a list that is still signed is checked as before.
+    The assertion names no teams: membership is checked on demand with
+    ``RequestUserIdentity.in_teams()`` (#225), and an assertion that lists
+    teams is refused.
     """
-    if "team_uids" not in claims:
-        return None
-    return _team_uids(claims["team_uids"], owner=owner)
-
-
-def _caller_facts(payload: dict) -> tuple[tuple[str, ...] | None, bool]:
-    """The caller's admin flag, and its team UIDs while the platform signs them."""
     # A requester-bound call also carries "requester", which _requester() checks.
-    if set(payload) - {"requester", "team_uids"} != REQUIRED_CLAIMS:
+    if set(payload) - {"requester"} != REQUIRED_CLAIMS:
         raise InvalidCallerAssertion("Caller assertion claims are invalid.")
-    return (
-        _signed_team_uids(payload, owner="Caller"),
-        _admin_flag(payload["is_organization_admin"], owner="Caller"),
-    )
+    return _admin_flag(payload["is_organization_admin"], owner="Caller")
 
 
 def _requester(payload: dict) -> _VerifiedRequester | None:
     """The person a requester-bound call works for, or None on any other call.
 
     The claim has exactly ``sub`` and ``is_organization_admin``, the person's
-    own User UID and Organization-admin flag, and may still carry the
-    deprecated ``team_uids`` (#225).
+    own User UID and Organization-admin flag.
     """
     if "requester" not in payload:
         return None
     claim = payload["requester"]
-    if not isinstance(claim, dict) or set(claim) - {"team_uids"} != REQUESTER_CLAIMS:
+    if not isinstance(claim, dict) or set(claim) != REQUESTER_CLAIMS:
         raise InvalidCallerAssertion("Caller assertion requester is invalid.")
     return _VerifiedRequester(
         user_uid=_canonical_uid(claim["sub"]),
-        team_uids=_signed_team_uids(claim, owner="Requester"),
         is_organization_admin=_admin_flag(claim["is_organization_admin"], owner="Requester"),
     )
 
@@ -284,7 +260,7 @@ class CallerAssertionVerifier:
                 audience=f"urn:mainsequence:fapi:{self.release_uid}",
                 options={"require": list(REQUIRED_CLAIMS)},
             )
-            team_uids, is_organization_admin = _caller_facts(payload)
+            is_organization_admin = _caller_admin_flag(payload)
             requester = _requester(payload)
             if (
                 payload["aud"] != f"urn:mainsequence:fapi:{self.release_uid}"
@@ -304,7 +280,6 @@ class CallerAssertionVerifier:
                 environment_uid=self.environment_uid,
                 issued_at=iat,
                 expires_at=exp,
-                team_uids=team_uids,
                 is_organization_admin=is_organization_admin,
                 _requester=requester,
             )

{mainsequence-9.0.26 → mainsequence-9.0.27.dev71}/mainsequence/server/fastapi.py

@@ -229,7 +229,6 @@ class _RequestIdentityMiddleware:
                         caller = await asyncio.to_thread(self.verifier.verify, assertion)
                         user = RequestUserIdentity(
                             uid=caller.user_uid,
-                            team_uids=caller.team_uids,
                             is_organization_admin=caller.is_organization_admin,
                         )
                         state["resource_release_uid"] = caller.release_uid
@@ -244,7 +243,6 @@ class _RequestIdentityMiddleware:
                             # The person this call works for, with the person's own facts.
                             context.requester = RequestUserIdentity(
                                 uid=caller._requester.user_uid,
-                                team_uids=caller._requester.team_uids,
                                 is_organization_admin=caller._requester.is_organization_admin,
                             )
                     else:

{mainsequence-9.0.26 → mainsequence-9.0.27.dev71/mainsequence.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.26
+Version: 9.0.27.dev71
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.26 → mainsequence-9.0.27.dev71}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence"
-version = "9.0.26"
+version = "9.0.27.dev71"
 description = "Main Sequence SDK"
 readme = "README.md"
 requires-python = ">=3.13"

{mainsequence-9.0.26 → mainsequence-9.0.27.dev71}/tests/test_caller_assertions.py

@@ -55,7 +55,6 @@ def token(key, *, kid="first", headers=None, omit=(), **changes):
         "iat": now,
         "nbf": now,
         "exp": now + 120,
-        "team_uids": [],
         "is_organization_admin": False,
     }
     claims.update(changes)
@@ -79,57 +78,43 @@ def verifier(fetch):
 TEAMS = sorted([str(uuid4()), str(uuid4())])
 
 
-def test_exposes_the_callers_teams_and_admin_flag(keys):
+def test_exposes_the_callers_admin_flag_and_names_no_teams(keys):
     key, public = keys[0]
     check = verifier(lambda: {"keys": [public]})
 
-    caller = check.verify(token(key, team_uids=TEAMS, is_organization_admin=True))
+    caller = check.verify(token(key, is_organization_admin=True))
 
-    assert caller.team_uids == tuple(TEAMS)
     assert caller.is_organization_admin is True
+    # Membership is checked on demand with in_teams() (#225).
+    assert not hasattr(caller, "team_uids")
 
 
-def test_a_caller_in_no_team_who_is_not_an_admin(keys):
+def test_a_caller_who_is_not_an_admin(keys):
     key, public = keys[0]
 
     caller = verifier(lambda: {"keys": [public]}).verify(token(key))
 
-    assert caller.team_uids == ()
     assert caller.is_organization_admin is False
 
 
-@pytest.mark.parametrize(
-    "omit",
-    [("team_uids", "is_organization_admin"), ("is_organization_admin",)],
-    ids=["no_facts", "no_admin_flag"],
-)
-def test_rejects_an_assertion_without_the_callers_admin_flag(keys, omit):
+def test_rejects_an_assertion_without_the_callers_admin_flag(keys):
     """Every assertion states the caller's admin flag; there is no older shape."""
     key, public = keys[0]
     with pytest.raises(InvalidCallerAssertion):
-        verifier(lambda: {"keys": [public]}).verify(token(key, omit=omit))
+        verifier(lambda: {"keys": [public]}).verify(token(key, omit=("is_organization_admin",)))
 
 
-def test_accepts_an_assertion_without_a_team_list(keys):
-    """The platform stops signing team lists; membership is checked with in_teams (#225)."""
+@pytest.mark.parametrize("team_uids", [TEAMS, [], None], ids=["team_list", "empty_list", "null"])
+def test_rejects_an_assertion_that_lists_teams(keys, team_uids):
+    """The platform signs no team list; an assertion that carries one is refused (#225)."""
     key, public = keys[0]
-
-    caller = verifier(lambda: {"keys": [public]}).verify(
-        token(key, omit=("team_uids",), is_organization_admin=True)
-    )
-
-    assert caller.team_uids is None
-    assert caller.is_organization_admin is True
+    with pytest.raises(InvalidCallerAssertion):
+        verifier(lambda: {"keys": [public]}).verify(token(key, team_uids=team_uids))
 
 
 @pytest.mark.parametrize(
     "changes",
     [
-        {"team_uids": None},
-        {"team_uids": TEAMS[0]},
-        {"team_uids": list(reversed(TEAMS))},
-        {"team_uids": [TEAMS[0], TEAMS[0]]},
-        {"team_uids": [TEAMS[0].upper()]},
         {"is_organization_admin": None},
         {"is_organization_admin": "true"},
         {"is_organization_admin": 1},
@@ -146,11 +131,11 @@ def test_rejects_malformed_caller_facts(keys, changes):
 #
 # Another application calls while it works for a person, the requester. The
 # assertion's `sub` and facts stay the caller's, the acting application, and
-# `requester` names the person with the person's own facts: exactly `sub`,
-# `team_uids` and `is_organization_admin`.
+# `requester` names the person with the person's own facts: exactly `sub` and
+# `is_organization_admin`.
 
 PERSON = "5b0f9a8e-3c2d-4e1f-9a7b-6c5d4e3f2a1b"
-REQUESTER = {"sub": PERSON, "team_uids": TEAMS, "is_organization_admin": True}
+REQUESTER = {"sub": PERSON, "is_organization_admin": True}
 
 
 @pytest.mark.parametrize(
@@ -160,45 +145,32 @@ REQUESTER = {"sub": PERSON, "team_uids": TEAMS, "is_organization_admin": True}
 )
 def test_exposes_the_requester_beside_the_acting_caller(keys, caller_admin, person_admin):
     key, public = keys[0]
-    caller_teams = [str(uuid4())]
     check = verifier(lambda: {"keys": [public]})
 
     caller = check.verify(
         token(
             key,
-            team_uids=caller_teams,
             is_organization_admin=caller_admin,
             requester={**REQUESTER, "is_organization_admin": person_admin},
         )
     )
 
     # Each identity keeps its own facts: neither admin flag reaches the other.
-    assert (caller.user_uid, caller.team_uids, caller.is_organization_admin) == (
-        USER,
-        tuple(caller_teams),
-        caller_admin,
-    )
+    assert (caller.user_uid, caller.is_organization_admin) == (USER, caller_admin)
     requester = caller._requester
-    assert (requester.user_uid, requester.team_uids, requester.is_organization_admin) == (
-        PERSON,
-        tuple(TEAMS),
-        person_admin,
-    )
+    assert (requester.user_uid, requester.is_organization_admin) == (PERSON, person_admin)
+    assert not hasattr(requester, "team_uids")
 
 
-def test_a_requester_in_no_team_who_is_not_an_admin(keys):
+def test_a_requester_who_is_not_an_admin(keys):
     key, public = keys[0]
 
     caller = verifier(lambda: {"keys": [public]}).verify(
-        token(key, requester={"sub": PERSON, "team_uids": [], "is_organization_admin": False})
+        token(key, requester={"sub": PERSON, "is_organization_admin": False})
     )
 
     requester = caller._requester
-    assert (requester.user_uid, requester.team_uids, requester.is_organization_admin) == (
-        PERSON,
-        (),
-        False,
-    )
+    assert (requester.user_uid, requester.is_organization_admin) == (PERSON, False)
 
 
 def test_a_call_that_is_not_requester_bound_has_no_requester(keys):
@@ -206,7 +178,7 @@ def test_a_call_that_is_not_requester_bound_has_no_requester(keys):
     check = verifier(lambda: {"keys": [public]})
 
     assert check.verify(token(key))._requester is None
-    assert check.verify(token(key, team_uids=TEAMS, is_organization_admin=True))._requester is None
+    assert check.verify(token(key, is_organization_admin=True))._requester is None
 
 
 @pytest.mark.parametrize(
@@ -214,12 +186,14 @@ def test_a_call_that_is_not_requester_bound_has_no_requester(keys):
     [
         None,
         PERSON,
-        [PERSON, TEAMS, True],
+        [PERSON, True],
         {},
-        {"sub": PERSON, "team_uids": TEAMS},
-        {"team_uids": TEAMS, "is_organization_admin": True},
+        {"sub": PERSON},
+        {"is_organization_admin": True},
         {**REQUESTER, "username": "person"},
         {**REQUESTER, "requester": {"sub": PERSON}},
+        {**REQUESTER, "team_uids": TEAMS},
+        {**REQUESTER, "team_uids": []},
         {**REQUESTER, "is_organization_admin": None},
         {**REQUESTER, "is_organization_admin": 1},
         {**REQUESTER, "is_organization_admin": 0},
@@ -230,22 +204,18 @@ def test_a_call_that_is_not_requester_bound_has_no_requester(keys):
         {**REQUESTER, "sub": "not-a-uuid"},
         {**REQUESTER, "sub": None},
         {**REQUESTER, "sub": 1},
-        {**REQUESTER, "team_uids": None},
-        {**REQUESTER, "team_uids": TEAMS[0]},
-        {**REQUESTER, "team_uids": [1]},
-        {**REQUESTER, "team_uids": [TEAMS[0].upper()]},
-        {**REQUESTER, "team_uids": list(reversed(TEAMS))},
-        {**REQUESTER, "team_uids": [TEAMS[0], TEAMS[0]]},
     ],
     ids=[
         "null",
         "string",
         "list",
         "empty",
-        "two_field_without_admin_flag",
+        "missing_admin_flag",
         "missing_sub",
         "extra_key",
         "nested_requester",
+        "team_list",
+        "empty_team_list",
         "null_admin_flag",
         "integer_true_admin_flag",
         "integer_false_admin_flag",
@@ -256,12 +226,6 @@ def test_a_call_that_is_not_requester_bound_has_no_requester(keys):
         "invalid_sub",
         "null_sub",
         "integer_sub",
-        "null_team_uids",
-        "string_team_uids",
-        "integer_team_uid",
-        "uppercase_team_uid",
-        "unsorted_team_uids",
-        "duplicate_team_uids",
     ],
 )
 def test_rejects_a_malformed_requester(keys, requester):
@@ -270,35 +234,18 @@ def test_rejects_a_malformed_requester(keys, requester):
         verifier(lambda: {"keys": [public]}).verify(token(key, requester=requester))
 
 
-def test_a_requester_and_caller_without_team_lists_are_accepted(keys):
-    """Neither the caller's facts nor the requester's need a team list (#225)."""
-    key, public = keys[0]
-
-    caller = verifier(lambda: {"keys": [public]}).verify(
-        token(
-            key,
-            omit=("team_uids",),
-            requester={"sub": PERSON, "is_organization_admin": True},
-        )
-    )
-
-    assert caller.team_uids is None
-    assert (caller._requester.user_uid, caller._requester.team_uids) == (PERSON, None)
-    assert caller._requester.is_organization_admin is True
-
-
 @pytest.mark.parametrize(
     ("changes", "omit"),
     [
         ({"extra": "not an identity claim"}, ()),
         ({"requester_is_organization_admin": True}, ()),
-        ({}, ("team_uids", "is_organization_admin")),
+        ({"team_uids": TEAMS}, ()),
         ({}, ("is_organization_admin",)),
     ],
     ids=[
         "unknown_claim",
         "requester_admin_claim",
-        "no_caller_facts",
+        "caller_team_list",
         "no_caller_admin_flag",
     ],
 )

{mainsequence-9.0.26 → mainsequence-9.0.27.dev71}/tests/test_fastapi_mcp.py

@@ -254,14 +254,16 @@ def test_a_tool_with_an_optional_person_never_combines_grants(signed):
 
 REJECTED_ASSERTIONS = {
     "missing": None,
-    "two_field_requester": dict(requester={"sub": PERSON, "team_uids": []}),
+    "requester_without_admin_flag": dict(requester={"sub": PERSON}),
+    "requester_with_a_team_list": dict(requester={**requester_claim(PERSON), "team_uids": []}),
     "requester_extra_key": dict(requester={**requester_claim(PERSON), "username": "person"}),
     "requester_integer_admin_flag": dict(
         requester=requester_claim(PERSON, is_organization_admin=1)
     ),
-    "without_caller_facts": dict(omit=("team_uids", "is_organization_admin")),
-    "requester_bound_without_caller_facts": dict(
-        requester=requester_claim(PERSON), omit=("team_uids", "is_organization_admin")
+    "without_caller_admin_flag": dict(omit=("is_organization_admin",)),
+    "with_a_caller_team_list": dict(team_uids=[]),
+    "requester_bound_without_caller_admin_flag": dict(
+        requester=requester_claim(PERSON), omit=("is_organization_admin",)
     ),
 }
 

{mainsequence-9.0.26 → mainsequence-9.0.27.dev71}/tests/test_fastapi_request_identity.py

@@ -69,7 +69,6 @@ def signed(monkeypatch):
             iat=now,
             nbf=now,
             exp=now + 120,
-            team_uids=[],
             is_organization_admin=False,
         )
         claims.update(changes)
@@ -114,21 +113,18 @@ def test_sync_getter_signed_proof_once_and_process_credentials_untouched(signed,
 
 def test_signed_caller_facts_reach_the_logged_user(signed):
     token, _, _ = signed
-    teams = sorted([str(uuid4()), str(uuid4())])
 
     def handler():
         user = User.get_logged_user()
-        return {"teams": list(user.team_uids), "admin": user.is_organization_admin}
+        return {"admin": user.is_organization_admin, "teams": hasattr(user, "team_uids")}
 
     with TestClient(app_for(handler)) as client:
-        admin = client.get(
-            "/me",
-            headers={ASSERTION_HEADER: token(team_uids=teams, is_organization_admin=True)},
-        )
-        member_of_none = client.get("/me", headers={ASSERTION_HEADER: token()})
+        admin = client.get("/me", headers={ASSERTION_HEADER: token(is_organization_admin=True)})
+        member = client.get("/me", headers={ASSERTION_HEADER: token()})
 
-    assert admin.json() == {"teams": teams, "admin": True}
-    assert member_of_none.json() == {"teams": [], "admin": False}
+    # The identity names no teams: membership is checked with in_teams() (#225).
+    assert admin.json() == {"admin": True, "teams": False}
+    assert member.json() == {"admin": False, "teams": False}
 
 
 @pytest.mark.parametrize(
@@ -139,7 +135,7 @@ def test_signed_caller_facts_reach_the_logged_user(signed):
         "expired",
         "wrong_target",
         "duplicate",
-        "without_caller_facts",
+        "with_a_team_list",
         "without_admin_flag",
     ],
 )
@@ -164,8 +160,8 @@ def test_invalid_proof_never_reaches_route(signed, case, monkeypatch):
         headers[ASSERTION_HEADER] = token(resource_release_uid=OTHER)
     elif case == "duplicate":
         headers = [(ASSERTION_HEADER, token()), (ASSERTION_HEADER, token())]
-    elif case == "without_caller_facts":
-        headers[ASSERTION_HEADER] = token(omit=("team_uids", "is_organization_admin"))
+    elif case == "with_a_team_list":
+        headers[ASSERTION_HEADER] = token(team_uids=[])
     elif case == "without_admin_flag":
         headers[ASSERTION_HEADER] = token(omit=("is_organization_admin",))
     assert TestClient(app_for(handler)).get("/me", headers=headers).status_code == 401
@@ -575,24 +571,18 @@ def test_reads_as_caller_needs_a_signed_http_request(monkeypatch):
 PERSON = "5b0f9a8e-3c2d-4e1f-9a7b-6c5d4e3f2a1b"
 
 
-def requester_claim(sub=PERSON, team_uids=(), is_organization_admin=False):
+def requester_claim(sub=PERSON, is_organization_admin=False):
     """The requester claim as the platform signs it."""
-    return {
-        "sub": sub,
-        "team_uids": list(team_uids),
-        "is_organization_admin": is_organization_admin,
-    }
+    return {"sub": sub, "is_organization_admin": is_organization_admin}
 
 
 def _identities():
     caller = User.get_logged_user()
     requester = User.get_requester()
     return {
-        "caller": [caller.uid, list(caller.team_uids), caller.is_organization_admin],
+        "caller": [caller.uid, caller.is_organization_admin],
         "requester": (
-            None
-            if requester is None
-            else [requester.uid, list(requester.team_uids), requester.is_organization_admin]
+            None if requester is None else [requester.uid, requester.is_organization_admin]
         ),
     }
 
@@ -606,11 +596,9 @@ def test_requester_bound_call_binds_the_requester_beside_the_caller(
     signed, caller_admin, person_admin
 ):
     token, _, _ = signed
-    caller_teams = sorted([str(uuid4()), str(uuid4())])
-    requester_teams = sorted([str(uuid4()), str(uuid4())])
     # Each identity keeps its own facts: neither admin flag reaches the other.
-    facts = dict(team_uids=caller_teams, is_organization_admin=caller_admin)
-    person = requester_claim(team_uids=requester_teams, is_organization_admin=person_admin)
+    facts = dict(is_organization_admin=caller_admin)
+    person = requester_claim(is_organization_admin=person_admin)
 
     with TestClient(app_for(_identities)) as client:
         bound = client.get("/me", headers={ASSERTION_HEADER: token(**facts, requester=person)})
@@ -622,10 +610,10 @@ def test_requester_bound_call_binds_the_requester_beside_the_caller(
         )
 
     assert bound.json() == {
-        "caller": [USER, caller_teams, caller_admin],
-        "requester": [PERSON, requester_teams, person_admin],
+        "caller": [USER, caller_admin],
+        "requester": [PERSON, person_admin],
     }
-    assert direct.json() == {"caller": [USER, caller_teams, caller_admin], "requester": None}
+    assert direct.json() == {"caller": [USER, caller_admin], "requester": None}
     with pytest.raises(RequestIdentityError, match=r"User\.get_requester\(\)"):
         User.get_requester()
 
@@ -634,23 +622,25 @@ def test_requester_bound_call_binds_the_requester_beside_the_caller(
     ("requester", "omit"),
     [
         (None, ()),
-        ({"sub": PERSON, "team_uids": []}, ()),
+        ({"sub": PERSON}, ()),
+        ({**requester_claim(), "team_uids": []}, ()),
         ({**requester_claim(), "username": "person"}, ()),
         (requester_claim(is_organization_admin=1), ()),
         (requester_claim(is_organization_admin="true"), ()),
         (requester_claim(is_organization_admin=None), ()),
         (requester_claim(sub=PERSON.upper()), ()),
-        (requester_claim(), ("team_uids", "is_organization_admin")),
+        (requester_claim(), ("is_organization_admin",)),
     ],
     ids=[
         "null",
-        "two_field_without_admin_flag",
+        "without_admin_flag",
+        "with_a_team_list",
         "extra_key",
         "integer_admin_flag",
         "string_admin_flag",
         "null_admin_flag",
         "non_canonical_sub",
-        "without_caller_facts",
+        "without_caller_admin_flag",
     ],
 )
 def test_malformed_requester_never_reaches_route(signed, requester, omit):
@@ -682,7 +672,7 @@ def test_requester_is_none_in_local_mode_and_on_websockets(monkeypatch):
     install_request_identity(app)
     client = TestClient(app)
 
-    expected = {"caller": [USER, [], False], "requester": None}
+    expected = {"caller": [USER, False], "requester": None}
     assert client.get("/me", headers={"Authorization": "Bearer local-token"}).json() == expected
     with client.websocket_connect("/ws", headers={"X-User-UID": USER}) as connection:
         assert connection.receive_json() == expected
@@ -766,5 +756,5 @@ def test_reads_as_caller_refuses_a_requester_bound_request(signed, monkeypatch):
     with TestClient(app_for(handler)) as client:
         response = client.get("/me", headers={ASSERTION_HEADER: token(requester=person)})
 
-    assert response.json() == {"caller": [USER, [], False], "requester": [PERSON, [], True]}
+    assert response.json() == {"caller": [USER, False], "requester": [PERSON, True]}
     assert sent == []

{mainsequence-9.0.26 → mainsequence-9.0.27.dev71}/tests/test_models_user_request_bound_auth.py

@@ -51,7 +51,6 @@ def test_process_profile_still_uses_process_session(monkeypatch):
 # A requester-bound request: the caller is the acting application, and the
 # request scope also holds the person it works for (ADR-0036).
 REQUESTER_UID = "5b0f9a8e-3c2d-4e1f-9a7b-6c5d4e3f2a1b"
-TEAM_UID = "3f1cc452-43ec-49cb-b2ba-87dbac164d29"
 
 
 def test_requester_getter_requires_authenticated_request():
@@ -67,15 +66,12 @@ def test_requester_getter_requires_authenticated_request():
 
 def test_requester_getter_returns_the_requester_beside_the_unchanged_caller():
     caller = RequestUserIdentity(uid=USER_UID)
-    requester = RequestUserIdentity(
-        uid=REQUESTER_UID, team_uids=[TEAM_UID], is_organization_admin=True
-    )
+    requester = RequestUserIdentity(uid=REQUESTER_UID, is_organization_admin=True)
     with _request_scope() as context:
         context.user = caller
         assert User.get_requester() is None
         context.requester = requester
         assert User.get_requester() is requester
-        assert User.get_requester().team_uids == (TEAM_UID,)
         # The person's own admin flag, never the caller's.
         assert User.get_requester().is_organization_admin is True
         assert User.get_logged_user().is_organization_admin is False

{mainsequence-9.0.26 → mainsequence-9.0.27.dev71}/tests/test_team_memberships.py

@@ -7,7 +7,6 @@ memberships and records every call.
 
 import asyncio
 import time
-import warnings
 from types import SimpleNamespace
 from unittest.mock import Mock
 from uuid import uuid4
@@ -393,11 +392,7 @@ def test_local_mode_has_no_assertion_to_ask_with(platform, monkeypatch):
     )
 
     def handler():
-        user = User.get_logged_user()
-        with warnings.catch_warnings():
-            warnings.simplefilter("ignore", DeprecationWarning)
-            assert user.team_uids == ()
-        user.in_teams(teams(1))
+        User.get_logged_user().in_teams(teams(1))
 
     with TestClient(app_with(handler), raise_server_exceptions=True) as client:
         with pytest.raises(RequestIdentityError):
@@ -405,26 +400,20 @@ def test_local_mode_has_no_assertion_to_ask_with(platform, monkeypatch):
     assert platform.calls == []
 
 
-def test_team_uids_is_deprecated_and_never_answers_empty_for_a_missing_list(sign, platform):
-    (research,) = teams(1)
+def test_the_identity_has_no_team_list(sign, platform):
+    # Step 5 (#225): the deprecated team_uids is gone; in_teams() answers.
     seen = {}
 
     def handler():
         user = User.get_logged_user()
-        with pytest.warns(DeprecationWarning):
-            try:
-                seen["teams"] = user.team_uids
-            except RequestIdentityError as error:
-                seen["error"] = str(error)
+        seen["has_team_uids"] = hasattr(user, "team_uids")
 
     with TestClient(app_with(handler)) as client:
-        client.get("/check", headers={ASSERTION_HEADER: sign(team_uids=[research])})
-        signed = dict(seen)
-        seen.clear()
         client.get("/check", headers={ASSERTION_HEADER: sign()})
 
-    assert signed == {"teams": (research,)}
-    assert "in_teams()" in seen["error"]
+    assert seen == {"has_team_uids": False}
+    with pytest.raises(ValueError):
+        RequestUserIdentity(uid=CALLER, team_uids=[])
 
 
 @pytest.mark.parametrize(