simple-module-users 0.0.36__tar.gz → 0.0.37__tar.gz

{simple_module_users-0.0.36 → simple_module_users-0.0.37}/.gitignore

@@ -64,3 +64,4 @@ host/client_app/.playwright-cli/*
 .superpowers/
 .qa/
 .verify/
+/openapi.json

{simple_module_users-0.0.36 → simple_module_users-0.0.37}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_users
-Version: 0.0.36
+Version: 0.0.37
 Summary: Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -24,11 +24,11 @@ Requires-Python: >=3.12
 Requires-Dist: aiosmtplib>=3.0
 Requires-Dist: cachetools>=5.3
 Requires-Dist: fastapi-users[oauth,sqlalchemy]<16,>=15
-Requires-Dist: simple-module-auth==0.0.36
-Requires-Dist: simple-module-core==0.0.36
-Requires-Dist: simple-module-db==0.0.36
-Requires-Dist: simple-module-hosting==0.0.36
-Requires-Dist: simple-module-settings==0.0.36
+Requires-Dist: simple-module-auth==0.0.37
+Requires-Dist: simple-module-core==0.0.37
+Requires-Dist: simple-module-db==0.0.37
+Requires-Dist: simple-module-hosting==0.0.37
+Requires-Dist: simple-module-settings==0.0.37
 Requires-Dist: typer>=0.12
 Description-Content-Type: text/markdown
 

{simple_module_users-0.0.36 → simple_module_users-0.0.37}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_users"
-version = "0.0.36"
+version = "0.0.37"
 description = "Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps"
 readme = "README.md"
 license = "MIT"
@@ -21,11 +21,11 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "simple_module_core==0.0.36",
-    "simple_module_db==0.0.36",
-    "simple_module_hosting==0.0.36",
-    "simple_module_settings==0.0.36",
-    "simple_module_auth==0.0.36",
+    "simple_module_core==0.0.37",
+    "simple_module_db==0.0.37",
+    "simple_module_hosting==0.0.37",
+    "simple_module_settings==0.0.37",
+    "simple_module_auth==0.0.37",
     # Pinned to a narrow range: `deps.py` relies on mutating CookieTransport
     # fields after construction (see reconfigure_cookie_transport in backend.py).
     # Bumping the major version requires re-checking those field names.

simple_module_users-0.0.37/tests/_users_oauth_support.py

@@ -0,0 +1,84 @@
+"""A fake OAuth provider (no network) to drive the ``/login`` + ``/callback`` flow."""
+
+from __future__ import annotations
+
+import uuid
+from urllib.parse import parse_qs, urlparse
+
+import httpx
+from fastapi_users.password import PasswordHelper
+from sqlalchemy import select
+from users.models import User
+
+
+class _FakeOAuthClient:
+    def __init__(self, account_id: str, account_email: str) -> None:
+        self._account_id = account_id
+        self._account_email = account_email
+
+    async def get_authorization_url(self, redirect_uri: str, state: str) -> str:
+        return f"https://idp.example/authorize?state={state}"
+
+    async def get_access_token(self, code: str, redirect_uri: str) -> dict:
+        return {"access_token": "fake-token", "expires_at": None, "refresh_token": None}
+
+    async def get_id_email(self, access_token: str) -> tuple[str, str]:
+        return self._account_id, self._account_email
+
+
+def install_fake_provider(app, account_id: str, account_email: str) -> None:
+    from users.oauth import OAuthProvider
+
+    app.state.users.oauth_clients["microsoft"] = OAuthProvider(
+        "microsoft", "Microsoft", _FakeOAuthClient(account_id, account_email)
+    )
+
+
+def set_users_settings(app, **update) -> None:
+    """Change fields on the live users settings, as an admin edit would."""
+    settings = app.state.users.settings
+    app.state.users.settings = settings.model_copy(update=update)
+
+
+def set_allow_signup(app, allowed: bool) -> None:
+    """Flip ``allow_signup`` on the live settings, as an admin edit would."""
+    set_users_settings(app, allow_signup=allowed)
+
+
+async def find_user(app, email: str) -> User | None:
+    async with app.state.sm.db.session_factory() as session:
+        stmt = select(User).where(User.email == email)
+        return (await session.execute(stmt)).scalar_one_or_none()
+
+
+async def seed_password_user(app, email: str, **fields) -> uuid.UUID:
+    """Insert an active password account for ``email``; return its id."""
+    user_id = uuid.uuid4()
+    async with app.state.sm.db.session_factory() as session:
+        session.add(
+            User(
+                id=user_id,
+                email=email,
+                hashed_password=PasswordHelper().hash("SecurePass1!"),
+                is_active=True,
+                **fields,
+            )
+        )
+        await session.commit()
+    return user_id
+
+
+async def oauth_callback(client: httpx.AsyncClient) -> httpx.Response:
+    """Drive /login then /callback; return the callback response."""
+    login = await client.get("/api/users/auth/microsoft/login", follow_redirects=False)
+    assert login.status_code == 302
+    state = parse_qs(urlparse(login.headers["location"]).query)["state"][0]
+    return await client.get(
+        f"/api/users/auth/microsoft/callback?code=abc&state={state}",
+        follow_redirects=False,
+    )
+
+
+async def run_oauth_login(client: httpx.AsyncClient) -> int:
+    """Drive /login then /callback; return the callback status code."""
+    return (await oauth_callback(client)).status_code

{simple_module_users-0.0.36 → simple_module_users-0.0.37}/tests/test_auth_screens_props.py

@@ -257,3 +257,10 @@ class TestAcceptInviteFullName:
                 await session.execute(select(User).where(User.email == "joins@example.com"))
             ).scalar_one()
         assert stored.full_name == "Rob Meyer"
+
+
+class TestLoginAsideProps:
+    @pytest.mark.anyio
+    async def test_keycloak_flag_is_false_without_the_module(self, anon_client):
+        props = _props(await anon_client.get("/users/login", headers=_INERTIA_HEADERS))
+        assert props["keycloak_installed"] is False

{simple_module_users-0.0.36 → simple_module_users-0.0.37}/tests/test_external_users.py

@@ -11,9 +11,9 @@ Covers the feature added on top of the OAuth/OIDC login flow:
 from __future__ import annotations
 
 import uuid
-from urllib.parse import parse_qs, urlparse
 
 import pytest
+from _users_oauth_support import install_fake_provider, run_oauth_login, set_allow_signup
 from fastapi_users.password import PasswordHelper
 from sqlalchemy import select
 from users.models import Role, User
@@ -21,46 +21,6 @@ from users.models import Role, User
 _pw = PasswordHelper()
 
 
-# ---------------------------------------------------------------------------
-# Fake OAuth provider (no network) to drive the /login + /callback flow
-# ---------------------------------------------------------------------------
-
-
-class _FakeOAuthClient:
-    def __init__(self, account_id: str, account_email: str) -> None:
-        self._account_id = account_id
-        self._account_email = account_email
-
-    async def get_authorization_url(self, redirect_uri: str, state: str) -> str:
-        return f"https://idp.example/authorize?state={state}"
-
-    async def get_access_token(self, code: str, redirect_uri: str) -> dict:
-        return {"access_token": "fake-token", "expires_at": None, "refresh_token": None}
-
-    async def get_id_email(self, access_token: str) -> tuple[str, str]:
-        return self._account_id, self._account_email
-
-
-def _install_fake_provider(app, account_id: str, account_email: str) -> None:
-    from users.oauth import OAuthProvider
-
-    app.state.users.oauth_clients["microsoft"] = OAuthProvider(
-        "microsoft", "Microsoft", _FakeOAuthClient(account_id, account_email)
-    )
-
-
-async def _run_oauth_login(client) -> int:
-    """Drive /login then /callback; return the callback status code."""
-    login = await client.get("/api/users/auth/microsoft/login", follow_redirects=False)
-    assert login.status_code == 302
-    state = parse_qs(urlparse(login.headers["location"]).query)["state"][0]
-    cb = await client.get(
-        f"/api/users/auth/microsoft/callback?code=abc&state={state}",
-        follow_redirects=False,
-    )
-    return cb.status_code
-
-
 async def _get_user_by_email(db, email: str) -> User:
     return (await db.execute(select(User).where(User.email == email))).scalar_one()
 
@@ -72,9 +32,10 @@ async def _get_user_by_email(db, email: str) -> User:
 
 @pytest.mark.anyio
 async def test_new_oauth_login_creates_external_user(users_app, anon_client, users_db):
-    _install_fake_provider(users_app, "ms-oid-1", "sso-new@example.com")
+    set_allow_signup(users_app, True)  # creating an account via OAuth is a signup (#543)
+    install_fake_provider(users_app, "ms-oid-1", "sso-new@example.com")
 
-    assert await _run_oauth_login(anon_client) == 303
+    assert await run_oauth_login(anon_client) == 303
 
     user = await _get_user_by_email(users_db, "sso-new@example.com")
     assert user.is_external is True
@@ -96,8 +57,8 @@ async def test_oauth_login_links_existing_password_user_stays_local(
     users_db.add(existing)
     await users_db.commit()
 
-    _install_fake_provider(users_app, "ms-oid-2", "local@example.com")
-    assert await _run_oauth_login(anon_client) == 303
+    install_fake_provider(users_app, "ms-oid-2", "local@example.com")
+    assert await run_oauth_login(anon_client) == 303
 
     user = await _get_user_by_email(users_db, "local@example.com")
     assert user.is_external is False

{simple_module_users-0.0.36 → simple_module_users-0.0.37}/tests/test_negative_authz.py

@@ -17,7 +17,10 @@ import uuid
 
 import pytest
 
-_FAKE_ID = uuid.uuid4()
+# Fixed, not ``uuid4()``: the id lands in the parametrize ids, and pytest-xdist
+# refuses to run when its workers collect differently-named tests. The request
+# must be refused before any lookup, so which id it names does not matter.
+_FAKE_ID = uuid.UUID("00000000-0000-4000-8000-000000000000")
 _PROTECTED_ENDPOINTS: tuple[tuple[str, str, dict | None], ...] = (
     # users — admin sub-router
     ("GET", "/api/users/admin", None),

{simple_module_users-0.0.36 → simple_module_users-0.0.37}/tests/test_token_api.py

@@ -71,6 +71,27 @@ class TestTokenLogin:
         )
         assert resp.status_code == 401
 
+    @pytest.mark.anyio
+    async def test_legacy_hash_is_upgraded_on_token_login(self, anon_client, users_db):
+        from pwdlib.hashers.bcrypt import BcryptHasher
+
+        legacy = BcryptHasher().hash("SecurePass1!")
+        assert legacy.startswith("$2")
+        user = await _seed_user(users_db, email="legacy@example.com")
+        user.hashed_password = legacy
+        await users_db.commit()
+
+        for _ in range(2):  # second login proves the upgraded hash still verifies
+            resp = await anon_client.post(
+                "/api/users/auth/token",
+                json={"email": "legacy@example.com", "password": "SecurePass1!"},
+            )
+            assert resp.status_code == 200
+
+        await users_db.refresh(user)
+        assert user.hashed_password != legacy
+        assert user.hashed_password.startswith("$argon2")
+
     @pytest.mark.anyio
     async def test_valid_credentials_returns_token_pair(self, anon_client, users_db):
         await _seed_user(users_db)
@@ -80,7 +101,7 @@ class TestTokenLogin:
         )
         assert resp.status_code == 200
         body = resp.json()
-        assert body["token_type"] == "bearer"
+        assert body["token_type"] == "Bearer"
         assert body["access_token"]
         assert body["refresh_token"]
         assert body["expires_in"] > 0

{simple_module_users-0.0.36 → simple_module_users-0.0.37}/tests/test_user_manager.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 
 import uuid
 from datetime import UTC, datetime
-from unittest.mock import AsyncMock, MagicMock
+from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
 from fastapi_users import exceptions
@@ -51,6 +51,8 @@ def fake_user():
 def fake_user_db():
     db = MagicMock()
     db.update = AsyncMock(return_value=None)
+    db.session.flush = AsyncMock()
+    db.session.commit = AsyncMock()
     return db
 
 
@@ -125,17 +127,53 @@ class TestOnAfterRegister:
         # Pre-verified so the manager doesn't try to send a verify email.
         fake_user.is_verified = True
 
-        await manager.on_after_register(fake_user, request)
+        with patch("users.manager.attach_default_role", AsyncMock()):
+            await manager.on_after_register(fake_user, request)
 
         (event,) = bus.assert_published(UserRegistered)
         assert event.user_id == fake_user.id
         assert event.email == fake_user.email
 
     @pytest.mark.anyio
-    async def test_without_request_skips_publish(self, manager, fake_user):
-        """CLI/bootstrap flows pass request=None — must not crash."""
+    async def test_request_bound_registration_gets_the_user_role(
+        self, manager, fake_user, fake_user_db
+    ):
+        """GH #488: a signup with no role holds no permissions at all."""
+        from users.models import UserRole
+
+        request = MagicMock()
+        request.state = MagicMock(spec=[])  # a local signup, not OAuth
+        request.app.state.sm.event_bus = MagicMock(publish=AsyncMock())
+        fake_user.is_verified = True
+        role = MagicMock(id=uuid.uuid4())
+        fake_user_db.session.execute = AsyncMock(
+            return_value=MagicMock(scalar_one_or_none=MagicMock(return_value=role))
+        )
+        await manager.on_after_register(fake_user, request)
+
+        (added,) = fake_user_db.session.add.call_args.args
+        assert isinstance(added, UserRole)
+        assert (added.user_id, added.role_id) == (fake_user.id, role.id)
+
+    @pytest.mark.anyio
+    async def test_a_deleted_user_role_is_not_recreated(self, manager, fake_user, fake_user_db):
+        """An admin who removed the role meant it; a public signup must not undo that."""
+        request = MagicMock()
+        request.app.state.sm.event_bus = MagicMock(publish=AsyncMock())
+        fake_user.is_verified = True
+        fake_user_db.session.execute = AsyncMock(
+            return_value=MagicMock(scalar_one_or_none=MagicMock(return_value=None))
+        )
+        await manager.on_after_register(fake_user, request)
+        fake_user_db.session.add.assert_not_called()
+
+    @pytest.mark.anyio
+    async def test_without_request_skips_publish(self, manager, fake_user, fake_user_db):
+        """CLI/bootstrap and admin flows pass request=None — no crash, no role:
+        the admin picks the roles there, and may pick none."""
         fake_user.is_verified = True
         await manager.on_after_register(fake_user, None)
+        fake_user_db.session.add.assert_not_called()
 
 
 class TestOnAfterForgotPassword:

simple_module_users-0.0.37/tests/test_users_bearer_scheme.py

@@ -0,0 +1,54 @@
+"""The ``Authorization`` scheme is case-insensitive (RFC 9110 §11.1, GH #533).
+
+``/auth/token`` used to answer ``token_type="bearer"``, and a client that built
+its header from that value sent ``bearer <token>`` — which the provider refused.
+"""
+
+from __future__ import annotations
+
+import pytest
+from starlette.requests import Request
+
+_TOKEN = "/api/users/auth/token"
+
+
+def _request(app, header: str) -> Request:
+    return Request(
+        {
+            "type": "http",
+            "method": "GET",
+            "path": "/api/anything",
+            "headers": [(b"authorization", header.encode())],
+            "session": {},
+            "app": app,
+        }
+    )
+
+
+@pytest.mark.anyio
+@pytest.mark.parametrize("scheme", ["Bearer", "bearer", "BEARER", "  bearer  "])
+async def test_any_scheme_casing_authenticates(users_app, anon_client, scheme):
+    from users.provider import UsersAuthProvider
+
+    resp = await anon_client.post(
+        _TOKEN, json={"email": "admin@example.com", "password": "AdminPass1!"}
+    )
+    assert resp.status_code == 200, resp.text
+    body = resp.json()
+    assert body["token_type"] == "Bearer"
+
+    provider = UsersAuthProvider()
+    request = _request(users_app, f"{scheme} {body['access_token']}")
+    assert provider.is_bearer_request(request)
+    ctx = await provider.resolve_user(request)
+    assert ctx is not None
+    assert ctx.email == "admin@example.com"
+
+
+@pytest.mark.anyio
+async def test_another_scheme_is_not_a_bearer_request(users_app):
+    from users.provider import UsersAuthProvider
+
+    request = _request(users_app, "Basic dXNlcjpwYXNz")
+    assert not UsersAuthProvider().is_bearer_request(request)
+    assert await UsersAuthProvider().resolve_user(request) is None

simple_module_users-0.0.37/tests/test_users_default_role.py

@@ -0,0 +1,82 @@
+"""Which registrations get the standard ``user`` role (GH #488 review).
+
+OAuth provisioning is not gated by ``allow_signup``, so the role it attaches
+must be: with signups closed, an account any provider user can create holds no
+role until an admin grants one.
+"""
+
+from __future__ import annotations
+
+import uuid
+from types import SimpleNamespace
+from unittest.mock import AsyncMock, MagicMock
+
+import pytest
+from users.constants import OAUTH_REGISTRATION_REQUEST_FLAG
+from users.manager import UserManager
+from users.models import UserRole
+from users.settings import UsersSettings
+
+_ROLE_ID = uuid.uuid4()
+
+
+def _manager(*, allow_signup: bool) -> UserManager:
+    settings = UsersSettings(
+        verification_token_secret="test-verify-secret-at-least-32-bytes-long",
+        reset_password_token_secret="test-reset-secret-at-least-32-bytes-long",
+        allow_signup=allow_signup,
+    )
+    user_db = MagicMock()
+    user_db.update = AsyncMock()
+    user_db.session.flush = AsyncMock()
+    user_db.session.commit = AsyncMock()
+    user_db.session.execute = AsyncMock(
+        return_value=MagicMock(scalar_one_or_none=MagicMock(return_value=MagicMock(id=_ROLE_ID)))
+    )
+    return UserManager(user_db, MagicMock(send_verification=AsyncMock()), settings)
+
+
+def _request(*, oauth: bool) -> MagicMock:
+    request = MagicMock()
+    request.app.state.sm.event_bus = MagicMock(publish=AsyncMock())
+    request.state = SimpleNamespace(**({OAUTH_REGISTRATION_REQUEST_FLAG: True} if oauth else {}))
+    return request
+
+
+def _user() -> MagicMock:
+    return MagicMock(id=uuid.uuid4(), email="new@example.com", is_verified=True)
+
+
+def _added_roles(manager: UserManager) -> list[UserRole]:
+    return [
+        c.args[0]
+        for c in manager.user_db.session.add.call_args_list
+        if isinstance(c.args[0], UserRole)
+    ]
+
+
+@pytest.mark.anyio
+async def test_oauth_provisioning_with_signup_closed_gets_no_role():
+    manager = _manager(allow_signup=False)
+    await manager.on_after_register(_user(), _request(oauth=True))
+    assert _added_roles(manager) == []
+
+
+@pytest.mark.anyio
+async def test_oauth_provisioning_with_signup_open_gets_the_user_role():
+    manager = _manager(allow_signup=True)
+    user = _user()
+    await manager.on_after_register(user, _request(oauth=True))
+    (link,) = _added_roles(manager)
+    assert (link.user_id, link.role_id) == (user.id, _ROLE_ID)
+
+
+@pytest.mark.anyio
+async def test_local_registration_gets_the_user_role():
+    # /register itself 404s while signup is closed, so reaching the hook
+    # means the operator opened it.
+    manager = _manager(allow_signup=True)
+    user = _user()
+    await manager.on_after_register(user, _request(oauth=False))
+    (link,) = _added_roles(manager)
+    assert (link.user_id, link.role_id) == (user.id, _ROLE_ID)

simple_module_users-0.0.37/tests/test_users_oauth_signup_gate.py

@@ -0,0 +1,63 @@
+"""OAuth sign-in creates an account only when ``allow_signup`` is on (GH #543).
+
+With signups closed, an operator who enables SSO for staff must not open a
+signup to the provider's whole user base. Accounts that already exist — linked
+by OAuth account or associated by email — still sign in.
+"""
+
+from __future__ import annotations
+
+import pytest
+from _users_oauth_support import (
+    find_user,
+    install_fake_provider,
+    oauth_callback,
+    seed_password_user,
+    set_allow_signup,
+)
+
+
+@pytest.mark.anyio
+async def test_signup_closed_refuses_a_new_identity(users_app, anon_client):
+    install_fake_provider(users_app, "ms-new", "stranger@example.com")
+
+    resp = await oauth_callback(anon_client)
+
+    assert resp.status_code == 403
+    assert resp.json()["detail"] == "OAUTH_SIGNUP_DISABLED"
+    assert users_app.state.users.settings.cookie_name not in resp.cookies
+    assert await find_user(users_app, "stranger@example.com") is None
+
+
+@pytest.mark.anyio
+async def test_signup_open_creates_the_account(users_app, anon_client):
+    set_allow_signup(users_app, True)
+    install_fake_provider(users_app, "ms-new", "newcomer@example.com")
+
+    assert (await oauth_callback(anon_client)).status_code == 303
+    user = await find_user(users_app, "newcomer@example.com")
+    assert user is not None
+    assert user.is_external is True
+
+
+@pytest.mark.anyio
+async def test_signup_closed_still_associates_an_existing_email(users_app, anon_client):
+    await seed_password_user(users_app, "staff@example.com", is_verified=True)
+    install_fake_provider(users_app, "ms-staff", "staff@example.com")
+
+    assert (await oauth_callback(anon_client)).status_code == 303
+
+
+@pytest.mark.anyio
+async def test_signup_closed_still_signs_in_a_linked_oauth_account(users_app, anon_client):
+    """Matched by the linked OAuth account even when the provider's email moved."""
+    set_allow_signup(users_app, True)
+    install_fake_provider(users_app, "ms-linked", "before@example.com")
+    assert (await oauth_callback(anon_client)).status_code == 303
+
+    set_allow_signup(users_app, False)
+    anon_client.cookies.clear()
+    install_fake_provider(users_app, "ms-linked", "after@example.com")
+
+    assert (await oauth_callback(anon_client)).status_code == 303
+    assert await find_user(users_app, "after@example.com") is None

simple_module_users-0.0.37/tests/test_users_oauth_unverified_link.py

@@ -0,0 +1,85 @@
+"""OAuth never links by email to an unverified password account (GH #547).
+
+With ``require_verification`` off anyone can register ``victim@corp.com`` with
+a password and sign in. If the real owner later signs in with SSO, associating
+by email would hand them — and the attacker — one shared account.
+"""
+
+from __future__ import annotations
+
+import uuid
+from datetime import UTC, datetime
+
+import pytest
+from _users_oauth_support import (
+    install_fake_provider,
+    oauth_callback,
+    seed_password_user,
+    set_allow_signup,
+)
+from fastapi_users.password import PasswordHelper
+from sqlalchemy import select
+from users.models import OAuthAccount, User
+
+_EMAIL = "victim@example.com"
+
+
+async def _links(app, user_id: uuid.UUID) -> list[OAuthAccount]:
+    async with app.state.sm.db.session_factory() as session:
+        stmt = select(OAuthAccount).where(OAuthAccount.user_id == user_id)
+        return list((await session.execute(stmt)).scalars())
+
+
+@pytest.mark.anyio
+@pytest.mark.parametrize("allow_signup", [True, False])
+async def test_unverified_password_account_is_not_linked(users_app, anon_client, allow_signup):
+    set_allow_signup(users_app, allow_signup)
+    user_id = await seed_password_user(users_app, _EMAIL, is_verified=False)
+    install_fake_provider(users_app, "ms-victim", _EMAIL)
+
+    resp = await oauth_callback(anon_client)
+
+    assert resp.status_code == 403
+    assert resp.json()["detail"] == "OAUTH_ACCOUNT_NOT_VERIFIED"
+    assert users_app.state.users.settings.cookie_name not in resp.cookies
+    assert await _links(users_app, user_id) == []
+
+
+@pytest.mark.anyio
+async def test_verified_account_links(users_app, anon_client):
+    user_id = await seed_password_user(users_app, _EMAIL, is_verified=True)
+    install_fake_provider(users_app, "ms-owner", _EMAIL)
+
+    assert (await oauth_callback(anon_client)).status_code == 303
+    assert [a.account_id for a in await _links(users_app, user_id)] == ["ms-owner"]
+
+
+@pytest.mark.anyio
+async def test_pending_invite_links(users_app, anon_client):
+    """An invite's password is random and unknown, so nobody else holds the account."""
+    user_id = await seed_password_user(
+        users_app, _EMAIL, is_verified=False, invited_at=datetime.now(UTC)
+    )
+    install_fake_provider(users_app, "ms-invitee", _EMAIL)
+
+    assert (await oauth_callback(anon_client)).status_code == 303
+    assert len(await _links(users_app, user_id)) == 1
+
+
+@pytest.mark.anyio
+async def test_already_linked_account_signs_in(users_app, anon_client):
+    """Found by its OAuth link, not by email — verification is not asked for."""
+    set_allow_signup(users_app, True)
+    install_fake_provider(users_app, "ms-linked", "linked@example.com")
+    assert (await oauth_callback(anon_client)).status_code == 303
+    async with users_app.state.sm.db.session_factory() as session:
+        user = (
+            await session.execute(select(User).where(User.email == "linked@example.com"))
+        ).scalar_one()
+        user.is_verified = False
+        user.hashed_password = PasswordHelper().hash("SecurePass1!")
+        user.is_external = False
+        await session.commit()
+
+    anon_client.cookies.clear()
+    assert (await oauth_callback(anon_client)).status_code == 303