simple-module-users 0.0.20__tar.gz → 0.0.22__tar.gz

{simple_module_users-0.0.20 → simple_module_users-0.0.22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simple_module_users
-Version: 0.0.20
+Version: 0.0.22
 Summary: Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -24,11 +24,11 @@ Requires-Python: >=3.12
 Requires-Dist: aiosmtplib>=3.0
 Requires-Dist: cachetools>=5.3
 Requires-Dist: fastapi-users[oauth,sqlalchemy]<16,>=15
-Requires-Dist: simple-module-auth==0.0.20
-Requires-Dist: simple-module-core==0.0.20
-Requires-Dist: simple-module-db==0.0.20
-Requires-Dist: simple-module-hosting==0.0.20
-Requires-Dist: simple-module-settings==0.0.20
+Requires-Dist: simple-module-auth==0.0.22
+Requires-Dist: simple-module-core==0.0.22
+Requires-Dist: simple-module-db==0.0.22
+Requires-Dist: simple-module-hosting==0.0.22
+Requires-Dist: simple-module-settings==0.0.22
 Requires-Dist: typer>=0.12
 Description-Content-Type: text/markdown
 

{simple_module_users-0.0.20 → simple_module_users-0.0.22}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_users"
-version = "0.0.20"
+version = "0.0.22"
 description = "Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps"
 readme = "README.md"
 license = "MIT"
@@ -21,11 +21,11 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "simple_module_core==0.0.20",
-    "simple_module_db==0.0.20",
-    "simple_module_hosting==0.0.20",
-    "simple_module_settings==0.0.20",
-    "simple_module_auth==0.0.20",
+    "simple_module_core==0.0.22",
+    "simple_module_db==0.0.22",
+    "simple_module_hosting==0.0.22",
+    "simple_module_settings==0.0.22",
+    "simple_module_auth==0.0.22",
     # Pinned to a narrow range: `deps.py` relies on mutating CookieTransport
     # fields after construction (see reconfigure_cookie_transport in backend.py).
     # Bumping the major version requires re-checking those field names.

simple_module_users-0.0.22/tests/test_external_users.py

@@ -0,0 +1,228 @@
+"""External (SSO) user behaviour: null password, marking, and guards.
+
+Covers the feature added on top of the OAuth/OIDC login flow:
+- a *new* OAuth login provisions an external user (null password, marked),
+- an OAuth login that *links* to an existing password account leaves it local,
+- external users cannot password-login or be sent a reset link,
+- admins can still assign roles to external users like any other user,
+- the admin list surfaces ``is_external``.
+"""
+
+from __future__ import annotations
+
+import uuid
+from urllib.parse import parse_qs, urlparse
+
+import pytest
+from fastapi_users.password import PasswordHelper
+from sqlalchemy import select
+from users.models import Role, User
+
+_pw = PasswordHelper()
+
+
+# ---------------------------------------------------------------------------
+# Fake OAuth provider (no network) to drive the /login + /callback flow
+# ---------------------------------------------------------------------------
+
+
+class _FakeOAuthClient:
+    def __init__(self, account_id: str, account_email: str) -> None:
+        self._account_id = account_id
+        self._account_email = account_email
+
+    async def get_authorization_url(self, redirect_uri: str, state: str) -> str:
+        return f"https://idp.example/authorize?state={state}"
+
+    async def get_access_token(self, code: str, redirect_uri: str) -> dict:
+        return {"access_token": "fake-token", "expires_at": None, "refresh_token": None}
+
+    async def get_id_email(self, access_token: str) -> tuple[str, str]:
+        return self._account_id, self._account_email
+
+
+def _install_fake_provider(app, account_id: str, account_email: str) -> None:
+    from users.oauth import OAuthProvider
+
+    app.state.users.oauth_clients["microsoft"] = OAuthProvider(
+        "microsoft", "Microsoft", _FakeOAuthClient(account_id, account_email)
+    )
+
+
+async def _run_oauth_login(client) -> int:
+    """Drive /login then /callback; return the callback status code."""
+    login = await client.get("/api/users/auth/microsoft/login", follow_redirects=False)
+    assert login.status_code == 302
+    state = parse_qs(urlparse(login.headers["location"]).query)["state"][0]
+    cb = await client.get(
+        f"/api/users/auth/microsoft/callback?code=abc&state={state}",
+        follow_redirects=False,
+    )
+    return cb.status_code
+
+
+async def _get_user_by_email(db, email: str) -> User:
+    return (await db.execute(select(User).where(User.email == email))).scalar_one()
+
+
+# ---------------------------------------------------------------------------
+# Provisioning
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.anyio
+async def test_new_oauth_login_creates_external_user(users_app, anon_client, users_db):
+    _install_fake_provider(users_app, "ms-oid-1", "sso-new@example.com")
+
+    assert await _run_oauth_login(anon_client) == 303
+
+    user = await _get_user_by_email(users_db, "sso-new@example.com")
+    assert user.is_external is True
+    assert user.hashed_password is None
+    assert user.is_verified is True
+
+
+@pytest.mark.anyio
+async def test_oauth_login_links_existing_password_user_stays_local(
+    users_app, anon_client, users_db
+):
+    existing = User(
+        id=uuid.uuid4(),
+        email="local@example.com",
+        hashed_password=_pw.hash("SecurePass1!"),
+        is_active=True,
+        is_verified=True,
+    )
+    users_db.add(existing)
+    await users_db.commit()
+
+    _install_fake_provider(users_app, "ms-oid-2", "local@example.com")
+    assert await _run_oauth_login(anon_client) == 303
+
+    user = await _get_user_by_email(users_db, "local@example.com")
+    assert user.is_external is False
+    assert user.hashed_password is not None  # password retained
+
+
+# ---------------------------------------------------------------------------
+# Credential guards
+# ---------------------------------------------------------------------------
+
+
+async def _seed_external_user(db, email: str = "ext@example.com") -> User:
+    user = User(
+        id=uuid.uuid4(),
+        email=email,
+        hashed_password=None,
+        is_active=True,
+        is_verified=True,
+        is_external=True,
+    )
+    db.add(user)
+    await db.commit()
+    return user
+
+
+@pytest.mark.anyio
+async def test_external_user_cannot_password_login(users_app, anon_client, users_db):
+    await _seed_external_user(users_db, "ext-login@example.com")
+
+    resp = await anon_client.post(
+        "/api/users/auth/login",
+        data={"username": "ext-login@example.com", "password": "anything-at-all"},
+    )
+    assert resp.status_code == 400
+    assert resp.json()["detail"] == "LOGIN_BAD_CREDENTIALS"
+
+
+@pytest.mark.anyio
+async def test_external_user_cannot_bearer_token_login(users_app, anon_client, users_db):
+    """The bearer-token login path must reject external users cleanly (401),
+    not 500 on a None-hash verify, and without a timing/error enumeration leak."""
+    await _seed_external_user(users_db, "ext-token@example.com")
+
+    resp = await anon_client.post(
+        "/api/users/auth/token",
+        json={"email": "ext-token@example.com", "password": "anything-at-all"},
+    )
+    assert resp.status_code == 401
+    assert resp.json()["detail"] == "Invalid credentials"
+
+
+@pytest.mark.anyio
+async def test_admin_reset_link_rejected_for_external_user(admin_client, users_db):
+    user = await _seed_external_user(users_db, "ext-reset@example.com")
+
+    resp = await admin_client.post(f"/api/users/admin/{user.id}/reset-password-link")
+    assert resp.status_code == 409
+
+
+@pytest.mark.anyio
+async def test_forgot_password_is_noop_for_external_user(users_app):
+    from users.db_adapter import UserDatabaseWithRoles
+    from users.manager import UserManager
+    from users.models import OAuthAccount
+
+    async with users_app.state.sm.db.session_factory() as session:
+        user_db = UserDatabaseWithRoles(session, User, OAuthAccount)
+        manager = UserManager(user_db, users_app.state.users.mailer, users_app.state.users.settings)
+
+        sent: list[str] = []
+
+        async def _spy(user, token, request=None):
+            sent.append(user.email)
+
+        manager.on_after_forgot_password = _spy
+
+        external = User(
+            id=uuid.uuid4(),
+            email="ext-forgot@example.com",
+            hashed_password=None,
+            is_active=True,
+            is_verified=True,
+            is_external=True,
+        )
+        local = User(
+            id=uuid.uuid4(),
+            email="local-forgot@example.com",
+            hashed_password=_pw.hash("SecurePass1!"),
+            is_active=True,
+            is_verified=True,
+        )
+
+        await manager.forgot_password(external)
+        assert sent == []  # SSO account: no reset email
+
+        await manager.forgot_password(local)
+        assert sent == ["local-forgot@example.com"]  # control: local account still works
+
+
+# ---------------------------------------------------------------------------
+# Roles + admin visibility (external users are managed like normal users)
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.anyio
+async def test_admin_can_assign_role_to_external_user(admin_client, users_db):
+    user = await _seed_external_user(users_db, "ext-role@example.com")
+    users_db.add(Role(id=uuid.uuid4(), name="member", description="Member"))
+    await users_db.commit()
+
+    resp = await admin_client.put(
+        f"/api/users/admin/{user.id}/roles",
+        json={"role_names": ["member"]},
+    )
+    assert resp.status_code == 200
+    assert "member" in resp.json()["roles"]
+
+
+@pytest.mark.anyio
+async def test_admin_list_exposes_is_external(admin_client, users_db):
+    await _seed_external_user(users_db, "ext-list@example.com")
+
+    resp = await admin_client.get("/api/users/admin?per_page=100")
+    assert resp.status_code == 200
+    rows = {r["email"]: r for r in resp.json()}
+    assert rows["ext-list@example.com"]["is_external"] is True
+    # The seeded admin is a local account.
+    assert rows["admin@example.com"]["is_external"] is False

{simple_module_users-0.0.20 → simple_module_users-0.0.22}/tests/test_mailer.py

@@ -78,3 +78,53 @@ async def test_base_url_trailing_slash_stripped(caplog):
     link = caplog.records[0].link  # type: ignore[attr-defined]
     assert not link.startswith("http://localhost:8000//")
     assert link == "http://localhost:8000/users/verify?token=tok"
+
+
+@pytest.mark.anyio
+async def test_console_logs_configured_app_name(caplog):
+    """A supplied provider brands the console log; otherwise the default."""
+    from users.mailer.console import ConsoleMailer
+
+    branded = ConsoleMailer(base_url="http://localhost:8000", app_name_provider=lambda: "Acme")
+    default = ConsoleMailer(base_url="http://localhost:8000")
+
+    with caplog.at_level(logging.INFO, logger="users.mailer"):
+        await branded.send_invite("a@b.com", "tok", "Alice")
+        await default.send_verification("a@b.com", "tok")
+
+    assert caplog.records[0].app_name == "Acme"  # type: ignore[attr-defined]
+    assert caplog.records[1].app_name == "SimpleModule"  # type: ignore[attr-defined]
+
+
+@pytest.mark.anyio
+async def test_smtp_emails_carry_the_app_name(monkeypatch):
+    """SMTP subjects + bodies include the live app name (and keep the link)."""
+    from users.mailer.smtp import SmtpMailer
+
+    captured: list[dict[str, str]] = []
+
+    async def fake_send(self, to: str, subject: str, body: str) -> None:
+        captured.append({"to": to, "subject": subject, "body": body})
+
+    monkeypatch.setattr(SmtpMailer, "_send", fake_send)
+    mailer = SmtpMailer(
+        host="smtp.test",
+        port=25,
+        username="",
+        password="",
+        from_address="from@test",
+        use_tls=False,
+        base_url="http://localhost:8000",
+        app_name_provider=lambda: "Acme",
+    )
+
+    await mailer.send_invite("new@x.com", "tok", "Alice")
+    await mailer.send_verification("v@x.com", "vtok")
+    await mailer.send_password_reset("r@x.com", "rtok")
+
+    invite, verify, reset = captured
+    assert "Acme" in invite["subject"] and "Alice" in invite["subject"]
+    assert "Acme" in invite["body"]
+    assert "http://localhost:8000/users/invite/accept?token=tok" in invite["body"]
+    assert "Acme" in verify["subject"] and "Acme" in verify["body"]
+    assert "Acme" in reset["subject"] and "Acme" in reset["body"]

{simple_module_users-0.0.20 → simple_module_users-0.0.22}/users/admin/api.py

@@ -28,7 +28,11 @@ from users.contracts.schemas import (
     UserListItem,
 )
 from users.deps import get_event_bus, get_mailer, get_user_service
-from users.exceptions import EmailAlreadyExistsError, UserNotFoundError
+from users.exceptions import (
+    EmailAlreadyExistsError,
+    ExternalUserNoPasswordError,
+    UserNotFoundError,
+)
 
 admin_router = APIRouter(
     prefix="/admin",
@@ -243,4 +247,9 @@ async def admin_reset_password_link(
         link = await service.generate_reset_link(user_id, base_url)
     except UserNotFoundError:
         raise HTTPException(status_code=404, detail="User not found") from None
+    except ExternalUserNoPasswordError:
+        raise HTTPException(
+            status_code=409,
+            detail="External (SSO) users have no password to reset",
+        ) from None
     return PasswordResetLink(link=link)

{simple_module_users-0.0.20 → simple_module_users-0.0.22}/users/admin/components/UserRow.tsx

@@ -10,6 +10,7 @@ export interface UserListItem {
   full_name: string | null;
   is_active: boolean;
   is_verified: boolean;
+  is_external: boolean;
   last_login_at: string | null;
   created_at: string | null;
   roles: string[];
@@ -63,7 +64,14 @@ export function UserRow({ user }: { user: UserListItem }) {
         {user.roles.length > 0 ? user.roles.join(', ') : '—'}
       </TableCell>
       <TableCell className="hidden sm:table-cell">
-        <StatusBadge user={user} />
+        <div className="flex items-center gap-1.5">
+          <StatusBadge user={user} />
+          {user.is_external && (
+            <Badge variant="outline" className="border-violet-200 bg-violet-50 text-violet-700">
+              SSO
+            </Badge>
+          )}
+        </div>
       </TableCell>
       <TableCell className="hidden lg:table-cell text-sm text-muted-foreground">
         {user.last_login_at ? new Date(user.last_login_at).toLocaleDateString() : '—'}

{simple_module_users-0.0.20 → simple_module_users-0.0.22}/users/admin/queries.py

@@ -40,6 +40,7 @@ class _UserServiceBase:
             full_name=user.full_name,
             is_active=user.is_active,
             is_verified=user.is_verified,
+            is_external=user.is_external,
             disabled_at=user.disabled_at,
             last_login_at=user.last_login_at,
             created_at=user.created_at,
@@ -103,6 +104,7 @@ class _UserServiceBase:
             User.full_name,
             User.is_active,
             User.is_verified,
+            User.is_external,
             User.disabled_at,
             User.last_login_at,
             User.created_at,

{simple_module_users-0.0.20 → simple_module_users-0.0.22}/users/admin/service.py

@@ -11,7 +11,11 @@ from sqlalchemy.orm import noload
 
 from users.admin.queries import _UserServiceBase
 from users.contracts.schemas import UserCreate
-from users.exceptions import EmailAlreadyExistsError, UserNotFoundError
+from users.exceptions import (
+    EmailAlreadyExistsError,
+    ExternalUserNoPasswordError,
+    UserNotFoundError,
+)
 from users.models import OAuthAccount, RefreshToken, User, UserAccessToken, UserRole
 
 
@@ -205,8 +209,15 @@ class UserService(_UserServiceBase):
         return user
 
     async def generate_reset_link(self, user_id: uuid.UUID, base_url: str) -> str:
-        """Build an admin-copyable password-reset URL. No email side-effect."""
+        """Build an admin-copyable password-reset URL. No email side-effect.
+
+        Raises ``ExternalUserNoPasswordError`` for SSO users — they have no
+        local password, so a reset link is meaningless (and would crash on the
+        null-hash fingerprint).
+        """
         user = await self._require_user(user_id)
+        if user.is_external:
+            raise ExternalUserNoPasswordError(user_id)
 
         token = await self._manager.generate_reset_password_token(user)
         return f"{base_url.rstrip('/')}/users/reset-password?token={token}"

{simple_module_users-0.0.20 → simple_module_users-0.0.22}/users/auth_local/token_api.py

@@ -62,7 +62,17 @@ async def token_login(
 
     stmt = select(User).where(User.email == body.email)
     user = (await db.execute(stmt)).scalar_one_or_none()
-    if user is None or not user.is_active or user.disabled_at is not None:
+    if (
+        user is None
+        or not user.is_active
+        or user.disabled_at is not None
+        # External (SSO) users have ``hashed_password is None`` — there's no
+        # local password to verify. Treat them like a missing user: verifying
+        # against a None hash would raise (500) and the instant failure would
+        # leak that the account is SSO-only. The session login is guarded the
+        # same way in ``UserManager.authenticate``.
+        or user.hashed_password is None
+    ):
         # Constant-time: run bcrypt on a dummy hash to prevent timing-based
         # email enumeration (existing user + wrong password takes ~50ms for
         # bcrypt; missing user would be instant without this).

{simple_module_users-0.0.20 → simple_module_users-0.0.22}/users/backend.py

@@ -82,4 +82,4 @@ def reconfigure_cookie_transport(
     transport.cookie_name = settings.cookie_name
     transport.cookie_max_age = settings.cookie_max_age_seconds
     transport.cookie_secure = settings.cookie_secure
-    transport.cookie_samesite = settings.cookie_samesite  # type: ignore[assignment] # ty: ignore[invalid-assignment]
+    transport.cookie_samesite = settings.cookie_samesite  # type: ignore[assignment]

{simple_module_users-0.0.20 → simple_module_users-0.0.22}/users/constants.py

@@ -20,6 +20,12 @@ PERM_USERS_SELF_PROFILE = "users.self.profile"
 # Session keys
 SESSION_USER_ID_KEY = "user_id"
 
+# request.state flag set by the OAuth callback before find-or-create so the
+# manager's on_after_register hook can mark *newly provisioned* OAuth users as
+# external (null password). on_after_register fires only for new users, so the
+# flag is ignored when an OAuth login merely links to an existing account.
+OAUTH_REGISTRATION_REQUEST_FLAG = "users_oauth_registration"
+
 # Admin list-endpoint allowed filter/sort values
 ALLOWED_STATUS = frozenset({"active", "disabled"})
 ALLOWED_VERIFIED = frozenset({"yes", "no"})

{simple_module_users-0.0.20 → simple_module_users-0.0.22}/users/contracts/schemas.py

@@ -25,6 +25,7 @@ class UserRead(CreateUpdateDictModel, SQLModel):
     is_active: bool = True
     is_superuser: bool = False
     is_verified: bool = False
+    is_external: bool = False
     full_name: str | None = None
     tenant_id: str | None = None
     disabled_at: datetime | None = None
@@ -74,6 +75,7 @@ class UserListItem(SQLModel):
     full_name: str | None = None
     is_active: bool
     is_verified: bool
+    is_external: bool = False
     disabled_at: datetime | None = None
     last_login_at: datetime | None = None
     created_at: datetime | None = None

{simple_module_users-0.0.20 → simple_module_users-0.0.22}/users/exceptions.py

@@ -24,3 +24,15 @@ class EmailAlreadyExistsError(Exception):
     def __init__(self, email: str) -> None:
         super().__init__(f"Email {email} already in use")
         self.email = email
+
+
+class ExternalUserNoPasswordError(Exception):
+    """Raised when a password-credential action targets an external (SSO) user.
+
+    External users have no local password, so password reset / set has no
+    meaning for them. Endpoints translate this into a 4xx.
+    """
+
+    def __init__(self, user_id: uuid.UUID) -> None:
+        super().__init__(f"User {user_id} is external (SSO) and has no password")
+        self.user_id = user_id

{simple_module_users-0.0.20 → simple_module_users-0.0.22}/users/mailer/__init__.py

@@ -2,10 +2,22 @@
 
 from __future__ import annotations
 
+from collections.abc import Callable
 from typing import Protocol, runtime_checkable
 
 from users.settings import UsersSettings
 
+#: Returns the live application name (e.g. from the branding module) so emails
+#: are branded with the deployment's name rather than the framework default.
+AppNameProvider = Callable[[], str]
+
+#: Fallback app name when no provider is supplied (e.g. branding not installed).
+DEFAULT_APP_NAME = "SimpleModule"
+
+
+def default_app_name() -> str:
+    return DEFAULT_APP_NAME
+
 
 @runtime_checkable
 class Mailer(Protocol):
@@ -14,7 +26,11 @@ class Mailer(Protocol):
     async def send_invite(self, email: str, token: str, invited_by_name: str) -> None: ...
 
 
-def build_mailer(settings: UsersSettings) -> Mailer:
+def build_mailer(
+    settings: UsersSettings,
+    app_name_provider: AppNameProvider | None = None,
+) -> Mailer:
+    provider = app_name_provider or default_app_name
     if settings.mailer == "smtp":
         from users.mailer.smtp import SmtpMailer
 
@@ -26,8 +42,9 @@ def build_mailer(settings: UsersSettings) -> Mailer:
             from_address=settings.smtp_from,
             use_tls=settings.smtp_tls,
             base_url=settings.base_url,
+            app_name_provider=provider,
         )
 
     from users.mailer.console import ConsoleMailer
 
-    return ConsoleMailer(base_url=settings.base_url)
+    return ConsoleMailer(base_url=settings.base_url, app_name_provider=provider)

simple_module_users-0.0.22/users/mailer/console.py

@@ -0,0 +1,43 @@
+"""Console mailer — logs tokenized links for local development."""
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from users.mailer import AppNameProvider
+
+logger = logging.getLogger("users.mailer")
+
+
+class ConsoleMailer:
+    def __init__(self, base_url: str, app_name_provider: AppNameProvider | None = None) -> None:
+        self._base = base_url.rstrip("/")
+        from users.mailer import default_app_name
+
+        self._app_name = app_name_provider or default_app_name
+
+    async def send_verification(self, email: str, token: str) -> None:
+        link = f"{self._base}/users/verify?token={token}"
+        logger.info(
+            "users.verify.email", extra={"to": email, "link": link, "app_name": self._app_name()}
+        )
+
+    async def send_password_reset(self, email: str, token: str) -> None:
+        link = f"{self._base}/users/reset-password?token={token}"
+        logger.info(
+            "users.reset.email", extra={"to": email, "link": link, "app_name": self._app_name()}
+        )
+
+    async def send_invite(self, email: str, token: str, invited_by_name: str) -> None:
+        link = f"{self._base}/users/invite/accept?token={token}"
+        logger.info(
+            "users.invite.email",
+            extra={
+                "to": email,
+                "link": link,
+                "invited_by": invited_by_name,
+                "app_name": self._app_name(),
+            },
+        )

{simple_module_users-0.0.20 → simple_module_users-0.0.22}/users/mailer/smtp.py

@@ -4,10 +4,14 @@ from __future__ import annotations
 
 import importlib.resources
 from email.message import EmailMessage
+from typing import TYPE_CHECKING
 
 import aiosmtplib
 import jinja2
 
+if TYPE_CHECKING:
+    from users.mailer import AppNameProvider
+
 
 def _load_template_env() -> jinja2.Environment:
     """Build a Jinja2 Environment pointed at the bundled templates directory."""
@@ -33,6 +37,7 @@ class SmtpMailer:
         from_address: str,
         use_tls: bool,
         base_url: str,
+        app_name_provider: AppNameProvider | None = None,
     ) -> None:
         self._host = host
         self._port = port
@@ -41,24 +46,30 @@ class SmtpMailer:
         self._from = from_address
         self._use_tls = use_tls
         self._base = base_url.rstrip("/")
+        from users.mailer import default_app_name
+
+        self._app_name = app_name_provider or default_app_name
 
     async def send_verification(self, email: str, token: str) -> None:
+        app = self._app_name()
         link = f"{self._base}/users/verify?token={token}"
         template = _template_env.get_template("verify_email.txt")
-        body = template.render(link=link)
-        await self._send(email, "Verify your email address", body)
+        body = template.render(link=link, app_name=app)
+        await self._send(email, f"Verify your email for {app}", body)
 
     async def send_password_reset(self, email: str, token: str) -> None:
+        app = self._app_name()
         link = f"{self._base}/users/reset-password?token={token}"
         template = _template_env.get_template("reset_password.txt")
-        body = template.render(link=link)
-        await self._send(email, "Reset your password", body)
+        body = template.render(link=link, app_name=app)
+        await self._send(email, f"Reset your {app} password", body)
 
     async def send_invite(self, email: str, token: str, invited_by_name: str) -> None:
+        app = self._app_name()
         link = f"{self._base}/users/invite/accept?token={token}"
         template = _template_env.get_template("invite.txt")
-        body = template.render(link=link, invited_by_name=invited_by_name)
-        await self._send(email, f"You've been invited by {invited_by_name}", body)
+        body = template.render(link=link, invited_by_name=invited_by_name, app_name=app)
+        await self._send(email, f"{invited_by_name} invited you to {app}", body)
 
     async def _send(self, to: str, subject: str, body: str) -> None:
         message = EmailMessage()

simple_module_users-0.0.22/users/mailer/templates/invite.txt

@@ -0,0 +1,7 @@
+{{ invited_by_name }} invited you to join {{ app_name }}.
+
+Accept the invitation: {{ link }}
+
+If you weren't expecting this, you can safely ignore this email.
+
+— The {{ app_name }} team

simple_module_users-0.0.22/users/mailer/templates/reset_password.txt

@@ -0,0 +1,7 @@
+We received a request to reset your {{ app_name }} password.
+
+Reset it here: {{ link }}
+
+If you didn't request this, you can safely ignore this email — your password won't change.
+
+— The {{ app_name }} team