simple-module-auth 0.0.35__tar.gz → 0.0.36__tar.gz

{simple_module_auth-0.0.35 → simple_module_auth-0.0.36}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_auth
-Version: 0.0.35
+Version: 0.0.36
 Summary: Session-cookie authentication primitives — middleware, login/logout, redirect helpers for simple_module
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -22,8 +22,8 @@ Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Typing :: Typed
 Requires-Python: >=3.12
 Requires-Dist: itsdangerous>=2.2
-Requires-Dist: simple-module-core==0.0.35
-Requires-Dist: simple-module-db==0.0.35
+Requires-Dist: simple-module-core==0.0.36
+Requires-Dist: simple-module-db==0.0.36
 Description-Content-Type: text/markdown
 
 # simple_module_auth

{simple_module_auth-0.0.35 → simple_module_auth-0.0.36}/auth/contracts/schemas.py

@@ -20,13 +20,20 @@ class UserContext:
     name: str
     roles: list[str] = field(default_factory=list)
     tenant_id: str | None = None
+    # Permissions the principal carries itself — a token scope or IdP claim a
+    # provider maps in. Frozen in the session cookie like ``roles``; anything
+    # revocable belongs in a grant source. The resolver drops ``*`` from here.
+    permissions: list[str] = field(default_factory=list)
 
     @classmethod
     def from_user(cls, user: User | Any) -> UserContext:
         """Build a UserContext from a users.models.User with eagerly-loaded roles.
 
         Duck-typed to avoid importing users.models at runtime — any object
-        exposing .id, .email, .full_name, .roles[*].name, .tenant_id works.
+        exposing .id, .email, .full_name, .roles[*].name works. The user row
+        carries no tenant: the active tenant is resolved per request from
+        ``tenants_membership``, so ``tenant_id`` stays ``None`` here (only a
+        generic provider's claim path sets it).
         The caller is responsible for eager-loading roles (selectinload).
         """
         return cls(
@@ -34,7 +41,6 @@ class UserContext:
             email=user.email,
             name=user.full_name or user.email,
             roles=[r.name for r in user.roles],
-            tenant_id=user.tenant_id,
         )
 
     def to_session_dict(self) -> dict[str, Any]:
@@ -49,6 +55,7 @@ class UserContext:
             "name": self.name,
             "roles": list(self.roles),
             "tenant_id": self.tenant_id,
+            "permissions": list(self.permissions),
         }
 
     @classmethod
@@ -64,6 +71,8 @@ class UserContext:
                 name=str(payload["name"]),
                 roles=list(payload.get("roles") or []),
                 tenant_id=payload.get("tenant_id"),
+                # Absent on cookies written before the field existed.
+                permissions=list(payload.get("permissions") or []),
             )
         except (KeyError, TypeError, ValueError):
             return None
@@ -71,5 +80,12 @@ class UserContext:
     def has_role(self, role: str) -> bool:
         return role in self.roles
 
+    def has_permission(self, permission: str) -> bool:
+        """Exact match against :attr:`permissions` only — no roles, no wildcard.
+
+        Gate routes with ``RequiresPermission``, which also folds in roles and
+        grant sources; this is for the principal's own claims alone."""
+        return permission in self.permissions
+
     def has_any_role(self, roles: list[str]) -> bool:
         return bool(set(self.roles) & set(roles))

{simple_module_auth-0.0.35 → simple_module_auth-0.0.36}/auth/deps.py

@@ -5,7 +5,9 @@ from __future__ import annotations
 from typing import Annotated
 
 from fastapi import Depends, HTTPException, Request
+from simple_module_core.permissions import grants
 from simple_module_hosting.i18n_deps import TranslatorDep
+from simple_module_hosting.permissions import ensure_resolved_permissions
 
 from auth.contracts.schemas import UserContext
 
@@ -44,11 +46,11 @@ def require_permission(*permissions: str):
         if _ADMIN_ROLE in user.roles:
             return
 
-        # Get permission registry from app state
-        perm_registry = request.app.state.sm.permissions
-        user_perms = perm_registry.get_permissions_for_roles(user.roles)
-
-        if not any(p in user_perms for p in permissions):
+        # The same resolution RequiresPermission reads: the registry's role map
+        # plus module grant sources. This used to call get_permissions_for_roles
+        # without a map, which grants every non-admin role nothing (GH #337).
+        held = await ensure_resolved_permissions(request)
+        if not any(grants(held, p) for p in permissions):
             raise HTTPException(
                 status_code=403,
                 detail=t.t(

{simple_module_auth-0.0.35 → simple_module_auth-0.0.36}/auth/middleware.py

@@ -33,6 +33,27 @@ def _query_suffix(request: Request) -> str:
     return f"?{request.url.query}" if request.url.query else ""
 
 
+def _is_navigation(request: Request) -> bool:
+    """Whether this request is the page the visitor asked for, not something it loaded.
+
+    Only a navigation may become the post-login target: the sign-in page's
+    own favicon request used to overwrite it, so sign-in landed on
+    /favicon.ico (#416). Inertia visits count — a session expiring mid-click
+    must still return the user to that page. Without fetch metadata (old
+    clients, scripts) keep the previous behaviour.
+    """
+    headers = request.headers
+    if headers.get("x-inertia") == "true":
+        return True
+    dest = headers.get("sec-fetch-dest")
+    if dest is not None:
+        return dest == "document"
+    mode = headers.get("sec-fetch-mode")
+    if mode is not None:
+        return mode == "navigate"
+    return True
+
+
 class AuthMiddleware:
     """Authenticate requests via the registered AuthProvider.
 
@@ -76,6 +97,11 @@ class AuthMiddleware:
             prefix_paths, exact_paths = provider.get_public_paths()
             is_public = any(path.startswith(p) for p in prefix_paths) or path in exact_paths
 
+        # Contract with the host's RateLimitMiddleware (plain scope key, no import
+        # between them): whether *this* middleware treats the request as anonymous-
+        # allowed, from all three sources above. One source of truth.
+        scope.setdefault("state", {})["auth_public"] = is_public
+
         request = Request(scope)
         user_ctx = await provider.resolve_user(request)
 
@@ -103,7 +129,13 @@ class AuthMiddleware:
                 # goes to the provider — session-based providers ignore it,
                 # but a redirect-based one (OIDC) needs it in the auth URL.
                 session = scope.get("session", {})
-                next_url = safe_next_or_none(request.url.path + _query_suffix(request))
+                # Only a navigation is a target: a subresource (the sign-in
+                # page's own favicon) would overwrite it (#416).
+                next_url = (
+                    safe_next_or_none(request.url.path + _query_suffix(request))
+                    if _is_navigation(request)
+                    else None
+                )
                 if next_url is not None:
                     session[SESSION_NEXT_KEY] = next_url
                 response = RedirectResponse(

{simple_module_auth-0.0.35 → simple_module_auth-0.0.36}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_auth"
-version = "0.0.35"
+version = "0.0.36"
 description = "Session-cookie authentication primitives — middleware, login/logout, redirect helpers for simple_module"
 readme = "README.md"
 license = "MIT"
@@ -22,8 +22,8 @@ classifiers = [
 ]
 dependencies = [
     "itsdangerous>=2.2",
-    "simple_module_core==0.0.35",
-    "simple_module_db==0.0.35",
+    "simple_module_core==0.0.36",
+    "simple_module_db==0.0.36",
 ]
 
 [project.entry-points.simple_module]

simple_module_auth-0.0.36/tests/test_auth_next_target.py

@@ -0,0 +1,98 @@
+"""Only top-level navigations may become the post-login target (#416)."""
+
+from __future__ import annotations
+
+import httpx
+import pytest
+from auth.middleware import AuthMiddleware
+from auth.state import AuthState
+from fastapi import FastAPI, Request
+from simple_module_core.redirect_safety import SESSION_NEXT_KEY
+from starlette.middleware.sessions import SessionMiddleware
+from starlette.responses import JSONResponse
+
+SECRET = "test-next-target-secret"
+
+
+class _StubProvider:
+    name = "stub"
+
+    async def resolve_user(self, request):
+        return None
+
+    def get_login_url(self, request, next_url=None):
+        return "/stub/login"
+
+    def get_logout_url(self, request):
+        return "/stub/logout"
+
+    def get_public_paths(self):
+        return (("/stub/login", "/stub/public/"), ())
+
+    def is_bearer_request(self, request):
+        return False
+
+
+def _build_app(provider) -> FastAPI:
+    app = FastAPI()
+    app.state.auth = AuthState(auth_provider=provider, principal_resolvers=[])
+
+    # /static/ is framework-public, so this reads the session without auth.
+    async def _next(request: Request):
+        return JSONResponse({"next": request.session.get(SESSION_NEXT_KEY)})
+
+    async def _any(path: str = ""):
+        return JSONResponse({})
+
+    app.add_api_route("/static/next", _next, methods=["GET"])
+    app.add_api_route("/{path:path}", _any, methods=["GET"])
+    app.add_middleware(AuthMiddleware)
+    app.add_middleware(SessionMiddleware, secret_key=SECRET)
+    return app
+
+
+CASES = [
+    ({"Sec-Fetch-Dest": "image", "Sec-Fetch-Mode": "no-cors"}, None),  # favicon
+    ({"Sec-Fetch-Dest": "script", "Sec-Fetch-Mode": "no-cors"}, None),
+    ({"Sec-Fetch-Dest": "empty", "Sec-Fetch-Mode": "cors"}, None),  # fetch()
+    ({"Sec-Fetch-Dest": "document", "Sec-Fetch-Mode": "navigate"}, "/protected/page"),
+    ({"Sec-Fetch-Mode": "navigate"}, "/protected/page"),
+    ({"X-Inertia": "true", "Sec-Fetch-Dest": "empty", "Sec-Fetch-Mode": "cors"}, "/protected/page"),
+    ({}, "/protected/page"),  # no metadata: previous behaviour
+]
+
+
+@pytest.mark.parametrize(("headers", "expected"), CASES)
+async def test_only_navigations_record_the_target(headers, expected):
+    seen: list[str | None] = []
+
+    class _Recording(_StubProvider):
+        def get_login_url(self, request, next_url=None):
+            seen.append(next_url)
+            return "/stub/login"
+
+    app = _build_app(_Recording())
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=app), base_url="http://test"
+    ) as c:
+        resp = await c.get("/protected/page", headers=headers)
+        recorded = (await c.get("/static/next")).json()["next"]
+    assert resp.status_code == 302
+    assert resp.headers["location"] == "/stub/login"
+    assert seen == [expected]
+    assert recorded == expected
+
+
+async def test_a_subresource_does_not_overwrite_a_recorded_target():
+    """The bug: the sign-in page's favicon request replaced the real target."""
+    app = _build_app(_StubProvider())
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=app), base_url="http://test"
+    ) as c:
+        nav = {"Sec-Fetch-Dest": "document", "Sec-Fetch-Mode": "navigate"}
+        assert (await c.get("/protected/page", headers=nav)).status_code == 302
+        icon = {"Sec-Fetch-Dest": "image", "Sec-Fetch-Mode": "no-cors"}
+        resp = await c.get("/favicon.ico", headers=icon)
+        assert resp.status_code == 302  # the redirect itself is unchanged
+        recorded = (await c.get("/static/next")).json()["next"]
+    assert recorded == "/protected/page"

{simple_module_auth-0.0.35 → simple_module_auth-0.0.36}/tests/test_deps.py

@@ -27,6 +27,14 @@ def _translator() -> Translator:
     return Translator(registry, locale="en", default_locale="en")
 
 
+def _request(app, user: UserContext) -> MagicMock:
+    """A request whose state is real, so the permission cache reads as absent."""
+    request = MagicMock()
+    request.app.state.sm = SimpleNamespace(permissions=app.state.sm.permissions)
+    request.state = SimpleNamespace(user=user)
+    return request
+
+
 class TestGetCurrentUser:
     async def test_raises_401_when_no_user(self):
         """get_current_user raises 401 when request.state has no user."""
@@ -53,10 +61,8 @@ class TestRequirePermission:
         dep = require_permission("products.delete")
         check_fn = dep.dependency
 
-        request = MagicMock()
-        request.app.state.sm = SimpleNamespace(permissions=app.state.sm.permissions)
-
         user = UserContext(id="u1", email="u@test.com", name="User", roles=["viewer"])
+        request = _request(app, user)
 
         with pytest.raises(HTTPException) as exc_info:
             await check_fn(request, _translator(), user)
@@ -67,10 +73,8 @@ class TestRequirePermission:
         dep = require_permission("products.delete")
         check_fn = dep.dependency
 
-        request = MagicMock()
-        request.app.state.sm = SimpleNamespace(permissions=app.state.sm.permissions)
-
         admin_user = UserContext(id="a1", email="admin@test.com", name="Admin", roles=["admin"])
+        request = _request(app, admin_user)
         await check_fn(request, _translator(), admin_user)
 
 
@@ -80,21 +84,28 @@ class TestRequirePermissionAdvanced:
         dep = require_permission("products.view", "products.edit")
         check_fn = dep.dependency
 
-        request = MagicMock()
-        request.app.state.sm = SimpleNamespace(permissions=app.state.sm.permissions)
-
         admin = UserContext(id="a1", email="a@t.com", name="Admin", roles=["admin"])
+        request = _request(app, admin)
         await check_fn(request, _translator(), admin)
 
     async def test_non_admin_without_permission_fails(self, app):
         dep = require_permission("products.delete")
         check_fn = dep.dependency
 
-        request = MagicMock()
-        request.app.state.sm = SimpleNamespace(permissions=app.state.sm.permissions)
-
         user = UserContext(id="u1", email="u@t.com", name="User", roles=["user"])
+        request = _request(app, user)
         with pytest.raises(HTTPException) as exc_info:
             await check_fn(request, _translator(), user)
         assert exc_info.value.status_code == 403
         assert "products.delete" in str(exc_info.value.detail)
+
+    async def test_non_admin_role_mapped_in_registry_passes(self, app):
+        """A role granted the key via the registry's role map is admitted.
+
+        Regression for GH #337: the check resolved roles without the role map,
+        so every non-admin role held nothing and this was a 403.
+        """
+        app.state.sm.permissions.map_role("clerk", ["products.delete"])
+        dep = require_permission("products.delete")
+        user = UserContext(id="u1", email="u@t.com", name="User", roles=["clerk"])
+        await dep.dependency(_request(app, user), _translator(), user)

{simple_module_auth-0.0.35 → simple_module_auth-0.0.36}/tests/test_user_context.py

@@ -18,14 +18,14 @@ class TestUserContextFromUser:
             email="charlie@example.com",
             full_name="Charlie Brown",
             roles=[role_a, role_b],
-            tenant_id="tenant-42",
         )
         ctx = UserContext.from_user(fake_user)
         assert ctx.id == "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
         assert ctx.email == "charlie@example.com"
         assert ctx.name == "Charlie Brown"
         assert ctx.roles == ["admin", "editor"]
-        assert ctx.tenant_id == "tenant-42"
+        # The user row carries no tenant; the resolver supplies it per request.
+        assert ctx.tenant_id is None
 
     async def test_from_user_name_fallback_to_email(self):
         """When full_name is None, ctx.name falls back to the user's email."""
@@ -93,3 +93,45 @@ class TestUserContextDefaults:
     async def test_roles_default_is_empty_list(self):
         ctx = UserContext(id="1", email="a@b.com", name="A")
         assert ctx.roles == []
+
+    async def test_permissions_default_is_empty_list(self):
+        ctx = UserContext(id="1", email="a@b.com", name="A")
+        assert ctx.permissions == []
+
+    async def test_positional_construction_unchanged(self):
+        ctx = UserContext("1", "a@b.com", "A", ["admin"], "t1")
+        assert ctx.tenant_id == "t1"
+        assert ctx.permissions == []
+
+
+class TestUserContextPermissions:
+    async def test_session_round_trip_keeps_permissions(self):
+        ctx = UserContext(id="1", email="a@b.com", name="A", permissions=["x.read", "x.write"])
+        payload = ctx.to_session_dict()
+        assert payload["permissions"] == ["x.read", "x.write"]
+        assert UserContext.from_session_dict(payload) == ctx
+
+    async def test_legacy_cookie_without_permissions_key(self):
+        """A cookie written before the field existed still decodes."""
+        payload = {"id": "1", "email": "a@b.com", "name": "A", "roles": [], "tenant_id": None}
+        ctx = UserContext.from_session_dict(payload)
+        assert ctx is not None
+        assert ctx.permissions == []
+
+    async def test_null_permissions_decodes_empty(self):
+        payload = {"id": "1", "email": "a@b.com", "name": "A", "permissions": None}
+        ctx = UserContext.from_session_dict(payload)
+        assert ctx is not None
+        assert ctx.permissions == []
+
+    async def test_from_user_leaves_permissions_empty(self):
+        from types import SimpleNamespace
+
+        user = SimpleNamespace(id=1, email="a@b.com", full_name="A", roles=[])
+        assert UserContext.from_user(user).permissions == []
+
+    async def test_has_permission_exact_match(self):
+        ctx = UserContext(id="1", email="a@b.com", name="A", permissions=["x.read"])
+        assert ctx.has_permission("x.read") is True
+        assert ctx.has_permission("x.write") is False
+        assert ctx.has_permission("x") is False