simple-module-auth 0.0.38__tar.gz → 0.0.39__tar.gz

{simple_module_auth-0.0.38 → simple_module_auth-0.0.39}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_auth
-Version: 0.0.38
+Version: 0.0.39
 Summary: Session-cookie authentication primitives — middleware, login/logout, redirect helpers for simple_module
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -21,9 +21,10 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Typing :: Typed
 Requires-Python: >=3.12
-Requires-Dist: itsdangerous>=2.2
-Requires-Dist: simple-module-core==0.0.38
-Requires-Dist: simple-module-db==0.0.38
+Requires-Dist: itsdangerous<3,>=2.2
+Requires-Dist: simple-module-core==0.0.39
+Requires-Dist: simple-module-db==0.0.39
+Requires-Dist: simple-module-hosting==0.0.39
 Description-Content-Type: text/markdown
 
 # simple_module_auth

{simple_module_auth-0.0.38 → simple_module_auth-0.0.39}/auth/middleware.py

@@ -10,9 +10,10 @@ from __future__ import annotations
 
 import logging
 
-from simple_module_core.public_routes import legacy_provider_public_paths
+from simple_module_core.app_state import get_openapi_url
 from simple_module_core.redirect_safety import SESSION_NEXT_KEY, safe_next_or_none
 from simple_module_db.listeners import current_user_id
+from simple_module_hosting.public_access import is_public as route_is_public
 from starlette.requests import Request
 from starlette.responses import JSONResponse, RedirectResponse
 from starlette.types import ASGIApp, Receive, Scope, Send
@@ -87,19 +88,10 @@ class AuthMiddleware:
             any(path.startswith(p) for p in _FRAMEWORK_PUBLIC_PREFIXES)
             or path in _FRAMEWORK_PUBLIC_EXACT
             # Anonymous exactly when the host serves it (dev, or openapi_public).
-            or path == getattr(app_state, "openapi_url", None)
+            or path == get_openapi_url(scope["app"])
         )
-        # Module-contributed public routes (register_public_routes hook). Method
-        # -aware, so a GET read route can be exempted without opening sibling
-        # POST/PATCH mutations under the same prefix.
         if not is_public:
-            public_routes = getattr(app_state, "public_routes", None)
-            is_public = public_routes is not None and public_routes.matches(method, path)
-        # Deprecated provider-declared paths (prefix-only, method-agnostic); honoured
-        # until 0.1.0 for third-party providers. users/keycloak use the registry.
-        if not is_public:
-            prefix_paths, exact_paths = legacy_provider_public_paths(provider)
-            is_public = any(path.startswith(p) for p in prefix_paths) or path in exact_paths
+            is_public = route_is_public(scope["app"], method, path)
 
         # Contract with the host's RateLimitMiddleware (plain scope key, no import
         # between them): whether *this* middleware treats the request as anonymous-
@@ -159,6 +151,11 @@ class AuthMiddleware:
 
         if user_ctx is not None:
             request.state.user = user_ctx
+            for guard in auth_state.principal_guards:
+                refusal = guard(request)
+                if refusal is not None:
+                    await refusal(scope, receive, send)
+                    return
             token = current_user_id.set(user_ctx.id)
             try:
                 await self.app(scope, receive, send)

{simple_module_auth-0.0.38 → simple_module_auth-0.0.39}/auth/state.py

@@ -9,12 +9,16 @@ principal-resolver registry. Apps register additional resolvers from their
 
 from __future__ import annotations
 
+from collections.abc import Callable
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING
 
 from auth.contracts.resolver import PrincipalResolver
 
 if TYPE_CHECKING:
+    from starlette.requests import Request
+    from starlette.responses import Response
+
     from auth.contracts.provider import AuthProvider
 
 
@@ -24,6 +28,11 @@ class AuthState:
 
     auth_provider: AuthProvider | None = None
     principal_resolvers: list[PrincipalResolver] = field(default_factory=list)
+    # Run once a principal has resolved (any credential source), before downstream
+    # middleware; anonymous requests never reach them.
+    # A guard is a sync callable returning a refusal response or None to continue.
+    # An exception propagates (a 500), so a broken guard fails closed, never open.
+    principal_guards: list[Callable[[Request], Response | None]] = field(default_factory=list)
 
 
 __all__ = ["AuthState"]

{simple_module_auth-0.0.38 → simple_module_auth-0.0.39}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simple-module-py/auth",
-  "version": "0.0.38",
+  "version": "0.0.39",
   "private": true,
   "description": "Frontend assets for the Auth module",
   "peerDependencies": {

{simple_module_auth-0.0.38 → simple_module_auth-0.0.39}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_auth"
-version = "0.0.38"
+version = "0.0.39"
 description = "Session-cookie authentication primitives — middleware, login/logout, redirect helpers for simple_module"
 readme = "README.md"
 license = "MIT"
@@ -21,9 +21,10 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "itsdangerous>=2.2",
-    "simple_module_core==0.0.38",
-    "simple_module_db==0.0.38",
+    "itsdangerous>=2.2,<3",
+    "simple_module_core==0.0.39",
+    "simple_module_db==0.0.39",
+    "simple_module_hosting==0.0.39",
 ]
 
 [project.entry-points.simple_module]
@@ -50,3 +51,4 @@ packages = ["auth"]
 [tool.uv.sources]
 simple_module_core = { workspace = true }
 simple_module_db = { workspace = true }
+simple_module_hosting = { workspace = true }