regstack 0.2.5__tar.gz → 0.2.6__tar.gz

{regstack-0.2.5 → regstack-0.2.6}/CHANGELOG.md

@@ -5,6 +5,19 @@ authoritative copy lives at
 [`docs/changelog.md`](docs/changelog.md) and is rendered into the
 Sphinx docs.
 
+## 0.2.6 — 2026-04-28
+
+Bug fix.
+
+- **Fix:** `/admin/stats` reported `pending_registrations: 0` on
+  every SQL backend. The route reached into the Mongo repo's private
+  `_collection` attribute and silently fell back to `0` when the
+  attribute was absent. Added `count_unexpired(now=None)` to
+  `PendingRepoProtocol` with Mongo + SQL implementations and routed
+  through `rs.clock.now()` so the count respects the injected clock.
+  New parametrized integration test exercises the count on every
+  backend.
+
 ## 0.2.5 — 2026-04-28
 
 Bug fix + tooling.

{regstack-0.2.5 → regstack-0.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: regstack
-Version: 0.2.5
+Version: 0.2.6
 Summary: Embeddable user registration, login, and account management for FastAPI apps. SQLite / Postgres / MongoDB.
 Project-URL: Homepage, https://github.com/jdrumgoole/regstack
 Project-URL: Repository, https://github.com/jdrumgoole/regstack

{regstack-0.2.5 → regstack-0.2.6}/docs/changelog.md

@@ -3,6 +3,36 @@
 All notable changes to this project are documented here. Versions follow
 [Semantic Versioning](https://semver.org/) once `1.0.0` ships.
 
+## 0.2.6 — 2026-04-28
+
+**Bug fix.**
+
+### Fixed
+
+- ``/admin/stats`` reported ``pending_registrations: 0`` on every SQL
+  backend. The route reached into the Mongo repo's private
+  ``_collection`` attribute and silently fell back to ``0`` when the
+  attribute was absent — the kind of failure that survives a
+  multi-backend refactor when the integration tests don't pin the
+  number.
+
+### Added
+
+- ``PendingRepoProtocol.count_unexpired(now=None) -> int``, with Mongo
+  and SQL implementations. "Unexpired" rather than a raw row count
+  because SQL backends accumulate dead rows until ``purge_expired``
+  runs; an admin looking at "pending: 47" wants 47 *live* rows.
+- The admin stats route now routes the count through
+  ``rs.clock.now()``. Without this, ``FrozenClock``-driven tests
+  would see every row as "expired" because the route would be reading
+  wall-clock time while the rest of the system runs on the injected
+  clock. Same shape of clock-injection drift the bulk-revoke fix
+  closed earlier.
+- New parametrized integration test
+  ``test_stats_pending_registrations_count_unexpired`` runs against
+  SQLite + Mongo + Postgres and confirms the count excludes expired
+  rows on every backend.
+
 ## 0.2.5 — 2026-04-28
 
 **Bug fix + tooling.**

{regstack-0.2.5 → regstack-0.2.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "regstack"
-version = "0.2.5"
+version = "0.2.6"
 description = "Embeddable user registration, login, and account management for FastAPI apps. SQLite / Postgres / MongoDB."
 readme = "README.md"
 requires-python = ">=3.11"

{regstack-0.2.5 → regstack-0.2.6}/src/regstack/backends/mongo/repositories/pending_repo.py

@@ -64,6 +64,10 @@ class PendingRepo:
         result = await self._collection.delete_many({"expires_at": {"$lt": cutoff}})
         return int(result.deleted_count)
 
+    async def count_unexpired(self, now: datetime | None = None) -> int:
+        cutoff = now or datetime.now(UTC)
+        return await self._collection.count_documents({"expires_at": {"$gt": cutoff}})
+
     @staticmethod
     def _hydrate(doc: dict[str, Any] | None) -> PendingRegistration | None:
         if doc is None:

{regstack-0.2.5 → regstack-0.2.6}/src/regstack/backends/protocols.py

@@ -154,6 +154,22 @@ class PendingRepoProtocol(Protocol):
         """
         ...
 
+    async def count_unexpired(self, now: datetime | None = None) -> int:
+        """Count pending-registration rows whose ``expires_at`` is in the future.
+
+        "Unexpired" rather than a raw row-count because SQL backends
+        accumulate dead rows until ``purge_expired`` runs — a raw
+        count would double-report a verification email that's been
+        unanswered for a month and a fresh one sent today.
+
+        Args:
+            now: Reference instant. Defaults to ``datetime.now(UTC)``.
+
+        Returns:
+            Number of pending rows with ``expires_at > now``.
+        """
+        ...
+
 
 @runtime_checkable
 class BlacklistRepoProtocol(Protocol):

{regstack-0.2.5 → regstack-0.2.6}/src/regstack/backends/sql/repositories/pending_repo.py

@@ -4,7 +4,7 @@ import uuid
 from datetime import UTC, datetime
 from typing import TYPE_CHECKING
 
-from sqlalchemy import delete, select
+from sqlalchemy import delete, func, select
 
 from regstack.backends.sql.schema import pending_table
 from regstack.models.pending_registration import PendingRegistration
@@ -56,6 +56,14 @@ class SqlPendingRepo:
             result = await conn.execute(delete(self._t).where(self._t.c.expires_at < cutoff))
         return int(result.rowcount or 0)
 
+    async def count_unexpired(self, now: datetime | None = None) -> int:
+        cutoff = now or datetime.now(UTC)
+        async with self._engine.connect() as conn:
+            result = await conn.execute(
+                select(func.count()).select_from(self._t).where(self._t.c.expires_at > cutoff)
+            )
+        return int(result.scalar_one())
+
 
 def _pending_values(p: PendingRegistration) -> dict:
     return {

{regstack-0.2.5 → regstack-0.2.6}/src/regstack/routers/admin.py

@@ -50,13 +50,7 @@ def build_admin_router(rs: RegStack) -> APIRouter:
         active = await rs.users.count(is_active=True)
         verified = await rs.users.count(is_verified=True)
         supers = await rs.users.count(is_superuser=True)
-        # PendingRegistrations don't have a count() yet — peek through the
-        # mongo backend; SQL backends will add a typed count too.
-        pending_count_doc = getattr(rs.pending, "_collection", None)
-        if pending_count_doc is not None:
-            pending = await pending_count_doc.count_documents({})
-        else:  # pragma: no cover — used by SQL backends in Phase 2
-            pending = 0
+        pending = await rs.pending.count_unexpired(rs.clock.now())
         return AdminStats(
             total_users=total,
             active_users=active,

regstack-0.2.6/src/regstack/version.py

@@ -0,0 +1 @@
+__version__ = "0.2.6"

{regstack-0.2.5 → regstack-0.2.6}/tests/integration/test_admin_router.py

@@ -161,6 +161,62 @@ async def test_admin_resend_verification(make_client) -> None:
         assert r.status_code == 400
 
 
+@pytest.mark.asyncio
+async def test_stats_pending_registrations_count_unexpired(make_client) -> None:
+    """Admin stats must report pending-registration count correctly on every backend.
+
+    Before this test landed, the stats route reached into Mongo's private
+    ``_collection`` attribute and silently returned 0 on SQL backends. The
+    parametrized ``backend_kind`` fixture means this asserts the count
+    against SQLite, MongoDB, and PostgreSQL in turn — a gap that survived
+    the multi-backend refactor because the existing admin tests didn't
+    pin this number.
+
+    Also seeds an already-expired pending row directly via the repo to
+    confirm the count excludes it (the SQL backend has no TTL reaper, so
+    this distinction matters).
+    """
+    from datetime import timedelta
+
+    from regstack.models.pending_registration import PendingRegistration
+
+    async with make_client(
+        require_verification=True,
+        enable_admin_router=True,
+    ) as (rs, client):
+        await rs.bootstrap_admin("admin@example.com", "adminadminadmin")
+        admin_token = await _login(client, "admin@example.com", "adminadminadmin")
+        headers = {"authorization": f"Bearer {admin_token}"}
+
+        # Two fresh registrations → two unexpired pending rows.
+        await client.post(REGISTER, json=ALICE)
+        await client.post(REGISTER, json=BOB)
+
+        r = await client.get(ADMIN_STATS, headers=headers)
+        assert r.status_code == 200
+        assert r.json()["pending_registrations"] == 2
+
+        # Insert a stale pending row directly, anchored to ``rs.clock`` so
+        # it's "in the past" from the route's POV (which also reads the
+        # injected clock). Mongo would reap it via TTL eventually; SQL
+        # leaves it in place until purge_expired runs. Either way,
+        # count_unexpired must exclude it.
+        stale = PendingRegistration(
+            email="stale@example.com",
+            hashed_password="x",
+            full_name="Stale",
+            token_hash="stale-token-hash",
+            expires_at=rs.clock.now() - timedelta(hours=1),
+        )
+        await rs.pending.upsert(stale)
+
+        r = await client.get(ADMIN_STATS, headers=headers)
+        assert r.status_code == 200
+        assert r.json()["pending_registrations"] == 2, (
+            f"stale row should not be counted: {r.json()}"
+        )
+
+
 @pytest.mark.asyncio
 async def test_admin_404_for_unknown_user(make_client) -> None:
     async with make_client(enable_admin_router=True) as (rs, client):

{regstack-0.2.5 → regstack-0.2.6}/uv.lock

@@ -1978,7 +1978,7 @@ wheels = [
 
 [[package]]
 name = "regstack"
-version = "0.2.5"
+version = "0.2.6"
 source = { editable = "." }
 dependencies = [
     { name = "aiosmtplib" },

regstack-0.2.5/src/regstack/version.py

@@ -1 +0,0 @@
-__version__ = "0.2.5"