simple-module-auth 0.0.36__tar.gz → 0.0.38__tar.gz

{simple_module_auth-0.0.36 → simple_module_auth-0.0.38}/.gitignore

@@ -7,8 +7,6 @@ build/
 .venv/
 *.egg
 
-# UV
-uv.lock
 
 # Node
 node_modules/
@@ -64,3 +62,5 @@ host/client_app/.playwright-cli/*
 .superpowers/
 .qa/
 .verify/
+/openapi.json
+qa-shots/

{simple_module_auth-0.0.36 → simple_module_auth-0.0.38}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_auth
-Version: 0.0.36
+Version: 0.0.38
 Summary: Session-cookie authentication primitives — middleware, login/logout, redirect helpers for simple_module
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -22,8 +22,8 @@ Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Typing :: Typed
 Requires-Python: >=3.12
 Requires-Dist: itsdangerous>=2.2
-Requires-Dist: simple-module-core==0.0.36
-Requires-Dist: simple-module-db==0.0.36
+Requires-Dist: simple-module-core==0.0.38
+Requires-Dist: simple-module-db==0.0.38
 Description-Content-Type: text/markdown
 
 # simple_module_auth
@@ -41,7 +41,7 @@ pip install simple_module_auth
 ## What it provides
 
 - `UserContext` — the request-scoped principal (`id`, `name`, `email`, `roles`).
-- `AuthProvider` protocol — the swappable-backend contract (`resolve_user`, `get_login_url`, `get_logout_url`, `get_public_paths`, `is_bearer_request`); exactly one provider module registers an implementation on `app.state.auth.auth_provider`.
+- `AuthProvider` protocol — the swappable-backend contract (`resolve_user`, `get_login_url`, `get_logout_url`, `is_bearer_request`); exactly one provider module registers an implementation on `app.state.auth.auth_provider`.
 - `PrincipalResolver` chain — async `(Request) -> UserContext | None` callables apps append to `app.state.auth.principal_resolvers` (e.g. PAT/bearer-token or API-key auth), consulted after the session path.
 - `AuthMiddleware` — delegates to the provider + resolver chain on every request and populates the request principal.
 - `get_current_user` / `CurrentUser` dependency and the `require_permission(*permissions)` dependency factory.

{simple_module_auth-0.0.36 → simple_module_auth-0.0.38}/README.md

@@ -13,7 +13,7 @@ pip install simple_module_auth
 ## What it provides
 
 - `UserContext` — the request-scoped principal (`id`, `name`, `email`, `roles`).
-- `AuthProvider` protocol — the swappable-backend contract (`resolve_user`, `get_login_url`, `get_logout_url`, `get_public_paths`, `is_bearer_request`); exactly one provider module registers an implementation on `app.state.auth.auth_provider`.
+- `AuthProvider` protocol — the swappable-backend contract (`resolve_user`, `get_login_url`, `get_logout_url`, `is_bearer_request`); exactly one provider module registers an implementation on `app.state.auth.auth_provider`.
 - `PrincipalResolver` chain — async `(Request) -> UserContext | None` callables apps append to `app.state.auth.principal_resolvers` (e.g. PAT/bearer-token or API-key auth), consulted after the session path.
 - `AuthMiddleware` — delegates to the provider + resolver chain on every request and populates the request principal.
 - `get_current_user` / `CurrentUser` dependency and the `require_permission(*permissions)` dependency factory.

simple_module_auth-0.0.38/auth/_route_match.py

@@ -0,0 +1,71 @@
+"""Does a request resolve to *any* route of the app? (#473)
+
+``AuthMiddleware`` only gates paths the router would actually serve. A path
+nothing matches falls through to the normal 404 instead of bouncing an
+anonymous visitor to the sign-in form (and storing it as their post-login
+target). Every path that does resolve stays gated exactly as before.
+
+The probe mirrors Starlette/FastAPI dispatch without running a handler:
+
+* any ``Match`` other than ``NONE`` counts — ``PARTIAL`` is an existing path
+  under the wrong method (a 405 for a signed-in caller), so it stays gated;
+* the ``redirect_slashes`` toggle counts too — ``/admin/users/`` that only
+  resolves by redirecting to ``/admin/users`` is gated like its target;
+* FastAPI's low-priority (frontend) routes are consulted when present.
+
+It fails closed: any surprise while matching reports "exists", so the worst
+case is today's behaviour (a redirect), never an ungated route.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+from starlette.routing import Match
+from starlette.types import Scope
+
+logger = logging.getLogger(__name__)
+
+
+def _probe(scope: Scope, path: str | None = None) -> dict[str, Any]:
+    # A shallow copy without FastAPI's per-request bookkeeping: matching an
+    # included router writes into ``scope["fastapi"]``, which must not leak
+    # into the real dispatch that follows.
+    probe = {k: v for k, v in scope.items() if k != "fastapi"}
+    if path is not None:
+        probe["path"] = path
+    return probe
+
+
+def _any_match(router: Any, probe: dict[str, Any]) -> bool:
+    for route in router.routes:
+        match, _ = route.matches(probe)
+        if match != Match.NONE:
+            return True
+    return False
+
+
+def route_exists(scope: Scope) -> bool:
+    """Whether the app's router would serve this request (or redirect it to a route)."""
+    try:
+        router = scope["app"].router
+        if _any_match(router, _probe(scope)):
+            return True
+        path: str = scope["path"]
+        if getattr(router, "redirect_slashes", False) and path != "/":
+            toggled = path.rstrip("/") if path.endswith("/") else path + "/"
+            if _any_match(router, _probe(scope, toggled)):
+                return True
+        low_priority = getattr(router, "_match_low_priority", None)
+        if low_priority is not None:
+            match = low_priority(_probe(scope))[0]
+            if match != Match.NONE:
+                return True
+    except Exception:
+        logger.exception("Route probe failed; treating the path as existing")
+        return True
+    return False
+
+
+__all__ = ["route_exists"]

{simple_module_auth-0.0.36 → simple_module_auth-0.0.38}/auth/contracts/provider.py

@@ -26,8 +26,6 @@ class AuthProvider(Protocol):
 
     def get_logout_url(self, request: Request) -> str: ...
 
-    def get_public_paths(self) -> tuple[tuple[str, ...], tuple[str, ...]]: ...
-
     def is_bearer_request(self, request: Request) -> bool: ...
 
 

{simple_module_auth-0.0.36 → simple_module_auth-0.0.38}/auth/contracts/schemas.py

@@ -2,13 +2,28 @@
 
 from __future__ import annotations
 
+from collections.abc import Iterable
 from dataclasses import dataclass, field
-from typing import TYPE_CHECKING, Any
+from typing import Any, Protocol
 
-if TYPE_CHECKING:
-    # Runtime import would be circular: auth -> users -> auth.
-    # Only imported for type-hints, never at runtime.
-    from users.models import User
+from auth.contracts.tokens import AUTH_KIND_SESSION
+
+
+class NamedRole(Protocol):
+    name: str
+
+
+class AccountLike(Protocol):
+    """What :meth:`UserContext.from_user` reads from an account row.
+
+    Structural, so ``auth`` names no provider's model: ``users`` depends on
+    ``auth``, never the other way round (GH #501).
+    """
+
+    id: Any
+    email: str
+    full_name: str | None
+    roles: Iterable[NamedRole]
 
 
 @dataclass
@@ -24,10 +39,39 @@ class UserContext:
     # provider maps in. Frozen in the session cookie like ``roles``; anything
     # revocable belongs in a grant source. The resolver drops ``*`` from here.
     permissions: list[str] = field(default_factory=list)
+    # Which credential authenticated the request: ``"session"`` for a browser
+    # sign-in, ``"bearer"`` for a provider's own bearer token (a ``users``
+    # access token, an IdP JWT), ``"pat"`` / ``"service"`` for an
+    # ``api_tokens`` credential (see ``auth.contracts.tokens``). Code that must
+    # only ever act for a person at a keyboard — minting more credentials —
+    # refuses anything but ``"session"``.
+    auth_kind: str = AUTH_KIND_SESSION
+    # The ceiling a token carries. ``None`` means "no cap" (an ordinary
+    # session); a list — even an empty one — is intersected with whatever the
+    # principal resolves to, and the admin-role shortcuts are skipped, so an
+    # admin's token is worth exactly the scopes it was given.
+    scopes: list[str] | None = None
+    # A permission the account must *currently* hold for this credential to
+    # authenticate at all — ``api_tokens.use`` for a personal access token.
+    # Checked on every request against the account's live, tenant-aware
+    # permissions; when missing, the request runs as anonymous (401 on gated
+    # routes). ``None`` (a session, a service key) requires nothing.
+    required_permission: str | None = None
+
+    @property
+    def is_scoped(self) -> bool:
+        """Whether a scope cap applies (any token-authenticated principal)."""
+        return self.scopes is not None
 
     @classmethod
-    def from_user(cls, user: User | Any) -> UserContext:
-        """Build a UserContext from a users.models.User with eagerly-loaded roles.
+    def from_user(
+        cls,
+        user: AccountLike,
+        *,
+        auth_kind: str = AUTH_KIND_SESSION,
+        scopes: list[str] | None = None,
+    ) -> UserContext:
+        """Build a UserContext from an :class:`AccountLike` with eagerly-loaded roles.
 
         Duck-typed to avoid importing users.models at runtime — any object
         exposing .id, .email, .full_name, .roles[*].name works. The user row
@@ -41,6 +85,8 @@ class UserContext:
             email=user.email,
             name=user.full_name or user.email,
             roles=[r.name for r in user.roles],
+            auth_kind=auth_kind,
+            scopes=list(scopes) if scopes is not None else None,
         )
 
     def to_session_dict(self) -> dict[str, Any]:
@@ -56,6 +102,9 @@ class UserContext:
             "roles": list(self.roles),
             "tenant_id": self.tenant_id,
             "permissions": list(self.permissions),
+            "auth_kind": self.auth_kind,
+            "scopes": list(self.scopes) if self.scopes is not None else None,
+            "required_permission": self.required_permission,
         }
 
     @classmethod
@@ -73,6 +122,9 @@ class UserContext:
                 tenant_id=payload.get("tenant_id"),
                 # Absent on cookies written before the field existed.
                 permissions=list(payload.get("permissions") or []),
+                auth_kind=str(payload.get("auth_kind") or AUTH_KIND_SESSION),
+                scopes=_scopes_from(payload.get("scopes")),
+                required_permission=payload.get("required_permission") or None,
             )
         except (KeyError, TypeError, ValueError):
             return None
@@ -89,3 +141,12 @@ class UserContext:
 
     def has_any_role(self, roles: list[str]) -> bool:
         return bool(set(self.roles) & set(roles))
+
+
+def _scopes_from(raw: Any) -> list[str] | None:
+    """``None`` stays ``None`` (uncapped); anything else must be a list."""
+    if raw is None:
+        return None
+    if not isinstance(raw, list):
+        raise TypeError("scopes must be a list")
+    return [str(s) for s in raw]

simple_module_auth-0.0.38/auth/contracts/tokens.py

@@ -0,0 +1,65 @@
+"""Credential kinds and API-token prefixes shared by every auth source.
+
+Lives in ``auth`` rather than in the ``api_tokens`` module because the auth
+*providers* need it: ``users`` and ``keycloak`` both claim every
+``Authorization: Bearer`` header, and must step aside for a value that is
+recognisably an ``api_tokens`` credential — otherwise each token request costs
+a wasted lookup against the provider's own token store (or a JWT parse), and
+the provider's ``None`` there is final, so the principal resolver that
+actually owns the token never gets to see it.
+"""
+
+from __future__ import annotations
+
+AUTH_KIND_SESSION = "session"
+"""A browser sign-in: the principal came from the session cookie."""
+
+AUTH_KIND_BEARER = "bearer"
+"""An auth provider's own ``Authorization: Bearer`` credential — a ``users``
+access token or an identity provider's JWT. Unscoped (it carries its user's
+full rights, as before), but not a person at a keyboard: it may not manage
+API tokens, so a short-lived access token cannot mint a year-long PAT."""
+
+AUTH_KIND_PAT = "pat"
+"""A personal access token acting for its owner, capped by its scopes."""
+
+AUTH_KIND_SERVICE = "service"
+"""A service API key: no person behind it, roles and tenant fixed at creation."""
+
+PAT_PREFIX = "smpat_"
+SERVICE_KEY_PREFIX = "smsk_"
+API_TOKEN_PREFIXES: tuple[str, ...] = (PAT_PREFIX, SERVICE_KEY_PREFIX)
+
+
+def parse_bearer(header: str | None) -> str | None:
+    """The credential of an ``Authorization: Bearer <credential>`` header, else None.
+
+    The auth scheme is case-insensitive (RFC 9110 §11.1): clients that build
+    the header from ``/auth/token``'s ``token_type`` send ``bearer``, and must
+    authenticate exactly like ``Bearer``. Surrounding and separating whitespace
+    is tolerated; a header with no credential, or a different scheme, is None.
+    """
+    if not header:
+        return None
+    parts = header.split(None, 1)
+    if len(parts) != 2 or parts[0].lower() != "bearer":
+        return None
+    return parts[1].strip() or None
+
+
+def is_api_token(credential: str) -> bool:
+    """Whether a bearer value is an ``api_tokens`` credential (by prefix only)."""
+    return credential.startswith(API_TOKEN_PREFIXES)
+
+
+__all__ = [
+    "API_TOKEN_PREFIXES",
+    "AUTH_KIND_BEARER",
+    "AUTH_KIND_PAT",
+    "AUTH_KIND_SERVICE",
+    "AUTH_KIND_SESSION",
+    "PAT_PREFIX",
+    "SERVICE_KEY_PREFIX",
+    "is_api_token",
+    "parse_bearer",
+]

{simple_module_auth-0.0.36 → simple_module_auth-0.0.38}/auth/deps.py

@@ -8,6 +8,7 @@ from fastapi import Depends, HTTPException, Request
 from simple_module_core.permissions import grants
 from simple_module_hosting.i18n_deps import TranslatorDep
 from simple_module_hosting.permissions import ensure_resolved_permissions
+from simple_module_hosting.token_guard import GATE_PERMISSION, mark_token_gate
 
 from auth.contracts.schemas import UserContext
 
@@ -42,8 +43,10 @@ def require_permission(*permissions: str):
         t: TranslatorDep,
         user: UserContext = Depends(get_current_user),
     ):
-        # Admin role bypasses permission checks
-        if _ADMIN_ROLE in user.roles:
+        # Admin role bypasses permission checks — but not for a token: an
+        # admin's PAT is worth only the scopes it carries, and the resolved
+        # set below already applies that cap.
+        if _ADMIN_ROLE in user.roles and user.scopes is None:
             return
 
         # The same resolution RequiresPermission reads: the registry's role map
@@ -59,4 +62,6 @@ def require_permission(*permissions: str):
                 ),
             )
 
-    return Depends(check)
+    # A permission gate: API tokens may reach the route, capped at their
+    # scopes (``simple_module_hosting.token_guard``).
+    return Depends(mark_token_gate(check, GATE_PERMISSION))

simple_module_auth-0.0.38/auth/locales/de.json

@@ -0,0 +1,6 @@
+{
+  "errors": {
+    "not_authenticated": "Nicht authentifiziert",
+    "missing_permission": "Erforderliche Berechtigung fehlt: {permissions}"
+  }
+}

{simple_module_auth-0.0.36 → simple_module_auth-0.0.38}/auth/middleware.py

@@ -10,12 +10,15 @@ from __future__ import annotations
 
 import logging
 
+from simple_module_core.public_routes import legacy_provider_public_paths
 from simple_module_core.redirect_safety import SESSION_NEXT_KEY, safe_next_or_none
 from simple_module_db.listeners import current_user_id
 from starlette.requests import Request
 from starlette.responses import JSONResponse, RedirectResponse
 from starlette.types import ASGIApp, Receive, Scope, Send
 
+from auth._route_match import route_exists
+
 logger = logging.getLogger(__name__)
 
 _FRAMEWORK_PUBLIC_PREFIXES = (
@@ -23,7 +26,6 @@ _FRAMEWORK_PUBLIC_PREFIXES = (
     "/static/",
     "/api/docs",
     "/api/redoc",
-    "/openapi.json",
     "/i18n/",
 )
 _FRAMEWORK_PUBLIC_EXACT = ("/",)
@@ -84,6 +86,8 @@ class AuthMiddleware:
         is_public = (
             any(path.startswith(p) for p in _FRAMEWORK_PUBLIC_PREFIXES)
             or path in _FRAMEWORK_PUBLIC_EXACT
+            # Anonymous exactly when the host serves it (dev, or openapi_public).
+            or path == getattr(app_state, "openapi_url", None)
         )
         # Module-contributed public routes (register_public_routes hook). Method
         # -aware, so a GET read route can be exempted without opening sibling
@@ -91,10 +95,10 @@ class AuthMiddleware:
         if not is_public:
             public_routes = getattr(app_state, "public_routes", None)
             is_public = public_routes is not None and public_routes.matches(method, path)
-        # Legacy provider-declared paths (prefix-only, method-agnostic). Kept for
-        # back-compat with AuthProvider implementations.
+        # Deprecated provider-declared paths (prefix-only, method-agnostic); honoured
+        # until 0.1.0 for third-party providers. users/keycloak use the registry.
         if not is_public:
-            prefix_paths, exact_paths = provider.get_public_paths()
+            prefix_paths, exact_paths = legacy_provider_public_paths(provider)
             is_public = any(path.startswith(p) for p in prefix_paths) or path in exact_paths
 
         # Contract with the host's RateLimitMiddleware (plain scope key, no import
@@ -118,6 +122,15 @@ class AuthMiddleware:
                 if user_ctx is not None:
                     break
 
+        if user_ctx is None and not is_public and not route_exists(scope):
+            # Nothing would serve this path (#473): let the app's 404 answer it
+            # — the same page a signed-in caller gets — rather than sending the
+            # visitor to sign in for a page that does not exist, or keeping it
+            # as their post-login target. The request now reaches the app
+            # anonymously, so the rate limiter treats it like any public hit.
+            scope["state"]["auth_public"] = True
+            is_public = True
+
         if user_ctx is None and not is_public:
             if path.startswith("/api/") or provider.is_bearer_request(request):
                 response = JSONResponse({"detail": "Not authenticated"}, status_code=401)

{simple_module_auth-0.0.36 → simple_module_auth-0.0.38}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simple-module-py/auth",
-  "version": "0.1.0",
+  "version": "0.0.38",
   "private": true,
   "description": "Frontend assets for the Auth module",
   "peerDependencies": {

{simple_module_auth-0.0.36 → simple_module_auth-0.0.38}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_auth"
-version = "0.0.36"
+version = "0.0.38"
 description = "Session-cookie authentication primitives — middleware, login/logout, redirect helpers for simple_module"
 readme = "README.md"
 license = "MIT"
@@ -22,8 +22,8 @@ classifiers = [
 ]
 dependencies = [
     "itsdangerous>=2.2",
-    "simple_module_core==0.0.36",
-    "simple_module_db==0.0.36",
+    "simple_module_core==0.0.38",
+    "simple_module_db==0.0.38",
 ]
 
 [project.entry-points.simple_module]

simple_module_auth-0.0.38/tests/test_auth_parse_bearer.py

@@ -0,0 +1,21 @@
+"""``parse_bearer``: the one place an ``Authorization: Bearer`` header is read (GH #533)."""
+
+from __future__ import annotations
+
+import pytest
+from auth.contracts.tokens import parse_bearer
+
+
+@pytest.mark.parametrize(
+    "header",
+    ["Bearer abc", "bearer abc", "BEARER abc", "BeArEr abc", "  Bearer   abc  ", "bearer\tabc"],
+)
+def test_scheme_is_case_insensitive_and_whitespace_tolerant(header):
+    assert parse_bearer(header) == "abc"
+
+
+@pytest.mark.parametrize(
+    "header", [None, "", "Bearer", "Bearer   ", "Basic abc", "Bearerabc", "Token abc"]
+)
+def test_anything_else_is_not_a_bearer_credential(header):
+    assert parse_bearer(header) is None

simple_module_auth-0.0.38/tests/test_auth_unknown_paths.py

@@ -0,0 +1,181 @@
+"""AuthMiddleware lets a path no route serves reach the 404 (#473).
+
+Only an *unmatched* path is let through anonymously; anything the router would
+serve — including under the wrong method, or only via a trailing-slash
+redirect — stays gated exactly as before.
+"""
+
+from __future__ import annotations
+
+import httpx
+import pytest
+from auth.contracts.schemas import UserContext
+from auth.middleware import AuthMiddleware
+from auth.state import AuthState
+from fastapi import APIRouter, FastAPI
+from simple_module_core.redirect_safety import SESSION_NEXT_KEY
+from starlette.middleware.sessions import SessionMiddleware
+from starlette.requests import Request
+from starlette.responses import JSONResponse
+
+_USER = UserContext(id="u-1", email="a@example.com", name="A", roles=["admin"])
+
+
+class _Provider:
+    name = "stub"
+
+    def __init__(self, user: UserContext | None = None) -> None:
+        self._user = user
+
+    async def resolve_user(self, request):
+        return self._user
+
+    def get_login_url(self, request, next_url=None):
+        return "/stub/login"
+
+    def get_logout_url(self, request):
+        return "/stub/logout"
+
+    def get_public_paths(self):
+        return (("/stub/login",), ())
+
+    def is_bearer_request(self, request):
+        return request.headers.get("authorization", "").startswith("Bearer ")
+
+
+def _build(user: UserContext | None = None) -> FastAPI:
+    app = FastAPI()
+    app.state.auth = AuthState(auth_provider=_Provider(user), principal_resolvers=[])
+
+    async def ok():
+        return {"ok": True}
+
+    async def item(item_id: int):
+        return {"id": item_id}
+
+    async def session_dump(request: Request):
+        return JSONResponse(dict(request.session))
+
+    app.add_api_route("/dashboard", ok, methods=["GET"])
+    app.add_api_route("/api/items", ok, methods=["GET"])
+    app.add_api_route("/api/items/{item_id:int}", item, methods=["GET"])
+    app.add_api_route("/stub/login", session_dump, methods=["GET"])
+    admin = APIRouter(prefix="/admin")
+    admin.add_api_route("/users", ok, methods=["GET"])
+    admin.add_api_route("/roles/", ok, methods=["GET"])
+    app.include_router(admin)
+
+    app.add_middleware(AuthMiddleware)
+    app.add_middleware(SessionMiddleware, secret_key="unknown-paths-secret")
+    return app
+
+
+def _client(app: FastAPI) -> httpx.AsyncClient:
+    transport = httpx.ASGITransport(app=app)
+    return httpx.AsyncClient(transport=transport, base_url="http://test", follow_redirects=False)
+
+
+async def test_anonymous_unknown_page_is_404_and_stores_no_next():
+    async with _client(_build()) as c:
+        resp = await c.get("/does-not-exist", headers={"sec-fetch-dest": "document"})
+        assert resp.status_code == 404
+        session = (await c.get("/stub/login")).json()
+    assert SESSION_NEXT_KEY not in session
+
+
+async def test_anonymous_unknown_api_is_404_json():
+    async with _client(_build()) as c:
+        resp = await c.get("/api/nope")
+    assert resp.status_code == 404
+    assert resp.json() == {"detail": "Not Found"}
+
+
+async def test_anonymous_unknown_api_with_bad_bearer_is_404():
+    async with _client(_build()) as c:
+        resp = await c.get("/api/nope", headers={"Authorization": "Bearer junk"})
+    assert resp.status_code == 404
+
+
+async def test_unknown_path_is_marked_anonymous_allowed_for_rate_limit():
+    seen: dict = {}
+    inner = _build()
+
+    async def spy(scope, receive, send):
+        await inner(scope, receive, send)
+        seen.update(scope.get("state", {}))
+
+    async with httpx.AsyncClient(transport=httpx.ASGITransport(app=spy), base_url="http://t") as c:
+        await c.get("/nope")
+    assert seen.get("auth_public") is True
+
+
+async def test_anonymous_existing_private_page_still_redirects_with_next():
+    async with _client(_build()) as c:
+        resp = await c.get("/dashboard?tab=1", headers={"sec-fetch-dest": "document"})
+        assert resp.status_code == 302
+        assert resp.headers["location"] == "/stub/login"
+        session = (await c.get("/stub/login")).json()
+    assert session[SESSION_NEXT_KEY] == "/dashboard?tab=1"
+
+
+@pytest.mark.parametrize(
+    ("method", "path", "status"),
+    [
+        ("GET", "/api/items", 401),
+        ("GET", "/api/items/7", 401),
+        ("POST", "/api/items", 401),  # wrong method on an existing route (405 when signed in)
+        ("DELETE", "/dashboard", 302),
+        ("HEAD", "/dashboard", 302),
+        ("GET", "/admin/users", 302),  # route from an included router
+        ("GET", "/admin/users/", 302),  # resolves only via the slash redirect
+        ("GET", "/admin/roles", 302),  # the other direction of the slash redirect
+        ("GET", "/api/items/", 401),
+    ],
+)
+async def test_existing_routes_stay_gated(method, path, status):
+    async with _client(_build()) as c:
+        resp = await c.request(method, path)
+    assert resp.status_code == status
+
+
+async def test_converter_mismatch_is_an_unknown_path():
+    # ``/api/items/{item_id:int}`` cannot serve ``/api/items/abc`` for anyone.
+    async with _client(_build()) as c:
+        resp = await c.get("/api/items/abc")
+    assert resp.status_code == 404
+
+
+async def test_signed_in_unknown_path_is_404():
+    async with _client(_build(_USER)) as c:
+        resp = await c.get("/does-not-exist")
+    assert resp.status_code == 404
+
+
+async def test_probe_failure_fails_closed(monkeypatch):
+    import auth._route_match as rm
+
+    def boom(router, probe):
+        raise RuntimeError("router exploded")
+
+    monkeypatch.setattr(rm, "_any_match", boom)
+    async with _client(_build()) as c:
+        resp = await c.get("/does-not-exist")
+    assert resp.status_code == 302
+
+
+async def test_full_app_unknown_paths_render_404_for_anonymous(client):
+    page = await client.get("/does-not-exist", follow_redirects=False)
+    assert page.status_code == 404
+    assert "location" not in page.headers
+    api = await client.get("/api/does-not-exist", follow_redirects=False)
+    assert api.status_code == 404
+    assert api.headers["content-type"].startswith("application/json")
+
+
+async def test_full_app_private_routes_stay_gated_for_anonymous(client):
+    page = await client.get("/admin/users", follow_redirects=False)
+    assert page.status_code == 302
+    assert "/login" in page.headers["location"]
+    slash = await client.get("/admin/users/", follow_redirects=False)
+    assert slash.status_code == 302
+    assert "/login" in slash.headers["location"]

{simple_module_auth-0.0.36 → simple_module_auth-0.0.38}/tests/test_deps.py

@@ -109,3 +109,18 @@ class TestRequirePermissionAdvanced:
         dep = require_permission("products.delete")
         user = UserContext(id="u1", email="u@t.com", name="User", roles=["clerk"])
         await dep.dependency(_request(app, user), _translator(), user)
+
+
+def test_require_permission_is_a_token_gate():
+    """``token_guard`` admits API tokens on a route gated by ``require_permission``."""
+    from fastapi import FastAPI
+    from simple_module_hosting.token_guard import route_admits_tokens
+
+    app = FastAPI()
+
+    @app.get("/g", dependencies=[require_permission("x.view")])
+    async def gated() -> None:
+        return None
+
+    route = next(r for r in app.router.routes if getattr(r, "path", "") == "/g")
+    assert route_admits_tokens(route) is True

{simple_module_auth-0.0.36 → simple_module_auth-0.0.38}/tests/test_user_context.py

@@ -135,3 +135,27 @@ class TestUserContextPermissions:
         assert ctx.has_permission("x.read") is True
         assert ctx.has_permission("x.write") is False
         assert ctx.has_permission("x") is False
+
+
+class TestUserContextTokenFields:
+    async def test_defaults_are_an_uncapped_session(self):
+        ctx = UserContext(id="1", email="a@b.com", name="A")
+        assert (ctx.auth_kind, ctx.scopes, ctx.is_scoped) == ("session", None, False)
+
+    async def test_legacy_cookie_decodes_as_uncapped_session(self):
+        """A cookie from before token principals must not become scoped."""
+        payload = {"id": "1", "email": "a@b.com", "name": "A", "roles": ["admin"]}
+        ctx = UserContext.from_session_dict(payload)
+        assert ctx is not None
+        assert (ctx.auth_kind, ctx.scopes) == ("session", None)
+
+    async def test_token_fields_round_trip_and_empty_scopes_stay_capped(self):
+        for scopes in (["x.read"], []):
+            ctx = UserContext(id="1", email="", name="A", auth_kind="pat", scopes=scopes)
+            back = UserContext.from_session_dict(ctx.to_session_dict())
+            assert back == ctx
+            assert back is not None and back.is_scoped
+
+    async def test_malformed_scopes_reject_the_payload(self):
+        payload = {"id": "1", "email": "a@b.com", "name": "A", "scopes": "x.read"}
+        assert UserContext.from_session_dict(payload) is None