simple-module-auth 0.0.37__tar.gz → 0.0.39__tar.gz

{simple_module_auth-0.0.37 → simple_module_auth-0.0.39}/.gitignore

@@ -7,8 +7,6 @@ build/
 .venv/
 *.egg
 
-# UV
-uv.lock
 
 # Node
 node_modules/
@@ -65,3 +63,4 @@ host/client_app/.playwright-cli/*
 .qa/
 .verify/
 /openapi.json
+qa-shots/

{simple_module_auth-0.0.37 → simple_module_auth-0.0.39}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_auth
-Version: 0.0.37
+Version: 0.0.39
 Summary: Session-cookie authentication primitives — middleware, login/logout, redirect helpers for simple_module
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -21,9 +21,10 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Typing :: Typed
 Requires-Python: >=3.12
-Requires-Dist: itsdangerous>=2.2
-Requires-Dist: simple-module-core==0.0.37
-Requires-Dist: simple-module-db==0.0.37
+Requires-Dist: itsdangerous<3,>=2.2
+Requires-Dist: simple-module-core==0.0.39
+Requires-Dist: simple-module-db==0.0.39
+Requires-Dist: simple-module-hosting==0.0.39
 Description-Content-Type: text/markdown
 
 # simple_module_auth
@@ -41,7 +42,7 @@ pip install simple_module_auth
 ## What it provides
 
 - `UserContext` — the request-scoped principal (`id`, `name`, `email`, `roles`).
-- `AuthProvider` protocol — the swappable-backend contract (`resolve_user`, `get_login_url`, `get_logout_url`, `get_public_paths`, `is_bearer_request`); exactly one provider module registers an implementation on `app.state.auth.auth_provider`.
+- `AuthProvider` protocol — the swappable-backend contract (`resolve_user`, `get_login_url`, `get_logout_url`, `is_bearer_request`); exactly one provider module registers an implementation on `app.state.auth.auth_provider`.
 - `PrincipalResolver` chain — async `(Request) -> UserContext | None` callables apps append to `app.state.auth.principal_resolvers` (e.g. PAT/bearer-token or API-key auth), consulted after the session path.
 - `AuthMiddleware` — delegates to the provider + resolver chain on every request and populates the request principal.
 - `get_current_user` / `CurrentUser` dependency and the `require_permission(*permissions)` dependency factory.

{simple_module_auth-0.0.37 → simple_module_auth-0.0.39}/README.md

@@ -13,7 +13,7 @@ pip install simple_module_auth
 ## What it provides
 
 - `UserContext` — the request-scoped principal (`id`, `name`, `email`, `roles`).
-- `AuthProvider` protocol — the swappable-backend contract (`resolve_user`, `get_login_url`, `get_logout_url`, `get_public_paths`, `is_bearer_request`); exactly one provider module registers an implementation on `app.state.auth.auth_provider`.
+- `AuthProvider` protocol — the swappable-backend contract (`resolve_user`, `get_login_url`, `get_logout_url`, `is_bearer_request`); exactly one provider module registers an implementation on `app.state.auth.auth_provider`.
 - `PrincipalResolver` chain — async `(Request) -> UserContext | None` callables apps append to `app.state.auth.principal_resolvers` (e.g. PAT/bearer-token or API-key auth), consulted after the session path.
 - `AuthMiddleware` — delegates to the provider + resolver chain on every request and populates the request principal.
 - `get_current_user` / `CurrentUser` dependency and the `require_permission(*permissions)` dependency factory.

{simple_module_auth-0.0.37 → simple_module_auth-0.0.39}/auth/contracts/provider.py

@@ -26,8 +26,6 @@ class AuthProvider(Protocol):
 
     def get_logout_url(self, request: Request) -> str: ...
 
-    def get_public_paths(self) -> tuple[tuple[str, ...], tuple[str, ...]]: ...
-
     def is_bearer_request(self, request: Request) -> bool: ...
 
 

{simple_module_auth-0.0.37 → simple_module_auth-0.0.39}/auth/contracts/schemas.py

@@ -2,15 +2,28 @@
 
 from __future__ import annotations
 
+from collections.abc import Iterable
 from dataclasses import dataclass, field
-from typing import TYPE_CHECKING, Any
+from typing import Any, Protocol
 
 from auth.contracts.tokens import AUTH_KIND_SESSION
 
-if TYPE_CHECKING:
-    # Runtime import would be circular: auth -> users -> auth.
-    # Only imported for type-hints, never at runtime.
-    from users.models import User
+
+class NamedRole(Protocol):
+    name: str
+
+
+class AccountLike(Protocol):
+    """What :meth:`UserContext.from_user` reads from an account row.
+
+    Structural, so ``auth`` names no provider's model: ``users`` depends on
+    ``auth``, never the other way round (GH #501).
+    """
+
+    id: Any
+    email: str
+    full_name: str | None
+    roles: Iterable[NamedRole]
 
 
 @dataclass
@@ -53,12 +66,12 @@ class UserContext:
     @classmethod
     def from_user(
         cls,
-        user: User | Any,
+        user: AccountLike,
         *,
         auth_kind: str = AUTH_KIND_SESSION,
         scopes: list[str] | None = None,
     ) -> UserContext:
-        """Build a UserContext from a users.models.User with eagerly-loaded roles.
+        """Build a UserContext from an :class:`AccountLike` with eagerly-loaded roles.
 
         Duck-typed to avoid importing users.models at runtime — any object
         exposing .id, .email, .full_name, .roles[*].name works. The user row

simple_module_auth-0.0.39/auth/locales/de.json

@@ -0,0 +1,6 @@
+{
+  "errors": {
+    "not_authenticated": "Nicht authentifiziert",
+    "missing_permission": "Erforderliche Berechtigung fehlt: {permissions}"
+  }
+}

{simple_module_auth-0.0.37 → simple_module_auth-0.0.39}/auth/middleware.py

@@ -10,8 +10,10 @@ from __future__ import annotations
 
 import logging
 
+from simple_module_core.app_state import get_openapi_url
 from simple_module_core.redirect_safety import SESSION_NEXT_KEY, safe_next_or_none
 from simple_module_db.listeners import current_user_id
+from simple_module_hosting.public_access import is_public as route_is_public
 from starlette.requests import Request
 from starlette.responses import JSONResponse, RedirectResponse
 from starlette.types import ASGIApp, Receive, Scope, Send
@@ -86,19 +88,10 @@ class AuthMiddleware:
             any(path.startswith(p) for p in _FRAMEWORK_PUBLIC_PREFIXES)
             or path in _FRAMEWORK_PUBLIC_EXACT
             # Anonymous exactly when the host serves it (dev, or openapi_public).
-            or path == getattr(app_state, "openapi_url", None)
+            or path == get_openapi_url(scope["app"])
         )
-        # Module-contributed public routes (register_public_routes hook). Method
-        # -aware, so a GET read route can be exempted without opening sibling
-        # POST/PATCH mutations under the same prefix.
         if not is_public:
-            public_routes = getattr(app_state, "public_routes", None)
-            is_public = public_routes is not None and public_routes.matches(method, path)
-        # Legacy provider-declared paths (prefix-only, method-agnostic). Kept for
-        # back-compat with AuthProvider implementations.
-        if not is_public:
-            prefix_paths, exact_paths = provider.get_public_paths()
-            is_public = any(path.startswith(p) for p in prefix_paths) or path in exact_paths
+            is_public = route_is_public(scope["app"], method, path)
 
         # Contract with the host's RateLimitMiddleware (plain scope key, no import
         # between them): whether *this* middleware treats the request as anonymous-
@@ -158,6 +151,11 @@ class AuthMiddleware:
 
         if user_ctx is not None:
             request.state.user = user_ctx
+            for guard in auth_state.principal_guards:
+                refusal = guard(request)
+                if refusal is not None:
+                    await refusal(scope, receive, send)
+                    return
             token = current_user_id.set(user_ctx.id)
             try:
                 await self.app(scope, receive, send)

{simple_module_auth-0.0.37 → simple_module_auth-0.0.39}/auth/state.py

@@ -9,12 +9,16 @@ principal-resolver registry. Apps register additional resolvers from their
 
 from __future__ import annotations
 
+from collections.abc import Callable
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING
 
 from auth.contracts.resolver import PrincipalResolver
 
 if TYPE_CHECKING:
+    from starlette.requests import Request
+    from starlette.responses import Response
+
     from auth.contracts.provider import AuthProvider
 
 
@@ -24,6 +28,11 @@ class AuthState:
 
     auth_provider: AuthProvider | None = None
     principal_resolvers: list[PrincipalResolver] = field(default_factory=list)
+    # Run once a principal has resolved (any credential source), before downstream
+    # middleware; anonymous requests never reach them.
+    # A guard is a sync callable returning a refusal response or None to continue.
+    # An exception propagates (a 500), so a broken guard fails closed, never open.
+    principal_guards: list[Callable[[Request], Response | None]] = field(default_factory=list)
 
 
 __all__ = ["AuthState"]

{simple_module_auth-0.0.37 → simple_module_auth-0.0.39}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simple-module-py/auth",
-  "version": "0.1.0",
+  "version": "0.0.39",
   "private": true,
   "description": "Frontend assets for the Auth module",
   "peerDependencies": {

{simple_module_auth-0.0.37 → simple_module_auth-0.0.39}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_auth"
-version = "0.0.37"
+version = "0.0.39"
 description = "Session-cookie authentication primitives — middleware, login/logout, redirect helpers for simple_module"
 readme = "README.md"
 license = "MIT"
@@ -21,9 +21,10 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "itsdangerous>=2.2",
-    "simple_module_core==0.0.37",
-    "simple_module_db==0.0.37",
+    "itsdangerous>=2.2,<3",
+    "simple_module_core==0.0.39",
+    "simple_module_db==0.0.39",
+    "simple_module_hosting==0.0.39",
 ]
 
 [project.entry-points.simple_module]
@@ -50,3 +51,4 @@ packages = ["auth"]
 [tool.uv.sources]
 simple_module_core = { workspace = true }
 simple_module_db = { workspace = true }
+simple_module_hosting = { workspace = true }