simple-module-users 0.0.32__tar.gz → 0.0.34__tar.gz

{simple_module_users-0.0.32 → simple_module_users-0.0.34}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_users
-Version: 0.0.32
+Version: 0.0.34
 Summary: Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -24,11 +24,11 @@ Requires-Python: >=3.12
 Requires-Dist: aiosmtplib>=3.0
 Requires-Dist: cachetools>=5.3
 Requires-Dist: fastapi-users[oauth,sqlalchemy]<16,>=15
-Requires-Dist: simple-module-auth==0.0.32
-Requires-Dist: simple-module-core==0.0.32
-Requires-Dist: simple-module-db==0.0.32
-Requires-Dist: simple-module-hosting==0.0.32
-Requires-Dist: simple-module-settings==0.0.32
+Requires-Dist: simple-module-auth==0.0.34
+Requires-Dist: simple-module-core==0.0.34
+Requires-Dist: simple-module-db==0.0.34
+Requires-Dist: simple-module-hosting==0.0.34
+Requires-Dist: simple-module-settings==0.0.34
 Requires-Dist: typer>=0.12
 Description-Content-Type: text/markdown
 

{simple_module_users-0.0.32 → simple_module_users-0.0.34}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_users"
-version = "0.0.32"
+version = "0.0.34"
 description = "Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps"
 readme = "README.md"
 license = "MIT"
@@ -21,11 +21,11 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "simple_module_core==0.0.32",
-    "simple_module_db==0.0.32",
-    "simple_module_hosting==0.0.32",
-    "simple_module_settings==0.0.32",
-    "simple_module_auth==0.0.32",
+    "simple_module_core==0.0.34",
+    "simple_module_db==0.0.34",
+    "simple_module_hosting==0.0.34",
+    "simple_module_settings==0.0.34",
+    "simple_module_auth==0.0.34",
     # Pinned to a narrow range: `deps.py` relies on mutating CookieTransport
     # fields after construction (see reconfigure_cookie_transport in backend.py).
     # Bumping the major version requires re-checking those field names.

simple_module_users-0.0.34/tests/_users_app_builders.py

@@ -0,0 +1,163 @@
+"""App-construction helpers for the users test fixtures.
+
+Split out of ``conftest.py`` so that file holds fixtures and this one holds
+the machinery they call: schema creation, seed data, and the ``create_app``
+wiring. Not named ``test_*`` so pytest does not collect it.
+"""
+
+from __future__ import annotations
+
+from simple_module_hosting.settings import Settings
+from users.constants import ADMIN_ROLE_ID, USER_ROLE_ID
+
+# ---------------------------------------------------------------------------
+
+
+def _users_overrides(allow_signup: bool = False) -> dict[str, tuple[str, str]]:
+    """Values seeded into the ``SettingsStore`` before the app lifespan runs."""
+    return {
+        "allow_signup": (str(allow_signup).lower(), "bool"),
+        "mailer": ("console", "string"),
+        "base_url": ("http://testserver", "string"),
+        "cookie_secure": ("false", "bool"),
+        # 32+ bytes to clear pyjwt's InsecureKeyLengthWarning for HMAC-SHA256.
+        "reset_password_token_secret": ("test-reset-secret-32-bytes-xxxxx", "string"),
+        "verification_token_secret": ("test-verify-secret-32-bytes-xxxxx", "string"),
+        "login_rate_limit_failures": ("5", "int"),
+        "login_rate_limit_window_seconds": ("300", "int"),
+        "login_rate_limit_cooldown_seconds": ("900", "int"),
+    }
+
+
+# ---------------------------------------------------------------------------
+# Full-app fixture
+# ---------------------------------------------------------------------------
+
+
+async def _setup_app_db(application) -> None:
+    """Create all tables and stamp alembic version so migration check passes."""
+
+    from simple_module_db.base import all_module_bases
+    from simple_module_hosting.migrations import resolve_head_revisions
+    from sqlalchemy import text
+
+    # Plural: each module's first migration sets its own branch_labels, so a
+    # real upgraded database carries one alembic_version row per branch.
+    # Stamping only one leaves the others looking un-applied, which reads as a
+    # behind-head schema and puts every app built here behind the setup gate.
+    heads = resolve_head_revisions()
+
+    async with application.state.sm.db.engine.begin() as conn:
+
+        def _create(sync_conn):
+            for base in all_module_bases:
+                base.metadata.create_all(sync_conn)
+
+        await conn.run_sync(_create)
+
+        if heads:
+            await conn.execute(
+                text(
+                    "CREATE TABLE IF NOT EXISTS alembic_version "
+                    "(version_num VARCHAR(32) NOT NULL PRIMARY KEY)"
+                )
+            )
+            await conn.execute(text("DELETE FROM alembic_version"))
+            for head in heads:
+                await conn.execute(
+                    text("INSERT INTO alembic_version (version_num) VALUES (:v)"),
+                    {"v": head},
+                )
+
+
+async def _seed_roles(application) -> None:
+    """Insert admin/user Role rows with deterministic UUIDs if missing."""
+    from sqlalchemy import select
+    from users.models import Role
+
+    async with application.state.sm.db.session_factory() as session:
+        existing = set((await session.execute(select(Role.name))).scalars().all())
+        if "admin" not in existing:
+            session.add(Role(id=ADMIN_ROLE_ID, name="admin", description="Administrator"))
+        if "user" not in existing:
+            session.add(Role(id=USER_ROLE_ID, name="user", description="Standard user"))
+        await session.commit()
+
+
+async def _seed_users_settings(application, *, allow_signup: bool) -> None:
+    """Write the test UsersSettings overrides to the DB before hydrate runs.
+
+    Hydrate fires inside the lifespan ``__aenter__``, so this needs to land
+    between table creation and lifespan entry.
+    """
+    from settings.service import SettingService
+    from settings.store import SettingsStore
+
+    async with application.state.sm.db.session_factory() as session:
+        store = SettingsStore(SettingService(session))
+        for field, (raw, vtype) in _users_overrides(allow_signup=allow_signup).items():
+            await store.set_override("users", field, raw, vtype)
+        await session.commit()
+
+
+async def _make_admin_user(app):
+    """Seed an admin User + Role into app's DB and return the User row."""
+    from users.bootstrap import create_admin
+    from users.models import User
+
+    async with app.state.sm.db.session_factory() as session:
+        result = await create_admin(
+            session,
+            email="admin@example.com",
+            password="AdminPass1!",
+            full_name="Test Admin",
+        )
+    user: User = result.user
+    return user
+
+
+async def _make_standard_user(app, email: str = "user@example.com"):
+    """Seed a non-admin User with the standard ``user`` role.
+
+    Used by the negative-authz tests to confirm endpoints protected by
+    ``RequiresPermission(...)`` reject authenticated-but-non-admin callers.
+    """
+    from users.bootstrap import create_standard_user
+    from users.models import User
+
+    async with app.state.sm.db.session_factory() as session:
+        result = await create_standard_user(
+            session,
+            email=email,
+            password="UserPass1!",
+            full_name="Regular User",
+        )
+    user: User = result.user
+    return user
+
+
+async def _build_users_app(monkeypatch, *, allow_signup: bool, seed_admin: bool = True):
+    """Build a test FastAPI app with DB created, settings seeded, lifespan started."""
+    from simple_module_hosting.app_builder import create_app
+
+    settings = Settings(
+        database_url="sqlite+aiosqlite:///:memory:",
+        environment="testing",
+        secret_key="test-secret-key",
+        multi_tenant=False,
+    )
+    application = create_app(settings)
+    await _setup_app_db(application)
+    await _seed_users_settings(application, allow_signup=allow_signup)
+
+    ctx = application.router.lifespan_context(application)
+    await ctx.__aenter__()
+    await _seed_roles(application)
+    # SetupMiddleware redirects everything to /setup until an administrator
+    # exists. These tests assert on ordinary pages, not on first-run setup, so
+    # the app has to model a configured install. Reuses the same admin
+    # admin_client seeds — create_admin is idempotent, so that fixture's own
+    # call still resolves the id without creating a second account.
+    if seed_admin:
+        await _make_admin_user(application)
+    return application, ctx

simple_module_users-0.0.34/tests/conftest.py

@@ -0,0 +1,165 @@
+"""Shared fixtures for users module API tests.
+
+The ``users_app`` fixture builds a full FastAPI app via ``create_app`` but
+with an in-memory SQLite database, seeded roles, and test-friendly settings
+(ConsoleMailer, signup disabled by default, short secrets).
+
+The ``anon_client`` gives a plain httpx client.
+The ``admin_client`` gives a client with a signed local-user session cookie
+carrying a real admin User row (written into the in-memory DB).
+"""
+
+from __future__ import annotations
+
+import os
+from collections.abc import AsyncGenerator
+
+import httpx
+import pytest
+
+# Bare import, not relative: tests/ has no __init__.py, so these are
+# top-level modules on pytest's sys.path — same mechanism as the
+# _middleware_support plugin loaded at the bottom of this file.
+from _users_app_builders import (
+    _build_users_app,
+    _make_admin_user,
+    _make_standard_user,
+)
+from simple_module_test import forge_session_cookie
+from sqlalchemy.ext.asyncio import AsyncSession
+
+
+@pytest.fixture(autouse=True)
+def _isolate_users_env(monkeypatch):
+    """Scrub stale ``SM_USERS_*`` env vars from the shell/.env.
+
+    After the env→DB migration ``UsersSettings()`` no longer reads these
+    values, so this is belt-and-braces: it keeps old shell exports from
+    muddying any ``SM_ENVIRONMENT`` checks or from being misread during
+    developer spelunking. Also stubs out
+    ``users.bootstrap._read_dotenv_bootstrap_vars`` so the developer's local
+    ``.env`` can't seed bootstrap creds into tests that exercise the resolver.
+    """
+    from users import bootstrap as bootstrap_module
+
+    for key in list(os.environ):
+        if key.startswith("SM_USERS_"):
+            monkeypatch.delenv(key, raising=False)
+    monkeypatch.setattr(bootstrap_module, "_read_dotenv_bootstrap_vars", dict)
+
+
+# ---------------------------------------------------------------------------
+# Settings helpers
+
+
+@pytest.fixture
+async def users_app(monkeypatch):
+    """Full FastAPI app with in-memory DB, seeded roles, users module active."""
+    application, ctx = await _build_users_app(monkeypatch, allow_signup=False)
+    yield application
+    await ctx.__aexit__(None, None, None)
+
+
+@pytest.fixture
+async def users_app_empty(monkeypatch):
+    """``users_app`` with no seeded administrator, so the users table starts empty.
+
+    For DB-level tests that assert on absolute user counts or on behaviour
+    when no account exists yet — bootstrap-from-env, user listing. They reach
+    the app only through ``session_factory`` and never issue HTTP requests, so
+    the first-run setup gate never applies to them.
+    """
+    application, ctx = await _build_users_app(monkeypatch, allow_signup=False, seed_admin=False)
+    yield application
+    await ctx.__aexit__(None, None, None)
+
+
+@pytest.fixture
+async def users_app_signup(monkeypatch):
+    """Like users_app but with allow_signup=True."""
+    application, ctx = await _build_users_app(monkeypatch, allow_signup=True)
+    yield application
+    await ctx.__aexit__(None, None, None)
+
+
+# ---------------------------------------------------------------------------
+# Client fixtures
+# ---------------------------------------------------------------------------
+
+
+@pytest.fixture
+async def anon_client(users_app) -> AsyncGenerator[httpx.AsyncClient, None]:
+    """Unauthenticated client against users_app."""
+    transport = httpx.ASGITransport(app=users_app)
+    async with httpx.AsyncClient(
+        transport=transport,
+        base_url="http://testserver",
+    ) as c:
+        yield c
+
+
+@pytest.fixture
+async def anon_client_signup(users_app_signup) -> AsyncGenerator[httpx.AsyncClient, None]:
+    """Unauthenticated client against users_app_signup (signup enabled)."""
+    transport = httpx.ASGITransport(app=users_app_signup)
+    async with httpx.AsyncClient(
+        transport=transport,
+        base_url="http://testserver",
+    ) as c:
+        yield c
+
+
+@pytest.fixture
+async def admin_client(users_app) -> AsyncGenerator[httpx.AsyncClient, None]:
+    """Client with a signed local-user session cookie (admin role)."""
+    user = await _make_admin_user(users_app)
+    cookie = forge_session_cookie(
+        str(users_app.state.sm.settings.secret_key),
+        {"user_id": str(user.id)},
+    )
+    transport = httpx.ASGITransport(app=users_app)
+    async with httpx.AsyncClient(
+        transport=transport,
+        base_url="http://testserver",
+        cookies={"session": cookie},
+    ) as c:
+        yield c
+
+
+@pytest.fixture
+async def user_client(users_app) -> AsyncGenerator[httpx.AsyncClient, None]:
+    """Client with a signed session cookie for an authenticated non-admin user.
+
+    Counterpart to ``admin_client`` — every endpoint behind
+    ``RequiresPermission(...)`` should answer with 403 for this caller, since
+    the default role map only grants the wildcard to ``admin``.
+    """
+    user = await _make_standard_user(users_app)
+    cookie = forge_session_cookie(
+        str(users_app.state.sm.settings.secret_key),
+        {"user_id": str(user.id)},
+    )
+    transport = httpx.ASGITransport(app=users_app)
+    async with httpx.AsyncClient(
+        transport=transport,
+        base_url="http://testserver",
+        cookies={"session": cookie},
+    ) as c:
+        yield c
+
+
+# ---------------------------------------------------------------------------
+# DB session fixture scoped to users_app
+# ---------------------------------------------------------------------------
+
+
+@pytest.fixture
+async def users_db(users_app) -> AsyncGenerator[AsyncSession, None]:
+    """Session against the users_app in-memory DB."""
+    async with users_app.state.sm.db.session_factory() as session:
+        yield session
+
+
+# Fixtures consumed by the users.middleware unit tests live in
+# _middleware_support.py (imported as a pytest plugin below).
+pytest_plugins = ["_middleware_support"]

simple_module_users-0.0.34/tests/test_activity_summary.py

@@ -0,0 +1,111 @@
+"""Every activity line comes out of a catalog, not out of an f-string.
+
+The card used to build its sentences in Python — ``f"{verb} {kind} {label}"``
+from an English verb table — so the "Recent activity" list read as English in
+every locale and no translation could reach it. Neither lint check could see
+it: they only parse ``.tsx``.
+
+These tests translate with a stub that echoes ``key(args)`` instead of copy, so
+an assertion here fails the moment a sentence is assembled locally again — an
+f-string would produce prose where the stub produces a key.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from simple_module_core import AuditLink, AuditLinkRegistry
+from users.admin.recent_activity import _kind_of, _summarise
+
+
+class _EchoTranslator:
+    """Stands in for ``Translator``, rendering the key and its arguments."""
+
+    def t(self, key: str, **params: Any) -> str:
+        rendered = ", ".join(f"{name}={value}" for name, value in sorted(params.items()))
+        return f"{key}({rendered})"
+
+
+class _KeylessTranslator(_EchoTranslator):
+    """A translator with an empty catalog: ``t`` echoes the key back."""
+
+    def t(self, key: str, **params: Any) -> str:
+        return key
+
+
+T = _EchoTranslator()
+
+
+class TestSummaryKeys:
+    def test_a_create_reads_from_the_created_key(self) -> None:
+        assert _summarise(T, "create", "setting", "smtp_host", []) == (
+            "users.recent_activity.summary.created(kind=setting, label=smtp_host)"
+        )
+
+    def test_every_spelling_of_one_action_shares_a_key(self) -> None:
+        """Writers disagree on "delete"/"deleted"; the reader should not."""
+        assert _summarise(T, "delete", "file", "x", []) == _summarise(T, "deleted", "file", "x", [])
+
+    def test_an_unknown_action_keeps_its_verb_as_an_argument(self) -> None:
+        """Inventing a translation for a verb only one writer uses is a guess."""
+        assert _summarise(T, "archive", "file", "x", []) == (
+            "users.recent_activity.summary.other(action=Archive, kind=file, label=x)"
+        )
+
+    def test_named_fields_are_one_argument_not_a_locally_joined_sentence(self) -> None:
+        summary = _summarise(T, "update", "user", "Ada", [{"field": "email"}, {"field": "roles"}])
+        assert summary == (
+            "users.recent_activity.summary.changed_fields(fields=email, roles, label=Ada)"
+        )
+
+    def test_a_long_field_list_becomes_a_count(self) -> None:
+        changes = [{"field": name} for name in ("a", "b", "c", "d")]
+        assert _summarise(T, "update", "user", "Ada", changes) == (
+            "users.recent_activity.summary.changed_count(count=4, label=Ada)"
+        )
+
+    def test_an_update_with_no_recorded_fields_falls_back_to_the_plain_verb(self) -> None:
+        assert _summarise(T, "update", "user", "Ada", None) == (
+            "users.recent_activity.summary.updated(kind=user, label=Ada)"
+        )
+
+    def test_a_missing_catalog_entry_leaves_no_trailing_space(self) -> None:
+        """The key echoes back verbatim; nothing here appends a stray gap."""
+        assert _summarise(_KeylessTranslator(), "create", "setting", "x", []) == (
+            "users.recent_activity.summary.created"
+        )
+
+
+class TestKindOf:
+    def _registry(self, link: AuditLink) -> AuditLinkRegistry:
+        registry = AuditLinkRegistry()
+        registry.register(link)
+        return registry
+
+    def test_the_links_label_key_is_translated(self) -> None:
+        registry = self._registry(
+            AuditLink(
+                entity_type="Setting",
+                url_template="/s/{id}",
+                label="Setting",
+                label_key="settings.audit.setting",
+            )
+        )
+        assert _kind_of(T, registry, "Setting") == "settings.audit.setting()"
+
+    def test_an_unresolved_key_falls_back_to_the_english_label(self) -> None:
+        registry = self._registry(
+            AuditLink(
+                entity_type="Setting",
+                url_template="/s/{id}",
+                label="Setting",
+                label_key="settings.audit.setting",
+            )
+        )
+        assert _kind_of(_KeylessTranslator(), registry, "Setting") == "setting"
+
+    def test_a_type_no_module_claims_reads_as_its_class_name(self) -> None:
+        assert _kind_of(T, AuditLinkRegistry(), "Unclaimed") == "unclaimed"
+
+    def test_no_registry_at_all_is_survivable(self) -> None:
+        assert _kind_of(T, None, "Unclaimed") == "unclaimed"