simple-module-users 0.0.37__tar.gz → 0.0.38__tar.gz

{simple_module_users-0.0.37 → simple_module_users-0.0.38}/.gitignore

@@ -7,8 +7,6 @@ build/
 .venv/
 *.egg
 
-# UV
-uv.lock
 
 # Node
 node_modules/
@@ -65,3 +63,4 @@ host/client_app/.playwright-cli/*
 .qa/
 .verify/
 /openapi.json
+qa-shots/

{simple_module_users-0.0.37 → simple_module_users-0.0.38}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_users
-Version: 0.0.37
+Version: 0.0.38
 Summary: Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -21,14 +21,14 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Typing :: Typed
 Requires-Python: >=3.12
-Requires-Dist: aiosmtplib>=3.0
 Requires-Dist: cachetools>=5.3
 Requires-Dist: fastapi-users[oauth,sqlalchemy]<16,>=15
-Requires-Dist: simple-module-auth==0.0.37
-Requires-Dist: simple-module-core==0.0.37
-Requires-Dist: simple-module-db==0.0.37
-Requires-Dist: simple-module-hosting==0.0.37
-Requires-Dist: simple-module-settings==0.0.37
+Requires-Dist: simple-module-auth==0.0.38
+Requires-Dist: simple-module-core==0.0.38
+Requires-Dist: simple-module-db==0.0.38
+Requires-Dist: simple-module-hosting==0.0.38
+Requires-Dist: simple-module-mail==0.0.38
+Requires-Dist: simple-module-settings==0.0.38
 Requires-Dist: typer>=0.12
 Description-Content-Type: text/markdown
 
@@ -52,7 +52,7 @@ Pre-wired into any app scaffolded with `smpy new`.
 - Bootstrap admin via env vars (`SM_USERS_BOOTSTRAP_EMAIL` + `SM_USERS_BOOTSTRAP_PASSWORD`) — idempotent, only creates if the users table is empty.
 - `smpy users create-admin` CLI for ad-hoc admin creation.
 - Inertia pages for login/register/invite-accept/admin-invite.
-- Console mailer (logs to stdout) or SMTP mailer (`SM_USERS_MAILER=smtp`).
+- Sends verification, reset and invite emails through the framework mail sender (configure the transport in the `mail` module).
 - Demo mode — one-click, read-only shared **admin** and **standard user** accounts on the sign-in card, for public showcase instances.
 
 ## Usage
@@ -73,7 +73,7 @@ SM_USERS_BOOTSTRAP_PASSWORD=change-me
 Program:
 
 ```python
-from auth.deps import CurrentUser  # type: ignore[import-not-found]
+from auth.deps import CurrentUser
 
 
 @router.get("/profile")
@@ -84,7 +84,7 @@ async def profile(user: CurrentUser):
 ## Depends on
 
 - `simple_module_core`, `simple_module_db`, `simple_module_hosting`, `simple_module_settings`, `simple_module_auth`
-- `fastapi-users[sqlalchemy,oauth]>=15,<16`, `aiosmtplib`, `cachetools`, `typer`
+- `fastapi-users[sqlalchemy,oauth]>=15,<16`, `cachetools`, `typer`
 
 ## Demo mode
 

{simple_module_users-0.0.37 → simple_module_users-0.0.38}/README.md

@@ -18,7 +18,7 @@ Pre-wired into any app scaffolded with `smpy new`.
 - Bootstrap admin via env vars (`SM_USERS_BOOTSTRAP_EMAIL` + `SM_USERS_BOOTSTRAP_PASSWORD`) — idempotent, only creates if the users table is empty.
 - `smpy users create-admin` CLI for ad-hoc admin creation.
 - Inertia pages for login/register/invite-accept/admin-invite.
-- Console mailer (logs to stdout) or SMTP mailer (`SM_USERS_MAILER=smtp`).
+- Sends verification, reset and invite emails through the framework mail sender (configure the transport in the `mail` module).
 - Demo mode — one-click, read-only shared **admin** and **standard user** accounts on the sign-in card, for public showcase instances.
 
 ## Usage
@@ -39,7 +39,7 @@ SM_USERS_BOOTSTRAP_PASSWORD=change-me
 Program:
 
 ```python
-from auth.deps import CurrentUser  # type: ignore[import-not-found]
+from auth.deps import CurrentUser
 
 
 @router.get("/profile")
@@ -50,7 +50,7 @@ async def profile(user: CurrentUser):
 ## Depends on
 
 - `simple_module_core`, `simple_module_db`, `simple_module_hosting`, `simple_module_settings`, `simple_module_auth`
-- `fastapi-users[sqlalchemy,oauth]>=15,<16`, `aiosmtplib`, `cachetools`, `typer`
+- `fastapi-users[sqlalchemy,oauth]>=15,<16`, `cachetools`, `typer`
 
 ## Demo mode
 

{simple_module_users-0.0.37 → simple_module_users-0.0.38}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simple-module-py/users",
-  "version": "0.1.0",
+  "version": "0.0.38",
   "private": true,
   "description": "Frontend assets for the Users module",
   "peerDependencies": {

{simple_module_users-0.0.37 → simple_module_users-0.0.38}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_users"
-version = "0.0.37"
+version = "0.0.38"
 description = "Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps"
 readme = "README.md"
 license = "MIT"
@@ -21,16 +21,18 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "simple_module_core==0.0.37",
-    "simple_module_db==0.0.37",
-    "simple_module_hosting==0.0.37",
-    "simple_module_settings==0.0.37",
-    "simple_module_auth==0.0.37",
+    "simple_module_core==0.0.38",
+    "simple_module_db==0.0.38",
+    "simple_module_hosting==0.0.38",
+    "simple_module_settings==0.0.38",
+    "simple_module_auth==0.0.38",
+    # Sends through the framework mail sender; `mail` owns the SMTP transport
+    # (GH #496), so an upgrade keeps delivering mail.
+    "simple_module_mail==0.0.38",
     # Pinned to a narrow range: `deps.py` relies on mutating CookieTransport
     # fields after construction (see reconfigure_cookie_transport in backend.py).
     # Bumping the major version requires re-checking those field names.
     "fastapi-users[sqlalchemy,oauth]>=15,<16",
-    "aiosmtplib>=3.0",
     "cachetools>=5.3",
     "typer>=0.12",
 ]
@@ -63,3 +65,4 @@ simple_module_db = { workspace = true }
 simple_module_hosting = { workspace = true }
 simple_module_settings = { workspace = true }
 simple_module_auth = { workspace = true }
+simple_module_mail = { workspace = true }

{simple_module_users-0.0.37 → simple_module_users-0.0.38}/tests/_middleware_support.py

@@ -60,8 +60,14 @@ async def _build_app(db_state, inner_handler=None, *, principal_resolvers=None):
 
     app = FastAPI()
     app.state.sm = SimpleNamespace(db=db_state)
+    from simple_module_core.public_routes import PublicRouteRegistry
+    from users.module import UsersModule
     from users.provider import UsersAuthProvider
 
+    # The host fills this from every module's register_public_routes at boot.
+    app.state.public_routes = PublicRouteRegistry()
+    UsersModule().register_public_routes(app.state.public_routes)
+
     app.state.auth = AuthState(
         auth_provider=UsersAuthProvider(),
         principal_resolvers=list(principal_resolvers or []),

{simple_module_users-0.0.37 → simple_module_users-0.0.38}/tests/_users_app_builders.py

@@ -7,9 +7,12 @@ wiring. Not named ``test_*`` so pytest does not collect it.
 
 from __future__ import annotations
 
+import httpx
 from simple_module_hosting.settings import Settings
 from users.constants import ADMIN_ROLE_ID, USER_ROLE_ID
 
+ALICE = "alice@example.com"
+
 # ---------------------------------------------------------------------------
 
 
@@ -17,7 +20,6 @@ def _users_overrides(allow_signup: bool = False) -> dict[str, tuple[str, str]]:
     """Values seeded into the ``SettingsStore`` before the app lifespan runs."""
     return {
         "allow_signup": (str(allow_signup).lower(), "bool"),
-        "mailer": ("console", "string"),
         "base_url": ("http://testserver", "string"),
         "cookie_secure": ("false", "bool"),
         # 32+ bytes to clear pyjwt's InsecureKeyLengthWarning for HMAC-SHA256.
@@ -84,7 +86,9 @@ async def _seed_roles(application) -> None:
         await session.commit()
 
 
-async def _seed_users_settings(application, *, allow_signup: bool) -> None:
+async def _seed_users_settings(
+    application, *, allow_signup: bool, overrides: dict[str, tuple[str, str]] | None = None
+) -> None:
     """Write the test UsersSettings overrides to the DB before hydrate runs.
 
     Hydrate fires inside the lifespan ``__aenter__``, so this needs to land
@@ -95,7 +99,8 @@ async def _seed_users_settings(application, *, allow_signup: bool) -> None:
 
     async with application.state.sm.db.session_factory() as session:
         store = SettingsStore(SettingService(session))
-        for field, (raw, vtype) in _users_overrides(allow_signup=allow_signup).items():
+        rows = _users_overrides(allow_signup=allow_signup) | (overrides or {})
+        for field, (raw, vtype) in rows.items():
             await store.set_override("users", field, raw, vtype)
         await session.commit()
 
@@ -136,19 +141,33 @@ async def _make_standard_user(app, email: str = "user@example.com"):
     return user
 
 
-async def _build_users_app(monkeypatch, *, allow_signup: bool, seed_admin: bool = True):
-    """Build a test FastAPI app with DB created, settings seeded, lifespan started."""
+async def _build_users_app(
+    monkeypatch,
+    *,
+    allow_signup: bool,
+    seed_admin: bool = True,
+    database_url: str = "sqlite+aiosqlite:///:memory:",
+    overrides: dict[str, tuple[str, str]] | None = None,
+):
+    """Build a test FastAPI app with DB created, settings seeded, lifespan started.
+
+    ``database_url`` lets several apps share one SQLite file, standing in for
+    workers of one deployment; ``overrides`` adds ``UsersSettings`` rows.
+    """
     from simple_module_hosting.app_builder import create_app
 
     settings = Settings(
-        database_url="sqlite+aiosqlite:///:memory:",
+        database_url=database_url,
         environment="testing",
         secret_key="test-secret-key",
         multi_tenant=False,
+        # Explicit: a developer's .env pointing at the shared Redis would make
+        # login-lockout counters outlive the test that wrote them.
+        redis_url=None,
     )
     application = create_app(settings)
     await _setup_app_db(application)
-    await _seed_users_settings(application, allow_signup=allow_signup)
+    await _seed_users_settings(application, allow_signup=allow_signup, overrides=overrides)
 
     ctx = application.router.lifespan_context(application)
     await ctx.__aenter__()
@@ -161,3 +180,30 @@ async def _build_users_app(monkeypatch, *, allow_signup: bool, seed_admin: bool
     if seed_admin:
         await _make_admin_user(application)
     return application, ctx
+
+
+# ---------------------------------------------------------------------------
+# Request and row helpers for the login-lockout tests
+# ---------------------------------------------------------------------------
+
+
+def _client(app, ip: str) -> httpx.AsyncClient:
+    """A client whose requests arrive from *ip*."""
+    transport = httpx.ASGITransport(app=app, client=(ip, 1))
+    return httpx.AsyncClient(transport=transport, base_url="http://testserver")
+
+
+async def _login(app, ip: str, username: str, password: str = "wrong") -> httpx.Response:
+    async with _client(app, ip) as c:
+        return await c.post(
+            "/api/users/auth/login", data={"username": username, "password": password}
+        )
+
+
+async def user_row(app, email: str):
+    """The ``User`` row for *email*, or ``None``, read in a fresh session."""
+    from sqlalchemy import select
+    from users.models import User
+
+    async with app.state.sm.db.session_factory() as session:
+        return (await session.execute(select(User).where(User.email == email))).scalar_one_or_none()

{simple_module_users-0.0.37 → simple_module_users-0.0.38}/tests/conftest.py

@@ -2,7 +2,7 @@
 
 The ``users_app`` fixture builds a full FastAPI app via ``create_app`` but
 with an in-memory SQLite database, seeded roles, and test-friendly settings
-(ConsoleMailer, signup disabled by default, short secrets).
+(no mail sender installed, signup disabled by default, short secrets).
 
 The ``anon_client`` gives a plain httpx client.
 The ``admin_client`` gives a client with a signed local-user session cookie
@@ -21,6 +21,7 @@ import pytest
 # top-level modules on pytest's sys.path — same mechanism as the
 # _middleware_support plugin loaded at the bottom of this file.
 from _users_app_builders import (
+    ALICE,
     _build_users_app,
     _make_admin_user,
     _make_standard_user,
@@ -148,6 +149,12 @@ async def user_client(users_app) -> AsyncGenerator[httpx.AsyncClient, None]:
         yield c
 
 
+@pytest.fixture
+async def alice(users_app):
+    """A standard user, ``ALICE``, for the login-lockout tests."""
+    return await _make_standard_user(users_app, ALICE)
+
+
 # ---------------------------------------------------------------------------
 # DB session fixture scoped to users_app
 # ---------------------------------------------------------------------------

{simple_module_users-0.0.37 → simple_module_users-0.0.38}/tests/test_admin_resend_invite.py

@@ -10,6 +10,7 @@ message nobody received.
 from __future__ import annotations
 
 import logging
+import re
 from datetime import UTC, datetime, timedelta
 
 import pytest
@@ -174,14 +175,15 @@ class TestResendInvite:
 
 class TestInviteTokenClaims:
     @pytest.mark.anyio
-    async def test_invite_token_names_the_inviter(self, admin_client, users_app, caplog):
+    async def test_invite_token_names_the_inviter(self, admin_client, users_app, captured_mail):
         """The accept-invite card says who invited you; the claim carries it."""
         import jwt
 
-        with caplog.at_level(logging.INFO, logger="users.mailer"):
-            await _invite(admin_client, "whosent@example.com")
-        link = next(r for r in caplog.records if r.getMessage() == "users.invite.email").link
-        token = link.split("token=", 1)[1]
+        await _invite(admin_client, "whosent@example.com")
+        text = next(
+            m.text for m in captured_mail.to("whosent@example.com") if "invited you" in m.subject
+        )
+        token = re.search(r"token=(\S+)", text).group(1)
 
         payload = jwt.decode(
             token,

simple_module_users-0.0.38/tests/test_api_admin_pagination_bounds.py

@@ -0,0 +1,31 @@
+"""``GET /api/users/admin`` validates paging like every other JSON list (#513)."""
+
+from __future__ import annotations
+
+import pytest
+from simple_module_db.pagination import MAX_PAGE, MAX_PER_PAGE
+
+ADMIN_URL = "/api/users/admin"
+
+
+@pytest.mark.parametrize(
+    "params",
+    [
+        {"page": 0},
+        {"page": -3},
+        {"page": MAX_PAGE + 1},
+        {"per_page": 0},
+        {"per_page": -1},
+        {"per_page": MAX_PER_PAGE + 1},
+        {"per_page": 100000},
+    ],
+)
+async def test_rejects_out_of_range(params: dict, admin_client, users_db) -> None:
+    resp = await admin_client.get(ADMIN_URL, params=params)
+    assert resp.status_code == 422
+
+
+async def test_accepts_bounds(admin_client, users_db) -> None:
+    resp = await admin_client.get(ADMIN_URL, params={"page": MAX_PAGE, "per_page": MAX_PER_PAGE})
+    assert resp.status_code == 200
+    assert resp.json() == []

{simple_module_users-0.0.37 → simple_module_users-0.0.38}/tests/test_auth_screens_props.py

@@ -62,7 +62,7 @@ class TestForgotPasswordProps:
 
     @pytest.mark.anyio
     async def test_console_mailer_does_not_deliver(self, anon_client):
-        """The test app runs the ConsoleMailer, so the amber callout must show."""
+        """The test app has no delivering mail sender, so the amber callout must show."""
         props = _props(await anon_client.get("/users/forgot-password", headers=_INERTIA_HEADERS))
         assert props["mailer_delivers"] is False
 

{simple_module_users-0.0.37 → simple_module_users-0.0.38}/tests/test_bearer_token_expiry.py

@@ -192,16 +192,20 @@ class TestAPasswordChangeStrandsBearerTokens:
     async def test_changing_the_password_deletes_the_rows(self, users_app, anon_client):
         """The stamped counter already strands them; deleting is what stops a
         stolen token resolving a row at all, and stops the refresh tokens
-        minting fresh ones behind it."""
+        minting fresh ones behind it. The one row left is the changing
+        browser's reissued ``sm_auth`` credential, minted under the new counter."""
         assert (await anon_client.post(_LOGIN, data=_CREDS)).status_code == 204
-        assert await _tokens(users_app)
+        before = {row.token for row in await _tokens(users_app)}
+        assert before
 
         resp = await anon_client.post(
             "/api/users/me/password",
             json={"current_password": "AdminPass1!", "new_password": "NewAdminPass1!"},
         )
         assert resp.status_code == 204, resp.text
-        assert await _tokens(users_app) == []
+        reissued = await _only_token(users_app)
+        assert reissued.token not in before
+        assert reissued.session_version == 1
 
 
 class TestTheMintedCounterIsCurrent:

{simple_module_users-0.0.37 → simple_module_users-0.0.38}/tests/test_bootstrap.py

@@ -187,7 +187,7 @@ async def test_bootstrap_from_env_noop_when_unset(users_app_empty) -> None:
         bootstrap_password="",
     )
     # Patch fake_app.state onto a real app-like object
-    await bootstrap_admin_from_env(fake_app)  # type: ignore[arg-type]
+    await bootstrap_admin_from_env(fake_app)
 
     # No users should have been created
     async with users_app_empty.state.sm.db.session_factory() as s:
@@ -217,7 +217,7 @@ async def test_bootstrap_from_env_noop_when_table_nonempty(users_app_empty) -> N
         bootstrap_email="admin@test.example",
         bootstrap_password="AdminPass1!",
     )
-    await bootstrap_admin_from_env(fake_app)  # type: ignore[arg-type]
+    await bootstrap_admin_from_env(fake_app)
 
     # Only the original dummy user should exist
     async with users_app_empty.state.sm.db.session_factory() as s:
@@ -236,7 +236,7 @@ async def test_bootstrap_from_env_creates_admin_when_empty_and_configured(users_
         bootstrap_email="bootstrap@test.example",
         bootstrap_password="BootPass1!",
     )
-    await bootstrap_admin_from_env(fake_app)  # type: ignore[arg-type]
+    await bootstrap_admin_from_env(fake_app)
 
     async with users_app_empty.state.sm.db.session_factory() as s:
         user = (
@@ -247,3 +247,31 @@ async def test_bootstrap_from_env_creates_admin_when_empty_and_configured(users_
     assert user.is_superuser is True
     assert user.is_verified is True
     assert user.is_active is True
+
+
+@pytest.mark.parametrize("generated", [False, True])
+async def test_bootstrap_logs_generated_password_only_once(
+    users_app_empty, monkeypatch, caplog, generated
+):
+    if generated:
+        monkeypatch.setenv("SM_USERS_BOOTSTRAP_PASSWORD_GENERATED", "1")
+    fake_app = _make_fake_app(
+        users_app_empty.state.sm.db.session_factory,
+        bootstrap_email="first@test.example",
+        bootstrap_password="GeneratedPass1!",
+    )
+    with caplog.at_level("WARNING", logger="users.bootstrap"):
+        await bootstrap_admin_from_env(fake_app)
+        first_messages = list(caplog.messages)
+        caplog.clear()
+        # A restart generates a different unused password for an existing install.
+        fake_app.state.users.settings.bootstrap_password = "UnusedPass2!"
+        await bootstrap_admin_from_env(fake_app)
+    assert caplog.messages == []
+    if generated:
+        assert first_messages == [
+            "first-boot admin created; store this password securely: "
+            "first@test.example / GeneratedPass1!"
+        ]
+    else:
+        assert first_messages == []

{simple_module_users-0.0.37 → simple_module_users-0.0.38}/tests/test_bulk_invite_message.py

@@ -8,8 +8,6 @@ rather than stopping at the API boundary.
 
 from __future__ import annotations
 
-import logging
-
 import pytest
 
 _URL = "/api/users/admin/invite/bulk"
@@ -111,11 +109,15 @@ class TestBulkInviteMessage:
         assert row["state"] == "invited"
 
 
-class TestConsoleMailerMessage:
+class TestTemplatedMailerMessage:
+    @pytest.mark.anyio
+    async def test_mailer_quotes_the_message(self, users_app, captured_mail):
+        mailer = users_app.state.users.mailer
+        await mailer.send_invite("x@example.com", "tok", "Alex Doyle", "See you Monday.")
+        assert "See you Monday." in captured_mail.to("x@example.com")[0].text
+
     @pytest.mark.anyio
-    async def test_console_mailer_logs_the_message(self, users_app, caplog):
+    async def test_blank_message_leaves_no_quote(self, users_app, captured_mail):
         mailer = users_app.state.users.mailer
-        with caplog.at_level(logging.INFO, logger="users.mailer"):
-            await mailer.send_invite("x@example.com", "tok", "Alex Doyle", "See you Monday.")
-        record = next(r for r in caplog.records if r.getMessage() == "users.invite.email")
-        assert record.message_body == "See you Monday."
+        await mailer.send_invite("x@example.com", "tok", "Alex Doyle", "   \n ")
+        assert "See you" not in captured_mail.to("x@example.com")[0].text

{simple_module_users-0.0.37 → simple_module_users-0.0.38}/tests/test_demo_account.py

@@ -9,6 +9,7 @@ feature is off. The third, a demo session that is allowed to write, is
 from __future__ import annotations
 
 from _demo_support import DEMO_ADMIN_EMAIL, DEMO_USER_EMAIL
+from _users_app_builders import user_row
 from sqlalchemy import select
 from users.constants import ADMIN_ROLE_NAME, USER_ROLE_NAME
 from users.demo import (
@@ -75,11 +76,6 @@ def test_read_only_is_the_default_posture():
 # ── seeding ─────────────────────────────────────────────────────────────────
 
 
-async def _row(app, email: str) -> User | None:
-    async with app.state.sm.db.session_factory() as session:
-        return (await session.execute(select(User).where(User.email == email))).scalar_one_or_none()
-
-
 async def _role_names(app, user_id) -> list[str]:
     async with app.state.sm.db.session_factory() as session:
         return list(
@@ -102,8 +98,8 @@ async def test_ensure_demo_users_seeds_both_accounts(users_app):
 
     assert len(ids) == 2
     assert users_app.state.users.demo_user_ids == ids
-    admin = await _row(users_app, DEMO_ADMIN_EMAIL)
-    user = await _row(users_app, DEMO_USER_EMAIL)
+    admin = await user_row(users_app, DEMO_ADMIN_EMAIL)
+    user = await user_row(users_app, DEMO_USER_EMAIL)
     assert admin is not None and admin.is_superuser
     assert user is not None and not user.is_superuser
     assert all(row.is_active and row.is_verified for row in (admin, user))
@@ -113,8 +109,8 @@ async def test_each_account_gets_its_own_role(users_app):
     users_app.state.users.settings.demo_mode = True
     await ensure_demo_users(users_app)
 
-    admin = await _row(users_app, DEMO_ADMIN_EMAIL)
-    user = await _row(users_app, DEMO_USER_EMAIL)
+    admin = await user_row(users_app, DEMO_ADMIN_EMAIL)
+    user = await user_row(users_app, DEMO_USER_EMAIL)
     assert await _role_names(users_app, admin.id) == [ADMIN_ROLE_NAME]
     assert await _role_names(users_app, user.id) == [USER_ROLE_NAME]
 
@@ -124,8 +120,8 @@ async def test_a_blank_password_still_produces_usable_accounts(users_app):
     users_app.state.users.settings.demo_mode = True
     await ensure_demo_users(users_app)
 
-    assert (await _row(users_app, DEMO_ADMIN_EMAIL)).hashed_password
-    assert (await _row(users_app, DEMO_USER_EMAIL)).hashed_password
+    assert (await user_row(users_app, DEMO_ADMIN_EMAIL)).hashed_password
+    assert (await user_row(users_app, DEMO_USER_EMAIL)).hashed_password
 
 
 async def test_a_generated_password_is_not_re_rolled_on_every_boot(users_app):
@@ -133,23 +129,23 @@ async def test_a_generated_password_is_not_re_rolled_on_every_boot(users_app):
     worker per restart, for no gain."""
     users_app.state.users.settings.demo_mode = True
     await ensure_demo_users(users_app)
-    first = (await _row(users_app, DEMO_ADMIN_EMAIL)).hashed_password
+    first = (await user_row(users_app, DEMO_ADMIN_EMAIL)).hashed_password
 
     await ensure_demo_users(users_app)
 
-    assert (await _row(users_app, DEMO_ADMIN_EMAIL)).hashed_password == first
+    assert (await user_row(users_app, DEMO_ADMIN_EMAIL)).hashed_password == first
 
 
 async def test_a_configured_password_is_reapplied(users_app):
     """Changing a demo password in the admin UI has to take effect."""
     users_app.state.users.settings.demo_mode = True
     await ensure_demo_users(users_app)
-    first = (await _row(users_app, DEMO_USER_EMAIL)).hashed_password
+    first = (await user_row(users_app, DEMO_USER_EMAIL)).hashed_password
 
     users_app.state.users.settings.demo_user_password = "a-published-demo-password"
     await ensure_demo_users(users_app)
 
-    assert (await _row(users_app, DEMO_USER_EMAIL)).hashed_password != first
+    assert (await user_row(users_app, DEMO_USER_EMAIL)).hashed_password != first
 
 
 async def test_demo_off_clears_the_cached_ids(users_app):

{simple_module_users-0.0.37 → simple_module_users-0.0.38}/tests/test_edit_recent_activity.py

@@ -102,7 +102,7 @@ class TestRecentActivity:
         settings.
         """
         from audit_log.models import AuditEntry
-        from settings.models import Setting
+        from simple_module_db.stored_settings import Setting
 
         user_id = await _admin_id(users_app)
         async with users_app.state.sm.db.session_factory() as session:
@@ -147,17 +147,19 @@ class TestRecentActivity:
 
     @pytest.mark.anyio
     async def test_prop_is_none_when_audit_log_is_not_installed(self, admin_client, users_app):
-        """Absent module, absent card — not an empty one claiming no activity."""
-        sm = users_app.state.sm
-        loaded = sm.modules
-        trimmed = type(loaded)(m for m in loaded if getattr(m.meta, "name", "") != "AuditLog")
-        assert len(trimmed) < len(loaded), "audit_log was not loaded, so this proves nothing"
-        # ``sm`` is a frozen dataclass, so this is the only way to model an app
-        # built without the module short of building a second one.
-        object.__setattr__(sm, "modules", trimmed)
+        """No activity feed, absent card — not an empty one claiming no activity.
+
+        The card reads the core activity feed that ``audit_log`` installs
+        (GH #501); an app built without the module has none.
+        """
+        from simple_module_core.activity_feed import get_activity_feed, set_activity_feed
+
+        feed = get_activity_feed(users_app)
+        assert feed is not None, "audit_log installed no feed, so this proves nothing"
+        set_activity_feed(users_app, None)
         try:
             user_id = await _admin_id(users_app)
             props = await _edit_props(admin_client, user_id)
             assert props["recent_activity"] is None
         finally:
-            object.__setattr__(sm, "modules", loaded)
+            set_activity_feed(users_app, feed)