simple-module-auth 0.0.35__tar.gz → 0.0.37__tar.gz

{simple_module_auth-0.0.35 → simple_module_auth-0.0.37}/.gitignore

@@ -64,3 +64,4 @@ host/client_app/.playwright-cli/*
 .superpowers/
 .qa/
 .verify/
+/openapi.json

{simple_module_auth-0.0.35 → simple_module_auth-0.0.37}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_auth
-Version: 0.0.35
+Version: 0.0.37
 Summary: Session-cookie authentication primitives — middleware, login/logout, redirect helpers for simple_module
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -22,8 +22,8 @@ Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Typing :: Typed
 Requires-Python: >=3.12
 Requires-Dist: itsdangerous>=2.2
-Requires-Dist: simple-module-core==0.0.35
-Requires-Dist: simple-module-db==0.0.35
+Requires-Dist: simple-module-core==0.0.37
+Requires-Dist: simple-module-db==0.0.37
 Description-Content-Type: text/markdown
 
 # simple_module_auth

simple_module_auth-0.0.37/auth/_route_match.py

@@ -0,0 +1,71 @@
+"""Does a request resolve to *any* route of the app? (#473)
+
+``AuthMiddleware`` only gates paths the router would actually serve. A path
+nothing matches falls through to the normal 404 instead of bouncing an
+anonymous visitor to the sign-in form (and storing it as their post-login
+target). Every path that does resolve stays gated exactly as before.
+
+The probe mirrors Starlette/FastAPI dispatch without running a handler:
+
+* any ``Match`` other than ``NONE`` counts — ``PARTIAL`` is an existing path
+  under the wrong method (a 405 for a signed-in caller), so it stays gated;
+* the ``redirect_slashes`` toggle counts too — ``/admin/users/`` that only
+  resolves by redirecting to ``/admin/users`` is gated like its target;
+* FastAPI's low-priority (frontend) routes are consulted when present.
+
+It fails closed: any surprise while matching reports "exists", so the worst
+case is today's behaviour (a redirect), never an ungated route.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+from starlette.routing import Match
+from starlette.types import Scope
+
+logger = logging.getLogger(__name__)
+
+
+def _probe(scope: Scope, path: str | None = None) -> dict[str, Any]:
+    # A shallow copy without FastAPI's per-request bookkeeping: matching an
+    # included router writes into ``scope["fastapi"]``, which must not leak
+    # into the real dispatch that follows.
+    probe = {k: v for k, v in scope.items() if k != "fastapi"}
+    if path is not None:
+        probe["path"] = path
+    return probe
+
+
+def _any_match(router: Any, probe: dict[str, Any]) -> bool:
+    for route in router.routes:
+        match, _ = route.matches(probe)
+        if match != Match.NONE:
+            return True
+    return False
+
+
+def route_exists(scope: Scope) -> bool:
+    """Whether the app's router would serve this request (or redirect it to a route)."""
+    try:
+        router = scope["app"].router
+        if _any_match(router, _probe(scope)):
+            return True
+        path: str = scope["path"]
+        if getattr(router, "redirect_slashes", False) and path != "/":
+            toggled = path.rstrip("/") if path.endswith("/") else path + "/"
+            if _any_match(router, _probe(scope, toggled)):
+                return True
+        low_priority = getattr(router, "_match_low_priority", None)
+        if low_priority is not None:
+            match = low_priority(_probe(scope))[0]
+            if match != Match.NONE:
+                return True
+    except Exception:
+        logger.exception("Route probe failed; treating the path as existing")
+        return True
+    return False
+
+
+__all__ = ["route_exists"]

simple_module_auth-0.0.37/auth/contracts/schemas.py

@@ -0,0 +1,139 @@
+"""Auth data types shared with other modules."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, Any
+
+from auth.contracts.tokens import AUTH_KIND_SESSION
+
+if TYPE_CHECKING:
+    # Runtime import would be circular: auth -> users -> auth.
+    # Only imported for type-hints, never at runtime.
+    from users.models import User
+
+
+@dataclass
+class UserContext:
+    """Authenticated user information for downstream handlers."""
+
+    id: str
+    email: str
+    name: str
+    roles: list[str] = field(default_factory=list)
+    tenant_id: str | None = None
+    # Permissions the principal carries itself — a token scope or IdP claim a
+    # provider maps in. Frozen in the session cookie like ``roles``; anything
+    # revocable belongs in a grant source. The resolver drops ``*`` from here.
+    permissions: list[str] = field(default_factory=list)
+    # Which credential authenticated the request: ``"session"`` for a browser
+    # sign-in, ``"bearer"`` for a provider's own bearer token (a ``users``
+    # access token, an IdP JWT), ``"pat"`` / ``"service"`` for an
+    # ``api_tokens`` credential (see ``auth.contracts.tokens``). Code that must
+    # only ever act for a person at a keyboard — minting more credentials —
+    # refuses anything but ``"session"``.
+    auth_kind: str = AUTH_KIND_SESSION
+    # The ceiling a token carries. ``None`` means "no cap" (an ordinary
+    # session); a list — even an empty one — is intersected with whatever the
+    # principal resolves to, and the admin-role shortcuts are skipped, so an
+    # admin's token is worth exactly the scopes it was given.
+    scopes: list[str] | None = None
+    # A permission the account must *currently* hold for this credential to
+    # authenticate at all — ``api_tokens.use`` for a personal access token.
+    # Checked on every request against the account's live, tenant-aware
+    # permissions; when missing, the request runs as anonymous (401 on gated
+    # routes). ``None`` (a session, a service key) requires nothing.
+    required_permission: str | None = None
+
+    @property
+    def is_scoped(self) -> bool:
+        """Whether a scope cap applies (any token-authenticated principal)."""
+        return self.scopes is not None
+
+    @classmethod
+    def from_user(
+        cls,
+        user: User | Any,
+        *,
+        auth_kind: str = AUTH_KIND_SESSION,
+        scopes: list[str] | None = None,
+    ) -> UserContext:
+        """Build a UserContext from a users.models.User with eagerly-loaded roles.
+
+        Duck-typed to avoid importing users.models at runtime — any object
+        exposing .id, .email, .full_name, .roles[*].name works. The user row
+        carries no tenant: the active tenant is resolved per request from
+        ``tenants_membership``, so ``tenant_id`` stays ``None`` here (only a
+        generic provider's claim path sets it).
+        The caller is responsible for eager-loading roles (selectinload).
+        """
+        return cls(
+            id=str(user.id),
+            email=user.email,
+            name=user.full_name or user.email,
+            roles=[r.name for r in user.roles],
+            auth_kind=auth_kind,
+            scopes=list(scopes) if scopes is not None else None,
+        )
+
+    def to_session_dict(self) -> dict[str, Any]:
+        """Serialize to a JSON-safe dict for the signed session cookie.
+
+        The inverse of :meth:`from_session_dict`. Adding a new field to
+        ``UserContext`` requires updating both methods here — not the
+        AuthMiddleware cache helper, which stays schema-agnostic."""
+        return {
+            "id": self.id,
+            "email": self.email,
+            "name": self.name,
+            "roles": list(self.roles),
+            "tenant_id": self.tenant_id,
+            "permissions": list(self.permissions),
+            "auth_kind": self.auth_kind,
+            "scopes": list(self.scopes) if self.scopes is not None else None,
+            "required_permission": self.required_permission,
+        }
+
+    @classmethod
+    def from_session_dict(cls, payload: Any) -> UserContext | None:
+        """Rebuild from :meth:`to_session_dict` output. Returns ``None`` on any
+        shape mismatch so callers can fall through to a fresh DB load."""
+        if not isinstance(payload, dict):
+            return None
+        try:
+            return cls(
+                id=str(payload["id"]),
+                email=str(payload["email"]),
+                name=str(payload["name"]),
+                roles=list(payload.get("roles") or []),
+                tenant_id=payload.get("tenant_id"),
+                # Absent on cookies written before the field existed.
+                permissions=list(payload.get("permissions") or []),
+                auth_kind=str(payload.get("auth_kind") or AUTH_KIND_SESSION),
+                scopes=_scopes_from(payload.get("scopes")),
+                required_permission=payload.get("required_permission") or None,
+            )
+        except (KeyError, TypeError, ValueError):
+            return None
+
+    def has_role(self, role: str) -> bool:
+        return role in self.roles
+
+    def has_permission(self, permission: str) -> bool:
+        """Exact match against :attr:`permissions` only — no roles, no wildcard.
+
+        Gate routes with ``RequiresPermission``, which also folds in roles and
+        grant sources; this is for the principal's own claims alone."""
+        return permission in self.permissions
+
+    def has_any_role(self, roles: list[str]) -> bool:
+        return bool(set(self.roles) & set(roles))
+
+
+def _scopes_from(raw: Any) -> list[str] | None:
+    """``None`` stays ``None`` (uncapped); anything else must be a list."""
+    if raw is None:
+        return None
+    if not isinstance(raw, list):
+        raise TypeError("scopes must be a list")
+    return [str(s) for s in raw]

simple_module_auth-0.0.37/auth/contracts/tokens.py

@@ -0,0 +1,65 @@
+"""Credential kinds and API-token prefixes shared by every auth source.
+
+Lives in ``auth`` rather than in the ``api_tokens`` module because the auth
+*providers* need it: ``users`` and ``keycloak`` both claim every
+``Authorization: Bearer`` header, and must step aside for a value that is
+recognisably an ``api_tokens`` credential — otherwise each token request costs
+a wasted lookup against the provider's own token store (or a JWT parse), and
+the provider's ``None`` there is final, so the principal resolver that
+actually owns the token never gets to see it.
+"""
+
+from __future__ import annotations
+
+AUTH_KIND_SESSION = "session"
+"""A browser sign-in: the principal came from the session cookie."""
+
+AUTH_KIND_BEARER = "bearer"
+"""An auth provider's own ``Authorization: Bearer`` credential — a ``users``
+access token or an identity provider's JWT. Unscoped (it carries its user's
+full rights, as before), but not a person at a keyboard: it may not manage
+API tokens, so a short-lived access token cannot mint a year-long PAT."""
+
+AUTH_KIND_PAT = "pat"
+"""A personal access token acting for its owner, capped by its scopes."""
+
+AUTH_KIND_SERVICE = "service"
+"""A service API key: no person behind it, roles and tenant fixed at creation."""
+
+PAT_PREFIX = "smpat_"
+SERVICE_KEY_PREFIX = "smsk_"
+API_TOKEN_PREFIXES: tuple[str, ...] = (PAT_PREFIX, SERVICE_KEY_PREFIX)
+
+
+def parse_bearer(header: str | None) -> str | None:
+    """The credential of an ``Authorization: Bearer <credential>`` header, else None.
+
+    The auth scheme is case-insensitive (RFC 9110 §11.1): clients that build
+    the header from ``/auth/token``'s ``token_type`` send ``bearer``, and must
+    authenticate exactly like ``Bearer``. Surrounding and separating whitespace
+    is tolerated; a header with no credential, or a different scheme, is None.
+    """
+    if not header:
+        return None
+    parts = header.split(None, 1)
+    if len(parts) != 2 or parts[0].lower() != "bearer":
+        return None
+    return parts[1].strip() or None
+
+
+def is_api_token(credential: str) -> bool:
+    """Whether a bearer value is an ``api_tokens`` credential (by prefix only)."""
+    return credential.startswith(API_TOKEN_PREFIXES)
+
+
+__all__ = [
+    "API_TOKEN_PREFIXES",
+    "AUTH_KIND_BEARER",
+    "AUTH_KIND_PAT",
+    "AUTH_KIND_SERVICE",
+    "AUTH_KIND_SESSION",
+    "PAT_PREFIX",
+    "SERVICE_KEY_PREFIX",
+    "is_api_token",
+    "parse_bearer",
+]

{simple_module_auth-0.0.35 → simple_module_auth-0.0.37}/auth/deps.py

@@ -5,7 +5,10 @@ from __future__ import annotations
 from typing import Annotated
 
 from fastapi import Depends, HTTPException, Request
+from simple_module_core.permissions import grants
 from simple_module_hosting.i18n_deps import TranslatorDep
+from simple_module_hosting.permissions import ensure_resolved_permissions
+from simple_module_hosting.token_guard import GATE_PERMISSION, mark_token_gate
 
 from auth.contracts.schemas import UserContext
 
@@ -40,15 +43,17 @@ def require_permission(*permissions: str):
         t: TranslatorDep,
         user: UserContext = Depends(get_current_user),
     ):
-        # Admin role bypasses permission checks
-        if _ADMIN_ROLE in user.roles:
+        # Admin role bypasses permission checks — but not for a token: an
+        # admin's PAT is worth only the scopes it carries, and the resolved
+        # set below already applies that cap.
+        if _ADMIN_ROLE in user.roles and user.scopes is None:
             return
 
-        # Get permission registry from app state
-        perm_registry = request.app.state.sm.permissions
-        user_perms = perm_registry.get_permissions_for_roles(user.roles)
-
-        if not any(p in user_perms for p in permissions):
+        # The same resolution RequiresPermission reads: the registry's role map
+        # plus module grant sources. This used to call get_permissions_for_roles
+        # without a map, which grants every non-admin role nothing (GH #337).
+        held = await ensure_resolved_permissions(request)
+        if not any(grants(held, p) for p in permissions):
             raise HTTPException(
                 status_code=403,
                 detail=t.t(
@@ -57,4 +62,6 @@ def require_permission(*permissions: str):
                 ),
             )
 
-    return Depends(check)
+    # A permission gate: API tokens may reach the route, capped at their
+    # scopes (``simple_module_hosting.token_guard``).
+    return Depends(mark_token_gate(check, GATE_PERMISSION))

{simple_module_auth-0.0.35 → simple_module_auth-0.0.37}/auth/middleware.py

@@ -16,6 +16,8 @@ from starlette.requests import Request
 from starlette.responses import JSONResponse, RedirectResponse
 from starlette.types import ASGIApp, Receive, Scope, Send
 
+from auth._route_match import route_exists
+
 logger = logging.getLogger(__name__)
 
 _FRAMEWORK_PUBLIC_PREFIXES = (
@@ -23,7 +25,6 @@ _FRAMEWORK_PUBLIC_PREFIXES = (
     "/static/",
     "/api/docs",
     "/api/redoc",
-    "/openapi.json",
     "/i18n/",
 )
 _FRAMEWORK_PUBLIC_EXACT = ("/",)
@@ -33,6 +34,27 @@ def _query_suffix(request: Request) -> str:
     return f"?{request.url.query}" if request.url.query else ""
 
 
+def _is_navigation(request: Request) -> bool:
+    """Whether this request is the page the visitor asked for, not something it loaded.
+
+    Only a navigation may become the post-login target: the sign-in page's
+    own favicon request used to overwrite it, so sign-in landed on
+    /favicon.ico (#416). Inertia visits count — a session expiring mid-click
+    must still return the user to that page. Without fetch metadata (old
+    clients, scripts) keep the previous behaviour.
+    """
+    headers = request.headers
+    if headers.get("x-inertia") == "true":
+        return True
+    dest = headers.get("sec-fetch-dest")
+    if dest is not None:
+        return dest == "document"
+    mode = headers.get("sec-fetch-mode")
+    if mode is not None:
+        return mode == "navigate"
+    return True
+
+
 class AuthMiddleware:
     """Authenticate requests via the registered AuthProvider.
 
@@ -63,6 +85,8 @@ class AuthMiddleware:
         is_public = (
             any(path.startswith(p) for p in _FRAMEWORK_PUBLIC_PREFIXES)
             or path in _FRAMEWORK_PUBLIC_EXACT
+            # Anonymous exactly when the host serves it (dev, or openapi_public).
+            or path == getattr(app_state, "openapi_url", None)
         )
         # Module-contributed public routes (register_public_routes hook). Method
         # -aware, so a GET read route can be exempted without opening sibling
@@ -76,6 +100,11 @@ class AuthMiddleware:
             prefix_paths, exact_paths = provider.get_public_paths()
             is_public = any(path.startswith(p) for p in prefix_paths) or path in exact_paths
 
+        # Contract with the host's RateLimitMiddleware (plain scope key, no import
+        # between them): whether *this* middleware treats the request as anonymous-
+        # allowed, from all three sources above. One source of truth.
+        scope.setdefault("state", {})["auth_public"] = is_public
+
         request = Request(scope)
         user_ctx = await provider.resolve_user(request)
 
@@ -92,6 +121,15 @@ class AuthMiddleware:
                 if user_ctx is not None:
                     break
 
+        if user_ctx is None and not is_public and not route_exists(scope):
+            # Nothing would serve this path (#473): let the app's 404 answer it
+            # — the same page a signed-in caller gets — rather than sending the
+            # visitor to sign in for a page that does not exist, or keeping it
+            # as their post-login target. The request now reaches the app
+            # anonymously, so the rate limiter treats it like any public hit.
+            scope["state"]["auth_public"] = True
+            is_public = True
+
         if user_ctx is None and not is_public:
             if path.startswith("/api/") or provider.is_bearer_request(request):
                 response = JSONResponse({"detail": "Not authenticated"}, status_code=401)
@@ -103,7 +141,13 @@ class AuthMiddleware:
                 # goes to the provider — session-based providers ignore it,
                 # but a redirect-based one (OIDC) needs it in the auth URL.
                 session = scope.get("session", {})
-                next_url = safe_next_or_none(request.url.path + _query_suffix(request))
+                # Only a navigation is a target: a subresource (the sign-in
+                # page's own favicon) would overwrite it (#416).
+                next_url = (
+                    safe_next_or_none(request.url.path + _query_suffix(request))
+                    if _is_navigation(request)
+                    else None
+                )
                 if next_url is not None:
                     session[SESSION_NEXT_KEY] = next_url
                 response = RedirectResponse(

{simple_module_auth-0.0.35 → simple_module_auth-0.0.37}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_auth"
-version = "0.0.35"
+version = "0.0.37"
 description = "Session-cookie authentication primitives — middleware, login/logout, redirect helpers for simple_module"
 readme = "README.md"
 license = "MIT"
@@ -22,8 +22,8 @@ classifiers = [
 ]
 dependencies = [
     "itsdangerous>=2.2",
-    "simple_module_core==0.0.35",
-    "simple_module_db==0.0.35",
+    "simple_module_core==0.0.37",
+    "simple_module_db==0.0.37",
 ]
 
 [project.entry-points.simple_module]

simple_module_auth-0.0.37/tests/test_auth_next_target.py

@@ -0,0 +1,98 @@
+"""Only top-level navigations may become the post-login target (#416)."""
+
+from __future__ import annotations
+
+import httpx
+import pytest
+from auth.middleware import AuthMiddleware
+from auth.state import AuthState
+from fastapi import FastAPI, Request
+from simple_module_core.redirect_safety import SESSION_NEXT_KEY
+from starlette.middleware.sessions import SessionMiddleware
+from starlette.responses import JSONResponse
+
+SECRET = "test-next-target-secret"
+
+
+class _StubProvider:
+    name = "stub"
+
+    async def resolve_user(self, request):
+        return None
+
+    def get_login_url(self, request, next_url=None):
+        return "/stub/login"
+
+    def get_logout_url(self, request):
+        return "/stub/logout"
+
+    def get_public_paths(self):
+        return (("/stub/login", "/stub/public/"), ())
+
+    def is_bearer_request(self, request):
+        return False
+
+
+def _build_app(provider) -> FastAPI:
+    app = FastAPI()
+    app.state.auth = AuthState(auth_provider=provider, principal_resolvers=[])
+
+    # /static/ is framework-public, so this reads the session without auth.
+    async def _next(request: Request):
+        return JSONResponse({"next": request.session.get(SESSION_NEXT_KEY)})
+
+    async def _any(path: str = ""):
+        return JSONResponse({})
+
+    app.add_api_route("/static/next", _next, methods=["GET"])
+    app.add_api_route("/{path:path}", _any, methods=["GET"])
+    app.add_middleware(AuthMiddleware)
+    app.add_middleware(SessionMiddleware, secret_key=SECRET)
+    return app
+
+
+CASES = [
+    ({"Sec-Fetch-Dest": "image", "Sec-Fetch-Mode": "no-cors"}, None),  # favicon
+    ({"Sec-Fetch-Dest": "script", "Sec-Fetch-Mode": "no-cors"}, None),
+    ({"Sec-Fetch-Dest": "empty", "Sec-Fetch-Mode": "cors"}, None),  # fetch()
+    ({"Sec-Fetch-Dest": "document", "Sec-Fetch-Mode": "navigate"}, "/protected/page"),
+    ({"Sec-Fetch-Mode": "navigate"}, "/protected/page"),
+    ({"X-Inertia": "true", "Sec-Fetch-Dest": "empty", "Sec-Fetch-Mode": "cors"}, "/protected/page"),
+    ({}, "/protected/page"),  # no metadata: previous behaviour
+]
+
+
+@pytest.mark.parametrize(("headers", "expected"), CASES)
+async def test_only_navigations_record_the_target(headers, expected):
+    seen: list[str | None] = []
+
+    class _Recording(_StubProvider):
+        def get_login_url(self, request, next_url=None):
+            seen.append(next_url)
+            return "/stub/login"
+
+    app = _build_app(_Recording())
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=app), base_url="http://test"
+    ) as c:
+        resp = await c.get("/protected/page", headers=headers)
+        recorded = (await c.get("/static/next")).json()["next"]
+    assert resp.status_code == 302
+    assert resp.headers["location"] == "/stub/login"
+    assert seen == [expected]
+    assert recorded == expected
+
+
+async def test_a_subresource_does_not_overwrite_a_recorded_target():
+    """The bug: the sign-in page's favicon request replaced the real target."""
+    app = _build_app(_StubProvider())
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=app), base_url="http://test"
+    ) as c:
+        nav = {"Sec-Fetch-Dest": "document", "Sec-Fetch-Mode": "navigate"}
+        assert (await c.get("/protected/page", headers=nav)).status_code == 302
+        icon = {"Sec-Fetch-Dest": "image", "Sec-Fetch-Mode": "no-cors"}
+        resp = await c.get("/favicon.ico", headers=icon)
+        assert resp.status_code == 302  # the redirect itself is unchanged
+        recorded = (await c.get("/static/next")).json()["next"]
+    assert recorded == "/protected/page"

simple_module_auth-0.0.37/tests/test_auth_parse_bearer.py

@@ -0,0 +1,21 @@
+"""``parse_bearer``: the one place an ``Authorization: Bearer`` header is read (GH #533)."""
+
+from __future__ import annotations
+
+import pytest
+from auth.contracts.tokens import parse_bearer
+
+
+@pytest.mark.parametrize(
+    "header",
+    ["Bearer abc", "bearer abc", "BEARER abc", "BeArEr abc", "  Bearer   abc  ", "bearer\tabc"],
+)
+def test_scheme_is_case_insensitive_and_whitespace_tolerant(header):
+    assert parse_bearer(header) == "abc"
+
+
+@pytest.mark.parametrize(
+    "header", [None, "", "Bearer", "Bearer   ", "Basic abc", "Bearerabc", "Token abc"]
+)
+def test_anything_else_is_not_a_bearer_credential(header):
+    assert parse_bearer(header) is None

simple_module_auth-0.0.37/tests/test_auth_unknown_paths.py

@@ -0,0 +1,181 @@
+"""AuthMiddleware lets a path no route serves reach the 404 (#473).
+
+Only an *unmatched* path is let through anonymously; anything the router would
+serve — including under the wrong method, or only via a trailing-slash
+redirect — stays gated exactly as before.
+"""
+
+from __future__ import annotations
+
+import httpx
+import pytest
+from auth.contracts.schemas import UserContext
+from auth.middleware import AuthMiddleware
+from auth.state import AuthState
+from fastapi import APIRouter, FastAPI
+from simple_module_core.redirect_safety import SESSION_NEXT_KEY
+from starlette.middleware.sessions import SessionMiddleware
+from starlette.requests import Request
+from starlette.responses import JSONResponse
+
+_USER = UserContext(id="u-1", email="a@example.com", name="A", roles=["admin"])
+
+
+class _Provider:
+    name = "stub"
+
+    def __init__(self, user: UserContext | None = None) -> None:
+        self._user = user
+
+    async def resolve_user(self, request):
+        return self._user
+
+    def get_login_url(self, request, next_url=None):
+        return "/stub/login"
+
+    def get_logout_url(self, request):
+        return "/stub/logout"
+
+    def get_public_paths(self):
+        return (("/stub/login",), ())
+
+    def is_bearer_request(self, request):
+        return request.headers.get("authorization", "").startswith("Bearer ")
+
+
+def _build(user: UserContext | None = None) -> FastAPI:
+    app = FastAPI()
+    app.state.auth = AuthState(auth_provider=_Provider(user), principal_resolvers=[])
+
+    async def ok():
+        return {"ok": True}
+
+    async def item(item_id: int):
+        return {"id": item_id}
+
+    async def session_dump(request: Request):
+        return JSONResponse(dict(request.session))
+
+    app.add_api_route("/dashboard", ok, methods=["GET"])
+    app.add_api_route("/api/items", ok, methods=["GET"])
+    app.add_api_route("/api/items/{item_id:int}", item, methods=["GET"])
+    app.add_api_route("/stub/login", session_dump, methods=["GET"])
+    admin = APIRouter(prefix="/admin")
+    admin.add_api_route("/users", ok, methods=["GET"])
+    admin.add_api_route("/roles/", ok, methods=["GET"])
+    app.include_router(admin)
+
+    app.add_middleware(AuthMiddleware)
+    app.add_middleware(SessionMiddleware, secret_key="unknown-paths-secret")
+    return app
+
+
+def _client(app: FastAPI) -> httpx.AsyncClient:
+    transport = httpx.ASGITransport(app=app)
+    return httpx.AsyncClient(transport=transport, base_url="http://test", follow_redirects=False)
+
+
+async def test_anonymous_unknown_page_is_404_and_stores_no_next():
+    async with _client(_build()) as c:
+        resp = await c.get("/does-not-exist", headers={"sec-fetch-dest": "document"})
+        assert resp.status_code == 404
+        session = (await c.get("/stub/login")).json()
+    assert SESSION_NEXT_KEY not in session
+
+
+async def test_anonymous_unknown_api_is_404_json():
+    async with _client(_build()) as c:
+        resp = await c.get("/api/nope")
+    assert resp.status_code == 404
+    assert resp.json() == {"detail": "Not Found"}
+
+
+async def test_anonymous_unknown_api_with_bad_bearer_is_404():
+    async with _client(_build()) as c:
+        resp = await c.get("/api/nope", headers={"Authorization": "Bearer junk"})
+    assert resp.status_code == 404
+
+
+async def test_unknown_path_is_marked_anonymous_allowed_for_rate_limit():
+    seen: dict = {}
+    inner = _build()
+
+    async def spy(scope, receive, send):
+        await inner(scope, receive, send)
+        seen.update(scope.get("state", {}))
+
+    async with httpx.AsyncClient(transport=httpx.ASGITransport(app=spy), base_url="http://t") as c:
+        await c.get("/nope")
+    assert seen.get("auth_public") is True
+
+
+async def test_anonymous_existing_private_page_still_redirects_with_next():
+    async with _client(_build()) as c:
+        resp = await c.get("/dashboard?tab=1", headers={"sec-fetch-dest": "document"})
+        assert resp.status_code == 302
+        assert resp.headers["location"] == "/stub/login"
+        session = (await c.get("/stub/login")).json()
+    assert session[SESSION_NEXT_KEY] == "/dashboard?tab=1"
+
+
+@pytest.mark.parametrize(
+    ("method", "path", "status"),
+    [
+        ("GET", "/api/items", 401),
+        ("GET", "/api/items/7", 401),
+        ("POST", "/api/items", 401),  # wrong method on an existing route (405 when signed in)
+        ("DELETE", "/dashboard", 302),
+        ("HEAD", "/dashboard", 302),
+        ("GET", "/admin/users", 302),  # route from an included router
+        ("GET", "/admin/users/", 302),  # resolves only via the slash redirect
+        ("GET", "/admin/roles", 302),  # the other direction of the slash redirect
+        ("GET", "/api/items/", 401),
+    ],
+)
+async def test_existing_routes_stay_gated(method, path, status):
+    async with _client(_build()) as c:
+        resp = await c.request(method, path)
+    assert resp.status_code == status
+
+
+async def test_converter_mismatch_is_an_unknown_path():
+    # ``/api/items/{item_id:int}`` cannot serve ``/api/items/abc`` for anyone.
+    async with _client(_build()) as c:
+        resp = await c.get("/api/items/abc")
+    assert resp.status_code == 404
+
+
+async def test_signed_in_unknown_path_is_404():
+    async with _client(_build(_USER)) as c:
+        resp = await c.get("/does-not-exist")
+    assert resp.status_code == 404
+
+
+async def test_probe_failure_fails_closed(monkeypatch):
+    import auth._route_match as rm
+
+    def boom(router, probe):
+        raise RuntimeError("router exploded")
+
+    monkeypatch.setattr(rm, "_any_match", boom)
+    async with _client(_build()) as c:
+        resp = await c.get("/does-not-exist")
+    assert resp.status_code == 302
+
+
+async def test_full_app_unknown_paths_render_404_for_anonymous(client):
+    page = await client.get("/does-not-exist", follow_redirects=False)
+    assert page.status_code == 404
+    assert "location" not in page.headers
+    api = await client.get("/api/does-not-exist", follow_redirects=False)
+    assert api.status_code == 404
+    assert api.headers["content-type"].startswith("application/json")
+
+
+async def test_full_app_private_routes_stay_gated_for_anonymous(client):
+    page = await client.get("/admin/users", follow_redirects=False)
+    assert page.status_code == 302
+    assert "/login" in page.headers["location"]
+    slash = await client.get("/admin/users/", follow_redirects=False)
+    assert slash.status_code == 302
+    assert "/login" in slash.headers["location"]

{simple_module_auth-0.0.35 → simple_module_auth-0.0.37}/tests/test_deps.py

@@ -27,6 +27,14 @@ def _translator() -> Translator:
     return Translator(registry, locale="en", default_locale="en")
 
 
+def _request(app, user: UserContext) -> MagicMock:
+    """A request whose state is real, so the permission cache reads as absent."""
+    request = MagicMock()
+    request.app.state.sm = SimpleNamespace(permissions=app.state.sm.permissions)
+    request.state = SimpleNamespace(user=user)
+    return request
+
+
 class TestGetCurrentUser:
     async def test_raises_401_when_no_user(self):
         """get_current_user raises 401 when request.state has no user."""
@@ -53,10 +61,8 @@ class TestRequirePermission:
         dep = require_permission("products.delete")
         check_fn = dep.dependency
 
-        request = MagicMock()
-        request.app.state.sm = SimpleNamespace(permissions=app.state.sm.permissions)
-
         user = UserContext(id="u1", email="u@test.com", name="User", roles=["viewer"])
+        request = _request(app, user)
 
         with pytest.raises(HTTPException) as exc_info:
             await check_fn(request, _translator(), user)
@@ -67,10 +73,8 @@ class TestRequirePermission:
         dep = require_permission("products.delete")
         check_fn = dep.dependency
 
-        request = MagicMock()
-        request.app.state.sm = SimpleNamespace(permissions=app.state.sm.permissions)
-
         admin_user = UserContext(id="a1", email="admin@test.com", name="Admin", roles=["admin"])
+        request = _request(app, admin_user)
         await check_fn(request, _translator(), admin_user)
 
 
@@ -80,21 +84,43 @@ class TestRequirePermissionAdvanced:
         dep = require_permission("products.view", "products.edit")
         check_fn = dep.dependency
 
-        request = MagicMock()
-        request.app.state.sm = SimpleNamespace(permissions=app.state.sm.permissions)
-
         admin = UserContext(id="a1", email="a@t.com", name="Admin", roles=["admin"])
+        request = _request(app, admin)
         await check_fn(request, _translator(), admin)
 
     async def test_non_admin_without_permission_fails(self, app):
         dep = require_permission("products.delete")
         check_fn = dep.dependency
 
-        request = MagicMock()
-        request.app.state.sm = SimpleNamespace(permissions=app.state.sm.permissions)
-
         user = UserContext(id="u1", email="u@t.com", name="User", roles=["user"])
+        request = _request(app, user)
         with pytest.raises(HTTPException) as exc_info:
             await check_fn(request, _translator(), user)
         assert exc_info.value.status_code == 403
         assert "products.delete" in str(exc_info.value.detail)
+
+    async def test_non_admin_role_mapped_in_registry_passes(self, app):
+        """A role granted the key via the registry's role map is admitted.
+
+        Regression for GH #337: the check resolved roles without the role map,
+        so every non-admin role held nothing and this was a 403.
+        """
+        app.state.sm.permissions.map_role("clerk", ["products.delete"])
+        dep = require_permission("products.delete")
+        user = UserContext(id="u1", email="u@t.com", name="User", roles=["clerk"])
+        await dep.dependency(_request(app, user), _translator(), user)
+
+
+def test_require_permission_is_a_token_gate():
+    """``token_guard`` admits API tokens on a route gated by ``require_permission``."""
+    from fastapi import FastAPI
+    from simple_module_hosting.token_guard import route_admits_tokens
+
+    app = FastAPI()
+
+    @app.get("/g", dependencies=[require_permission("x.view")])
+    async def gated() -> None:
+        return None
+
+    route = next(r for r in app.router.routes if getattr(r, "path", "") == "/g")
+    assert route_admits_tokens(route) is True

{simple_module_auth-0.0.35 → simple_module_auth-0.0.37}/tests/test_user_context.py

@@ -18,14 +18,14 @@ class TestUserContextFromUser:
             email="charlie@example.com",
             full_name="Charlie Brown",
             roles=[role_a, role_b],
-            tenant_id="tenant-42",
         )
         ctx = UserContext.from_user(fake_user)
         assert ctx.id == "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
         assert ctx.email == "charlie@example.com"
         assert ctx.name == "Charlie Brown"
         assert ctx.roles == ["admin", "editor"]
-        assert ctx.tenant_id == "tenant-42"
+        # The user row carries no tenant; the resolver supplies it per request.
+        assert ctx.tenant_id is None
 
     async def test_from_user_name_fallback_to_email(self):
         """When full_name is None, ctx.name falls back to the user's email."""
@@ -93,3 +93,69 @@ class TestUserContextDefaults:
     async def test_roles_default_is_empty_list(self):
         ctx = UserContext(id="1", email="a@b.com", name="A")
         assert ctx.roles == []
+
+    async def test_permissions_default_is_empty_list(self):
+        ctx = UserContext(id="1", email="a@b.com", name="A")
+        assert ctx.permissions == []
+
+    async def test_positional_construction_unchanged(self):
+        ctx = UserContext("1", "a@b.com", "A", ["admin"], "t1")
+        assert ctx.tenant_id == "t1"
+        assert ctx.permissions == []
+
+
+class TestUserContextPermissions:
+    async def test_session_round_trip_keeps_permissions(self):
+        ctx = UserContext(id="1", email="a@b.com", name="A", permissions=["x.read", "x.write"])
+        payload = ctx.to_session_dict()
+        assert payload["permissions"] == ["x.read", "x.write"]
+        assert UserContext.from_session_dict(payload) == ctx
+
+    async def test_legacy_cookie_without_permissions_key(self):
+        """A cookie written before the field existed still decodes."""
+        payload = {"id": "1", "email": "a@b.com", "name": "A", "roles": [], "tenant_id": None}
+        ctx = UserContext.from_session_dict(payload)
+        assert ctx is not None
+        assert ctx.permissions == []
+
+    async def test_null_permissions_decodes_empty(self):
+        payload = {"id": "1", "email": "a@b.com", "name": "A", "permissions": None}
+        ctx = UserContext.from_session_dict(payload)
+        assert ctx is not None
+        assert ctx.permissions == []
+
+    async def test_from_user_leaves_permissions_empty(self):
+        from types import SimpleNamespace
+
+        user = SimpleNamespace(id=1, email="a@b.com", full_name="A", roles=[])
+        assert UserContext.from_user(user).permissions == []
+
+    async def test_has_permission_exact_match(self):
+        ctx = UserContext(id="1", email="a@b.com", name="A", permissions=["x.read"])
+        assert ctx.has_permission("x.read") is True
+        assert ctx.has_permission("x.write") is False
+        assert ctx.has_permission("x") is False
+
+
+class TestUserContextTokenFields:
+    async def test_defaults_are_an_uncapped_session(self):
+        ctx = UserContext(id="1", email="a@b.com", name="A")
+        assert (ctx.auth_kind, ctx.scopes, ctx.is_scoped) == ("session", None, False)
+
+    async def test_legacy_cookie_decodes_as_uncapped_session(self):
+        """A cookie from before token principals must not become scoped."""
+        payload = {"id": "1", "email": "a@b.com", "name": "A", "roles": ["admin"]}
+        ctx = UserContext.from_session_dict(payload)
+        assert ctx is not None
+        assert (ctx.auth_kind, ctx.scopes) == ("session", None)
+
+    async def test_token_fields_round_trip_and_empty_scopes_stay_capped(self):
+        for scopes in (["x.read"], []):
+            ctx = UserContext(id="1", email="", name="A", auth_kind="pat", scopes=scopes)
+            back = UserContext.from_session_dict(ctx.to_session_dict())
+            assert back == ctx
+            assert back is not None and back.is_scoped
+
+    async def test_malformed_scopes_reject_the_payload(self):
+        payload = {"id": "1", "email": "a@b.com", "name": "A", "scopes": "x.read"}
+        assert UserContext.from_session_dict(payload) is None

simple_module_auth-0.0.35/auth/contracts/schemas.py

@@ -1,75 +0,0 @@
-"""Auth data types shared with other modules."""
-
-from __future__ import annotations
-
-from dataclasses import dataclass, field
-from typing import TYPE_CHECKING, Any
-
-if TYPE_CHECKING:
-    # Runtime import would be circular: auth -> users -> auth.
-    # Only imported for type-hints, never at runtime.
-    from users.models import User
-
-
-@dataclass
-class UserContext:
-    """Authenticated user information for downstream handlers."""
-
-    id: str
-    email: str
-    name: str
-    roles: list[str] = field(default_factory=list)
-    tenant_id: str | None = None
-
-    @classmethod
-    def from_user(cls, user: User | Any) -> UserContext:
-        """Build a UserContext from a users.models.User with eagerly-loaded roles.
-
-        Duck-typed to avoid importing users.models at runtime — any object
-        exposing .id, .email, .full_name, .roles[*].name, .tenant_id works.
-        The caller is responsible for eager-loading roles (selectinload).
-        """
-        return cls(
-            id=str(user.id),
-            email=user.email,
-            name=user.full_name or user.email,
-            roles=[r.name for r in user.roles],
-            tenant_id=user.tenant_id,
-        )
-
-    def to_session_dict(self) -> dict[str, Any]:
-        """Serialize to a JSON-safe dict for the signed session cookie.
-
-        The inverse of :meth:`from_session_dict`. Adding a new field to
-        ``UserContext`` requires updating both methods here — not the
-        AuthMiddleware cache helper, which stays schema-agnostic."""
-        return {
-            "id": self.id,
-            "email": self.email,
-            "name": self.name,
-            "roles": list(self.roles),
-            "tenant_id": self.tenant_id,
-        }
-
-    @classmethod
-    def from_session_dict(cls, payload: Any) -> UserContext | None:
-        """Rebuild from :meth:`to_session_dict` output. Returns ``None`` on any
-        shape mismatch so callers can fall through to a fresh DB load."""
-        if not isinstance(payload, dict):
-            return None
-        try:
-            return cls(
-                id=str(payload["id"]),
-                email=str(payload["email"]),
-                name=str(payload["name"]),
-                roles=list(payload.get("roles") or []),
-                tenant_id=payload.get("tenant_id"),
-            )
-        except (KeyError, TypeError, ValueError):
-            return None
-
-    def has_role(self, role: str) -> bool:
-        return role in self.roles
-
-    def has_any_role(self, roles: list[str]) -> bool:
-        return bool(set(self.roles) & set(roles))