simple-module-users 0.0.32__tar.gz → 0.0.33__tar.gz

{simple_module_users-0.0.32 → simple_module_users-0.0.33}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_users
-Version: 0.0.32
+Version: 0.0.33
 Summary: Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -24,11 +24,11 @@ Requires-Python: >=3.12
 Requires-Dist: aiosmtplib>=3.0
 Requires-Dist: cachetools>=5.3
 Requires-Dist: fastapi-users[oauth,sqlalchemy]<16,>=15
-Requires-Dist: simple-module-auth==0.0.32
-Requires-Dist: simple-module-core==0.0.32
-Requires-Dist: simple-module-db==0.0.32
-Requires-Dist: simple-module-hosting==0.0.32
-Requires-Dist: simple-module-settings==0.0.32
+Requires-Dist: simple-module-auth==0.0.33
+Requires-Dist: simple-module-core==0.0.33
+Requires-Dist: simple-module-db==0.0.33
+Requires-Dist: simple-module-hosting==0.0.33
+Requires-Dist: simple-module-settings==0.0.33
 Requires-Dist: typer>=0.12
 Description-Content-Type: text/markdown
 

{simple_module_users-0.0.32 → simple_module_users-0.0.33}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_users"
-version = "0.0.32"
+version = "0.0.33"
 description = "Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps"
 readme = "README.md"
 license = "MIT"
@@ -21,11 +21,11 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "simple_module_core==0.0.32",
-    "simple_module_db==0.0.32",
-    "simple_module_hosting==0.0.32",
-    "simple_module_settings==0.0.32",
-    "simple_module_auth==0.0.32",
+    "simple_module_core==0.0.33",
+    "simple_module_db==0.0.33",
+    "simple_module_hosting==0.0.33",
+    "simple_module_settings==0.0.33",
+    "simple_module_auth==0.0.33",
     # Pinned to a narrow range: `deps.py` relies on mutating CookieTransport
     # fields after construction (see reconfigure_cookie_transport in backend.py).
     # Bumping the major version requires re-checking those field names.

simple_module_users-0.0.33/tests/_users_app_builders.py

@@ -0,0 +1,163 @@
+"""App-construction helpers for the users test fixtures.
+
+Split out of ``conftest.py`` so that file holds fixtures and this one holds
+the machinery they call: schema creation, seed data, and the ``create_app``
+wiring. Not named ``test_*`` so pytest does not collect it.
+"""
+
+from __future__ import annotations
+
+from simple_module_hosting.settings import Settings
+from users.constants import ADMIN_ROLE_ID, USER_ROLE_ID
+
+# ---------------------------------------------------------------------------
+
+
+def _users_overrides(allow_signup: bool = False) -> dict[str, tuple[str, str]]:
+    """Values seeded into the ``SettingsStore`` before the app lifespan runs."""
+    return {
+        "allow_signup": (str(allow_signup).lower(), "bool"),
+        "mailer": ("console", "string"),
+        "base_url": ("http://testserver", "string"),
+        "cookie_secure": ("false", "bool"),
+        # 32+ bytes to clear pyjwt's InsecureKeyLengthWarning for HMAC-SHA256.
+        "reset_password_token_secret": ("test-reset-secret-32-bytes-xxxxx", "string"),
+        "verification_token_secret": ("test-verify-secret-32-bytes-xxxxx", "string"),
+        "login_rate_limit_failures": ("5", "int"),
+        "login_rate_limit_window_seconds": ("300", "int"),
+        "login_rate_limit_cooldown_seconds": ("900", "int"),
+    }
+
+
+# ---------------------------------------------------------------------------
+# Full-app fixture
+# ---------------------------------------------------------------------------
+
+
+async def _setup_app_db(application) -> None:
+    """Create all tables and stamp alembic version so migration check passes."""
+
+    from simple_module_db.base import all_module_bases
+    from simple_module_hosting.migrations import resolve_head_revisions
+    from sqlalchemy import text
+
+    # Plural: each module's first migration sets its own branch_labels, so a
+    # real upgraded database carries one alembic_version row per branch.
+    # Stamping only one leaves the others looking un-applied, which reads as a
+    # behind-head schema and puts every app built here behind the setup gate.
+    heads = resolve_head_revisions()
+
+    async with application.state.sm.db.engine.begin() as conn:
+
+        def _create(sync_conn):
+            for base in all_module_bases:
+                base.metadata.create_all(sync_conn)
+
+        await conn.run_sync(_create)
+
+        if heads:
+            await conn.execute(
+                text(
+                    "CREATE TABLE IF NOT EXISTS alembic_version "
+                    "(version_num VARCHAR(32) NOT NULL PRIMARY KEY)"
+                )
+            )
+            await conn.execute(text("DELETE FROM alembic_version"))
+            for head in heads:
+                await conn.execute(
+                    text("INSERT INTO alembic_version (version_num) VALUES (:v)"),
+                    {"v": head},
+                )
+
+
+async def _seed_roles(application) -> None:
+    """Insert admin/user Role rows with deterministic UUIDs if missing."""
+    from sqlalchemy import select
+    from users.models import Role
+
+    async with application.state.sm.db.session_factory() as session:
+        existing = set((await session.execute(select(Role.name))).scalars().all())
+        if "admin" not in existing:
+            session.add(Role(id=ADMIN_ROLE_ID, name="admin", description="Administrator"))
+        if "user" not in existing:
+            session.add(Role(id=USER_ROLE_ID, name="user", description="Standard user"))
+        await session.commit()
+
+
+async def _seed_users_settings(application, *, allow_signup: bool) -> None:
+    """Write the test UsersSettings overrides to the DB before hydrate runs.
+
+    Hydrate fires inside the lifespan ``__aenter__``, so this needs to land
+    between table creation and lifespan entry.
+    """
+    from settings.service import SettingService
+    from settings.store import SettingsStore
+
+    async with application.state.sm.db.session_factory() as session:
+        store = SettingsStore(SettingService(session))
+        for field, (raw, vtype) in _users_overrides(allow_signup=allow_signup).items():
+            await store.set_override("users", field, raw, vtype)
+        await session.commit()
+
+
+async def _make_admin_user(app):
+    """Seed an admin User + Role into app's DB and return the User row."""
+    from users.bootstrap import create_admin
+    from users.models import User
+
+    async with app.state.sm.db.session_factory() as session:
+        result = await create_admin(
+            session,
+            email="admin@example.com",
+            password="AdminPass1!",
+            full_name="Test Admin",
+        )
+    user: User = result.user
+    return user
+
+
+async def _make_standard_user(app, email: str = "user@example.com"):
+    """Seed a non-admin User with the standard ``user`` role.
+
+    Used by the negative-authz tests to confirm endpoints protected by
+    ``RequiresPermission(...)`` reject authenticated-but-non-admin callers.
+    """
+    from users.bootstrap import create_standard_user
+    from users.models import User
+
+    async with app.state.sm.db.session_factory() as session:
+        result = await create_standard_user(
+            session,
+            email=email,
+            password="UserPass1!",
+            full_name="Regular User",
+        )
+    user: User = result.user
+    return user
+
+
+async def _build_users_app(monkeypatch, *, allow_signup: bool, seed_admin: bool = True):
+    """Build a test FastAPI app with DB created, settings seeded, lifespan started."""
+    from simple_module_hosting.app_builder import create_app
+
+    settings = Settings(
+        database_url="sqlite+aiosqlite:///:memory:",
+        environment="testing",
+        secret_key="test-secret-key",
+        multi_tenant=False,
+    )
+    application = create_app(settings)
+    await _setup_app_db(application)
+    await _seed_users_settings(application, allow_signup=allow_signup)
+
+    ctx = application.router.lifespan_context(application)
+    await ctx.__aenter__()
+    await _seed_roles(application)
+    # SetupMiddleware redirects everything to /setup until an administrator
+    # exists. These tests assert on ordinary pages, not on first-run setup, so
+    # the app has to model a configured install. Reuses the same admin
+    # admin_client seeds — create_admin is idempotent, so that fixture's own
+    # call still resolves the id without creating a second account.
+    if seed_admin:
+        await _make_admin_user(application)
+    return application, ctx

simple_module_users-0.0.33/tests/conftest.py

@@ -0,0 +1,165 @@
+"""Shared fixtures for users module API tests.
+
+The ``users_app`` fixture builds a full FastAPI app via ``create_app`` but
+with an in-memory SQLite database, seeded roles, and test-friendly settings
+(ConsoleMailer, signup disabled by default, short secrets).
+
+The ``anon_client`` gives a plain httpx client.
+The ``admin_client`` gives a client with a signed local-user session cookie
+carrying a real admin User row (written into the in-memory DB).
+"""
+
+from __future__ import annotations
+
+import os
+from collections.abc import AsyncGenerator
+
+import httpx
+import pytest
+
+# Bare import, not relative: tests/ has no __init__.py, so these are
+# top-level modules on pytest's sys.path — same mechanism as the
+# _middleware_support plugin loaded at the bottom of this file.
+from _users_app_builders import (
+    _build_users_app,
+    _make_admin_user,
+    _make_standard_user,
+)
+from simple_module_test import forge_session_cookie
+from sqlalchemy.ext.asyncio import AsyncSession
+
+
+@pytest.fixture(autouse=True)
+def _isolate_users_env(monkeypatch):
+    """Scrub stale ``SM_USERS_*`` env vars from the shell/.env.
+
+    After the env→DB migration ``UsersSettings()`` no longer reads these
+    values, so this is belt-and-braces: it keeps old shell exports from
+    muddying any ``SM_ENVIRONMENT`` checks or from being misread during
+    developer spelunking. Also stubs out
+    ``users.bootstrap._read_dotenv_bootstrap_vars`` so the developer's local
+    ``.env`` can't seed bootstrap creds into tests that exercise the resolver.
+    """
+    from users import bootstrap as bootstrap_module
+
+    for key in list(os.environ):
+        if key.startswith("SM_USERS_"):
+            monkeypatch.delenv(key, raising=False)
+    monkeypatch.setattr(bootstrap_module, "_read_dotenv_bootstrap_vars", dict)
+
+
+# ---------------------------------------------------------------------------
+# Settings helpers
+
+
+@pytest.fixture
+async def users_app(monkeypatch):
+    """Full FastAPI app with in-memory DB, seeded roles, users module active."""
+    application, ctx = await _build_users_app(monkeypatch, allow_signup=False)
+    yield application
+    await ctx.__aexit__(None, None, None)
+
+
+@pytest.fixture
+async def users_app_empty(monkeypatch):
+    """``users_app`` with no seeded administrator, so the users table starts empty.
+
+    For DB-level tests that assert on absolute user counts or on behaviour
+    when no account exists yet — bootstrap-from-env, user listing. They reach
+    the app only through ``session_factory`` and never issue HTTP requests, so
+    the first-run setup gate never applies to them.
+    """
+    application, ctx = await _build_users_app(monkeypatch, allow_signup=False, seed_admin=False)
+    yield application
+    await ctx.__aexit__(None, None, None)
+
+
+@pytest.fixture
+async def users_app_signup(monkeypatch):
+    """Like users_app but with allow_signup=True."""
+    application, ctx = await _build_users_app(monkeypatch, allow_signup=True)
+    yield application
+    await ctx.__aexit__(None, None, None)
+
+
+# ---------------------------------------------------------------------------
+# Client fixtures
+# ---------------------------------------------------------------------------
+
+
+@pytest.fixture
+async def anon_client(users_app) -> AsyncGenerator[httpx.AsyncClient, None]:
+    """Unauthenticated client against users_app."""
+    transport = httpx.ASGITransport(app=users_app)
+    async with httpx.AsyncClient(
+        transport=transport,
+        base_url="http://testserver",
+    ) as c:
+        yield c
+
+
+@pytest.fixture
+async def anon_client_signup(users_app_signup) -> AsyncGenerator[httpx.AsyncClient, None]:
+    """Unauthenticated client against users_app_signup (signup enabled)."""
+    transport = httpx.ASGITransport(app=users_app_signup)
+    async with httpx.AsyncClient(
+        transport=transport,
+        base_url="http://testserver",
+    ) as c:
+        yield c
+
+
+@pytest.fixture
+async def admin_client(users_app) -> AsyncGenerator[httpx.AsyncClient, None]:
+    """Client with a signed local-user session cookie (admin role)."""
+    user = await _make_admin_user(users_app)
+    cookie = forge_session_cookie(
+        str(users_app.state.sm.settings.secret_key),
+        {"user_id": str(user.id)},
+    )
+    transport = httpx.ASGITransport(app=users_app)
+    async with httpx.AsyncClient(
+        transport=transport,
+        base_url="http://testserver",
+        cookies={"session": cookie},
+    ) as c:
+        yield c
+
+
+@pytest.fixture
+async def user_client(users_app) -> AsyncGenerator[httpx.AsyncClient, None]:
+    """Client with a signed session cookie for an authenticated non-admin user.
+
+    Counterpart to ``admin_client`` — every endpoint behind
+    ``RequiresPermission(...)`` should answer with 403 for this caller, since
+    the default role map only grants the wildcard to ``admin``.
+    """
+    user = await _make_standard_user(users_app)
+    cookie = forge_session_cookie(
+        str(users_app.state.sm.settings.secret_key),
+        {"user_id": str(user.id)},
+    )
+    transport = httpx.ASGITransport(app=users_app)
+    async with httpx.AsyncClient(
+        transport=transport,
+        base_url="http://testserver",
+        cookies={"session": cookie},
+    ) as c:
+        yield c
+
+
+# ---------------------------------------------------------------------------
+# DB session fixture scoped to users_app
+# ---------------------------------------------------------------------------
+
+
+@pytest.fixture
+async def users_db(users_app) -> AsyncGenerator[AsyncSession, None]:
+    """Session against the users_app in-memory DB."""
+    async with users_app.state.sm.db.session_factory() as session:
+        yield session
+
+
+# Fixtures consumed by the users.middleware unit tests live in
+# _middleware_support.py (imported as a pytest plugin below).
+pytest_plugins = ["_middleware_support"]

simple_module_users-0.0.33/tests/test_admin_resend_invite.py

@@ -0,0 +1,224 @@
+"""Resending an invite from the users table.
+
+An invite that never arrived is the most common reason a row sits in the
+"invited" state forever, and until now the only cure was deleting the account
+and inviting again. Resending has to mint a *fresh* token and move
+``invited_at`` forward, or the row would keep advertising the expiry of the
+message nobody received.
+"""
+
+from __future__ import annotations
+
+import logging
+from datetime import UTC, datetime, timedelta
+
+import pytest
+
+_INVITE = "/api/users/admin/invite"
+
+
+async def _invite(client, email: str) -> str:
+    resp = await client.post(_INVITE, json={"email": email, "role_names": []})
+    assert resp.status_code == 201, resp.text
+    return resp.json()["id"]
+
+
+async def _set_invited_at(users_db, user_id: str, when: datetime) -> None:
+    import uuid
+
+    from sqlalchemy import update
+    from users.models import User
+
+    await users_db.execute(
+        update(User).where(User.id == uuid.UUID(user_id)).values(invited_at=when)
+    )
+    await users_db.commit()
+
+
+class _SpyMailer:
+    """A mailer that reports itself as delivering, and records the send.
+
+    Implements the whole protocol: creating and re-inviting go through
+    ``on_after_register``/verification paths that call the other two methods.
+    """
+
+    delivers_email = True
+
+    def __init__(self) -> None:
+        self.invites: list[tuple[str, str]] = []
+
+    async def send_verification(self, email: str, token: str) -> None:
+        pass
+
+    async def send_password_reset(self, email: str, token: str) -> None:
+        pass
+
+    async def send_invite(
+        self, email: str, token: str, invited_by_name: str, message: str | None = None
+    ) -> None:
+        self.invites.append((email, token))
+
+
+@pytest.fixture
+def spy_mailer(users_app):
+    original = users_app.state.users.mailer
+    spy = _SpyMailer()
+    users_app.state.users.mailer = spy
+    yield spy
+    users_app.state.users.mailer = original
+
+
+class TestResendInvite:
+    @pytest.mark.anyio
+    async def test_resend_accepts_and_mails_again(self, admin_client, spy_mailer):
+        user_id = await _invite(admin_client, "again@example.com")
+
+        resp = await admin_client.post(f"/api/users/admin/{user_id}/resend-invite")
+
+        assert resp.status_code == 202, resp.text
+        assert resp.json()["status"] == "sent"
+        assert [email for email, _ in spy_mailer.invites] == [
+            "again@example.com",
+            "again@example.com",
+        ]
+        assert spy_mailer.invites[-1][1]
+
+    @pytest.mark.anyio
+    async def test_resend_refreshes_invited_at(self, admin_client, users_db):
+        user_id = await _invite(admin_client, "stale@example.com")
+        old = datetime.now(UTC) - timedelta(days=6)
+        await _set_invited_at(users_db, user_id, old)
+
+        resp = await admin_client.post(f"/api/users/admin/{user_id}/resend-invite")
+        assert resp.status_code == 202, resp.text
+
+        rows = await admin_client.get(
+            "/admin/users/", headers={"X-Inertia": "true", "Accept": "application/json"}
+        )
+        row = next(u for u in rows.json()["props"]["users"] if u["email"] == "stale@example.com")
+        # SQLite hands back naive datetimes for a tz-aware column, Postgres
+        # aware ones — compare on the wall clock either way.
+        refreshed = datetime.fromisoformat(row["invited_at"]).replace(tzinfo=None)
+        assert refreshed > old.replace(tzinfo=None)
+
+    @pytest.mark.anyio
+    async def test_resend_hands_back_a_link_when_mail_cannot_be_delivered(self, admin_client):
+        """The console mailer delivers nothing, so the admin needs the URL."""
+        user_id = await _invite(admin_client, "console@example.com")
+        resp = await admin_client.post(f"/api/users/admin/{user_id}/resend-invite")
+        assert resp.status_code == 202, resp.text
+        body = resp.json()
+        assert body["status"] == "link"
+        assert "/users/invite/accept?token=" in (body["link"] or "")
+
+    @pytest.mark.anyio
+    async def test_resend_refuses_for_an_already_verified_account(self, admin_client, users_db):
+        from test_api_admin import _make_user
+
+        user = await _make_user(users_db, email="settled@example.com", verified=True)
+        resp = await admin_client.post(f"/api/users/admin/{user.id}/resend-invite")
+        assert resp.status_code == 409, resp.text
+        assert "already accepted" in resp.json()["detail"]
+
+    @pytest.mark.anyio
+    async def test_resend_refuses_for_a_self_signup(self, admin_client, users_db):
+        """Nobody invited them, so there is no invitation to send again."""
+        from test_api_admin import _make_user
+
+        user = await _make_user(users_db, email="walkedin@example.com", verified=False)
+        resp = await admin_client.post(f"/api/users/admin/{user.id}/resend-invite")
+        assert resp.status_code == 409, resp.text
+        assert "signed itself up" in resp.json()["detail"]
+
+    @pytest.mark.anyio
+    async def test_a_refused_resend_leaves_the_state_alone(self, admin_client, users_db):
+        """Refusing must not stamp ``invited_at`` and turn a self-signup into an invite."""
+        from test_api_admin import _make_user
+
+        user = await _make_user(users_db, email="untouched@example.com", verified=False)
+        await admin_client.post(f"/api/users/admin/{user.id}/resend-invite")
+
+        rows = await admin_client.get(
+            "/admin/users/", headers={"X-Inertia": "true", "Accept": "application/json"}
+        )
+        row = next(
+            u for u in rows.json()["props"]["users"] if u["email"] == "untouched@example.com"
+        )
+        assert row["state"] == "unverified"
+        assert row["invited_at"] is None
+
+    @pytest.mark.anyio
+    async def test_resend_refuses_for_a_disabled_account(self, admin_client):
+        """A live invite token would let a disabled account back in."""
+        user_id = await _invite(admin_client, "shutout@example.com")
+        assert (await admin_client.patch(f"/api/users/admin/{user_id}/disable")).status_code == 200
+
+        resp = await admin_client.post(f"/api/users/admin/{user_id}/resend-invite")
+        assert resp.status_code == 409, resp.text
+        assert "disabled" in resp.json()["detail"]
+
+    @pytest.mark.anyio
+    async def test_resend_404s_for_an_unknown_user(self, admin_client):
+        resp = await admin_client.post(
+            "/api/users/admin/00000000-0000-0000-0000-0000000000ff/resend-invite"
+        )
+        assert resp.status_code == 404
+
+    @pytest.mark.anyio
+    async def test_resend_requires_the_manage_permission(self, user_client):
+        resp = await user_client.post(
+            "/api/users/admin/00000000-0000-0000-0000-0000000000ff/resend-invite"
+        )
+        assert resp.status_code == 403
+
+
+class TestInviteTokenClaims:
+    @pytest.mark.anyio
+    async def test_invite_token_names_the_inviter(self, admin_client, users_app, caplog):
+        """The accept-invite card says who invited you; the claim carries it."""
+        import jwt
+
+        with caplog.at_level(logging.INFO, logger="users.mailer"):
+            await _invite(admin_client, "whosent@example.com")
+        link = next(r for r in caplog.records if r.getMessage() == "users.invite.email").link
+        token = link.split("token=", 1)[1]
+
+        payload = jwt.decode(
+            token,
+            users_app.state.users.settings.verification_token_secret,
+            algorithms=["HS256"],
+            audience="fastapi-users:verify",
+        )
+        assert payload["invited_by"] == "Test Admin"
+        assert "exp" in payload
+
+
+class TestMailerFailureIsNotEchoed:
+    """An SMTP error quotes the host, the port and sometimes the credential."""
+
+    @pytest.mark.anyio
+    async def test_the_admin_gets_the_link_and_a_generic_reason(
+        self, admin_client, users_app, caplog
+    ):
+        from users.admin.bulk_invite import MAILER_FAILURE_DETAIL
+
+        class _BrokenMailer(_SpyMailer):
+            async def send_invite(self, email, token, invited_by_name, message=None):
+                raise RuntimeError("smtp://relay:s3cret@mail.internal:587 refused AUTH")
+
+        user_id = await _invite(admin_client, "broken@example.com")
+        original = users_app.state.users.mailer
+        users_app.state.users.mailer = _BrokenMailer()
+        try:
+            with caplog.at_level(logging.ERROR, logger="users.admin.resend_invite"):
+                resp = await admin_client.post(f"/api/users/admin/{user_id}/resend-invite")
+        finally:
+            users_app.state.users.mailer = original
+
+        assert resp.status_code == 202, resp.text
+        body = resp.json()
+        assert body["status"] == "link"
+        assert body["detail"] == MAILER_FAILURE_DETAIL
+        assert "s3cret" not in resp.text
+        # The real reason is not lost — it is one log line away.
+        assert "s3cret" in caplog.text

{simple_module_users-0.0.32 → simple_module_users-0.0.33}/tests/test_api_auth.py

@@ -148,7 +148,7 @@ class TestAcceptInvite:
         manager = UserManager(user_db, fake_mailer, settings)
         # Reload the user with the manager to get a proper User object
         fetched = await user_db.get_by_email("invited@example.com")
-        token = await manager.generate_verification_token(fetched)
+        token = manager.mint_invite_token(fetched)
 
         resp = await anon_client.post(
             "/api/users/auth/accept-invite",