simple-module-users 0.0.35__tar.gz → 0.0.37__tar.gz

{simple_module_users-0.0.35 → simple_module_users-0.0.37}/.gitignore

@@ -64,3 +64,4 @@ host/client_app/.playwright-cli/*
 .superpowers/
 .qa/
 .verify/
+/openapi.json

{simple_module_users-0.0.35 → simple_module_users-0.0.37}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_users
-Version: 0.0.35
+Version: 0.0.37
 Summary: Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -24,11 +24,11 @@ Requires-Python: >=3.12
 Requires-Dist: aiosmtplib>=3.0
 Requires-Dist: cachetools>=5.3
 Requires-Dist: fastapi-users[oauth,sqlalchemy]<16,>=15
-Requires-Dist: simple-module-auth==0.0.35
-Requires-Dist: simple-module-core==0.0.35
-Requires-Dist: simple-module-db==0.0.35
-Requires-Dist: simple-module-hosting==0.0.35
-Requires-Dist: simple-module-settings==0.0.35
+Requires-Dist: simple-module-auth==0.0.37
+Requires-Dist: simple-module-core==0.0.37
+Requires-Dist: simple-module-db==0.0.37
+Requires-Dist: simple-module-hosting==0.0.37
+Requires-Dist: simple-module-settings==0.0.37
 Requires-Dist: typer>=0.12
 Description-Content-Type: text/markdown
 

{simple_module_users-0.0.35 → simple_module_users-0.0.37}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_users"
-version = "0.0.35"
+version = "0.0.37"
 description = "Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps"
 readme = "README.md"
 license = "MIT"
@@ -21,11 +21,11 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "simple_module_core==0.0.35",
-    "simple_module_db==0.0.35",
-    "simple_module_hosting==0.0.35",
-    "simple_module_settings==0.0.35",
-    "simple_module_auth==0.0.35",
+    "simple_module_core==0.0.37",
+    "simple_module_db==0.0.37",
+    "simple_module_hosting==0.0.37",
+    "simple_module_settings==0.0.37",
+    "simple_module_auth==0.0.37",
     # Pinned to a narrow range: `deps.py` relies on mutating CookieTransport
     # fields after construction (see reconfigure_cookie_transport in backend.py).
     # Bumping the major version requires re-checking those field names.

{simple_module_users-0.0.35 → simple_module_users-0.0.37}/tests/_middleware_support.py

@@ -49,7 +49,6 @@ async def _build_app(db_state, inner_handler=None, *, principal_resolvers=None):
                         "email": user.email,
                         "name": user.name,
                         "roles": user.roles,
-                        "tenant_id": user.tenant_id,
                     }
                     if user is not None
                     else None
@@ -106,7 +105,6 @@ async def mw_active_user(db_session, _mw_seed_roles):
         is_superuser=False,
         is_verified=True,
         full_name="Middleware Tester",
-        tenant_id="acme",
     )
     link = UserRole(user_id=user_id, role_id=ADMIN_ROLE_ID)
     db_session.add_all([user, link])

simple_module_users-0.0.37/tests/_users_oauth_support.py

@@ -0,0 +1,84 @@
+"""A fake OAuth provider (no network) to drive the ``/login`` + ``/callback`` flow."""
+
+from __future__ import annotations
+
+import uuid
+from urllib.parse import parse_qs, urlparse
+
+import httpx
+from fastapi_users.password import PasswordHelper
+from sqlalchemy import select
+from users.models import User
+
+
+class _FakeOAuthClient:
+    def __init__(self, account_id: str, account_email: str) -> None:
+        self._account_id = account_id
+        self._account_email = account_email
+
+    async def get_authorization_url(self, redirect_uri: str, state: str) -> str:
+        return f"https://idp.example/authorize?state={state}"
+
+    async def get_access_token(self, code: str, redirect_uri: str) -> dict:
+        return {"access_token": "fake-token", "expires_at": None, "refresh_token": None}
+
+    async def get_id_email(self, access_token: str) -> tuple[str, str]:
+        return self._account_id, self._account_email
+
+
+def install_fake_provider(app, account_id: str, account_email: str) -> None:
+    from users.oauth import OAuthProvider
+
+    app.state.users.oauth_clients["microsoft"] = OAuthProvider(
+        "microsoft", "Microsoft", _FakeOAuthClient(account_id, account_email)
+    )
+
+
+def set_users_settings(app, **update) -> None:
+    """Change fields on the live users settings, as an admin edit would."""
+    settings = app.state.users.settings
+    app.state.users.settings = settings.model_copy(update=update)
+
+
+def set_allow_signup(app, allowed: bool) -> None:
+    """Flip ``allow_signup`` on the live settings, as an admin edit would."""
+    set_users_settings(app, allow_signup=allowed)
+
+
+async def find_user(app, email: str) -> User | None:
+    async with app.state.sm.db.session_factory() as session:
+        stmt = select(User).where(User.email == email)
+        return (await session.execute(stmt)).scalar_one_or_none()
+
+
+async def seed_password_user(app, email: str, **fields) -> uuid.UUID:
+    """Insert an active password account for ``email``; return its id."""
+    user_id = uuid.uuid4()
+    async with app.state.sm.db.session_factory() as session:
+        session.add(
+            User(
+                id=user_id,
+                email=email,
+                hashed_password=PasswordHelper().hash("SecurePass1!"),
+                is_active=True,
+                **fields,
+            )
+        )
+        await session.commit()
+    return user_id
+
+
+async def oauth_callback(client: httpx.AsyncClient) -> httpx.Response:
+    """Drive /login then /callback; return the callback response."""
+    login = await client.get("/api/users/auth/microsoft/login", follow_redirects=False)
+    assert login.status_code == 302
+    state = parse_qs(urlparse(login.headers["location"]).query)["state"][0]
+    return await client.get(
+        f"/api/users/auth/microsoft/callback?code=abc&state={state}",
+        follow_redirects=False,
+    )
+
+
+async def run_oauth_login(client: httpx.AsyncClient) -> int:
+    """Drive /login then /callback; return the callback status code."""
+    return (await oauth_callback(client)).status_code

{simple_module_users-0.0.35 → simple_module_users-0.0.37}/tests/test_auth_screens_props.py

@@ -257,3 +257,10 @@ class TestAcceptInviteFullName:
                 await session.execute(select(User).where(User.email == "joins@example.com"))
             ).scalar_one()
         assert stored.full_name == "Rob Meyer"
+
+
+class TestLoginAsideProps:
+    @pytest.mark.anyio
+    async def test_keycloak_flag_is_false_without_the_module(self, anon_client):
+        props = _props(await anon_client.get("/users/login", headers=_INERTIA_HEADERS))
+        assert props["keycloak_installed"] is False

{simple_module_users-0.0.35 → simple_module_users-0.0.37}/tests/test_external_users.py

@@ -11,9 +11,9 @@ Covers the feature added on top of the OAuth/OIDC login flow:
 from __future__ import annotations
 
 import uuid
-from urllib.parse import parse_qs, urlparse
 
 import pytest
+from _users_oauth_support import install_fake_provider, run_oauth_login, set_allow_signup
 from fastapi_users.password import PasswordHelper
 from sqlalchemy import select
 from users.models import Role, User
@@ -21,46 +21,6 @@ from users.models import Role, User
 _pw = PasswordHelper()
 
 
-# ---------------------------------------------------------------------------
-# Fake OAuth provider (no network) to drive the /login + /callback flow
-# ---------------------------------------------------------------------------
-
-
-class _FakeOAuthClient:
-    def __init__(self, account_id: str, account_email: str) -> None:
-        self._account_id = account_id
-        self._account_email = account_email
-
-    async def get_authorization_url(self, redirect_uri: str, state: str) -> str:
-        return f"https://idp.example/authorize?state={state}"
-
-    async def get_access_token(self, code: str, redirect_uri: str) -> dict:
-        return {"access_token": "fake-token", "expires_at": None, "refresh_token": None}
-
-    async def get_id_email(self, access_token: str) -> tuple[str, str]:
-        return self._account_id, self._account_email
-
-
-def _install_fake_provider(app, account_id: str, account_email: str) -> None:
-    from users.oauth import OAuthProvider
-
-    app.state.users.oauth_clients["microsoft"] = OAuthProvider(
-        "microsoft", "Microsoft", _FakeOAuthClient(account_id, account_email)
-    )
-
-
-async def _run_oauth_login(client) -> int:
-    """Drive /login then /callback; return the callback status code."""
-    login = await client.get("/api/users/auth/microsoft/login", follow_redirects=False)
-    assert login.status_code == 302
-    state = parse_qs(urlparse(login.headers["location"]).query)["state"][0]
-    cb = await client.get(
-        f"/api/users/auth/microsoft/callback?code=abc&state={state}",
-        follow_redirects=False,
-    )
-    return cb.status_code
-
-
 async def _get_user_by_email(db, email: str) -> User:
     return (await db.execute(select(User).where(User.email == email))).scalar_one()
 
@@ -72,9 +32,10 @@ async def _get_user_by_email(db, email: str) -> User:
 
 @pytest.mark.anyio
 async def test_new_oauth_login_creates_external_user(users_app, anon_client, users_db):
-    _install_fake_provider(users_app, "ms-oid-1", "sso-new@example.com")
+    set_allow_signup(users_app, True)  # creating an account via OAuth is a signup (#543)
+    install_fake_provider(users_app, "ms-oid-1", "sso-new@example.com")
 
-    assert await _run_oauth_login(anon_client) == 303
+    assert await run_oauth_login(anon_client) == 303
 
     user = await _get_user_by_email(users_db, "sso-new@example.com")
     assert user.is_external is True
@@ -96,8 +57,8 @@ async def test_oauth_login_links_existing_password_user_stays_local(
     users_db.add(existing)
     await users_db.commit()
 
-    _install_fake_provider(users_app, "ms-oid-2", "local@example.com")
-    assert await _run_oauth_login(anon_client) == 303
+    install_fake_provider(users_app, "ms-oid-2", "local@example.com")
+    assert await run_oauth_login(anon_client) == 303
 
     user = await _get_user_by_email(users_db, "local@example.com")
     assert user.is_external is False

simple_module_users-0.0.37/tests/test_legacy_cached_tenant.py

@@ -0,0 +1,54 @@
+"""A pre-#381 session cookie's cached ``tenant_id`` is ignored.
+
+``users_user.tenant_id`` is gone and the active tenant is resolved per request
+from memberships, but cookies signed before the upgrade still carry the old
+value inside ``user_ctx``. Honouring it would keep acting for a tenant the
+user may have left.
+"""
+
+from __future__ import annotations
+
+import time
+
+import pytest
+from auth.contracts.schemas import UserContext
+from simple_module_hosting.session import SESSION_EXPIRES_AT_KEY
+from sqlalchemy import select
+from starlette.requests import Request
+from users.models import User
+from users.provider import UsersAuthProvider
+
+
+async def _admin_id(users_app) -> str:
+    async with users_app.state.sm.db.session_factory() as session:
+        stmt = select(User.id).where(User.email == "admin@example.com")
+        return str((await session.execute(stmt)).scalar_one())
+
+
+@pytest.mark.anyio
+async def test_old_cookie_tenant_id_is_dropped_on_the_cached_path(users_app):
+    user_id = await _admin_id(users_app)
+    legacy_ctx = UserContext(
+        id=user_id, email="admin@example.com", name="Admin", roles=["admin"], tenant_id="acme"
+    ).to_session_dict()
+    session = {
+        "user_id": user_id,
+        "user_ctx": legacy_ctx,
+        "session_version": 0,
+        SESSION_EXPIRES_AT_KEY: int(time.time()) + 3600,
+    }
+    scope = {
+        "type": "http",
+        "method": "GET",
+        "path": "/",
+        "headers": [],
+        "app": users_app,
+        "session": session,
+    }
+
+    ctx = await UsersAuthProvider().resolve_user(Request(scope))
+
+    assert ctx is not None
+    assert ctx.id == user_id
+    assert ctx.name == "Admin"  # the cached context was used, not a DB reload
+    assert ctx.tenant_id is None

simple_module_users-0.0.37/tests/test_login_redirect_root_mount.py

@@ -0,0 +1,39 @@
+"""Login fallback with a module mounted at the root (#435)."""
+
+from __future__ import annotations
+
+import pytest
+
+
+def _fallback_url(app, prefixes: dict[str, str]) -> str:
+    """Run the login fallback against a Dashboard-less module set (#435)."""
+    from users.startup import apply_login_redirect_fallback
+
+    sm = app.state.sm
+    saved_mods, saved_prefixes = sm.modules, dict(sm.view_prefixes)
+    settings = app.state.users.settings
+    saved_url = settings.login_redirect_url
+    object.__setattr__(sm, "modules", tuple(m for m in saved_mods if m.meta.name != "Dashboard"))
+    sm.view_prefixes.clear()
+    sm.view_prefixes.update(prefixes)
+    settings.login_redirect_url = "/dashboard/"
+    try:
+        apply_login_redirect_fallback(app, settings, "Users", "/dashboard/")
+        return settings.login_redirect_url
+    finally:
+        object.__setattr__(sm, "modules", saved_mods)
+        sm.view_prefixes.clear()
+        sm.view_prefixes.update(saved_prefixes)
+        settings.login_redirect_url = saved_url
+
+
+@pytest.mark.anyio
+async def test_login_redirect_fallback_prefers_root_mounted_module(users_app):
+    """#435: a module that serves views at ``/`` (view_prefix == "") wins."""
+    assert _fallback_url(users_app, {"Users": "/users", "Home": "", "Other": "/o"}) == "/"
+
+
+@pytest.mark.anyio
+async def test_login_redirect_fallback_skips_api_only_module(users_app):
+    """An API-only module also has view_prefix == "" but is not in the map."""
+    assert _fallback_url(users_app, {"Users": "/users", "Other": "/o"}) == "/o/"

{simple_module_users-0.0.35 → simple_module_users-0.0.37}/tests/test_negative_authz.py

@@ -17,7 +17,10 @@ import uuid
 
 import pytest
 
-_FAKE_ID = uuid.uuid4()
+# Fixed, not ``uuid4()``: the id lands in the parametrize ids, and pytest-xdist
+# refuses to run when its workers collect differently-named tests. The request
+# must be refused before any lookup, so which id it names does not matter.
+_FAKE_ID = uuid.UUID("00000000-0000-4000-8000-000000000000")
 _PROTECTED_ENDPOINTS: tuple[tuple[str, str, dict | None], ...] = (
     # users — admin sub-router
     ("GET", "/api/users/admin", None),

{simple_module_users-0.0.35 → simple_module_users-0.0.37}/tests/test_token_api.py

@@ -71,6 +71,27 @@ class TestTokenLogin:
         )
         assert resp.status_code == 401
 
+    @pytest.mark.anyio
+    async def test_legacy_hash_is_upgraded_on_token_login(self, anon_client, users_db):
+        from pwdlib.hashers.bcrypt import BcryptHasher
+
+        legacy = BcryptHasher().hash("SecurePass1!")
+        assert legacy.startswith("$2")
+        user = await _seed_user(users_db, email="legacy@example.com")
+        user.hashed_password = legacy
+        await users_db.commit()
+
+        for _ in range(2):  # second login proves the upgraded hash still verifies
+            resp = await anon_client.post(
+                "/api/users/auth/token",
+                json={"email": "legacy@example.com", "password": "SecurePass1!"},
+            )
+            assert resp.status_code == 200
+
+        await users_db.refresh(user)
+        assert user.hashed_password != legacy
+        assert user.hashed_password.startswith("$argon2")
+
     @pytest.mark.anyio
     async def test_valid_credentials_returns_token_pair(self, anon_client, users_db):
         await _seed_user(users_db)
@@ -80,7 +101,7 @@ class TestTokenLogin:
         )
         assert resp.status_code == 200
         body = resp.json()
-        assert body["token_type"] == "bearer"
+        assert body["token_type"] == "Bearer"
         assert body["access_token"]
         assert body["refresh_token"]
         assert body["expires_in"] > 0

{simple_module_users-0.0.35 → simple_module_users-0.0.37}/tests/test_user_manager.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 
 import uuid
 from datetime import UTC, datetime
-from unittest.mock import AsyncMock, MagicMock
+from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
 from fastapi_users import exceptions
@@ -51,6 +51,8 @@ def fake_user():
 def fake_user_db():
     db = MagicMock()
     db.update = AsyncMock(return_value=None)
+    db.session.flush = AsyncMock()
+    db.session.commit = AsyncMock()
     return db
 
 
@@ -125,17 +127,53 @@ class TestOnAfterRegister:
         # Pre-verified so the manager doesn't try to send a verify email.
         fake_user.is_verified = True
 
-        await manager.on_after_register(fake_user, request)
+        with patch("users.manager.attach_default_role", AsyncMock()):
+            await manager.on_after_register(fake_user, request)
 
         (event,) = bus.assert_published(UserRegistered)
         assert event.user_id == fake_user.id
         assert event.email == fake_user.email
 
     @pytest.mark.anyio
-    async def test_without_request_skips_publish(self, manager, fake_user):
-        """CLI/bootstrap flows pass request=None — must not crash."""
+    async def test_request_bound_registration_gets_the_user_role(
+        self, manager, fake_user, fake_user_db
+    ):
+        """GH #488: a signup with no role holds no permissions at all."""
+        from users.models import UserRole
+
+        request = MagicMock()
+        request.state = MagicMock(spec=[])  # a local signup, not OAuth
+        request.app.state.sm.event_bus = MagicMock(publish=AsyncMock())
+        fake_user.is_verified = True
+        role = MagicMock(id=uuid.uuid4())
+        fake_user_db.session.execute = AsyncMock(
+            return_value=MagicMock(scalar_one_or_none=MagicMock(return_value=role))
+        )
+        await manager.on_after_register(fake_user, request)
+
+        (added,) = fake_user_db.session.add.call_args.args
+        assert isinstance(added, UserRole)
+        assert (added.user_id, added.role_id) == (fake_user.id, role.id)
+
+    @pytest.mark.anyio
+    async def test_a_deleted_user_role_is_not_recreated(self, manager, fake_user, fake_user_db):
+        """An admin who removed the role meant it; a public signup must not undo that."""
+        request = MagicMock()
+        request.app.state.sm.event_bus = MagicMock(publish=AsyncMock())
+        fake_user.is_verified = True
+        fake_user_db.session.execute = AsyncMock(
+            return_value=MagicMock(scalar_one_or_none=MagicMock(return_value=None))
+        )
+        await manager.on_after_register(fake_user, request)
+        fake_user_db.session.add.assert_not_called()
+
+    @pytest.mark.anyio
+    async def test_without_request_skips_publish(self, manager, fake_user, fake_user_db):
+        """CLI/bootstrap and admin flows pass request=None — no crash, no role:
+        the admin picks the roles there, and may pick none."""
         fake_user.is_verified = True
         await manager.on_after_register(fake_user, None)
+        fake_user_db.session.add.assert_not_called()
 
 
 class TestOnAfterForgotPassword:

{simple_module_users-0.0.35 → simple_module_users-0.0.37}/tests/test_user_model.py

@@ -35,7 +35,6 @@ class TestUserTableShape:
             "is_superuser",
             "is_verified",
             "full_name",
-            "tenant_id",
             "disabled_at",
             "last_login_at",
             # AuditMixin columns

simple_module_users-0.0.37/tests/test_users_bearer_scheme.py

@@ -0,0 +1,54 @@
+"""The ``Authorization`` scheme is case-insensitive (RFC 9110 §11.1, GH #533).
+
+``/auth/token`` used to answer ``token_type="bearer"``, and a client that built
+its header from that value sent ``bearer <token>`` — which the provider refused.
+"""
+
+from __future__ import annotations
+
+import pytest
+from starlette.requests import Request
+
+_TOKEN = "/api/users/auth/token"
+
+
+def _request(app, header: str) -> Request:
+    return Request(
+        {
+            "type": "http",
+            "method": "GET",
+            "path": "/api/anything",
+            "headers": [(b"authorization", header.encode())],
+            "session": {},
+            "app": app,
+        }
+    )
+
+
+@pytest.mark.anyio
+@pytest.mark.parametrize("scheme", ["Bearer", "bearer", "BEARER", "  bearer  "])
+async def test_any_scheme_casing_authenticates(users_app, anon_client, scheme):
+    from users.provider import UsersAuthProvider
+
+    resp = await anon_client.post(
+        _TOKEN, json={"email": "admin@example.com", "password": "AdminPass1!"}
+    )
+    assert resp.status_code == 200, resp.text
+    body = resp.json()
+    assert body["token_type"] == "Bearer"
+
+    provider = UsersAuthProvider()
+    request = _request(users_app, f"{scheme} {body['access_token']}")
+    assert provider.is_bearer_request(request)
+    ctx = await provider.resolve_user(request)
+    assert ctx is not None
+    assert ctx.email == "admin@example.com"
+
+
+@pytest.mark.anyio
+async def test_another_scheme_is_not_a_bearer_request(users_app):
+    from users.provider import UsersAuthProvider
+
+    request = _request(users_app, "Basic dXNlcjpwYXNz")
+    assert not UsersAuthProvider().is_bearer_request(request)
+    assert await UsersAuthProvider().resolve_user(request) is None

simple_module_users-0.0.37/tests/test_users_default_role.py

@@ -0,0 +1,82 @@
+"""Which registrations get the standard ``user`` role (GH #488 review).
+
+OAuth provisioning is not gated by ``allow_signup``, so the role it attaches
+must be: with signups closed, an account any provider user can create holds no
+role until an admin grants one.
+"""
+
+from __future__ import annotations
+
+import uuid
+from types import SimpleNamespace
+from unittest.mock import AsyncMock, MagicMock
+
+import pytest
+from users.constants import OAUTH_REGISTRATION_REQUEST_FLAG
+from users.manager import UserManager
+from users.models import UserRole
+from users.settings import UsersSettings
+
+_ROLE_ID = uuid.uuid4()
+
+
+def _manager(*, allow_signup: bool) -> UserManager:
+    settings = UsersSettings(
+        verification_token_secret="test-verify-secret-at-least-32-bytes-long",
+        reset_password_token_secret="test-reset-secret-at-least-32-bytes-long",
+        allow_signup=allow_signup,
+    )
+    user_db = MagicMock()
+    user_db.update = AsyncMock()
+    user_db.session.flush = AsyncMock()
+    user_db.session.commit = AsyncMock()
+    user_db.session.execute = AsyncMock(
+        return_value=MagicMock(scalar_one_or_none=MagicMock(return_value=MagicMock(id=_ROLE_ID)))
+    )
+    return UserManager(user_db, MagicMock(send_verification=AsyncMock()), settings)
+
+
+def _request(*, oauth: bool) -> MagicMock:
+    request = MagicMock()
+    request.app.state.sm.event_bus = MagicMock(publish=AsyncMock())
+    request.state = SimpleNamespace(**({OAUTH_REGISTRATION_REQUEST_FLAG: True} if oauth else {}))
+    return request
+
+
+def _user() -> MagicMock:
+    return MagicMock(id=uuid.uuid4(), email="new@example.com", is_verified=True)
+
+
+def _added_roles(manager: UserManager) -> list[UserRole]:
+    return [
+        c.args[0]
+        for c in manager.user_db.session.add.call_args_list
+        if isinstance(c.args[0], UserRole)
+    ]
+
+
+@pytest.mark.anyio
+async def test_oauth_provisioning_with_signup_closed_gets_no_role():
+    manager = _manager(allow_signup=False)
+    await manager.on_after_register(_user(), _request(oauth=True))
+    assert _added_roles(manager) == []
+
+
+@pytest.mark.anyio
+async def test_oauth_provisioning_with_signup_open_gets_the_user_role():
+    manager = _manager(allow_signup=True)
+    user = _user()
+    await manager.on_after_register(user, _request(oauth=True))
+    (link,) = _added_roles(manager)
+    assert (link.user_id, link.role_id) == (user.id, _ROLE_ID)
+
+
+@pytest.mark.anyio
+async def test_local_registration_gets_the_user_role():
+    # /register itself 404s while signup is closed, so reaching the hook
+    # means the operator opened it.
+    manager = _manager(allow_signup=True)
+    user = _user()
+    await manager.on_after_register(user, _request(oauth=False))
+    (link,) = _added_roles(manager)
+    assert (link.user_id, link.role_id) == (user.id, _ROLE_ID)

{simple_module_users-0.0.35 → simple_module_users-0.0.37}/tests/test_users_middleware.py

@@ -81,7 +81,6 @@ async def test_authenticated_request_sets_user_context(db_state, mw_active_user)
     assert data["user"]["email"] == "middleware-test@example.com"
     assert data["user"]["name"] == "Middleware Tester"
     assert data["user"]["roles"] == ["admin"]
-    assert data["user"]["tenant_id"] == "acme"
 
 
 # ---------------------------------------------------------------------------