simple-module-users 0.0.19__tar.gz → 0.0.21__tar.gz

{simple_module_users-0.0.19 → simple_module_users-0.0.21}/.gitignore

@@ -61,3 +61,4 @@ Thumbs.db
 .playwright-mcp/*
 host/client_app/.playwright-cli/*
 .superpowers/
+.qa/

{simple_module_users-0.0.19 → simple_module_users-0.0.21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simple_module_users
-Version: 0.0.19
+Version: 0.0.21
 Summary: Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -24,11 +24,11 @@ Requires-Python: >=3.12
 Requires-Dist: aiosmtplib>=3.0
 Requires-Dist: cachetools>=5.3
 Requires-Dist: fastapi-users[oauth,sqlalchemy]<16,>=15
-Requires-Dist: simple-module-auth==0.0.19
-Requires-Dist: simple-module-core==0.0.19
-Requires-Dist: simple-module-db==0.0.19
-Requires-Dist: simple-module-hosting==0.0.19
-Requires-Dist: simple-module-settings==0.0.19
+Requires-Dist: simple-module-auth==0.0.21
+Requires-Dist: simple-module-core==0.0.21
+Requires-Dist: simple-module-db==0.0.21
+Requires-Dist: simple-module-hosting==0.0.21
+Requires-Dist: simple-module-settings==0.0.21
 Requires-Dist: typer>=0.12
 Description-Content-Type: text/markdown
 

{simple_module_users-0.0.19 → simple_module_users-0.0.21}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_users"
-version = "0.0.19"
+version = "0.0.21"
 description = "Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps"
 readme = "README.md"
 license = "MIT"
@@ -21,11 +21,11 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "simple_module_core==0.0.19",
-    "simple_module_db==0.0.19",
-    "simple_module_hosting==0.0.19",
-    "simple_module_settings==0.0.19",
-    "simple_module_auth==0.0.19",
+    "simple_module_core==0.0.21",
+    "simple_module_db==0.0.21",
+    "simple_module_hosting==0.0.21",
+    "simple_module_settings==0.0.21",
+    "simple_module_auth==0.0.21",
     # Pinned to a narrow range: `deps.py` relies on mutating CookieTransport
     # fields after construction (see reconfigure_cookie_transport in backend.py).
     # Bumping the major version requires re-checking those field names.

simple_module_users-0.0.21/tests/test_api_admin_crud.py

@@ -0,0 +1,163 @@
+"""Admin REST CRUD tests: create / update / delete."""
+
+from __future__ import annotations
+
+import uuid
+
+import pytest
+from sqlalchemy import select
+from test_api_admin import _make_user
+from users.models import User, UserRole
+
+# ---------------------------------------------------------------------------
+# Admin create
+# ---------------------------------------------------------------------------
+
+
+class TestAdminCreate:
+    @pytest.mark.anyio
+    async def test_create_returns_201(self, admin_client):
+        resp = await admin_client.post(
+            "/api/users/admin",
+            json={
+                "email": "newuser@example.com",
+                "password": "SecurePass1!",
+                "full_name": "New User",
+                "role_names": ["user"],
+            },
+        )
+        assert resp.status_code == 201
+        body = resp.json()
+        assert body["email"] == "newuser@example.com"
+        assert body["is_active"] is True
+        assert body["is_verified"] is True
+        assert body["roles"] == ["user"]
+
+    @pytest.mark.anyio
+    async def test_create_duplicate_returns_409(self, admin_client, users_db):
+        await _make_user(users_db, email="taken@example.com")
+        resp = await admin_client.post(
+            "/api/users/admin",
+            json={"email": "taken@example.com", "password": "SecurePass1!"},
+        )
+        assert resp.status_code == 409
+        assert "already exists" in resp.json()["detail"]
+
+    @pytest.mark.anyio
+    async def test_create_weak_password_returns_400(self, admin_client):
+        resp = await admin_client.post(
+            "/api/users/admin",
+            json={"email": "weakpw@example.com", "password": "short"},
+        )
+        assert resp.status_code == 400
+        assert "8 characters" in resp.json()["detail"]
+
+    @pytest.mark.anyio
+    async def test_create_without_auth_is_rejected(self, anon_client):
+        resp = await anon_client.post(
+            "/api/users/admin",
+            json={"email": "hacker@example.com", "password": "SecurePass1!"},
+            follow_redirects=False,
+        )
+        assert resp.status_code == 401
+        assert resp.json() == {"detail": "Not authenticated"}
+
+
+# ---------------------------------------------------------------------------
+# Admin update details
+# ---------------------------------------------------------------------------
+
+
+class TestAdminUpdate:
+    @pytest.mark.anyio
+    async def test_update_changes_email_and_name(self, admin_client, users_db):
+        user = await _make_user(users_db, email="before@example.com")
+        resp = await admin_client.patch(
+            f"/api/users/admin/{user.id}",
+            json={"email": "after@example.com", "full_name": "After Name"},
+        )
+        assert resp.status_code == 200
+        body = resp.json()
+        assert body["email"] == "after@example.com"
+        assert body["full_name"] == "After Name"
+
+    @pytest.mark.anyio
+    async def test_update_duplicate_email_returns_409(self, admin_client, users_db):
+        await _make_user(users_db, email="exists@example.com")
+        target = await _make_user(users_db, email="target@example.com")
+        resp = await admin_client.patch(
+            f"/api/users/admin/{target.id}",
+            json={"email": "exists@example.com"},
+        )
+        assert resp.status_code == 409
+
+    @pytest.mark.anyio
+    async def test_update_nonexistent_returns_404(self, admin_client):
+        resp = await admin_client.patch(
+            f"/api/users/admin/{uuid.uuid4()}",
+            json={"email": "ghost@example.com"},
+        )
+        assert resp.status_code == 404
+
+    @pytest.mark.anyio
+    async def test_update_without_auth_is_rejected(self, anon_client):
+        resp = await anon_client.patch(
+            f"/api/users/admin/{uuid.uuid4()}",
+            json={"email": "x@example.com"},
+            follow_redirects=False,
+        )
+        assert resp.status_code == 401
+
+
+# ---------------------------------------------------------------------------
+# Admin delete
+# ---------------------------------------------------------------------------
+
+
+class TestAdminDelete:
+    @pytest.mark.anyio
+    async def test_delete_returns_204(self, admin_client, users_db):
+        user = await _make_user(users_db, email="deleteme@example.com")
+        resp = await admin_client.delete(f"/api/users/admin/{user.id}")
+        assert resp.status_code == 204
+
+    @pytest.mark.anyio
+    async def test_delete_user_with_role_returns_204(self, admin_client, users_db):
+        """Regression: deleting a user that HAS a role must not 500.
+
+        The delete runs in the request session, which eager-loads the user's
+        ``roles`` relationship. Bulk-deleting the ``users_user_role`` rows the
+        ORM is tracking raised ``StaleDataError`` on flush. The roleless
+        ``test_delete_returns_204`` never exercised this path."""
+        user = await _make_user(users_db, email="hasrole@example.com", role_names=["admin"])
+        resp = await admin_client.delete(f"/api/users/admin/{user.id}")
+        assert resp.status_code == 204
+        # The role association row is gone too (no orphan).
+        rows = (
+            (await users_db.execute(select(UserRole).where(UserRole.user_id == user.id)))
+            .scalars()
+            .all()
+        )
+        assert rows == []
+
+    @pytest.mark.anyio
+    async def test_delete_nonexistent_returns_404(self, admin_client):
+        resp = await admin_client.delete(f"/api/users/admin/{uuid.uuid4()}")
+        assert resp.status_code == 404
+
+    @pytest.mark.anyio
+    async def test_delete_self_returns_400(self, admin_client, users_app):
+        async with users_app.state.sm.db.session_factory() as session:
+            admin = (
+                await session.execute(select(User).where(User.email == "admin@example.com"))
+            ).scalar_one()
+        resp = await admin_client.delete(f"/api/users/admin/{admin.id}")
+        assert resp.status_code == 400
+
+    @pytest.mark.anyio
+    async def test_delete_without_auth_is_rejected(self, anon_client):
+        resp = await anon_client.delete(
+            f"/api/users/admin/{uuid.uuid4()}",
+            follow_redirects=False,
+        )
+        assert resp.status_code == 401

simple_module_users-0.0.21/tests/test_external_users.py

@@ -0,0 +1,228 @@
+"""External (SSO) user behaviour: null password, marking, and guards.
+
+Covers the feature added on top of the OAuth/OIDC login flow:
+- a *new* OAuth login provisions an external user (null password, marked),
+- an OAuth login that *links* to an existing password account leaves it local,
+- external users cannot password-login or be sent a reset link,
+- admins can still assign roles to external users like any other user,
+- the admin list surfaces ``is_external``.
+"""
+
+from __future__ import annotations
+
+import uuid
+from urllib.parse import parse_qs, urlparse
+
+import pytest
+from fastapi_users.password import PasswordHelper
+from sqlalchemy import select
+from users.models import Role, User
+
+_pw = PasswordHelper()
+
+
+# ---------------------------------------------------------------------------
+# Fake OAuth provider (no network) to drive the /login + /callback flow
+# ---------------------------------------------------------------------------
+
+
+class _FakeOAuthClient:
+    def __init__(self, account_id: str, account_email: str) -> None:
+        self._account_id = account_id
+        self._account_email = account_email
+
+    async def get_authorization_url(self, redirect_uri: str, state: str) -> str:
+        return f"https://idp.example/authorize?state={state}"
+
+    async def get_access_token(self, code: str, redirect_uri: str) -> dict:
+        return {"access_token": "fake-token", "expires_at": None, "refresh_token": None}
+
+    async def get_id_email(self, access_token: str) -> tuple[str, str]:
+        return self._account_id, self._account_email
+
+
+def _install_fake_provider(app, account_id: str, account_email: str) -> None:
+    from users.oauth import OAuthProvider
+
+    app.state.users.oauth_clients["microsoft"] = OAuthProvider(
+        "microsoft", "Microsoft", _FakeOAuthClient(account_id, account_email)
+    )
+
+
+async def _run_oauth_login(client) -> int:
+    """Drive /login then /callback; return the callback status code."""
+    login = await client.get("/api/users/auth/microsoft/login", follow_redirects=False)
+    assert login.status_code == 302
+    state = parse_qs(urlparse(login.headers["location"]).query)["state"][0]
+    cb = await client.get(
+        f"/api/users/auth/microsoft/callback?code=abc&state={state}",
+        follow_redirects=False,
+    )
+    return cb.status_code
+
+
+async def _get_user_by_email(db, email: str) -> User:
+    return (await db.execute(select(User).where(User.email == email))).scalar_one()
+
+
+# ---------------------------------------------------------------------------
+# Provisioning
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.anyio
+async def test_new_oauth_login_creates_external_user(users_app, anon_client, users_db):
+    _install_fake_provider(users_app, "ms-oid-1", "sso-new@example.com")
+
+    assert await _run_oauth_login(anon_client) == 303
+
+    user = await _get_user_by_email(users_db, "sso-new@example.com")
+    assert user.is_external is True
+    assert user.hashed_password is None
+    assert user.is_verified is True
+
+
+@pytest.mark.anyio
+async def test_oauth_login_links_existing_password_user_stays_local(
+    users_app, anon_client, users_db
+):
+    existing = User(
+        id=uuid.uuid4(),
+        email="local@example.com",
+        hashed_password=_pw.hash("SecurePass1!"),
+        is_active=True,
+        is_verified=True,
+    )
+    users_db.add(existing)
+    await users_db.commit()
+
+    _install_fake_provider(users_app, "ms-oid-2", "local@example.com")
+    assert await _run_oauth_login(anon_client) == 303
+
+    user = await _get_user_by_email(users_db, "local@example.com")
+    assert user.is_external is False
+    assert user.hashed_password is not None  # password retained
+
+
+# ---------------------------------------------------------------------------
+# Credential guards
+# ---------------------------------------------------------------------------
+
+
+async def _seed_external_user(db, email: str = "ext@example.com") -> User:
+    user = User(
+        id=uuid.uuid4(),
+        email=email,
+        hashed_password=None,
+        is_active=True,
+        is_verified=True,
+        is_external=True,
+    )
+    db.add(user)
+    await db.commit()
+    return user
+
+
+@pytest.mark.anyio
+async def test_external_user_cannot_password_login(users_app, anon_client, users_db):
+    await _seed_external_user(users_db, "ext-login@example.com")
+
+    resp = await anon_client.post(
+        "/api/users/auth/login",
+        data={"username": "ext-login@example.com", "password": "anything-at-all"},
+    )
+    assert resp.status_code == 400
+    assert resp.json()["detail"] == "LOGIN_BAD_CREDENTIALS"
+
+
+@pytest.mark.anyio
+async def test_external_user_cannot_bearer_token_login(users_app, anon_client, users_db):
+    """The bearer-token login path must reject external users cleanly (401),
+    not 500 on a None-hash verify, and without a timing/error enumeration leak."""
+    await _seed_external_user(users_db, "ext-token@example.com")
+
+    resp = await anon_client.post(
+        "/api/users/auth/token",
+        json={"email": "ext-token@example.com", "password": "anything-at-all"},
+    )
+    assert resp.status_code == 401
+    assert resp.json()["detail"] == "Invalid credentials"
+
+
+@pytest.mark.anyio
+async def test_admin_reset_link_rejected_for_external_user(admin_client, users_db):
+    user = await _seed_external_user(users_db, "ext-reset@example.com")
+
+    resp = await admin_client.post(f"/api/users/admin/{user.id}/reset-password-link")
+    assert resp.status_code == 409
+
+
+@pytest.mark.anyio
+async def test_forgot_password_is_noop_for_external_user(users_app):
+    from users.db_adapter import UserDatabaseWithRoles
+    from users.manager import UserManager
+    from users.models import OAuthAccount
+
+    async with users_app.state.sm.db.session_factory() as session:
+        user_db = UserDatabaseWithRoles(session, User, OAuthAccount)
+        manager = UserManager(user_db, users_app.state.users.mailer, users_app.state.users.settings)
+
+        sent: list[str] = []
+
+        async def _spy(user, token, request=None):
+            sent.append(user.email)
+
+        manager.on_after_forgot_password = _spy
+
+        external = User(
+            id=uuid.uuid4(),
+            email="ext-forgot@example.com",
+            hashed_password=None,
+            is_active=True,
+            is_verified=True,
+            is_external=True,
+        )
+        local = User(
+            id=uuid.uuid4(),
+            email="local-forgot@example.com",
+            hashed_password=_pw.hash("SecurePass1!"),
+            is_active=True,
+            is_verified=True,
+        )
+
+        await manager.forgot_password(external)
+        assert sent == []  # SSO account: no reset email
+
+        await manager.forgot_password(local)
+        assert sent == ["local-forgot@example.com"]  # control: local account still works
+
+
+# ---------------------------------------------------------------------------
+# Roles + admin visibility (external users are managed like normal users)
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.anyio
+async def test_admin_can_assign_role_to_external_user(admin_client, users_db):
+    user = await _seed_external_user(users_db, "ext-role@example.com")
+    users_db.add(Role(id=uuid.uuid4(), name="member", description="Member"))
+    await users_db.commit()
+
+    resp = await admin_client.put(
+        f"/api/users/admin/{user.id}/roles",
+        json={"role_names": ["member"]},
+    )
+    assert resp.status_code == 200
+    assert "member" in resp.json()["roles"]
+
+
+@pytest.mark.anyio
+async def test_admin_list_exposes_is_external(admin_client, users_db):
+    await _seed_external_user(users_db, "ext-list@example.com")
+
+    resp = await admin_client.get("/api/users/admin?per_page=100")
+    assert resp.status_code == 200
+    rows = {r["email"]: r for r in resp.json()}
+    assert rows["ext-list@example.com"]["is_external"] is True
+    # The seeded admin is a local account.
+    assert rows["admin@example.com"]["is_external"] is False

{simple_module_users-0.0.19 → simple_module_users-0.0.21}/tests/test_mailer.py

@@ -78,3 +78,53 @@ async def test_base_url_trailing_slash_stripped(caplog):
     link = caplog.records[0].link  # type: ignore[attr-defined]
     assert not link.startswith("http://localhost:8000//")
     assert link == "http://localhost:8000/users/verify?token=tok"
+
+
+@pytest.mark.anyio
+async def test_console_logs_configured_app_name(caplog):
+    """A supplied provider brands the console log; otherwise the default."""
+    from users.mailer.console import ConsoleMailer
+
+    branded = ConsoleMailer(base_url="http://localhost:8000", app_name_provider=lambda: "Acme")
+    default = ConsoleMailer(base_url="http://localhost:8000")
+
+    with caplog.at_level(logging.INFO, logger="users.mailer"):
+        await branded.send_invite("a@b.com", "tok", "Alice")
+        await default.send_verification("a@b.com", "tok")
+
+    assert caplog.records[0].app_name == "Acme"  # type: ignore[attr-defined]
+    assert caplog.records[1].app_name == "SimpleModule"  # type: ignore[attr-defined]
+
+
+@pytest.mark.anyio
+async def test_smtp_emails_carry_the_app_name(monkeypatch):
+    """SMTP subjects + bodies include the live app name (and keep the link)."""
+    from users.mailer.smtp import SmtpMailer
+
+    captured: list[dict[str, str]] = []
+
+    async def fake_send(self, to: str, subject: str, body: str) -> None:
+        captured.append({"to": to, "subject": subject, "body": body})
+
+    monkeypatch.setattr(SmtpMailer, "_send", fake_send)
+    mailer = SmtpMailer(
+        host="smtp.test",
+        port=25,
+        username="",
+        password="",
+        from_address="from@test",
+        use_tls=False,
+        base_url="http://localhost:8000",
+        app_name_provider=lambda: "Acme",
+    )
+
+    await mailer.send_invite("new@x.com", "tok", "Alice")
+    await mailer.send_verification("v@x.com", "vtok")
+    await mailer.send_password_reset("r@x.com", "rtok")
+
+    invite, verify, reset = captured
+    assert "Acme" in invite["subject"] and "Alice" in invite["subject"]
+    assert "Acme" in invite["body"]
+    assert "http://localhost:8000/users/invite/accept?token=tok" in invite["body"]
+    assert "Acme" in verify["subject"] and "Acme" in verify["body"]
+    assert "Acme" in reset["subject"] and "Acme" in reset["body"]

{simple_module_users-0.0.19 → simple_module_users-0.0.21}/tests/test_negative_authz.py

@@ -27,6 +27,13 @@ _PROTECTED_ENDPOINTS: tuple[tuple[str, str, dict | None], ...] = (
     ("PUT", f"/api/users/admin/{_FAKE_ID}/roles", {"role_names": []}),
     ("PATCH", f"/api/users/admin/{_FAKE_ID}/verify", None),
     ("POST", f"/api/users/admin/{_FAKE_ID}/reset-password-link", None),
+    (
+        "POST",
+        "/api/users/admin",
+        {"email": "x@y.test", "password": "SecurePass1!", "role_names": []},
+    ),
+    ("PATCH", f"/api/users/admin/{_FAKE_ID}", {"email": "x@y.test"}),
+    ("DELETE", f"/api/users/admin/{_FAKE_ID}", None),
     # permissions — root GET lists registered groups (PERM_VIEW)
     ("GET", "/api/permissions/", None),
     ("GET", f"/api/permissions/roles/{_FAKE_ID}", None),

simple_module_users-0.0.21/tests/test_service_admin_crud.py

@@ -0,0 +1,172 @@
+"""UserService write-op tests: create / update / delete."""
+
+from __future__ import annotations
+
+import uuid
+
+import pytest
+from test_service_admin import _build_service
+
+# ---------------------------------------------------------------------------
+# create_user
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.anyio
+async def test_create_user_active_verified_with_roles(users_app):
+    """create_user makes an active+verified user and assigns roles."""
+    async with users_app.state.sm.db.session_factory() as session:
+        svc = _build_service(session, users_app)
+        user = await svc.create_user(
+            email="created@example.com",
+            password="SecurePass1!",
+            full_name="Created User",
+            role_names=["user"],
+            created_by="admin-id",
+        )
+        assert user.is_active is True
+        assert user.is_verified is True
+        assert user.email == "created@example.com"
+        assert user.full_name == "Created User"
+        assert [r.name for r in user.roles] == ["user"]
+
+
+@pytest.mark.anyio
+async def test_create_user_weak_password_rejected(users_app):
+    from fastapi_users import exceptions as fa_exc
+
+    async with users_app.state.sm.db.session_factory() as session:
+        svc = _build_service(session, users_app)
+        with pytest.raises(fa_exc.InvalidPasswordException):
+            await svc.create_user(
+                email="weak@example.com",
+                password="short",
+                full_name=None,
+                role_names=[],
+                created_by=None,
+            )
+
+
+@pytest.mark.anyio
+async def test_create_user_duplicate_email_rejected(users_app):
+    from fastapi_users import exceptions as fa_exc
+
+    async with users_app.state.sm.db.session_factory() as session:
+        svc = _build_service(session, users_app)
+        await svc.create_user(
+            email="dup@example.com",
+            password="SecurePass1!",
+            full_name=None,
+            role_names=[],
+            created_by=None,
+        )
+        await session.flush()
+        with pytest.raises(fa_exc.UserAlreadyExists):
+            await svc.create_user(
+                email="dup@example.com",
+                password="SecurePass1!",
+                full_name=None,
+                role_names=[],
+                created_by=None,
+            )
+
+
+# ---------------------------------------------------------------------------
+# update_details
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.anyio
+async def test_update_details_changes_email_and_name(users_app):
+    from test_api_admin import _make_user
+
+    async with users_app.state.sm.db.session_factory() as session:
+        user = await _make_user(session, email="old@example.com")
+        svc = _build_service(session, users_app)
+        updated = await svc.update_details(user.id, email="new@example.com", full_name="New Name")
+        assert updated.email == "new@example.com"
+        assert updated.full_name == "New Name"
+
+
+@pytest.mark.anyio
+async def test_update_details_duplicate_email_rejected(users_app):
+    from test_api_admin import _make_user
+    from users.exceptions import EmailAlreadyExistsError
+
+    async with users_app.state.sm.db.session_factory() as session:
+        await _make_user(session, email="a@example.com")
+        target = await _make_user(session, email="b@example.com")
+        svc = _build_service(session, users_app)
+        with pytest.raises(EmailAlreadyExistsError):
+            await svc.update_details(target.id, email="a@example.com", full_name=None)
+
+
+@pytest.mark.anyio
+async def test_update_details_same_email_is_allowed(users_app):
+    from test_api_admin import _make_user
+
+    async with users_app.state.sm.db.session_factory() as session:
+        user = await _make_user(session, email="keep@example.com")
+        svc = _build_service(session, users_app)
+        updated = await svc.update_details(user.id, email="keep@example.com", full_name="Renamed")
+        assert updated.email == "keep@example.com"
+        assert updated.full_name == "Renamed"
+
+
+# ---------------------------------------------------------------------------
+# delete_user
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.anyio
+async def test_delete_user_removes_user_and_all_child_rows(users_app):
+    from datetime import UTC, datetime, timedelta
+
+    from sqlalchemy import select
+    from test_api_admin import _make_user
+    from users.models import (
+        OAuthAccount,
+        RefreshToken,
+        User,
+        UserAccessToken,
+        UserRole,
+    )
+
+    async with users_app.state.sm.db.session_factory() as session:
+        user = await _make_user(session, email="todelete@example.com", role_names=["admin"])
+        session.add(UserAccessToken(token=f"tok-{user.id.hex}", user_id=user.id))
+        session.add(
+            OAuthAccount(
+                user_id=user.id,
+                oauth_name="google",
+                access_token="x",
+                account_id="acct-1",
+                account_email="todelete@example.com",
+            )
+        )
+        session.add(RefreshToken(user_id=user.id, expires_at=datetime.now(UTC) + timedelta(days=1)))
+        await session.flush()
+
+        svc = _build_service(session, users_app)
+        await svc.delete_user(user.id)
+
+        assert (
+            await session.execute(select(User).where(User.id == user.id))
+        ).scalar_one_or_none() is None
+        for model in (UserRole, UserAccessToken, OAuthAccount, RefreshToken):
+            rows = (
+                (await session.execute(select(model).where(model.user_id == user.id)))
+                .scalars()
+                .all()
+            )
+            assert rows == [], f"{model.__name__} rows not cleaned up"
+
+
+@pytest.mark.anyio
+async def test_delete_user_nonexistent_raises(users_app):
+    from users.exceptions import UserNotFoundError
+
+    async with users_app.state.sm.db.session_factory() as session:
+        svc = _build_service(session, users_app)
+        with pytest.raises(UserNotFoundError):
+            await svc.delete_user(uuid.uuid4())