simple-module-auth 0.0.40__tar.gz → 0.0.42__tar.gz

{simple_module_auth-0.0.40 → simple_module_auth-0.0.42}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_auth
-Version: 0.0.40
+Version: 0.0.42
 Summary: Session-cookie authentication primitives — middleware, login/logout, redirect helpers for simple_module
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -22,14 +22,14 @@ Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Typing :: Typed
 Requires-Python: >=3.12
 Requires-Dist: itsdangerous<3,>=2.2
-Requires-Dist: simple-module-core==0.0.40
-Requires-Dist: simple-module-db==0.0.40
-Requires-Dist: simple-module-hosting==0.0.40
+Requires-Dist: simple-module-core==0.0.42
+Requires-Dist: simple-module-db==0.0.42
+Requires-Dist: simple-module-hosting==0.0.42
 Description-Content-Type: text/markdown
 
 # simple_module_auth
 
-Pluggable authentication core for [simple_module](https://github.com/antosubash/simple_module_python) apps. Owns the stable public contracts every other module imports — `UserContext`, the `AuthProvider` protocol, the `PrincipalResolver` chain, and the `get_current_user` / `CurrentUser` / `require_permission` dependencies — plus the `AuthMiddleware` that resolves the current principal on every request.
+Pluggable authentication core for [simple_module](https://github.com/antosubash/simple_module_python) apps. Owns the stable public contracts every other module imports — `UserContext`, the `AuthProvider` protocol, the `PrincipalResolver` chain, and the `get_current_user` / `CurrentUser` dependencies — plus the `AuthMiddleware` that resolves the current principal on every request.
 
 **Heads up:** for most apps you don't install this directly — an auth-provider module (`simple_module_users` for email+password, `simple_module_keycloak` for OIDC) pulls it in and registers itself on `app.state.auth.auth_provider`.
 
@@ -45,7 +45,7 @@ pip install simple_module_auth
 - `AuthProvider` protocol — the swappable-backend contract (`resolve_user`, `get_login_url`, `get_logout_url`, `is_bearer_request`); exactly one provider module registers an implementation on `app.state.auth.auth_provider`.
 - `PrincipalResolver` chain — async `(Request) -> UserContext | None` callables apps append to `app.state.auth.principal_resolvers` (e.g. PAT/bearer-token or API-key auth), consulted after the session path.
 - `AuthMiddleware` — delegates to the provider + resolver chain on every request and populates the request principal.
-- `get_current_user` / `CurrentUser` dependency and the `require_permission(*permissions)` dependency factory.
+- `get_current_user` / `CurrentUser` dependency.
 - Anonymous-access is declared via the framework's method-aware `register_public_routes` hook (with the `SM_AUTH_PUBLIC_PATHS` host-level escape hatch).
 
 ## Usage
@@ -63,18 +63,26 @@ async def me(user: CurrentUser):
     return {"user_id": user.id, "email": user.email}
 ```
 
-Routes that need a specific permission use the `require_permission(...)` dependency factory:
+Routes that need a specific permission use `RequiresPermission` from hosting:
 
 ```python
 from fastapi import Depends
 
-from auth.deps import require_permission
+from simple_module_hosting.permissions import RequiresPermission
 
+from .constants import PERM_PRODUCTS_CREATE
 
-@router.post("/", dependencies=[Depends(require_permission("products.create"))])
+
+@router.post("/", dependencies=[Depends(RequiresPermission(PERM_PRODUCTS_CREATE))])
 async def create_product(): ...
 ```
 
+`auth.deps.require_permission` is deprecated and will be removed in **0.1.0**
+(#698). It retains its legacy any-of semantics, role-based admin bypass and cached
+permission check. Migrate to `RequiresPermission(PERM_KEY)`; for several required
+permissions, declare a dependency for each. Unlike the legacy helper,
+`RequiresPermission` rechecks administrators demoted during the request.
+
 ## Depends on
 
 - `simple_module_core`, `simple_module_db`

{simple_module_auth-0.0.40 → simple_module_auth-0.0.42}/README.md

@@ -1,6 +1,6 @@
 # simple_module_auth
 
-Pluggable authentication core for [simple_module](https://github.com/antosubash/simple_module_python) apps. Owns the stable public contracts every other module imports — `UserContext`, the `AuthProvider` protocol, the `PrincipalResolver` chain, and the `get_current_user` / `CurrentUser` / `require_permission` dependencies — plus the `AuthMiddleware` that resolves the current principal on every request.
+Pluggable authentication core for [simple_module](https://github.com/antosubash/simple_module_python) apps. Owns the stable public contracts every other module imports — `UserContext`, the `AuthProvider` protocol, the `PrincipalResolver` chain, and the `get_current_user` / `CurrentUser` dependencies — plus the `AuthMiddleware` that resolves the current principal on every request.
 
 **Heads up:** for most apps you don't install this directly — an auth-provider module (`simple_module_users` for email+password, `simple_module_keycloak` for OIDC) pulls it in and registers itself on `app.state.auth.auth_provider`.
 
@@ -16,7 +16,7 @@ pip install simple_module_auth
 - `AuthProvider` protocol — the swappable-backend contract (`resolve_user`, `get_login_url`, `get_logout_url`, `is_bearer_request`); exactly one provider module registers an implementation on `app.state.auth.auth_provider`.
 - `PrincipalResolver` chain — async `(Request) -> UserContext | None` callables apps append to `app.state.auth.principal_resolvers` (e.g. PAT/bearer-token or API-key auth), consulted after the session path.
 - `AuthMiddleware` — delegates to the provider + resolver chain on every request and populates the request principal.
-- `get_current_user` / `CurrentUser` dependency and the `require_permission(*permissions)` dependency factory.
+- `get_current_user` / `CurrentUser` dependency.
 - Anonymous-access is declared via the framework's method-aware `register_public_routes` hook (with the `SM_AUTH_PUBLIC_PATHS` host-level escape hatch).
 
 ## Usage
@@ -34,18 +34,26 @@ async def me(user: CurrentUser):
     return {"user_id": user.id, "email": user.email}
 ```
 
-Routes that need a specific permission use the `require_permission(...)` dependency factory:
+Routes that need a specific permission use `RequiresPermission` from hosting:
 
 ```python
 from fastapi import Depends
 
-from auth.deps import require_permission
+from simple_module_hosting.permissions import RequiresPermission
 
+from .constants import PERM_PRODUCTS_CREATE
 
-@router.post("/", dependencies=[Depends(require_permission("products.create"))])
+
+@router.post("/", dependencies=[Depends(RequiresPermission(PERM_PRODUCTS_CREATE))])
 async def create_product(): ...
 ```
 
+`auth.deps.require_permission` is deprecated and will be removed in **0.1.0**
+(#698). It retains its legacy any-of semantics, role-based admin bypass and cached
+permission check. Migrate to `RequiresPermission(PERM_KEY)`; for several required
+permissions, declare a dependency for each. Unlike the legacy helper,
+`RequiresPermission` rechecks administrators demoted during the request.
+
 ## Depends on
 
 - `simple_module_core`, `simple_module_db`

{simple_module_auth-0.0.40 → simple_module_auth-0.0.42}/auth/deps.py

@@ -5,15 +5,14 @@ from __future__ import annotations
 from typing import Annotated
 
 from fastapi import Depends, HTTPException, Request
-from simple_module_core.permissions import grants
+from simple_module_core.deprecation import deprecated
+from simple_module_core.permissions import ADMIN_ROLE, grants
 from simple_module_hosting.i18n_deps import TranslatorDep
 from simple_module_hosting.permissions import ensure_resolved_permissions
 from simple_module_hosting.token_guard import GATE_PERMISSION, mark_token_gate
 
 from auth.contracts.schemas import UserContext
 
-_ADMIN_ROLE = "admin"
-
 
 async def get_current_user(request: Request, t: TranslatorDep) -> UserContext:
     """Extract the authenticated user from request state.
@@ -29,13 +28,13 @@ async def get_current_user(request: Request, t: TranslatorDep) -> UserContext:
 CurrentUser = Annotated[UserContext, Depends(get_current_user)]
 
 
+@deprecated(remove_in="0.1.0", use="simple_module_hosting.permissions.RequiresPermission")
 def require_permission(*permissions: str):
-    """Create a dependency that checks if the user has required permissions.
-
-    Usage::
+    """Legacy any-of gate, removed in 0.1.0; use ``RequiresPermission`` instead.
 
-        @router.post("/", dependencies=[Depends(require_permission("products.create"))])
-        async def create_product(...): ...
+    Retains the role-based admin bypass and cached permission behaviour for
+    compatibility. ``RequiresPermission`` rechecks a principal demoted during
+    the request; this helper does not.
     """
 
     async def check(
@@ -46,7 +45,7 @@ def require_permission(*permissions: str):
         # Admin role bypasses permission checks — but not for a token: an
         # admin's PAT is worth only the scopes it carries, and the resolved
         # set below already applies that cap.
-        if _ADMIN_ROLE in user.roles and user.scopes is None:
+        if ADMIN_ROLE in user.roles and user.scopes is None:
             return
 
         # The same resolution RequiresPermission reads: the registry's role map

{simple_module_auth-0.0.40 → simple_module_auth-0.0.42}/package.json

@@ -1,16 +1,15 @@
 {
   "name": "@simple-module-py/auth",
-  "version": "0.0.40",
+  "version": "0.0.42",
   "private": true,
   "description": "Frontend assets for the Auth module",
   "peerDependencies": {
+    "@inertiajs/react": "^3.9.1",
+    "@simple-module-py/ui": "*",
     "react": "^19.0.0",
-    "react-dom": "^19.0.0",
-    "@inertiajs/react": "^3.7.0",
-    "@simple-module-py/ui": "*"
+    "react-dom": "^19.3.1"
   },
   "devDependencies": {
     "@simple-module-py/tsconfig": "*"
-  },
-  "dependencies": {}
+  }
 }

{simple_module_auth-0.0.40 → simple_module_auth-0.0.42}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_auth"
-version = "0.0.40"
+version = "0.0.42"
 description = "Session-cookie authentication primitives — middleware, login/logout, redirect helpers for simple_module"
 readme = "README.md"
 license = "MIT"
@@ -22,9 +22,9 @@ classifiers = [
 ]
 dependencies = [
     "itsdangerous>=2.2,<3",
-    "simple_module_core==0.0.40",
-    "simple_module_db==0.0.40",
-    "simple_module_hosting==0.0.40",
+    "simple_module_core==0.0.42",
+    "simple_module_db==0.0.42",
+    "simple_module_hosting==0.0.42",
 ]
 
 [project.entry-points.simple_module]

simple_module_auth-0.0.42/tests/test_auth_permission_deprecation.py

@@ -0,0 +1,13 @@
+"""The legacy any-of permission helper carries a migration warning (#698)."""
+
+import pytest
+from auth.deps import require_permission
+from simple_module_core.deprecation import registered_deprecations
+
+
+def test_auth_require_permission_warns_and_registers_removal():
+    with pytest.warns(DeprecationWarning, match="RequiresPermission"):
+        dependency = require_permission("products.view")
+    assert callable(dependency.dependency)
+    entry = next(d for d in registered_deprecations() if d.name == "auth.deps.require_permission")
+    assert entry.remove_in == "0.1.0"