pyobs-auth 2.0.0.dev5__tar.gz → 2.0.0.dev6__tar.gz

{pyobs_auth-2.0.0.dev5 → pyobs_auth-2.0.0.dev6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pyobs-auth
-Version: 2.0.0.dev5
+Version: 2.0.0.dev6
 Summary: Shared Keycloak/OIDC authentication client for pyobs web services
 Author-email: Tim-Oliver Husser <thusser@uni-goettingen.de>
 License-Expression: MIT

{pyobs_auth-2.0.0.dev5 → pyobs_auth-2.0.0.dev6}/pyobs_auth/authentication.py

@@ -8,6 +8,11 @@ issuer.
 
 This class is written to be safe to stack alongside another Bearer-scheme authenticator that
 can't be modified (e.g. an existing legacy OAuth2 BearerAuthentication) - see below.
+
+A resolved user with `is_active=False` is refused - USER_RESOLVER implementations mint new
+accounts inactive by convention, giving each service an independent local activation gate on top
+of whatever access control Keycloak itself does (a kill switch that doesn't depend on Keycloak
+realm/client config alone).
 """
 
 from __future__ import annotations
@@ -50,6 +55,8 @@ class KeycloakAuthentication(authentication.BaseAuthentication):
         user = user_resolver(claims)
         if user is None:
             raise exceptions.AuthenticationFailed("No local user for this token")
+        if not user.is_active:
+            raise exceptions.AuthenticationFailed("Account pending activation")
 
         return (user, claims)
 

{pyobs_auth-2.0.0.dev5 → pyobs_auth-2.0.0.dev6}/pyobs_auth/views.py

@@ -76,6 +76,8 @@ class CallbackView(View):
         user = user_resolver(claims)
         if user is None:
             return HttpResponseBadRequest("No local user for this token")
+        if not user.is_active:
+            return HttpResponseBadRequest("Account pending activation")
 
         backend = getattr(django_settings, "PYOBS_AUTH_LOGIN_BACKEND", "django.contrib.auth.backends.ModelBackend")
         login(request, user, backend=backend)

{pyobs_auth-2.0.0.dev5 → pyobs_auth-2.0.0.dev6}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pyobs-auth"
-version = "2.0.0.dev5"
+version = "2.0.0.dev6"
 description = "Shared Keycloak/OIDC authentication client for pyobs web services"
 authors = [{ name = "Tim-Oliver Husser", email = "thusser@uni-goettingen.de" }]
 requires-python = ">=3.11"