oxutils 0.4.0__tar.gz → 0.4.2__tar.gz

{oxutils-0.4.0 → oxutils-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oxutils
-Version: 0.4.0
+Version: 0.4.2
 Summary: Production-ready utilities for Django applications in the Oxiliere ecosystem
 Keywords: django,utilities,jwt,audit,logging,celery,structlog
 Author: Edimedia Mutoke

{oxutils-0.4.0 → oxutils-0.4.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "oxutils"
-version = "0.4.0"
+version = "0.4.2"
 description = "Production-ready utilities for Django applications in the Oxiliere ecosystem"
 readme = "README.md"
 license = "LGPL-3.0-only"
@@ -98,6 +98,7 @@ dev = [
     "coverage>=7.4.0",
     "pillow>=12.0.0",
     "ruff>=0.8.0",
+    "twine>=6.0.0",
     "psycopg[binary]>=3.3.2",
 ]
 

{oxutils-0.4.0 → oxutils-0.4.2}/src/oxutils/__init__.py

@@ -15,7 +15,7 @@ This package provides:
 - Custom exceptions, enums, and type definitions
 """
 
-__version__ = "0.4.0"
+__version__ = "0.4.2"
 
 from oxutils.conf import AUDIT_MIDDLEWARE, UTILS_APPS
 from oxutils.settings import oxi_settings

{oxutils-0.4.0 → oxutils-0.4.2}/src/oxutils/oxiliere/cacheops.py

@@ -34,7 +34,7 @@ def get_cached_tenant_token(oxi_id: str, user_id: str):
         raise ObjectDoesNotExist(f"tenant not found: {oxi_id}") from ex
 
     try:
-        tenant_user = tenant.users.select_related("user").get(user__pk=user_id)
+        tenant_user = tenant.users.select_related("user").get(user__pk=user_id, status="active")
     except (ObjectDoesNotExist, ValueError) as ex:
         raise ObjectDoesNotExist(f"tenant_user not found: {oxi_id}/{user_id}") from ex
 

{oxutils-0.4.0 → oxutils-0.4.2}/src/oxutils/oxiliere/middleware.py

@@ -55,7 +55,7 @@ class TenantMainMiddleware(MiddlewareMixin):
             return None
 
         try:
-            return tenant.users.select_related("user").get(user__pk=user.id)
+            return tenant.users.select_related("user").get(user__pk=user.id, status="active")
         except ObjectDoesNotExist as exc:
             logger.error("tenant_user_not_found", tenant_id=tenant.id, user_id=user.id, exc_info=exc)
             if raise_exception:
@@ -99,8 +99,25 @@ class TenantMainMiddleware(MiddlewareMixin):
 
                 return HttpResponseBadRequest("Missing X-Organization-ID header")
         else:
-            # oxi_id present but no authenticated user
-            return self.no_tenant_found(request, oxi_id)
+            # oxi_id present but no authenticated user → fall back to system tenant
+            # (same behaviour as "no org header") — previously this raised Http404,
+            # which broke every route (including public ones) when the JWT token
+            # expired but the front-end still sent X-Organization-ID.
+            try:
+                from oxutils.oxiliere.caches import get_system_tenant
+
+                tenant = get_system_tenant()
+                # don't try to attach a tenant-user — the user is anonymous anyway
+                tenant.user = None
+            except Exception as e:
+                logger.error(
+                    "system_tenant_not_found",
+                    oxi_id=oxi_id,
+                    error=str(e),
+                )
+                from django.http import HttpResponseBadRequest
+
+                return HttpResponseBadRequest("Missing X-Organization-ID header")
 
         # ── Status guards ─────────────────────────────────────────────
         if tenant.is_deleted or not tenant.is_active:

oxutils-0.4.2/src/oxutils/permissions/migrations/0009_grant_is_active.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.2.9 on 2026-06-29 14:25
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('permissions', '0008_remove_grant_unique_user_scope_role_and_more'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='grant',
+            name='is_active',
+            field=models.BooleanField(default=True),
+        ),
+    ]

{oxutils-0.4.0 → oxutils-0.4.2}/src/oxutils/permissions/models.py

@@ -148,6 +148,7 @@ class Grant(TimestampMixin):
     scope = models.CharField(max_length=100)
     actions = ArrayField(models.CharField(max_length=5))
     context = models.JSONField(default=dict, blank=True)
+    is_active = models.BooleanField(default=True)
 
     class Meta:
         constraints = [

{oxutils-0.4.0 → oxutils-0.4.2}/src/oxutils/permissions/perms.py

@@ -1,25 +1,25 @@
 from typing import Optional
+
 from django.conf import settings
 from django.core.exceptions import ImproperlyConfigured
 from django.http import HttpRequest
-from ninja_extra.permissions import BasePermission
 from ninja_extra.controllers import ControllerBase
+from ninja_extra.permissions import BasePermission
 
 from oxutils.permissions.utils import str_check
 
 
-
 class ScopePermission(BasePermission):
     """
     Permission class for checking user permissions using the string format.
-    
+
     Format: "<scope>:<actions>" or "<scope>:<actions>:<role>?key=value"
-    
+
     Example:
         @api_controller('/articles', permissions=[ScopePermission('articles:w')])
         class ArticleController:
             pass
-            
+
         @api_controller('/articles', permissions=[ScopePermission('articles:w:editor')])
         class EditorArticleController:
             pass
@@ -28,7 +28,7 @@ class ScopePermission(BasePermission):
     def __init__(self, perm: str, ctx: Optional[dict] = None):
         """
         Initialize the permission checker.
-        
+
         Args:
             perm: Permission string in format "<scope>:<actions>" or "<scope>:<actions>:<role>?context"
         """
@@ -38,11 +38,11 @@ class ScopePermission(BasePermission):
     def has_permission(self, request: HttpRequest, controller: ControllerBase) -> bool:
         """
         Check if the user has the required permission.
-        
+
         Args:
             request: HTTP request object
             controller: Controller instance
-            
+
         Returns:
             True if user has permission, False otherwise
         """
@@ -52,10 +52,10 @@ class ScopePermission(BasePermission):
 class ScopeAnyPermission(BasePermission):
     """
     Permission class for checking if user has at least one of multiple permissions.
-    
+
     Vérifie si l'utilisateur possède au moins une des permissions fournies.
     Utilise any_permission_check pour une vérification optimisée en une seule requête.
-    
+
     Example:
         @api_controller('/articles', permissions=[
             ScopeAnyPermission('articles:r', 'articles:w:editor', 'articles:d:admin')
@@ -68,7 +68,7 @@ class ScopeAnyPermission(BasePermission):
     def __init__(self, *perms: str):
         """
         Initialize the permission checker with multiple permission strings.
-        
+
         Args:
             *perms: Variable number of permission strings in format "<scope>:<actions>" or "<scope>:<actions>:<role>?context"
         """
@@ -79,25 +79,26 @@ class ScopeAnyPermission(BasePermission):
     def has_permission(self, request: HttpRequest, controller: ControllerBase) -> bool:
         """
         Check if the user has at least one of the required permissions.
-        
+
         Args:
             request: HTTP request object
             controller: Controller instance
-            
+
         Returns:
             True if user has at least one permission, False otherwise
         """
         from oxutils.permissions.caches import cache_any_permission_check
+
         return cache_any_permission_check(request.user, *self.perms)
 
 
 class ScopeAnyActionPermission(BasePermission):
     """
     Permission class for checking if user has at least one of multiple actions on a scope.
-    
+
     Vérifie si l'utilisateur possède au moins une des actions requises pour un scope donné.
     La chaîne d'actions contient plusieurs actions dont au moins une est requise.
-    
+
     Example:
         @api_controller('/articles', permissions=[
             ScopeAnyActionPermission('articles:rwd')
@@ -105,7 +106,7 @@ class ScopeAnyActionPermission(BasePermission):
         class ArticleController:
             # User needs read OR write OR delete access on articles
             pass
-            
+
         @api_controller('/invoices', permissions=[
             ScopeAnyActionPermission('invoices:rw:accountant')
         ])
@@ -117,7 +118,7 @@ class ScopeAnyActionPermission(BasePermission):
     def __init__(self, perm: str, ctx: Optional[dict] = None):
         """
         Initialize the permission checker with a permission string.
-        
+
         Args:
             perm: Permission string in format "<scope>:<actions>" or "<scope>:<actions>:<role>?context"
                   where actions contains multiple characters (e.g., 'rwd' for read OR write OR delete)
@@ -125,82 +126,76 @@ class ScopeAnyActionPermission(BasePermission):
         """
         if not perm:
             raise ValueError("Permission string must be provided")
-        
+
         self.perm = perm
-        self.ctx = ctx if ctx else dict()
+        self.ctx = ctx if ctx else {}
 
     def has_permission(self, request: HttpRequest, controller: ControllerBase) -> bool:
         """
         Check if the user has at least one of the required actions.
-        
+
         Args:
             request: HTTP request object
             controller: Controller instance
-            
+
         Returns:
             True if user has at least one action, False otherwise
         """
         from oxutils.permissions.caches import cache_any_action_check
         from oxutils.permissions.utils import parse_permission
-        
+
         scope, actions, role, query_context = parse_permission(self.perm)
         final_context = {**query_context, **self.ctx}
-        
-        return cache_any_action_check(
-            request.user,
-            scope,
-            actions,
-            role=role,
-            **final_context
-        )
+
+        return cache_any_action_check(request.user, scope, actions, role=role, **final_context)
 
 
 def access_manager(actions: str):
     """
     Factory function for creating ScopePermission instances for access manager.
-    
+
     Builds a permission string from settings:
     - ACCESS_MANAGER_SCOPE: The scope to check
     - ACCESS_MANAGER_GROUP: Optional group for UserGroup assignment (used in authorization)
     - ACCESS_MANAGER_ROLE: Optional role filter for permission checks
     - ACCESS_MANAGER_CONTEXT: Optional context dict converted to query params
-    
+
     Args:
         actions: Actions required (e.g., 'r', 'rw', 'rwd')
-        
+
     Returns:
         ScopePermission instance configured with access manager settings
-        
+
     Raises:
         ImproperlyConfigured: If required settings are missing
-        
+
     Example:
         @api_controller('/access', permissions=[access_manager('w')])
         class AccessController:
             pass
     """
     # Validate required settings
-    if not hasattr(settings, 'ACCESS_MANAGER_SCOPE'):
+    if not hasattr(settings, "ACCESS_MANAGER_SCOPE"):
         raise ImproperlyConfigured(
-            'ACCESS_MANAGER_SCOPE is not defined. '
+            "ACCESS_MANAGER_SCOPE is not defined. "
             'Add ACCESS_MANAGER_SCOPE = "access" to your settings.'
         )
-    
+
     # Build base permission string: scope:actions
     perm = f"{settings.ACCESS_MANAGER_SCOPE}:{actions}"
-    
+
     # Add role if defined and not None
-    if hasattr(settings, 'ACCESS_MANAGER_ROLE') and settings.ACCESS_MANAGER_ROLE is not None:
+    if hasattr(settings, "ACCESS_MANAGER_ROLE") and settings.ACCESS_MANAGER_ROLE is not None:
         perm += f":{settings.ACCESS_MANAGER_ROLE}"
-    
+
     # Get context if defined and not empty
     context = {}
-    if hasattr(settings, 'ACCESS_MANAGER_CONTEXT') and settings.ACCESS_MANAGER_CONTEXT:
+    if hasattr(settings, "ACCESS_MANAGER_CONTEXT") and settings.ACCESS_MANAGER_CONTEXT:
         context = settings.ACCESS_MANAGER_CONTEXT
         if not isinstance(context, dict):
             raise ImproperlyConfigured(
-                'ACCESS_MANAGER_CONTEXT must be a dictionary. '
-                f'Got {type(context).__name__} instead.'
+                "ACCESS_MANAGER_CONTEXT must be a dictionary. "
+                f"Got {type(context).__name__} instead."
             )
-    
+
     return ScopePermission(perm, context)

{oxutils-0.4.0 → oxutils-0.4.2}/src/oxutils/permissions/schemas.py

@@ -1,36 +1,35 @@
-from typing import Any, Optional
 from datetime import datetime
+from typing import Any, Optional
 from uuid import UUID
+
 from django.conf import settings
 from ninja import Schema
-from oxutils.oxiliere.schemas import UserSchema
 from pydantic import field_validator
 
+from oxutils.oxiliere.schemas import UserSchema
+
 from .actions import ACTIONS
 
 
 def validate_actions_list(actions: list[str]) -> list[str]:
     """
     Valide qu'une liste d'actions contient uniquement des actions valides.
-    
+
     Args:
         actions: Liste des actions à valider
-        
+
     Returns:
         La liste d'actions si valide
-        
+
     Raises:
         ValueError: Si des actions invalides sont présentes
     """
     if not actions:
         raise ValueError("Les actions ne peuvent pas être vides")
-    
+
     invalid_actions = [a for a in actions if a not in ACTIONS]
     if invalid_actions:
-        raise ValueError(
-            f"Actions invalides: {invalid_actions}. "
-            f"Actions valides: {ACTIONS}"
-        )
+        raise ValueError(f"Actions invalides: {invalid_actions}. Actions valides: {ACTIONS}")
     return actions
 
 
@@ -38,6 +37,7 @@ class RoleSchema(Schema):
     """
     Schéma pour un rôle.
     """
+
     slug: str
     name: str
     created_at: datetime
@@ -51,6 +51,7 @@ class RoleSimpleSchema(Schema):
     """
     Schéma pour un rôle.
     """
+
     slug: str
     name: str
 
@@ -62,6 +63,7 @@ class RoleCreateSchema(Schema):
     """
     Schéma pour la création d'un rôle.
     """
+
     slug: str
     name: str
 
@@ -70,6 +72,7 @@ class RoleUpdateSchema(Schema):
     """
     Schéma pour la mise à jour d'un rôle.
     """
+
     name: Optional[str] = None
 
 
@@ -77,6 +80,7 @@ class GroupSchema(Schema):
     """
     Schéma pour un groupe.
     """
+
     slug: str
     name: str
     app: Optional[str] = None
@@ -99,6 +103,7 @@ class GroupCreateSchema(Schema):
     """
     Schéma pour la création d'un groupe.
     """
+
     name: str
     app: Optional[str] = None
     roles: list[str] = []
@@ -108,6 +113,7 @@ class GroupUpdateSchema(Schema):
     """
     Schéma pour la mise à jour d'un groupe.
     """
+
     name: Optional[str] = None
     roles: Optional[list[str]] = None
 
@@ -116,6 +122,7 @@ class GroupMemberSchema(Schema):
     """
     Schéma pour un membre d'un groupe.
     """
+
     user: UserSchema
     group_id: str
     created_at: Optional[datetime] = None
@@ -125,6 +132,7 @@ class RoleGrantSchema(Schema):
     """
     Schéma pour un role grant.
     """
+
     id: int
     role: RoleSimpleSchema
     scope: str
@@ -139,12 +147,13 @@ class RoleGrantCreateSchema(Schema):
     """
     Schéma pour la création d'un role grant.
     """
+
     role: str
     scope: str
     actions: list[str]
     context: dict[str, Any] = {}
-    
-    @field_validator('actions')
+
+    @field_validator("actions")
     @classmethod
     def validate_actions(cls, v: list[str]) -> list[str]:
         """Valide que toutes les actions sont valides."""
@@ -155,10 +164,11 @@ class RoleGrantUpdateSchema(Schema):
     """
     Schéma pour la mise à jour d'un role grant.
     """
+
     actions: Optional[list[str]] = None
     context: Optional[dict[str, Any]] = None
-    
-    @field_validator('actions')
+
+    @field_validator("actions")
     @classmethod
     def validate_actions(cls, v: Optional[list[str]]) -> Optional[list[str]]:
         """Valide que toutes les actions sont valides."""
@@ -171,6 +181,7 @@ class GrantSchema(Schema):
     """
     Schéma pour un grant utilisateur.
     """
+
     id: int
     user_id: UUID
     role: RoleSimpleSchema
@@ -194,13 +205,14 @@ class GrantCreateSchema(Schema):
     """
     Schéma pour la création d'un grant utilisateur.
     """
+
     user_id: UUID
     scope: str
     actions: list[str]
     context: dict[str, Any] = {}
     role: str
-    
-    @field_validator('actions')
+
+    @field_validator("actions")
     @classmethod
     def validate_actions(cls, v: list[str]) -> list[str]:
         """Valide que toutes les actions sont valides."""
@@ -211,11 +223,12 @@ class GrantUpdateSchema(Schema):
     """
     Schéma pour la mise à jour d'un grant utilisateur.
     """
+
     actions: Optional[list[str]] = None
     context: Optional[dict[str, Any]] = None
     role: Optional[str] = None
-    
-    @field_validator('actions')
+
+    @field_validator("actions")
     @classmethod
     def validate_actions(cls, v: Optional[list[str]]) -> Optional[list[str]]:
         """Valide que toutes les actions sont valides."""
@@ -228,12 +241,13 @@ class PermissionCheckSchema(Schema):
     """
     Schéma pour une requête de vérification de permissions.
     """
+
     user_id: UUID
     scope: str
     required_actions: list[str]
     context: dict[str, Any] = {}
-    
-    @field_validator('required_actions')
+
+    @field_validator("required_actions")
     @classmethod
     def validate_actions(cls, v: list[str]) -> list[str]:
         """Valide que toutes les actions sont valides."""
@@ -244,6 +258,7 @@ class PermissionCheckResponseSchema(Schema):
     """
     Schéma pour la réponse d'une vérification de permissions.
     """
+
     allowed: bool
     user_id: UUID
     scope: str
@@ -254,16 +269,17 @@ class AssignRoleSchema(Schema):
     """
     Schéma pour assigner un rôle à un utilisateur.
     """
+
     user_id: UUID
     role: str
     scope: str
 
-    @field_validator('scope')
+    @field_validator("scope")
     @classmethod
     def validate_scope(cls, v: str) -> str:
         """Valide que le scope est valide."""
-        scopes = getattr(settings, 'ACCESS_SCOPES', [])
-        
+        scopes = getattr(settings, "ACCESS_SCOPES", [])
+
         if v not in scopes:
             raise ValueError(f"Invalid scope '{v}'")
         return v
@@ -273,22 +289,23 @@ class OverrideGrantSchema(Schema):
     """
     Schéma pour modifier un grant utilisateur.
     """
+
     user_id: UUID
     scope: str
     role: str
     actions: list[str]
 
-    @field_validator('scope')
+    @field_validator("scope")
     @classmethod
     def validate_scope(cls, v: str) -> str:
         """Valide que le scope est valide."""
-        scopes = getattr(settings, 'ACCESS_SCOPES', [])
+        scopes = getattr(settings, "ACCESS_SCOPES", [])
 
         if v not in scopes:
             raise ValueError(f"Invalid scope '{v}'")
         return v
 
-    @field_validator('actions')
+    @field_validator("actions")
     @classmethod
     def validate_actions(cls, v: list[str]) -> list[str]:
         """Valide que toutes les actions sont valides."""
@@ -299,15 +316,16 @@ class RevokeRoleSchema(Schema):
     """
     Schéma pour révoquer un rôle d'un utilisateur.
     """
+
     user_id: UUID
     scope: str
     role: str
 
-    @field_validator('scope')
+    @field_validator("scope")
     @classmethod
     def validate_scope(cls, v: str) -> str:
         """Valide que le scope est valide."""
-        scopes = getattr(settings, 'ACCESS_SCOPES', [])
+        scopes = getattr(settings, "ACCESS_SCOPES", [])
 
         if v not in scopes:
             raise ValueError(f"Invalid scope '{v}'")
@@ -318,6 +336,7 @@ class AssignGroupSchema(Schema):
     """
     Schéma pour assigner un groupe à un utilisateur.
     """
+
     user_id: UUID
     group: str
 
@@ -326,6 +345,7 @@ class RevokeGroupSchema(Schema):
     """
     Schéma pour révoquer un groupe d'un utilisateur.
     """
+
     user_id: UUID
     group: str
 
@@ -334,6 +354,7 @@ class GroupSyncResponseSchema(Schema):
     """
     Schéma pour la réponse de la synchronisation d'un groupe.
     """
+
     users_synced: int
     grants_updated: int
 
@@ -342,6 +363,7 @@ class PresetLoadResponseSchema(Schema):
     """
     Schéma pour la réponse du chargement d'un preset.
     """
+
     roles_created: int
     groups_created: int
     role_grants_created: int