simple-module-auth 0.0.37__tar.gz → 0.0.38__tar.gz

{simple_module_auth-0.0.37 → simple_module_auth-0.0.38}/.gitignore

@@ -7,8 +7,6 @@ build/
 .venv/
 *.egg
 
-# UV
-uv.lock
 
 # Node
 node_modules/
@@ -65,3 +63,4 @@ host/client_app/.playwright-cli/*
 .qa/
 .verify/
 /openapi.json
+qa-shots/

{simple_module_auth-0.0.37 → simple_module_auth-0.0.38}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_auth
-Version: 0.0.37
+Version: 0.0.38
 Summary: Session-cookie authentication primitives — middleware, login/logout, redirect helpers for simple_module
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -22,8 +22,8 @@ Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Typing :: Typed
 Requires-Python: >=3.12
 Requires-Dist: itsdangerous>=2.2
-Requires-Dist: simple-module-core==0.0.37
-Requires-Dist: simple-module-db==0.0.37
+Requires-Dist: simple-module-core==0.0.38
+Requires-Dist: simple-module-db==0.0.38
 Description-Content-Type: text/markdown
 
 # simple_module_auth
@@ -41,7 +41,7 @@ pip install simple_module_auth
 ## What it provides
 
 - `UserContext` — the request-scoped principal (`id`, `name`, `email`, `roles`).
-- `AuthProvider` protocol — the swappable-backend contract (`resolve_user`, `get_login_url`, `get_logout_url`, `get_public_paths`, `is_bearer_request`); exactly one provider module registers an implementation on `app.state.auth.auth_provider`.
+- `AuthProvider` protocol — the swappable-backend contract (`resolve_user`, `get_login_url`, `get_logout_url`, `is_bearer_request`); exactly one provider module registers an implementation on `app.state.auth.auth_provider`.
 - `PrincipalResolver` chain — async `(Request) -> UserContext | None` callables apps append to `app.state.auth.principal_resolvers` (e.g. PAT/bearer-token or API-key auth), consulted after the session path.
 - `AuthMiddleware` — delegates to the provider + resolver chain on every request and populates the request principal.
 - `get_current_user` / `CurrentUser` dependency and the `require_permission(*permissions)` dependency factory.

{simple_module_auth-0.0.37 → simple_module_auth-0.0.38}/README.md

@@ -13,7 +13,7 @@ pip install simple_module_auth
 ## What it provides
 
 - `UserContext` — the request-scoped principal (`id`, `name`, `email`, `roles`).
-- `AuthProvider` protocol — the swappable-backend contract (`resolve_user`, `get_login_url`, `get_logout_url`, `get_public_paths`, `is_bearer_request`); exactly one provider module registers an implementation on `app.state.auth.auth_provider`.
+- `AuthProvider` protocol — the swappable-backend contract (`resolve_user`, `get_login_url`, `get_logout_url`, `is_bearer_request`); exactly one provider module registers an implementation on `app.state.auth.auth_provider`.
 - `PrincipalResolver` chain — async `(Request) -> UserContext | None` callables apps append to `app.state.auth.principal_resolvers` (e.g. PAT/bearer-token or API-key auth), consulted after the session path.
 - `AuthMiddleware` — delegates to the provider + resolver chain on every request and populates the request principal.
 - `get_current_user` / `CurrentUser` dependency and the `require_permission(*permissions)` dependency factory.

{simple_module_auth-0.0.37 → simple_module_auth-0.0.38}/auth/contracts/provider.py

@@ -26,8 +26,6 @@ class AuthProvider(Protocol):
 
     def get_logout_url(self, request: Request) -> str: ...
 
-    def get_public_paths(self) -> tuple[tuple[str, ...], tuple[str, ...]]: ...
-
     def is_bearer_request(self, request: Request) -> bool: ...
 
 

{simple_module_auth-0.0.37 → simple_module_auth-0.0.38}/auth/contracts/schemas.py

@@ -2,15 +2,28 @@
 
 from __future__ import annotations
 
+from collections.abc import Iterable
 from dataclasses import dataclass, field
-from typing import TYPE_CHECKING, Any
+from typing import Any, Protocol
 
 from auth.contracts.tokens import AUTH_KIND_SESSION
 
-if TYPE_CHECKING:
-    # Runtime import would be circular: auth -> users -> auth.
-    # Only imported for type-hints, never at runtime.
-    from users.models import User
+
+class NamedRole(Protocol):
+    name: str
+
+
+class AccountLike(Protocol):
+    """What :meth:`UserContext.from_user` reads from an account row.
+
+    Structural, so ``auth`` names no provider's model: ``users`` depends on
+    ``auth``, never the other way round (GH #501).
+    """
+
+    id: Any
+    email: str
+    full_name: str | None
+    roles: Iterable[NamedRole]
 
 
 @dataclass
@@ -53,12 +66,12 @@ class UserContext:
     @classmethod
     def from_user(
         cls,
-        user: User | Any,
+        user: AccountLike,
         *,
         auth_kind: str = AUTH_KIND_SESSION,
         scopes: list[str] | None = None,
     ) -> UserContext:
-        """Build a UserContext from a users.models.User with eagerly-loaded roles.
+        """Build a UserContext from an :class:`AccountLike` with eagerly-loaded roles.
 
         Duck-typed to avoid importing users.models at runtime — any object
         exposing .id, .email, .full_name, .roles[*].name works. The user row

simple_module_auth-0.0.38/auth/locales/de.json

@@ -0,0 +1,6 @@
+{
+  "errors": {
+    "not_authenticated": "Nicht authentifiziert",
+    "missing_permission": "Erforderliche Berechtigung fehlt: {permissions}"
+  }
+}

{simple_module_auth-0.0.37 → simple_module_auth-0.0.38}/auth/middleware.py

@@ -10,6 +10,7 @@ from __future__ import annotations
 
 import logging
 
+from simple_module_core.public_routes import legacy_provider_public_paths
 from simple_module_core.redirect_safety import SESSION_NEXT_KEY, safe_next_or_none
 from simple_module_db.listeners import current_user_id
 from starlette.requests import Request
@@ -94,10 +95,10 @@ class AuthMiddleware:
         if not is_public:
             public_routes = getattr(app_state, "public_routes", None)
             is_public = public_routes is not None and public_routes.matches(method, path)
-        # Legacy provider-declared paths (prefix-only, method-agnostic). Kept for
-        # back-compat with AuthProvider implementations.
+        # Deprecated provider-declared paths (prefix-only, method-agnostic); honoured
+        # until 0.1.0 for third-party providers. users/keycloak use the registry.
         if not is_public:
-            prefix_paths, exact_paths = provider.get_public_paths()
+            prefix_paths, exact_paths = legacy_provider_public_paths(provider)
             is_public = any(path.startswith(p) for p in prefix_paths) or path in exact_paths
 
         # Contract with the host's RateLimitMiddleware (plain scope key, no import

{simple_module_auth-0.0.37 → simple_module_auth-0.0.38}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simple-module-py/auth",
-  "version": "0.1.0",
+  "version": "0.0.38",
   "private": true,
   "description": "Frontend assets for the Auth module",
   "peerDependencies": {

{simple_module_auth-0.0.37 → simple_module_auth-0.0.38}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_auth"
-version = "0.0.37"
+version = "0.0.38"
 description = "Session-cookie authentication primitives — middleware, login/logout, redirect helpers for simple_module"
 readme = "README.md"
 license = "MIT"
@@ -22,8 +22,8 @@ classifiers = [
 ]
 dependencies = [
     "itsdangerous>=2.2",
-    "simple_module_core==0.0.37",
-    "simple_module_db==0.0.37",
+    "simple_module_core==0.0.38",
+    "simple_module_db==0.0.38",
 ]
 
 [project.entry-points.simple_module]