simple-module-auth 0.0.32__tar.gz → 0.0.34__tar.gz

{simple_module_auth-0.0.32 → simple_module_auth-0.0.34}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_auth
-Version: 0.0.32
+Version: 0.0.34
 Summary: Session-cookie authentication primitives — middleware, login/logout, redirect helpers for simple_module
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -22,8 +22,8 @@ Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Typing :: Typed
 Requires-Python: >=3.12
 Requires-Dist: itsdangerous>=2.2
-Requires-Dist: simple-module-core==0.0.32
-Requires-Dist: simple-module-db==0.0.32
+Requires-Dist: simple-module-core==0.0.34
+Requires-Dist: simple-module-db==0.0.34
 Description-Content-Type: text/markdown
 
 # simple_module_auth

{simple_module_auth-0.0.32 → simple_module_auth-0.0.34}/auth/middleware.py

@@ -10,6 +10,7 @@ from __future__ import annotations
 
 import logging
 
+from simple_module_core.redirect_safety import SESSION_NEXT_KEY, safe_next_or_none
 from simple_module_db.listeners import current_user_id
 from starlette.requests import Request
 from starlette.responses import JSONResponse, RedirectResponse
@@ -26,7 +27,10 @@ _FRAMEWORK_PUBLIC_PREFIXES = (
     "/i18n/",
 )
 _FRAMEWORK_PUBLIC_EXACT = ("/",)
-_SESSION_NEXT_KEY = "next"
+
+
+def _query_suffix(request: Request) -> str:
+    return f"?{request.url.query}" if request.url.query else ""
 
 
 class AuthMiddleware:
@@ -92,9 +96,19 @@ class AuthMiddleware:
             if path.startswith("/api/") or provider.is_bearer_request(request):
                 response = JSONResponse({"detail": "Not authenticated"}, status_code=401)
             else:
+                # Stash where they were heading so the login flow can return
+                # them there. Relative, not ``str(request.url)``: the value is
+                # replayed into a ``Location`` header, and an absolute URL is
+                # both needless and an open-redirect shape. ``next_url`` also
+                # goes to the provider — session-based providers ignore it,
+                # but a redirect-based one (OIDC) needs it in the auth URL.
                 session = scope.get("session", {})
-                session[_SESSION_NEXT_KEY] = str(request.url)
-                response = RedirectResponse(provider.get_login_url(request), status_code=302)
+                next_url = safe_next_or_none(request.url.path + _query_suffix(request))
+                if next_url is not None:
+                    session[SESSION_NEXT_KEY] = next_url
+                response = RedirectResponse(
+                    provider.get_login_url(request, next_url), status_code=302
+                )
             await response(scope, receive, send)
             return
 

{simple_module_auth-0.0.32 → simple_module_auth-0.0.34}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_auth"
-version = "0.0.32"
+version = "0.0.34"
 description = "Session-cookie authentication primitives — middleware, login/logout, redirect helpers for simple_module"
 readme = "README.md"
 license = "MIT"
@@ -22,8 +22,8 @@ classifiers = [
 ]
 dependencies = [
     "itsdangerous>=2.2",
-    "simple_module_core==0.0.32",
-    "simple_module_db==0.0.32",
+    "simple_module_core==0.0.34",
+    "simple_module_db==0.0.34",
 ]
 
 [project.entry-points.simple_module]

{simple_module_auth-0.0.32 → simple_module_auth-0.0.34}/tests/test_auth_middleware.py

@@ -203,3 +203,73 @@ async def test_resolver_exception_is_logged_and_skipped():
     ) as c:
         resp = await c.get("/protected/page")
     assert resp.status_code == 302
+
+
+class TestDeepLinkPreservation:
+    """AuthMiddleware stashes where an anonymous visitor was heading.
+
+    The value is replayed into a ``Location`` header after login, so it is
+    stored relative and sanitised on the way in — see
+    ``simple_module_core.redirect_safety``.
+    """
+
+    async def _get(self, app, path: str):
+        transport = httpx.ASGITransport(app=app)
+        async with httpx.AsyncClient(
+            transport=transport, base_url="http://test", follow_redirects=False
+        ) as c:
+            return await c.get(path)
+
+    async def test_target_is_offered_to_the_provider(self):
+        """The provider is handed the target, not left to guess it."""
+        seen: list[str | None] = []
+
+        class _RecordingProvider(_StubProvider):
+            def get_login_url(self, request, next_url=None):
+                seen.append(next_url)
+                return "/stub/login"
+
+        app = _build_app(_RecordingProvider())
+        app.add_middleware(AuthMiddleware)
+        app.add_middleware(SessionMiddleware, secret_key=SECRET)
+
+        await self._get(app, "/protected/page?tab=2")
+
+        assert seen == ["/protected/page?tab=2"]
+
+    async def test_target_is_relative_not_absolute(self):
+        """``str(request.url)`` would hand the provider an absolute URL —
+        needless, and the wrong shape for a redirect target."""
+        seen: list[str | None] = []
+
+        class _RecordingProvider(_StubProvider):
+            def get_login_url(self, request, next_url=None):
+                seen.append(next_url)
+                return "/stub/login"
+
+        app = _build_app(_RecordingProvider())
+        app.add_middleware(AuthMiddleware)
+        app.add_middleware(SessionMiddleware, secret_key=SECRET)
+
+        await self._get(app, "/protected/page")
+
+        assert seen == ["/protected/page"]
+        assert not seen[0].startswith("http")
+
+    async def test_authenticated_request_stashes_nothing(self):
+        """Only the anonymous branch records a target."""
+        seen: list[str | None] = []
+
+        class _RecordingProvider(_StubProvider):
+            def get_login_url(self, request, next_url=None):
+                seen.append(next_url)
+                return "/stub/login"
+
+        app = _build_app(_RecordingProvider(user=_TEST_USER))
+        app.add_middleware(AuthMiddleware)
+        app.add_middleware(SessionMiddleware, secret_key=SECRET)
+
+        resp = await self._get(app, "/protected/page")
+
+        assert resp.status_code == 200
+        assert seen == []