regstack 0.8.1__tar.gz → 0.8.2__tar.gz

{regstack-0.8.1 → regstack-0.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: regstack
-Version: 0.8.1
+Version: 0.8.2
 Summary: Embeddable user registration, login, and account management for FastAPI apps. SQLite / Postgres / MongoDB.
 Project-URL: Homepage, https://github.com/jdrumgoole/regstack
 Project-URL: Repository, https://github.com/jdrumgoole/regstack

{regstack-0.8.1 → regstack-0.8.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "regstack"
-version = "0.8.1"
+version = "0.8.2"
 description = "Embeddable user registration, login, and account management for FastAPI apps. SQLite / Postgres / MongoDB."
 readme = "README.md"
 requires-python = ">=3.11"

{regstack-0.8.1 → regstack-0.8.2}/src/regstack/cli/_results.py

@@ -15,6 +15,7 @@ class CheckResult:
     ok: bool
     detail: str
     skipped: bool = False
+    warn: bool = False
 
     @classmethod
     def passed(cls, name: str, detail: str) -> CheckResult:
@@ -27,3 +28,11 @@ class CheckResult:
     @classmethod
     def skip(cls, name: str, detail: str) -> CheckResult:
         return cls(name=name, ok=True, detail=detail, skipped=True)
+
+    @classmethod
+    def warned(cls, name: str, detail: str) -> CheckResult:
+        """An advisory finding: not a hard failure (``ok=True`` so it
+        doesn't fail the command), but surfaced distinctly so operators
+        notice it. Used for things outside regstack's control that the
+        operator should act on — e.g. an out-of-date database server."""
+        return cls(name=name, ok=True, detail=detail, warn=True)

{regstack-0.8.1 → regstack-0.8.2}/src/regstack/cli/doctor.py

@@ -49,14 +49,23 @@ def doctor(config_path_in: Path | None, check_dns: bool, test_recipient: str | N
         _run(toml_path=toml_path, check_dns=check_dns, test_recipient=test_recipient)
     )
     failed = sum(1 for r in results if not r.ok)
+    warned = sum(1 for r in results if r.warn)
     for r in results:
-        symbol = click.style("✔", fg="green") if r.ok else click.style("✘", fg="red")
+        if r.warn:
+            symbol = click.style("⚠", fg="yellow")
+        elif r.ok:
+            symbol = click.style("✔", fg="green")
+        else:
+            symbol = click.style("✘", fg="red")
         click.echo(f"{symbol} {r.name}: {r.detail}")
+    if warned:
+        click.echo(click.style(f"\n{warned} advisory warning(s).", fg="yellow"), err=True)
     if failed:
-        click.echo(click.style(f"\n{failed} check(s) failed.", fg="red"), err=True)
+        click.echo(click.style(f"{failed} check(s) failed.", fg="red"), err=True)
     # Clamp to 0/1 so a shell `regstack doctor && deploy` is predictable;
-    # the failure count appears on the stderr line above for operators
-    # who want it. (Review #4.)
+    # advisory warnings (e.g. an out-of-date DB server) do NOT fail the
+    # command — they're surfaced but exit 0. The failure count appears on
+    # the stderr line above for operators who want it. (Review #4.)
     sys.exit(1 if failed else 0)
 
 
@@ -79,6 +88,9 @@ async def _run(
 
     out.append(await _check_backend(config))
     out.append(await _check_schema(config))
+    mongo_version = await _check_mongo_server_version(config)
+    if mongo_version is not None:
+        out.append(mongo_version)
     out.append(_check_email_factory(config))
 
     if check_dns:
@@ -156,6 +168,109 @@ async def _check_schema(config: RegStackConfig) -> CheckResult:
         await backend.aclose()
 
 
+# CVE-2025-14847 ("MongoBleed", CVSS 8.7): an unauthenticated network
+# attacker can leak server memory via crafted zlib-compressed messages.
+# The pymongo driver is not the vulnerable component — the server binary
+# is. Patched server releases by LTS track. Keyed (major, minor) →
+# minimum safe (major, minor, patch). See docs/security-reports/2026-05-20.md.
+_MONGO_PATCHED_BASELINE: dict[tuple[int, int], tuple[int, int, int]] = {
+    (8, 2): (8, 2, 3),
+    (8, 0): (8, 0, 17),
+    (7, 0): (7, 0, 28),
+    (6, 0): (6, 0, 27),
+    (5, 0): (5, 0, 32),
+    (4, 4): (4, 4, 30),
+}
+
+# The newest LTS track we have a baseline for. A server on a track newer
+# than this (e.g. 8.3+, 9.x) post-dates the advisory and is treated as safe.
+_MONGO_NEWEST_KNOWN_TRACK = max(_MONGO_PATCHED_BASELINE)
+# The oldest LTS track the advisory lists. Anything below it (3.6, 4.0,
+# 4.2, …) is EOL and below every patched release — warn.
+_MONGO_OLDEST_KNOWN_TRACK = min(_MONGO_PATCHED_BASELINE)
+
+
+def _parse_mongo_version(version: str) -> tuple[int, int, int] | None:
+    """Parse a MongoDB version string like ``"7.0.5"`` into ``(7, 0, 5)``.
+
+    Tolerates a release-candidate / pre-release suffix (``"8.0.0-rc1"``)
+    by splitting on the first ``-``. Returns ``None`` if the leading
+    three dotted components aren't all integers.
+    """
+    core = version.split("-", 1)[0]
+    parts = core.split(".")
+    if len(parts) < 3:
+        return None
+    try:
+        return (int(parts[0]), int(parts[1]), int(parts[2]))
+    except ValueError:
+        return None
+
+
+def _assess_mongo_server_version(version: str) -> tuple[bool, str]:
+    """Decide whether ``version`` is safe against CVE-2025-14847.
+
+    Returns ``(ok, detail)``. ``ok`` is False only when the server is on
+    a known-affected LTS track *below* its patched baseline — that's the
+    case worth a WARNING. Newer-than-advisory and patched servers return
+    True; an unrecognised/older track returns True with a "verify
+    manually" note rather than crying wolf on every odd build string.
+    """
+    parsed = _parse_mongo_version(version)
+    if parsed is None:
+        return True, f"server {version} (could not parse version; verify against CVE-2025-14847)"
+    track = (parsed[0], parsed[1])
+    baseline = _MONGO_PATCHED_BASELINE.get(track)
+    if baseline is not None:
+        if parsed < baseline:
+            patched = ".".join(str(n) for n in baseline)
+            return False, (
+                f"server {version} is vulnerable to CVE-2025-14847 (MongoBleed); "
+                f"upgrade to ≥ {patched}, or disable zlib compression in mongod.conf"
+            )
+        return True, f"server {version} (≥ {'.'.join(str(n) for n in baseline)}, patched)"
+    if track > _MONGO_NEWEST_KNOWN_TRACK:
+        return True, f"server {version} (newer than CVE-2025-14847 advisory tracks)"
+    if track < _MONGO_OLDEST_KNOWN_TRACK:
+        return False, (
+            f"server {version} is end-of-life and below every CVE-2025-14847 "
+            "patched release; upgrade to a supported, patched MongoDB version"
+        )
+    return True, (
+        f"server {version} on an unrecognised release track; verify against CVE-2025-14847 manually"
+    )
+
+
+async def _check_mongo_server_version(config: RegStackConfig) -> CheckResult | None:
+    """Advisory check: warn if the MongoDB *server* is below the
+    CVE-2025-14847 patched baseline. Returns None for non-Mongo backends
+    (the check doesn't apply).
+    """
+    from regstack.backends.base import BackendKind
+
+    backend = build_backend(config)
+    try:
+        if backend.kind is not BackendKind.MONGO:
+            return None
+        from regstack.backends.mongo import MongoBackend
+
+        assert isinstance(backend, MongoBackend)
+        info = await backend.database.command("buildInfo")
+        version = str(info.get("version", ""))
+        if not version:
+            return CheckResult.warned(
+                "mongo server", "buildInfo returned no version; verify against CVE-2025-14847"
+            )
+        ok, detail = _assess_mongo_server_version(version)
+        if ok:
+            return CheckResult.passed("mongo server", detail)
+        return CheckResult.warned("mongo server", detail)
+    except Exception as exc:
+        return CheckResult.warned("mongo server", f"version check failed: {exc}")
+    finally:
+        await backend.aclose()
+
+
 def _check_email_factory(config: RegStackConfig) -> CheckResult:
     try:
         service = build_email_service(config.email)

{regstack-0.8.1 → regstack-0.8.2}/src/regstack/config/schema.py

@@ -98,11 +98,15 @@ class SmsConfig(BaseModel):
     twilio_account_sid: str | None = None
     twilio_auth_token: SecretStr | None = None
 
-    log_bodies: bool = True
-    """When True (default), the ``null`` backend logs the SMS body
-    (including the 6-digit code) at INFO. Set to False to silence
-    code logging in shared environments. Other backends ignore this
-    flag — they never log message bodies."""
+    log_bodies: bool = False
+    """When True, the ``null`` backend logs the SMS body (including the
+    6-digit MFA code) at INFO. Defaults to False so a misconfigured
+    deployment can't leak codes into shared logs — symmetric with
+    ``email.log_bodies``. Set it True for local dev when you want to
+    read the code out of stdout (the bundled examples instead surface
+    it via an ``mfa_login_started`` hook, so they don't need this).
+    Other backends ignore this flag — they never log message bodies.
+    (Security review 2026-05-19.)"""
 
 
 class OAuthConfig(BaseModel):

{regstack-0.8.1 → regstack-0.8.2}/src/regstack/oauth/providers/google.py

@@ -16,6 +16,7 @@ installed and turns ``enable_oauth`` on.
 
 from __future__ import annotations
 
+import asyncio
 from typing import TYPE_CHECKING, Any
 from urllib.parse import urlencode
 
@@ -162,7 +163,14 @@ class GoogleProvider(OAuthProvider):
         expected_nonce: str,
     ) -> OAuthUserInfo:
         try:
-            signing_key = self._jwks_client.get_signing_key_from_jwt(id_token).key
+            # PyJWKClient's fetch is synchronous urllib; on a cache miss it
+            # would block the event loop for the round-trip to Google's JWKS
+            # endpoint. Push it to a worker thread so concurrent requests
+            # aren't stalled. (Security review 2026-05-20 · I-2.)
+            signing_key_obj = await asyncio.to_thread(
+                self._jwks_client.get_signing_key_from_jwt, id_token
+            )
+            signing_key = signing_key_obj.key
         except Exception as exc:  # PyJWKClient raises a grab-bag — collapse to ours
             raise OAuthIdTokenError(f"jwks lookup failed: {exc}") from exc
         try:

{regstack-0.8.1 → regstack-0.8.2}/src/regstack/sms/null.py

@@ -10,14 +10,15 @@ log = logging.getLogger("regstack.sms.null")
 class NullSmsService(SmsService):
     """Default backend. Records messages in ``self.outbox`` so tests and dev
     runs can inspect them without contacting a real SMS gateway. Logs each
-    send at INFO so the demo can grep the code out of stdout.
+    send at INFO.
 
-    ``log_bodies`` (default True) controls whether the message body
-    (containing the 6-digit code) is included in the log line. Operators
-    in shared environments who want call-only audit lines can flip it off.
+    ``log_bodies`` (default False) controls whether the message body
+    (containing the 6-digit code) is included in the log line. It defaults
+    off so a misconfigured deployment can't leak codes into shared logs;
+    flip it on for local dev when you want to read the code out of stdout.
     """
 
-    def __init__(self, *, log_bodies: bool = True) -> None:
+    def __init__(self, *, log_bodies: bool = False) -> None:
         self.outbox: list[SmsMessage] = []
         self._log_bodies = log_bodies
 

regstack-0.8.2/src/regstack/version.py

@@ -0,0 +1 @@
+__version__ = "0.8.2"

regstack-0.8.1/src/regstack/version.py

@@ -1 +0,0 @@
-__version__ = "0.8.1"