simple-module-users 0.0.30__tar.gz → 0.0.32__tar.gz

{simple_module_users-0.0.30 → simple_module_users-0.0.32}/.gitignore

@@ -63,3 +63,4 @@ Thumbs.db
 host/client_app/.playwright-cli/*
 .superpowers/
 .qa/
+.verify/

{simple_module_users-0.0.30 → simple_module_users-0.0.32}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: simple_module_users
-Version: 0.0.30
+Version: 0.0.32
 Summary: Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -24,11 +24,11 @@ Requires-Python: >=3.12
 Requires-Dist: aiosmtplib>=3.0
 Requires-Dist: cachetools>=5.3
 Requires-Dist: fastapi-users[oauth,sqlalchemy]<16,>=15
-Requires-Dist: simple-module-auth==0.0.30
-Requires-Dist: simple-module-core==0.0.30
-Requires-Dist: simple-module-db==0.0.30
-Requires-Dist: simple-module-hosting==0.0.30
-Requires-Dist: simple-module-settings==0.0.30
+Requires-Dist: simple-module-auth==0.0.32
+Requires-Dist: simple-module-core==0.0.32
+Requires-Dist: simple-module-db==0.0.32
+Requires-Dist: simple-module-hosting==0.0.32
+Requires-Dist: simple-module-settings==0.0.32
 Requires-Dist: typer>=0.12
 Description-Content-Type: text/markdown
 

{simple_module_users-0.0.30 → simple_module_users-0.0.32}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_users"
-version = "0.0.30"
+version = "0.0.32"
 description = "Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps"
 readme = "README.md"
 license = "MIT"
@@ -21,11 +21,11 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "simple_module_core==0.0.30",
-    "simple_module_db==0.0.30",
-    "simple_module_hosting==0.0.30",
-    "simple_module_settings==0.0.30",
-    "simple_module_auth==0.0.30",
+    "simple_module_core==0.0.32",
+    "simple_module_db==0.0.32",
+    "simple_module_hosting==0.0.32",
+    "simple_module_settings==0.0.32",
+    "simple_module_auth==0.0.32",
     # Pinned to a narrow range: `deps.py` relies on mutating CookieTransport
     # fields after construction (see reconfigure_cookie_transport in backend.py).
     # Bumping the major version requires re-checking those field names.

{simple_module_users-0.0.30 → simple_module_users-0.0.32}/tests/test_api_admin.py

@@ -71,6 +71,17 @@ class TestAdminList:
         assert "alpha@example.com" in emails
         assert "beta@example.com" not in emails
 
+    @pytest.mark.anyio
+    async def test_list_search_matches_like_metacharacters_literally(self, admin_client, users_db):
+        """A literal "_" or "%" in the search must match as text, not wildcard."""
+        await _make_user(users_db, email="dana_x@example.com")
+        await _make_user(users_db, email="danaYx@example.com")
+
+        resp = await admin_client.get("/api/users/admin?q=dana_x")
+        assert resp.status_code == 200
+        emails = [u["email"] for u in resp.json()]
+        assert emails == ["dana_x@example.com"]
+
     @pytest.mark.anyio
     async def test_list_pagination(self, admin_client, users_db):
         for i in range(5):

simple_module_users-0.0.32/tests/test_users_bulk_invite.py

@@ -0,0 +1,229 @@
+"""Bulk invite — many addresses per submit, with per-address outcomes.
+
+The invite form took one address at a time, so onboarding a team meant
+repeating the form once per person. Partial success is the normal case here:
+one already-registered address must not discard the rest.
+"""
+
+from __future__ import annotations
+
+import httpx
+import pytest
+
+_URL = "/api/users/admin/invite/bulk"
+
+
+class TestBulkInvite:
+    async def test_invites_every_address(self, authenticated_client: httpx.AsyncClient):
+        resp = await authenticated_client.post(
+            _URL,
+            json={"emails": ["a@example.com", "b@example.com"], "role_names": []},
+        )
+        assert resp.status_code == 200, resp.text
+        results = resp.json()["results"]
+        assert [r["email"] for r in results] == ["a@example.com", "b@example.com"]
+
+    async def test_duplicate_addresses_are_invited_once(
+        self, authenticated_client: httpx.AsyncClient
+    ):
+        """Pasting a list with a repeat should not mint two invites for it."""
+        resp = await authenticated_client.post(
+            _URL,
+            json={"emails": ["dup@example.com", "DUP@example.com"], "role_names": []},
+        )
+        assert len(resp.json()["results"]) == 1
+
+    async def test_addresses_are_normalised_to_lowercase(
+        self, authenticated_client: httpx.AsyncClient
+    ):
+        resp = await authenticated_client.post(
+            _URL, json={"emails": ["Mixed@Example.com"], "role_names": []}
+        )
+        assert resp.json()["results"][0]["email"] == "mixed@example.com"
+
+    async def test_one_failure_does_not_discard_the_others(
+        self, authenticated_client: httpx.AsyncClient
+    ):
+        """A duplicate in a pasted list of twenty must not lose the other 19."""
+        await authenticated_client.post(
+            _URL, json={"emails": ["taken@example.com"], "role_names": []}
+        )
+        resp = await authenticated_client.post(
+            _URL,
+            json={"emails": ["taken@example.com", "fresh@example.com"], "role_names": []},
+        )
+        assert resp.status_code == 200, resp.text
+        by_email = {r["email"]: r for r in resp.json()["results"]}
+        assert by_email["taken@example.com"]["status"] == "failed"
+        assert by_email["fresh@example.com"]["status"] in ("sent", "link")
+
+    async def test_a_failure_always_carries_a_reason(self, authenticated_client: httpx.AsyncClient):
+        """Every failed row must say why.
+
+        ``str(UserAlreadyExists())`` is empty — the reason lives in the type, not
+        the message — so passing it through rendered an address in red with a
+        blank reason beside it. Asserting the status alone is what let that ship.
+        """
+        await authenticated_client.post(
+            _URL, json={"emails": ["why@example.com"], "role_names": []}
+        )
+        resp = await authenticated_client.post(
+            _URL, json={"emails": ["why@example.com"], "role_names": []}
+        )
+        result = resp.json()["results"][0]
+        assert result["status"] == "failed"
+        assert result["detail"], "a failed address must explain itself"
+        assert "already" in result["detail"].lower()
+
+    async def test_console_mailer_hands_back_a_copyable_link(
+        self, authenticated_client: httpx.AsyncClient
+    ):
+        """The test app uses the console mailer, which delivers nothing — the
+        admin needs the link or the invite is undeliverable."""
+        resp = await authenticated_client.post(
+            _URL, json={"emails": ["linkme@example.com"], "role_names": []}
+        )
+        result = resp.json()["results"][0]
+        assert result["status"] == "link"
+        assert "/users/invite/accept?token=" in result["link"]
+
+    async def test_roles_apply_to_every_address(self, authenticated_client: httpx.AsyncClient):
+        resp = await authenticated_client.post(
+            _URL,
+            json={"emails": ["r1@example.com", "r2@example.com"], "role_names": ["user"]},
+        )
+        assert resp.status_code == 200, resp.text
+        assert all(r["status"] in ("sent", "link") for r in resp.json()["results"])
+
+    async def test_roles_survive_a_later_failure(self, authenticated_client: httpx.AsyncClient):
+        """A failure mid-list must not roll back an earlier invite's roles.
+
+        ``invite`` only flushes its role rows; the rollback that clears failed
+        transaction state used to take them with it, so the person invited just
+        before a duplicate address ended up with none of the chosen roles.
+        """
+        await authenticated_client.post(
+            _URL, json={"emails": ["dupe@example.com"], "role_names": []}
+        )
+        resp = await authenticated_client.post(
+            _URL,
+            json={"emails": ["kept@example.com", "dupe@example.com"], "role_names": ["admin"]},
+        )
+        assert resp.status_code == 200, resp.text
+
+        listing = await authenticated_client.get("/api/users/admin")
+        users = {u["email"]: u for u in listing.json()}
+        assert users["kept@example.com"]["roles"] == ["admin"]
+
+    async def test_a_malformed_address_does_not_reject_the_submit(
+        self, authenticated_client: httpx.AsyncClient
+    ):
+        """A typo in one line of a pasted column used to 422 the whole body,
+        leaving the admin with a generic error and no idea which line."""
+        resp = await authenticated_client.post(
+            _URL,
+            json={"emails": ["good@example.com", "not-an-address"], "role_names": []},
+        )
+        assert resp.status_code == 200, resp.text
+        by_email = {r["email"]: r for r in resp.json()["results"]}
+        assert by_email["good@example.com"]["status"] in ("sent", "link")
+        assert by_email["not-an-address"]["status"] == "failed"
+        assert "valid email" in by_email["not-an-address"]["detail"]
+
+    async def test_empty_list_is_accepted_and_does_nothing(
+        self, authenticated_client: httpx.AsyncClient
+    ):
+        resp = await authenticated_client.post(_URL, json={"emails": [], "role_names": []})
+        assert resp.status_code == 200
+        assert resp.json()["results"] == []
+
+    async def test_address_count_is_capped(self, authenticated_client: httpx.AsyncClient):
+        """One submit must not be able to mint unbounded live invite tokens."""
+        from users.admin.bulk_invite import MAX_ADDRESSES
+
+        emails = [f"bulk{i}@example.com" for i in range(MAX_ADDRESSES + 5)]
+        resp = await authenticated_client.post(_URL, json={"emails": emails, "role_names": []})
+        invited = [r for r in resp.json()["results"] if r["status"] != "failed"]
+        assert len(invited) == MAX_ADDRESSES
+
+    async def test_addresses_over_the_cap_are_reported_not_dropped(
+        self, authenticated_client: httpx.AsyncClient
+    ):
+        """Silent truncation reports "100 invites sent" while 5 people are
+        never contacted, with nothing on screen saying so."""
+        from users.admin.bulk_invite import MAX_ADDRESSES
+
+        emails = [f"over{i}@example.com" for i in range(MAX_ADDRESSES + 5)]
+        resp = await authenticated_client.post(_URL, json={"emails": emails, "role_names": []})
+        results = resp.json()["results"]
+
+        assert len(results) == MAX_ADDRESSES + 5, "every submitted address needs an outcome"
+        overflow = {r["email"]: r for r in results[-5:]}
+        assert set(overflow) == {
+            f"over{i}@example.com" for i in range(MAX_ADDRESSES, MAX_ADDRESSES + 5)
+        }
+        for result in overflow.values():
+            assert result["status"] == "failed"
+            assert "limit" in result["detail"]
+
+    async def test_requires_authentication(self, client: httpx.AsyncClient):
+        resp = await client.post(
+            _URL, json={"emails": ["x@example.com"], "role_names": []}, follow_redirects=False
+        )
+        assert resp.status_code in (302, 401, 403)
+
+
+class TestInvitePreview:
+    async def test_accept_page_names_the_invitee(
+        self, authenticated_client: httpx.AsyncClient, client: httpx.AsyncClient
+    ):
+        """The card asked for a password while identifying nobody."""
+        created = await authenticated_client.post(
+            _URL, json={"emails": ["preview@example.com"], "role_names": []}
+        )
+        link = created.json()["results"][0]["link"]
+        token = link.split("token=")[1]
+
+        resp = await client.get(
+            f"/users/invite/accept?token={token}",
+            headers={"X-Inertia": "true", "Accept": "application/json"},
+        )
+        assert resp.status_code == 200, resp.text
+        invite = resp.json()["props"]["invite"]
+        assert invite["email"] == "preview@example.com"
+        assert invite["already_accepted"] is False
+
+    @pytest.mark.parametrize("token", ["", "not-a-jwt", "a.b.c"])
+    async def test_unreadable_tokens_yield_no_preview(self, client: httpx.AsyncClient, token: str):
+        """Expired, tampered and absent all look the same here on purpose —
+        the reason belongs to the accept attempt, which validates properly."""
+        resp = await client.get(
+            f"/users/invite/accept?token={token}",
+            headers={"X-Inertia": "true", "Accept": "application/json"},
+        )
+        assert resp.status_code == 200
+        assert resp.json()["props"]["invite"] is None
+
+    async def test_preview_does_not_consume_the_invite(
+        self, authenticated_client: httpx.AsyncClient, client: httpx.AsyncClient
+    ):
+        """Viewing the page must leave the token usable — UserManager.verify
+        marks the account verified as a side effect, so the preview cannot
+        route through it."""
+        created = await authenticated_client.post(
+            _URL, json={"emails": ["unspent@example.com"], "role_names": []}
+        )
+        token = created.json()["results"][0]["link"].split("token=")[1]
+
+        for _ in range(2):
+            resp = await client.get(
+                f"/users/invite/accept?token={token}",
+                headers={"X-Inertia": "true", "Accept": "application/json"},
+            )
+            assert resp.json()["props"]["invite"]["already_accepted"] is False
+
+        accepted = await client.post(
+            "/api/users/auth/accept-invite",
+            json={"token": token, "password": "a-good-password-123"},
+        )
+        assert accepted.status_code in (200, 204), accepted.text

simple_module_users-0.0.32/tests/test_users_shared_props.py

@@ -0,0 +1,52 @@
+"""The ``signup`` shared prop drives whether a "Sign up" link is rendered.
+
+``/users/register`` raises 404 when ``allow_signup`` is off, so the public shell
+has to know the answer before it draws the link. Getting the default wrong in
+either direction is a visible bug: too eager and every visitor hits a 404, too
+shy and a genuinely open instance hides its own signup.
+"""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+
+import pytest
+from users.shared_props import users_shared_props
+
+
+def _request(users_state: object) -> SimpleNamespace:
+    """A stand-in carrying only what the provider is allowed to touch."""
+    return SimpleNamespace(app=SimpleNamespace(state=SimpleNamespace(users=users_state)))
+
+
+class TestSignupSharedProp:
+    @pytest.mark.parametrize("allow", [True, False])
+    def test_reflects_the_setting(self, allow: bool) -> None:
+        request = _request(SimpleNamespace(settings=SimpleNamespace(allow_signup=allow)))
+        assert users_shared_props(request) == {"signup": {"allowed": allow}}
+
+    def test_coerces_to_a_real_bool(self) -> None:
+        """The value is serialised straight to JSON, so it must not leak a
+        truthy non-bool into the page props."""
+        request = _request(SimpleNamespace(settings=SimpleNamespace(allow_signup=1)))
+        assert users_shared_props(request)["signup"]["allowed"] is True
+
+    def test_defaults_closed_when_settings_are_missing(self) -> None:
+        request = _request(SimpleNamespace())
+        assert users_shared_props(request) == {"signup": {"allowed": False}}
+
+    def test_defaults_closed_when_module_state_is_absent(self) -> None:
+        """Never raises: the provider runs on every request and a failure here
+        would cost the whole page, not just the link."""
+        request = SimpleNamespace(app=SimpleNamespace(state=SimpleNamespace()))
+        assert users_shared_props(request) == {"signup": {"allowed": False}}
+
+
+class TestProviderIsRegistered:
+    def test_the_built_app_carries_it(self, app) -> None:
+        """Registered during ``register_settings``, so a fully booted app has it
+        in place before the first request is served. Asserted against the real
+        app rather than a bare FastAPI: the registration sits downstream of the
+        settings module, and a stub would pass while the wiring was broken."""
+        providers = getattr(app.state, "inertia_shared_providers", [])
+        assert users_shared_props in providers

{simple_module_users-0.0.30 → simple_module_users-0.0.32}/tests/test_views_admin.py

@@ -59,6 +59,45 @@ class TestAdminIndexFilters:
         assert props["filters"]["sort"] == "email"
         assert props["filters"]["order"] == "asc"
 
+    @pytest.mark.anyio
+    async def test_page_past_the_end_clamps_to_last_page(self, admin_client, users_db):
+        """A stale/hand-edited ?page= beyond the last page must clamp and
+        return the last page's rows, not an empty list with a nonzero total —
+        the same bug class background_tasks and file_storage fix for their
+        own admin listings."""
+        from test_api_admin import _make_user
+
+        await _make_user(users_db, email="clamp-a@x.com")
+        await _make_user(users_db, email="clamp-b@x.com")
+
+        resp = await admin_client.get(
+            "/users/admin?page=999&per_page=1",
+            headers={"X-Inertia": "true", "Accept": "application/json"},
+        )
+        assert resp.status_code == 200
+        props = resp.json()["props"]
+        assert props["users"], "expected the clamped last page to carry rows"
+        assert props["pagination"]["page"] < 999
+        assert props["pagination"]["total"] >= 2
+
+    @pytest.mark.anyio
+    async def test_pagination_prop_echoes_clamped_values(self, admin_client, users_db):
+        """The pagination prop must carry the values the query actually ran
+        with — ?page=0 renders page-1 rows and must not be labelled page 0,
+        and an oversized per_page is bounded to what the service fetched."""
+        from test_api_admin import _make_user
+
+        await _make_user(users_db, email="clamp-c@x.com")
+
+        resp = await admin_client.get(
+            "/users/admin?page=0&per_page=1000",
+            headers={"X-Inertia": "true", "Accept": "application/json"},
+        )
+        assert resp.status_code == 200
+        pagination = resp.json()["props"]["pagination"]
+        assert pagination["page"] == 1
+        assert pagination["per_page"] == 200
+
 
 # ---------------------------------------------------------------------------
 # has_permissions_module flag on admin edit page
@@ -129,23 +168,68 @@ class TestHasPermissionsModuleFlag:
 
 
 # ---------------------------------------------------------------------------
-# Admin create page
+# Admin add-people page (create + invite merged behind a mode switch)
 # ---------------------------------------------------------------------------
 
 
-class TestAdminCreatePage:
+class TestAdminAddPeoplePage:
     @pytest.mark.anyio
-    async def test_create_page_renders_with_roles(self, admin_client):
+    async def test_add_page_renders_with_roles(self, admin_client):
         resp = await admin_client.get(
-            "/users/admin/create",
+            "/users/admin/add",
             headers={"X-Inertia": "true", "Accept": "application/json"},
         )
         assert resp.status_code == 200
         data = resp.json()
-        assert data["component"] == "Users/Users/Create"
+        assert data["component"] == "Users/Users/AddPeople"
         assert "roles" in data["props"]
 
     @pytest.mark.anyio
-    async def test_create_page_requires_auth(self, anon_client):
-        resp = await anon_client.get("/users/admin/create", follow_redirects=False)
+    async def test_add_page_reports_whether_mail_can_be_delivered(self, admin_client):
+        """Drives the copy-link panel — the page has to know before submitting."""
+        resp = await admin_client.get(
+            "/users/admin/add",
+            headers={"X-Inertia": "true", "Accept": "application/json"},
+        )
+        assert "mailer_delivers" in resp.json()["props"]
+
+    @pytest.mark.anyio
+    async def test_no_mailer_does_not_promise_delivery(self, admin_client, app):
+        """With nothing able to send, the page must offer the copy-link panel —
+        claiming delivery is the one answer that is certainly wrong."""
+        original = app.state.users.mailer
+        app.state.users.mailer = None
+        try:
+            resp = await admin_client.get(
+                "/users/admin/add",
+                headers={"X-Inertia": "true", "Accept": "application/json"},
+            )
+            assert resp.json()["props"]["mailer_delivers"] is False
+        finally:
+            app.state.users.mailer = original
+
+    @pytest.mark.anyio
+    async def test_add_page_requires_auth(self, anon_client):
+        resp = await anon_client.get("/users/admin/add", follow_redirects=False)
+        assert resp.status_code == 302
+
+    @pytest.mark.anyio
+    @pytest.mark.parametrize(
+        ("old_path", "mode"),
+        [("/users/admin/create", "create"), ("/users/admin/invite", "invite")],
+    )
+    async def test_old_urls_redirect_into_the_right_mode(self, admin_client, old_path, mode):
+        """Existing links must land on the merged form with their mode preselected."""
+        resp = await admin_client.get(old_path, follow_redirects=False)
+        assert resp.status_code == 307
+        assert resp.headers["location"] == f"/users/admin/add?mode={mode}"
+
+    @pytest.mark.anyio
+    @pytest.mark.parametrize("old_path", ["/users/admin/create", "/users/admin/invite"])
+    async def test_old_urls_require_auth(self, anon_client, old_path):
+        """The legacy aliases must stay gated behind the same permission as
+        the page they redirect to — an anonymous caller must not reach the
+        redirect (and learn the target route exists) before being sent to
+        log in."""
+        resp = await anon_client.get(old_path, follow_redirects=False)
         assert resp.status_code == 302

{simple_module_users-0.0.30 → simple_module_users-0.0.32}/users/admin/api.py

@@ -10,6 +10,7 @@ from fastapi_users import exceptions as fa_exceptions
 from simple_module_core.events import EventBus
 from simple_module_hosting.permissions import RequiresPermission
 
+from users.admin.bulk_invite import bulk_router
 from users.admin.service import UserService
 from users.constants import PERM_USERS_MANAGE, sanitize_list_filters
 from users.contracts.events import (
@@ -40,6 +41,10 @@ admin_router = APIRouter(
     tags=["users-admin"],
 )
 
+# Bulk invite lives in its own module (this file is near the 300-line cap) but
+# mounts here so it inherits the users.manage guard above.
+admin_router.include_router(bulk_router)
+
 
 @admin_router.get("", response_model=list[UserListItem])
 async def admin_list_users(