regstack 0.8.2__tar.gz → 0.8.3__tar.gz

{regstack-0.8.2 → regstack-0.8.3}/CHANGELOG.md

@@ -7,6 +7,61 @@ Sphinx docs.
 
 ## Unreleased
 
+## 0.8.3 — 2026-06-12
+
+Closes out the 2026-05-15 → 2026-05-22 daily security-review series,
+fixes `was_new_account` on the OAuth exchange (new migration `0003`),
+and stops the test suite leaking MongoDB databases.
+
+**Fixed: Google JWKS fetch now has a timeout.** `PyJWKClient` was
+constructed without a `timeout`, so the synchronous `urllib` fetch
+(offloaded to `asyncio.to_thread`) could pin a worker thread
+indefinitely during a Google JWKS outage and, under sustained load,
+exhaust the bounded asyncio thread pool. Added a 5-second
+`JWKS_FETCH_TIMEOUT_SECONDS`. (Daily security review 2026-05-22 · W-1.)
+
+**Fixed: Google OAuth token-exchange error no longer logs the full
+provider response body at WARNING.** On a non-200 token exchange the
+provider's response body is now logged at DEBUG; the raised
+`OAuthTokenExchangeError` (which the router logs at WARNING) carries only
+`HTTP <status>`. (Daily security review 2026-05-22 · I-3.)
+
+**Fixed: `/oauth/exchange` now reports `was_new_account` accurately.**
+The field was hardcoded `False`; the callback computed whether it created
+a brand-new account but had nowhere to persist it. Added
+`oauth_states.result_was_new` (migration `0003`) which the callback sets
+and the exchange endpoint reads. (Daily security review 2026-05-22 · I-1.)
+
+**Documented: `phone_number` exposure in the admin user listing.**
+`docs/security.md` now spells out that `UserPublic.phone_number` is
+returned in plaintext on `GET /admin/users` (regulated PII in some
+jurisdictions) and that hosts wanting to mask/omit it should wrap the
+admin listing in their own response model. (Daily security review
+2026-05-21 · I-2.)
+
+**Fixed: `FrozenClock` now defaults to the far future (2125-01-01).**
+MongoDB's TTL monitor uses real wall-clock time, so the old 2025-01-01
+default meant every TTL-indexed test row was born already-expired and
+could be reaped mid-test when a ~60s TTL sweep landed — a rare,
+mongo-only parallel flake. A far-future pin keeps the reaper out of
+reach while staying deterministic.
+
+**Fixed: test runs no longer leak MongoDB databases.** Tests using the
+`make_client` factory bypassed the only fixture that dropped the
+per-test database, leaking one `regstack_test_*` DB per test per run.
+A teardown fixture wired into `config` now drops the DB on every path,
+a run-token-scoped `pytest_sessionfinish` sweep catches anything a
+crashed worker leaves behind, and `inv clean-test-dbs` purges leftovers
+from hard-killed runs.
+
+**Triaged: CVE-2026-2978 / CVE-2026-2979 not applicable.** Flagged for
+monitoring in the 2026-05-22 review; published NVD details show both
+affect the third-party "FastApiAdmin" project, not the `fastapi`
+library. regstack has no `fastapi-admin` dependency and no fastapi-core
+advisories affect versions ≥ 0.120.0 (our floor). Triage note recorded
+beside the floor in `pyproject.toml`. (Daily security review
+2026-05-22 · I-2.)
+
 ## 0.8.0 — 2026-05-19
 
 `regstack ses setup` guided wizard, plus two security fixes from

{regstack-0.8.2 → regstack-0.8.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: regstack
-Version: 0.8.2
+Version: 0.8.3
 Summary: Embeddable user registration, login, and account management for FastAPI apps. SQLite / Postgres / MongoDB.
 Project-URL: Homepage, https://github.com/jdrumgoole/regstack
 Project-URL: Repository, https://github.com/jdrumgoole/regstack

{regstack-0.8.2 → regstack-0.8.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "regstack"
-version = "0.8.2"
+version = "0.8.3"
 description = "Embeddable user registration, login, and account management for FastAPI apps. SQLite / Postgres / MongoDB."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -19,6 +19,9 @@ classifiers = [
 dependencies = [
     # fastapi>=0.120.0 picks up CVE-2025-62727 (Starlette DoS via large
     # request bodies after multipart processing).
+    # CVE-2026-2978 / CVE-2026-2979 (flagged for monitoring in the
+    # 2026-05-22 security review, I-2) affect the third-party
+    # "FastApiAdmin" project, not fastapi itself — no floor bump needed.
     "fastapi>=0.120.0",
     "pydantic>=2.6",
     "pydantic-settings>=2.2",

{regstack-0.8.2 → regstack-0.8.3}/src/regstack/auth/clock.py

@@ -42,14 +42,23 @@ class FrozenClock:
     """
 
     def __init__(self, start: datetime | None = None) -> None:
-        """Pin the clock at ``start`` (default 2025-01-01 UTC).
+        """Pin the clock at ``start`` (default 2125-01-01 UTC).
+
+        The default is deliberately ~100 years in the *future*. MongoDB's
+        TTL monitor deletes documents by comparing their ``expires_at``
+        against real wall-clock time on a ~60s cycle — it knows nothing
+        about this injected clock. A frozen "now" in the past would give
+        every TTL-indexed test row (oauth_states, pending_registrations,
+        mfa_codes, login_attempts, blacklist) an already-elapsed
+        ``expires_at``, and any test straddling a TTL sweep would have
+        its rows reaped mid-flight. A far-future pin keeps the reaper
+        permanently out of reach while staying deterministic.
 
         Args:
             start: The initial timestamp. Should be tz-aware. Defaults
-                to ``2025-01-01T00:00:00Z`` so test datetimes are
-                memorable.
+                to ``2125-01-01T00:00:00Z``.
         """
-        self._now = start or datetime(2025, 1, 1, tzinfo=UTC)
+        self._now = start or datetime(2125, 1, 1, tzinfo=UTC)
 
     def now(self) -> datetime:
         """Return the currently-pinned timestamp."""

{regstack-0.8.2 → regstack-0.8.3}/src/regstack/backends/mongo/repositories/oauth_state_repo.py

@@ -31,8 +31,9 @@ class MongoOAuthStateRepo:
         token: str,
         *,
         new_expires_at: datetime | None = None,
+        was_new: bool = False,
     ) -> None:
-        updates: dict[str, Any] = {"result_token": token}
+        updates: dict[str, Any] = {"result_token": token, "result_was_new": was_new}
         if new_expires_at is not None:
             updates["expires_at"] = new_expires_at
         await self._collection.update_one(

{regstack-0.8.2 → regstack-0.8.3}/src/regstack/backends/protocols.py

@@ -295,6 +295,7 @@ class OAuthStateRepoProtocol(Protocol):
         token: str,
         *,
         new_expires_at: datetime | None = None,
+        was_new: bool = False,
     ) -> None:
         """Stash the session JWT after a successful callback so the
         SPA can pick it up via :meth:`consume`.
@@ -305,6 +306,10 @@ class OAuthStateRepoProtocol(Protocol):
         ``oauth.state_ttl_seconds`` (covering the round-trip with
         the provider) to ``oauth.completion_ttl_seconds`` (covering
         only the SPA's exchange call after the callback lands).
+
+        ``was_new`` records whether the callback created a brand-new
+        account, so the exchange response can report
+        ``was_new_account`` accurately.
         """
         ...
 

regstack-0.8.3/src/regstack/backends/sql/migrations/versions/0003_oauth_state_result_was_new.py

@@ -0,0 +1,44 @@
+"""Add oauth_states.result_was_new.
+
+Revision ID: 0003
+Revises: 0002
+Create Date: 2026-06-04
+
+The OAuth callback computes whether it created a brand-new account
+(vs. signing an existing one in) but had nowhere to persist it, so the
+``POST /oauth/exchange`` response always reported
+``was_new_account=False``. This adds the column the callback writes and
+the exchange endpoint reads (Security review 2026-05-22 · I-1).
+
+The column is NOT NULL with a ``False`` server default so the in-flight
+state rows that exist at migration time (if any) get a sensible value
+without a backfill. ``batch_alter_table`` keeps the ADD COLUMN safe on
+SQLite.
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "0003"
+down_revision: str | None = "0002"
+branch_labels: tuple[str, ...] | None = None
+depends_on: str | None = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table("oauth_states") as batch_op:
+        batch_op.add_column(
+            sa.Column(
+                "result_was_new",
+                sa.Boolean(),
+                nullable=False,
+                server_default=sa.false(),
+            )
+        )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("oauth_states") as batch_op:
+        batch_op.drop_column("result_was_new")

{regstack-0.8.2 → regstack-0.8.3}/src/regstack/backends/sql/repositories/oauth_state_repo.py

@@ -34,6 +34,7 @@ class SqlOAuthStateRepo:
             "created_at": state.created_at,
             "expires_at": state.expires_at,
             "result_token": state.result_token,
+            "result_was_new": state.result_was_new,
         }
         async with self._engine.begin() as conn:
             await conn.execute(self._t.insert().values(values))
@@ -50,8 +51,9 @@ class SqlOAuthStateRepo:
         token: str,
         *,
         new_expires_at: datetime | None = None,
+        was_new: bool = False,
     ) -> None:
-        values: dict[str, Any] = {"result_token": token}
+        values: dict[str, Any] = {"result_token": token, "result_was_new": was_new}
         if new_expires_at is not None:
             values["expires_at"] = new_expires_at
         stmt = update(self._t).where(self._t.c.id == state_id).values(**values)

{regstack-0.8.2 → regstack-0.8.3}/src/regstack/backends/sql/schema.py

@@ -162,6 +162,7 @@ def _oauth_states(table_name: str) -> Table:
         Column("created_at", UtcDateTime(), nullable=False),
         Column("expires_at", UtcDateTime(), nullable=False),
         Column("result_token", Text, nullable=True),
+        Column("result_was_new", Boolean, nullable=False, default=False),
         Index("ix_oauth_states_expires_at", "expires_at"),
         CheckConstraint("mode IN ('signin', 'link')", name="mode_valid"),
     )

{regstack-0.8.2 → regstack-0.8.3}/src/regstack/models/oauth_state.py

@@ -77,6 +77,13 @@ class OAuthState(BaseModel):
     ``id`` for this value via ``POST /oauth/exchange``; the row is
     deleted on exchange."""
 
+    result_was_new: bool = False
+    """Whether the callback created a brand-new account (vs. signing in
+    an existing one). Set alongside ``result_token`` so the
+    ``POST /oauth/exchange`` response can surface ``was_new_account``
+    accurately — the callback computes this but had no field to persist
+    it on before (Security review 2026-05-22 · I-1)."""
+
     def to_mongo(self) -> dict[str, Any]:
         data = self.model_dump(by_alias=True, exclude_none=True)
         return data

{regstack-0.8.2 → regstack-0.8.3}/src/regstack/oauth/providers/google.py

@@ -17,6 +17,7 @@ installed and turns ``enable_oauth`` on.
 from __future__ import annotations
 
 import asyncio
+import logging
 from typing import TYPE_CHECKING, Any
 from urllib.parse import urlencode
 
@@ -30,6 +31,8 @@ from regstack.oauth.errors import OAuthIdTokenError, OAuthTokenExchangeError
 if TYPE_CHECKING:
     from collections.abc import Iterable
 
+log = logging.getLogger("regstack.oauth.google")
+
 GOOGLE_ISSUER = "https://accounts.google.com"
 GOOGLE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth"
 GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token"
@@ -37,6 +40,13 @@ GOOGLE_JWKS_URL = "https://www.googleapis.com/oauth2/v3/certs"
 
 DEFAULT_SCOPES: tuple[str, ...] = ("openid", "email", "profile")
 
+# Bound the synchronous JWKS fetch so a slow or unreachable Google JWKS
+# endpoint can't pin a worker thread indefinitely. The fetch is offloaded
+# to `asyncio.to_thread`, but `urllib` defaults to no timeout — under a
+# sustained JWKS outage that would let cache-miss requests exhaust the
+# bounded asyncio thread pool. (Security review 2026-05-22 · W-1.)
+JWKS_FETCH_TIMEOUT_SECONDS = 5
+
 
 class GoogleProvider(OAuthProvider):
     """OIDC provider for Google.
@@ -80,7 +90,9 @@ class GoogleProvider(OAuthProvider):
         self._owns_http = http is None
         self._issuer = issuer
         self._scopes = tuple(scopes)
-        self._jwks_client = PyJWKClient(jwks_url, cache_keys=True)
+        self._jwks_client = PyJWKClient(
+            jwks_url, cache_keys=True, timeout=JWKS_FETCH_TIMEOUT_SECONDS
+        )
 
     @property
     def name(self) -> str:
@@ -141,8 +153,18 @@ class GoogleProvider(OAuthProvider):
             if self._owns_http and client is not self._http:
                 await client.aclose()
         if response.status_code != 200:
+            # Keep the provider's response body at DEBUG only. It doesn't
+            # carry our client secret or the auth code, but Google's error
+            # bodies are verbose and there's no reason to put them in
+            # production WARNING logs — the status code is the actionable
+            # signal. (Security review 2026-05-22 · I-3.)
+            log.debug(
+                "google token exchange response body (HTTP %s): %s",
+                response.status_code,
+                response.text,
+            )
             raise OAuthTokenExchangeError(
-                f"google token exchange failed: {response.status_code} {response.text}"
+                f"google token exchange failed: HTTP {response.status_code}"
             )
         body: dict[str, Any] = response.json()
         try:

{regstack-0.8.2 → regstack-0.8.3}/src/regstack/routers/oauth.py

@@ -168,7 +168,7 @@ def build_oauth_router(rs: RegStack) -> APIRouter:
         if _is_mfa_pending_token(state.result_token):
             return ExchangeResponse(
                 redirect_to=state.redirect_to,
-                was_new_account=False,
+                was_new_account=state.result_was_new,
                 expires_in=rs.config.mfa_pending_token_ttl_seconds,
                 mfa_required=True,
                 mfa_pending_token=state.result_token,
@@ -176,7 +176,7 @@ def build_oauth_router(rs: RegStack) -> APIRouter:
         return ExchangeResponse(
             access_token=state.result_token,
             redirect_to=state.redirect_to,
-            was_new_account=False,
+            was_new_account=state.result_was_new,
             expires_in=rs.config.jwt_ttl_seconds,
         )
 
@@ -361,6 +361,7 @@ def build_oauth_router(rs: RegStack) -> APIRouter:
                 pending_token,
                 new_expires_at=rs.clock.now()
                 + timedelta(seconds=rs.config.mfa_pending_token_ttl_seconds),
+                was_new=was_new,
             )
         else:
             # Mint the session JWT, stash it on the state row for the
@@ -376,6 +377,7 @@ def build_oauth_router(rs: RegStack) -> APIRouter:
                 token,
                 new_expires_at=rs.clock.now()
                 + timedelta(seconds=rs.config.oauth.completion_ttl_seconds),
+                was_new=was_new,
             )
 
         await rs.hooks.fire(

regstack-0.8.3/src/regstack/version.py

@@ -0,0 +1 @@
+__version__ = "0.8.3"

regstack-0.8.2/src/regstack/version.py

@@ -1 +0,0 @@
-__version__ = "0.8.2"