scriptgini 1.5.2__tar.gz → 1.5.3__tar.gz

{scriptgini-1.5.2 → scriptgini-1.5.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scriptgini
-Version: 1.5.2
+Version: 1.5.3
 Summary: Agentic AI system that converts functional test cases into automation test scripts.
 Author: ScriptGini Team
 License: Proprietary
@@ -16,7 +16,7 @@ Description-Content-Type: text/markdown
 
 > **Enterprise-grade Agentic AI system that converts functional test cases into high-quality, review-ready automation test scripts.**
 
-Current release: v1.5.2 (Sprint 6 hardening + API key audit/revocation patch)
+Current release: v1.5.3 (Sprint 6 complete - 100% test coverage and full audit logging hardening)
 
 ---
 

{scriptgini-1.5.2 → scriptgini-1.5.3}/README.md

@@ -2,7 +2,7 @@
 
 > **Enterprise-grade Agentic AI system that converts functional test cases into high-quality, review-ready automation test scripts.**
 
-Current release: v1.5.2 (Sprint 6 hardening + API key audit/revocation patch)
+Current release: v1.5.3 (Sprint 6 complete - 100% test coverage and full audit logging hardening)
 
 ---
 

scriptgini-1.5.3/app/__init__.py

@@ -0,0 +1,3 @@
+__version__ = "1.5.3"
+__api_version__ = "v1.5.3"
+

{scriptgini-1.5.2 → scriptgini-1.5.3}/app/routers/api_key.py

@@ -118,6 +118,7 @@ def update_api_key(
     
     # Check that the key belongs to the current user
     if existing_key.user_id != current_user.id:
+        _audit_api_key_event("api_key_revoked", current_user.id, existing_key.id, existing_key.prefix, "forbidden")
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Not authorized to update this API key")
     
     api_key = api_key_service.update_api_key(
@@ -141,6 +142,7 @@ def delete_api_key(
     existing_key = api_key_service.get_api_key_by_id(db, key_id)
     
     if not existing_key:
+        _audit_api_key_event("api_key_revoked", current_user.id, key_id, None, "not_found")
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="API key not found")
     
     # Check that the key belongs to the current user

{scriptgini-1.5.2 → scriptgini-1.5.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "scriptgini"
-version = "1.5.2"
+version = "1.5.3"
 description = "Agentic AI system that converts functional test cases into automation test scripts."
 readme = "README.md"
 requires-python = ">=3.11"

{scriptgini-1.5.2 → scriptgini-1.5.3}/scriptgini.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scriptgini
-Version: 1.5.2
+Version: 1.5.3
 Summary: Agentic AI system that converts functional test cases into automation test scripts.
 Author: ScriptGini Team
 License: Proprietary
@@ -16,7 +16,7 @@ Description-Content-Type: text/markdown
 
 > **Enterprise-grade Agentic AI system that converts functional test cases into high-quality, review-ready automation test scripts.**
 
-Current release: v1.5.2 (Sprint 6 hardening + API key audit/revocation patch)
+Current release: v1.5.3 (Sprint 6 complete - 100% test coverage and full audit logging hardening)
 
 ---
 

{scriptgini-1.5.2 → scriptgini-1.5.3}/tests/test_auth.py

@@ -386,6 +386,43 @@ class TestAPIKeyManagement:
         )
         assert response.status_code == 403
 
+    def test_update_api_key_not_accessible_by_other_user_emits_audit_log(
+        self, db_session, test_user, test_user_2, auth_headers, monkeypatch
+    ):
+        """Update by non-owner should emit a structured audit event."""
+        create_response = client.post(
+            "/api/v1/auth/api-keys",
+            headers=auth_headers,
+            json={"name": "Owner Key", "scopes": ["read"]},
+        )
+        key_id = create_response.json()["id"]
+
+        login_response = client.post(
+            "/api/v1/auth/login",
+            json={
+                "email": "testuser2@example.com",
+                "password": "TestPassword123!",
+            },
+        )
+        other_user_headers = {
+            "Authorization": f"Bearer {login_response.json()['access_token']}"
+        }
+
+        captured: list[tuple] = []
+
+        def _capture_log(*args, **kwargs):
+            captured.append(args)
+
+        monkeypatch.setattr("app.routers.api_key.logger.info", _capture_log)
+
+        response = client.put(
+            f"/api/v1/auth/api-keys/{key_id}",
+            headers=other_user_headers,
+            json={"name": "Hacked", "scopes": ["write"]},
+        )
+        assert response.status_code == 403
+        assert any(len(entry) > 5 and entry[1] == "api_key_revoked" and entry[5] == "forbidden" for entry in captured)
+
     def test_delete_api_key(self, db_session, test_user, auth_headers):
         """Test deleting an API key."""
         # Create key
@@ -449,6 +486,19 @@ class TestAPIKeyManagement:
         response = client.delete("/api/v1/auth/api-keys/99999", headers=auth_headers)
         assert response.status_code == 404
 
+    def test_delete_api_key_not_found_emits_audit_log(self, auth_headers, monkeypatch):
+        """Missing API key deletion should emit a structured audit event."""
+        captured: list[tuple] = []
+
+        def _capture_log(*args, **kwargs):
+            captured.append(args)
+
+        monkeypatch.setattr("app.routers.api_key.logger.info", _capture_log)
+
+        response = client.delete("/api/v1/auth/api-keys/99999", headers=auth_headers)
+        assert response.status_code == 404
+        assert any(len(entry) > 5 and entry[1] == "api_key_revoked" and entry[5] == "not_found" for entry in captured)
+
     def test_delete_api_key_not_accessible_by_other_user(
         self, db_session, test_user, test_user_2, auth_headers
     ):

scriptgini-1.5.2/app/__init__.py

@@ -1,3 +0,0 @@
-__version__ = "1.5.2"
-__api_version__ = "v1.5.2"
-