simple-module-users 0.0.37__tar.gz → 0.0.39__tar.gz

{simple_module_users-0.0.37 → simple_module_users-0.0.39}/.gitignore

@@ -7,8 +7,6 @@ build/
 .venv/
 *.egg
 
-# UV
-uv.lock
 
 # Node
 node_modules/
@@ -65,3 +63,4 @@ host/client_app/.playwright-cli/*
 .qa/
 .verify/
 /openapi.json
+qa-shots/

{simple_module_users-0.0.37 → simple_module_users-0.0.39}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_users
-Version: 0.0.37
+Version: 0.0.39
 Summary: Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -21,15 +21,15 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Typing :: Typed
 Requires-Python: >=3.12
-Requires-Dist: aiosmtplib>=3.0
-Requires-Dist: cachetools>=5.3
+Requires-Dist: cachetools<8,>=5.3
 Requires-Dist: fastapi-users[oauth,sqlalchemy]<16,>=15
-Requires-Dist: simple-module-auth==0.0.37
-Requires-Dist: simple-module-core==0.0.37
-Requires-Dist: simple-module-db==0.0.37
-Requires-Dist: simple-module-hosting==0.0.37
-Requires-Dist: simple-module-settings==0.0.37
-Requires-Dist: typer>=0.12
+Requires-Dist: simple-module-auth==0.0.39
+Requires-Dist: simple-module-core==0.0.39
+Requires-Dist: simple-module-db==0.0.39
+Requires-Dist: simple-module-hosting==0.0.39
+Requires-Dist: simple-module-mail==0.0.39
+Requires-Dist: simple-module-settings==0.0.39
+Requires-Dist: typer<0.28,>=0.12
 Description-Content-Type: text/markdown
 
 # simple_module_users
@@ -52,7 +52,7 @@ Pre-wired into any app scaffolded with `smpy new`.
 - Bootstrap admin via env vars (`SM_USERS_BOOTSTRAP_EMAIL` + `SM_USERS_BOOTSTRAP_PASSWORD`) — idempotent, only creates if the users table is empty.
 - `smpy users create-admin` CLI for ad-hoc admin creation.
 - Inertia pages for login/register/invite-accept/admin-invite.
-- Console mailer (logs to stdout) or SMTP mailer (`SM_USERS_MAILER=smtp`).
+- Sends verification, reset and invite emails through the framework mail sender (configure the transport in the `mail` module).
 - Demo mode — one-click, read-only shared **admin** and **standard user** accounts on the sign-in card, for public showcase instances.
 
 ## Usage
@@ -73,7 +73,7 @@ SM_USERS_BOOTSTRAP_PASSWORD=change-me
 Program:
 
 ```python
-from auth.deps import CurrentUser  # type: ignore[import-not-found]
+from auth.deps import CurrentUser
 
 
 @router.get("/profile")
@@ -84,7 +84,7 @@ async def profile(user: CurrentUser):
 ## Depends on
 
 - `simple_module_core`, `simple_module_db`, `simple_module_hosting`, `simple_module_settings`, `simple_module_auth`
-- `fastapi-users[sqlalchemy,oauth]>=15,<16`, `aiosmtplib`, `cachetools`, `typer`
+- `fastapi-users[sqlalchemy,oauth]>=15,<16`, `cachetools`, `typer`
 
 ## Demo mode
 

{simple_module_users-0.0.37 → simple_module_users-0.0.39}/README.md

@@ -18,7 +18,7 @@ Pre-wired into any app scaffolded with `smpy new`.
 - Bootstrap admin via env vars (`SM_USERS_BOOTSTRAP_EMAIL` + `SM_USERS_BOOTSTRAP_PASSWORD`) — idempotent, only creates if the users table is empty.
 - `smpy users create-admin` CLI for ad-hoc admin creation.
 - Inertia pages for login/register/invite-accept/admin-invite.
-- Console mailer (logs to stdout) or SMTP mailer (`SM_USERS_MAILER=smtp`).
+- Sends verification, reset and invite emails through the framework mail sender (configure the transport in the `mail` module).
 - Demo mode — one-click, read-only shared **admin** and **standard user** accounts on the sign-in card, for public showcase instances.
 
 ## Usage
@@ -39,7 +39,7 @@ SM_USERS_BOOTSTRAP_PASSWORD=change-me
 Program:
 
 ```python
-from auth.deps import CurrentUser  # type: ignore[import-not-found]
+from auth.deps import CurrentUser
 
 
 @router.get("/profile")
@@ -50,7 +50,7 @@ async def profile(user: CurrentUser):
 ## Depends on
 
 - `simple_module_core`, `simple_module_db`, `simple_module_hosting`, `simple_module_settings`, `simple_module_auth`
-- `fastapi-users[sqlalchemy,oauth]>=15,<16`, `aiosmtplib`, `cachetools`, `typer`
+- `fastapi-users[sqlalchemy,oauth]>=15,<16`, `cachetools`, `typer`
 
 ## Demo mode
 

{simple_module_users-0.0.37 → simple_module_users-0.0.39}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simple-module-py/users",
-  "version": "0.1.0",
+  "version": "0.0.39",
   "private": true,
   "description": "Frontend assets for the Users module",
   "peerDependencies": {

{simple_module_users-0.0.37 → simple_module_users-0.0.39}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_users"
-version = "0.0.37"
+version = "0.0.39"
 description = "Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps"
 readme = "README.md"
 license = "MIT"
@@ -21,18 +21,20 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "simple_module_core==0.0.37",
-    "simple_module_db==0.0.37",
-    "simple_module_hosting==0.0.37",
-    "simple_module_settings==0.0.37",
-    "simple_module_auth==0.0.37",
+    "simple_module_core==0.0.39",
+    "simple_module_db==0.0.39",
+    "simple_module_hosting==0.0.39",
+    "simple_module_settings==0.0.39",
+    "simple_module_auth==0.0.39",
+    # Sends through the framework mail sender; `mail` owns the SMTP transport
+    # (GH #496), so an upgrade keeps delivering mail.
+    "simple_module_mail==0.0.39",
     # Pinned to a narrow range: `deps.py` relies on mutating CookieTransport
     # fields after construction (see reconfigure_cookie_transport in backend.py).
     # Bumping the major version requires re-checking those field names.
     "fastapi-users[sqlalchemy,oauth]>=15,<16",
-    "aiosmtplib>=3.0",
-    "cachetools>=5.3",
-    "typer>=0.12",
+    "cachetools>=5.3,<8",
+    "typer>=0.12,<0.28",
 ]
 
 [project.entry-points.simple_module]
@@ -63,3 +65,4 @@ simple_module_db = { workspace = true }
 simple_module_hosting = { workspace = true }
 simple_module_settings = { workspace = true }
 simple_module_auth = { workspace = true }
+simple_module_mail = { workspace = true }

{simple_module_users-0.0.37 → simple_module_users-0.0.39}/tests/_middleware_support.py

@@ -60,8 +60,14 @@ async def _build_app(db_state, inner_handler=None, *, principal_resolvers=None):
 
     app = FastAPI()
     app.state.sm = SimpleNamespace(db=db_state)
+    from simple_module_core.public_routes import PublicRouteRegistry
+    from users.module import UsersModule
     from users.provider import UsersAuthProvider
 
+    # The host fills this from every module's register_public_routes at boot.
+    app.state.public_routes = PublicRouteRegistry()
+    UsersModule().register_public_routes(app.state.public_routes)
+
     app.state.auth = AuthState(
         auth_provider=UsersAuthProvider(),
         principal_resolvers=list(principal_resolvers or []),

{simple_module_users-0.0.37 → simple_module_users-0.0.39}/tests/_users_app_builders.py

@@ -7,9 +7,12 @@ wiring. Not named ``test_*`` so pytest does not collect it.
 
 from __future__ import annotations
 
+import httpx
 from simple_module_hosting.settings import Settings
 from users.constants import ADMIN_ROLE_ID, USER_ROLE_ID
 
+ALICE = "alice@example.com"
+
 # ---------------------------------------------------------------------------
 
 
@@ -17,7 +20,6 @@ def _users_overrides(allow_signup: bool = False) -> dict[str, tuple[str, str]]:
     """Values seeded into the ``SettingsStore`` before the app lifespan runs."""
     return {
         "allow_signup": (str(allow_signup).lower(), "bool"),
-        "mailer": ("console", "string"),
         "base_url": ("http://testserver", "string"),
         "cookie_secure": ("false", "bool"),
         # 32+ bytes to clear pyjwt's InsecureKeyLengthWarning for HMAC-SHA256.
@@ -82,9 +84,16 @@ async def _seed_roles(application) -> None:
         if "user" not in existing:
             session.add(Role(id=USER_ROLE_ID, name="user", description="Standard user"))
         await session.commit()
+    # Direct inserts bypass the role service that would refresh the cache; startup
+    # already warmed it (with the role it seeds), so refresh like a real write would.
+    from users.roles_cache import refresh_roles_cache
+
+    await refresh_roles_cache(application)
 
 
-async def _seed_users_settings(application, *, allow_signup: bool) -> None:
+async def _seed_users_settings(
+    application, *, allow_signup: bool, overrides: dict[str, tuple[str, str]] | None = None
+) -> None:
     """Write the test UsersSettings overrides to the DB before hydrate runs.
 
     Hydrate fires inside the lifespan ``__aenter__``, so this needs to land
@@ -95,7 +104,8 @@ async def _seed_users_settings(application, *, allow_signup: bool) -> None:
 
     async with application.state.sm.db.session_factory() as session:
         store = SettingsStore(SettingService(session))
-        for field, (raw, vtype) in _users_overrides(allow_signup=allow_signup).items():
+        rows = _users_overrides(allow_signup=allow_signup) | (overrides or {})
+        for field, (raw, vtype) in rows.items():
             await store.set_override("users", field, raw, vtype)
         await session.commit()
 
@@ -136,19 +146,33 @@ async def _make_standard_user(app, email: str = "user@example.com"):
     return user
 
 
-async def _build_users_app(monkeypatch, *, allow_signup: bool, seed_admin: bool = True):
-    """Build a test FastAPI app with DB created, settings seeded, lifespan started."""
+async def _build_users_app(
+    monkeypatch,
+    *,
+    allow_signup: bool,
+    seed_admin: bool = True,
+    database_url: str = "sqlite+aiosqlite:///:memory:",
+    overrides: dict[str, tuple[str, str]] | None = None,
+):
+    """Build a test FastAPI app with DB created, settings seeded, lifespan started.
+
+    ``database_url`` lets several apps share one SQLite file, standing in for
+    workers of one deployment; ``overrides`` adds ``UsersSettings`` rows.
+    """
     from simple_module_hosting.app_builder import create_app
 
     settings = Settings(
-        database_url="sqlite+aiosqlite:///:memory:",
+        database_url=database_url,
         environment="testing",
         secret_key="test-secret-key",
         multi_tenant=False,
+        # Explicit: a developer's .env pointing at the shared Redis would make
+        # login-lockout counters outlive the test that wrote them.
+        redis_url=None,
     )
     application = create_app(settings)
     await _setup_app_db(application)
-    await _seed_users_settings(application, allow_signup=allow_signup)
+    await _seed_users_settings(application, allow_signup=allow_signup, overrides=overrides)
 
     ctx = application.router.lifespan_context(application)
     await ctx.__aenter__()
@@ -161,3 +185,30 @@ async def _build_users_app(monkeypatch, *, allow_signup: bool, seed_admin: bool
     if seed_admin:
         await _make_admin_user(application)
     return application, ctx
+
+
+# ---------------------------------------------------------------------------
+# Request and row helpers for the login-lockout tests
+# ---------------------------------------------------------------------------
+
+
+def _client(app, ip: str) -> httpx.AsyncClient:
+    """A client whose requests arrive from *ip*."""
+    transport = httpx.ASGITransport(app=app, client=(ip, 1))
+    return httpx.AsyncClient(transport=transport, base_url="http://testserver")
+
+
+async def _login(app, ip: str, username: str, password: str = "wrong") -> httpx.Response:
+    async with _client(app, ip) as c:
+        return await c.post(
+            "/api/users/auth/login", data={"username": username, "password": password}
+        )
+
+
+async def user_row(app, email: str):
+    """The ``User`` row for *email*, or ``None``, read in a fresh session."""
+    from sqlalchemy import select
+    from users.models import User
+
+    async with app.state.sm.db.session_factory() as session:
+        return (await session.execute(select(User).where(User.email == email))).scalar_one_or_none()

{simple_module_users-0.0.37 → simple_module_users-0.0.39}/tests/conftest.py

@@ -2,7 +2,7 @@
 
 The ``users_app`` fixture builds a full FastAPI app via ``create_app`` but
 with an in-memory SQLite database, seeded roles, and test-friendly settings
-(ConsoleMailer, signup disabled by default, short secrets).
+(no mail sender installed, signup disabled by default, short secrets).
 
 The ``anon_client`` gives a plain httpx client.
 The ``admin_client`` gives a client with a signed local-user session cookie
@@ -21,6 +21,7 @@ import pytest
 # top-level modules on pytest's sys.path — same mechanism as the
 # _middleware_support plugin loaded at the bottom of this file.
 from _users_app_builders import (
+    ALICE,
     _build_users_app,
     _make_admin_user,
     _make_standard_user,
@@ -148,6 +149,12 @@ async def user_client(users_app) -> AsyncGenerator[httpx.AsyncClient, None]:
         yield c
 
 
+@pytest.fixture
+async def alice(users_app):
+    """A standard user, ``ALICE``, for the login-lockout tests."""
+    return await _make_standard_user(users_app, ALICE)
+
+
 # ---------------------------------------------------------------------------
 # DB session fixture scoped to users_app
 # ---------------------------------------------------------------------------

simple_module_users-0.0.37/tests/test_demo_account.py → simple_module_users-0.0.39/tests/demo/test_users_demo_account.py

@@ -9,6 +9,7 @@ feature is off. The third, a demo session that is allowed to write, is
 from __future__ import annotations
 
 from _demo_support import DEMO_ADMIN_EMAIL, DEMO_USER_EMAIL
+from _users_app_builders import user_row
 from sqlalchemy import select
 from users.constants import ADMIN_ROLE_NAME, USER_ROLE_NAME
 from users.demo import (
@@ -75,11 +76,6 @@ def test_read_only_is_the_default_posture():
 # ── seeding ─────────────────────────────────────────────────────────────────
 
 
-async def _row(app, email: str) -> User | None:
-    async with app.state.sm.db.session_factory() as session:
-        return (await session.execute(select(User).where(User.email == email))).scalar_one_or_none()
-
-
 async def _role_names(app, user_id) -> list[str]:
     async with app.state.sm.db.session_factory() as session:
         return list(
@@ -102,8 +98,8 @@ async def test_ensure_demo_users_seeds_both_accounts(users_app):
 
     assert len(ids) == 2
     assert users_app.state.users.demo_user_ids == ids
-    admin = await _row(users_app, DEMO_ADMIN_EMAIL)
-    user = await _row(users_app, DEMO_USER_EMAIL)
+    admin = await user_row(users_app, DEMO_ADMIN_EMAIL)
+    user = await user_row(users_app, DEMO_USER_EMAIL)
     assert admin is not None and admin.is_superuser
     assert user is not None and not user.is_superuser
     assert all(row.is_active and row.is_verified for row in (admin, user))
@@ -113,8 +109,8 @@ async def test_each_account_gets_its_own_role(users_app):
     users_app.state.users.settings.demo_mode = True
     await ensure_demo_users(users_app)
 
-    admin = await _row(users_app, DEMO_ADMIN_EMAIL)
-    user = await _row(users_app, DEMO_USER_EMAIL)
+    admin = await user_row(users_app, DEMO_ADMIN_EMAIL)
+    user = await user_row(users_app, DEMO_USER_EMAIL)
     assert await _role_names(users_app, admin.id) == [ADMIN_ROLE_NAME]
     assert await _role_names(users_app, user.id) == [USER_ROLE_NAME]
 
@@ -124,8 +120,8 @@ async def test_a_blank_password_still_produces_usable_accounts(users_app):
     users_app.state.users.settings.demo_mode = True
     await ensure_demo_users(users_app)
 
-    assert (await _row(users_app, DEMO_ADMIN_EMAIL)).hashed_password
-    assert (await _row(users_app, DEMO_USER_EMAIL)).hashed_password
+    assert (await user_row(users_app, DEMO_ADMIN_EMAIL)).hashed_password
+    assert (await user_row(users_app, DEMO_USER_EMAIL)).hashed_password
 
 
 async def test_a_generated_password_is_not_re_rolled_on_every_boot(users_app):
@@ -133,23 +129,23 @@ async def test_a_generated_password_is_not_re_rolled_on_every_boot(users_app):
     worker per restart, for no gain."""
     users_app.state.users.settings.demo_mode = True
     await ensure_demo_users(users_app)
-    first = (await _row(users_app, DEMO_ADMIN_EMAIL)).hashed_password
+    first = (await user_row(users_app, DEMO_ADMIN_EMAIL)).hashed_password
 
     await ensure_demo_users(users_app)
 
-    assert (await _row(users_app, DEMO_ADMIN_EMAIL)).hashed_password == first
+    assert (await user_row(users_app, DEMO_ADMIN_EMAIL)).hashed_password == first
 
 
 async def test_a_configured_password_is_reapplied(users_app):
     """Changing a demo password in the admin UI has to take effect."""
     users_app.state.users.settings.demo_mode = True
     await ensure_demo_users(users_app)
-    first = (await _row(users_app, DEMO_USER_EMAIL)).hashed_password
+    first = (await user_row(users_app, DEMO_USER_EMAIL)).hashed_password
 
     users_app.state.users.settings.demo_user_password = "a-published-demo-password"
     await ensure_demo_users(users_app)
 
-    assert (await _row(users_app, DEMO_USER_EMAIL)).hashed_password != first
+    assert (await user_row(users_app, DEMO_USER_EMAIL)).hashed_password != first
 
 
 async def test_demo_off_clears_the_cached_ids(users_app):

simple_module_users-0.0.39/tests/demo/test_users_demo_credentials.py

@@ -0,0 +1,139 @@
+"""Demo read-only mode follows identities authenticated without demo cookies."""
+
+import httpx
+import pytest
+from api_tokens.constants import TokenKind
+from api_tokens.service import ApiTokenService
+from simple_module_test import forge_session_cookie
+from users.auth_local.token_api import _create_token_pair
+from users.demo import ensure_demo_users
+
+
+@pytest.fixture
+async def demo_credentials(demo_app):
+    settings = demo_app.state.users.settings
+    settings.demo_admin_password = "DemoPass1!"
+    await ensure_demo_users(demo_app)
+    user_id = demo_app.state.users.demo_user_ids[0]
+    async with demo_app.state.sm.db.session_factory() as db:
+        pair = await _create_token_pair(db, user_id, settings)
+        _, pat = await ApiTokenService(db).create(
+            kind=TokenKind.PERSONAL,
+            name="pre-existing demo PAT",
+            scopes=["users.manage", "api_tokens.use"],
+            expires_in_days=1,
+            max_lifetime_days=30,
+            owner_user_id=user_id,
+        )
+        await db.commit()
+    return {"bearer": pair.access_token, "pat": pat, "refresh": pair.refresh_token}
+
+
+@pytest.mark.parametrize("credential", ["bearer", "pat"])
+@pytest.mark.parametrize("read_only", [True, False])
+async def test_demo_token_writes_follow_read_only_setting(
+    demo_app, demo_client, demo_credentials, credential, read_only
+):
+    demo_app.state.users.settings.demo_read_only = read_only
+    headers = {"Authorization": f"Bearer {demo_credentials[credential]}"}
+    # A successful read proves this credential actually resolves the demo identity.
+    target = demo_app.state.users.demo_user_ids[1]
+    assert (await demo_client.get("/api/users/admin", headers=headers)).status_code == 200
+    response = await demo_client.patch(
+        f"/api/users/admin/{target}",
+        json={"email": demo_app.state.users.settings.demo_user_email, "full_name": "Changed"},
+        headers=headers,
+    )
+    assert response.status_code == (403 if read_only else 200), response.text
+    if read_only:
+        assert response.json() == {"detail": "DEMO_READ_ONLY"}
+    else:
+        assert response.json()["full_name"] == "Changed"
+
+
+@pytest.mark.parametrize("credential", ["bearer", "pat"])
+async def test_demo_token_inertia_write_uses_existing_refusal(
+    demo_app, demo_client, demo_credentials, credential
+):
+    response = await demo_client.patch(
+        f"/api/users/admin/{demo_app.state.users.demo_user_ids[1]}",
+        json={"email": demo_app.state.users.settings.demo_user_email, "full_name": "Changed"},
+        headers={
+            "Authorization": f"Bearer {demo_credentials[credential]}",
+            "X-Inertia": "true",
+            "Referer": "http://testserver/admin/users/",
+        },
+    )
+    assert response.status_code == 409
+    assert response.headers["X-Inertia-Location"] == "http://testserver/admin/users/"
+
+
+@pytest.mark.parametrize("operation", ["login", "refresh"])
+async def test_demo_cannot_mint_token_pair_without_session(
+    demo_app, demo_client, demo_credentials, operation
+):
+    if operation == "login":
+        path = "/api/users/auth/token"
+        body = {"email": demo_app.state.users.settings.demo_admin_email, "password": "DemoPass1!"}
+    else:
+        path = "/api/users/auth/token/refresh"
+        body = {"refresh_token": demo_credentials["refresh"]}
+    response = await demo_client.post(path, json=body)
+    assert response.status_code == 403, response.text
+    assert response.json() == {"detail": "DEMO_READ_ONLY"}
+    # Refusal must not consume the refresh token or leave a login lockout slot.
+    demo_app.state.users.settings.demo_read_only = False
+    assert (await demo_client.post(path, json=body)).status_code == 200
+
+
+async def test_demo_session_cannot_create_pat(demo_app):
+    cookie = forge_session_cookie(
+        str(demo_app.state.sm.settings.secret_key),
+        {"user_id": str(demo_app.state.users.demo_user_ids[0]), "sm_csrf_token": "csrf"},
+    )
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=demo_app),
+        base_url="http://testserver",
+        cookies={"session": cookie},
+    ) as client:
+        response = await client.post(
+            "/api/api_tokens/tokens/",
+            json={"name": "demo", "scopes": ["users.manage"], "expires_in_days": 1},
+            headers={"X-CSRF-Token": "csrf"},
+        )
+    assert response.status_code == 403
+    assert response.json() == {"detail": "DEMO_READ_ONLY"}
+
+
+async def test_real_bearer_account_can_still_write_on_demo_instance(demo_app, demo_client):
+    response = await demo_client.post(
+        "/api/users/auth/token", json={"email": "admin@example.com", "password": "AdminPass1!"}
+    )
+    assert response.status_code == 200
+    response = await demo_client.patch(
+        f"/api/users/admin/{demo_app.state.users.demo_user_ids[1]}",
+        json={
+            "email": demo_app.state.users.settings.demo_user_email,
+            "full_name": "Real admin write",
+        },
+        headers={"Authorization": f"Bearer {response.json()['access_token']}"},
+    )
+    assert response.status_code == 200
+    assert response.json()["full_name"] == "Real admin write"
+
+
+async def test_demo_token_login_still_checks_password(demo_app, demo_client, demo_credentials):
+    response = await demo_client.post(
+        "/api/users/auth/token",
+        json={"email": demo_app.state.users.settings.demo_admin_email, "password": "wrong"},
+    )
+    assert response.status_code == 401
+
+
+@pytest.mark.parametrize("credential", ["bearer", "pat"])
+async def test_demo_token_can_still_logout(demo_client, demo_credentials, credential):
+    response = await demo_client.post(
+        "/api/users/auth/logout",
+        headers={"Authorization": f"Bearer {demo_credentials[credential]}"},
+    )
+    assert response.status_code == 204

simple_module_users-0.0.37/tests/test_demo_guard.py → simple_module_users-0.0.39/tests/demo/test_users_demo_guard.py

@@ -9,7 +9,7 @@ from __future__ import annotations
 import httpx
 from users.constants import ADMIN_ROLE_NAME, SESSION_USER_ID_KEY, USER_ROLE_NAME
 from users.demo import SESSION_DEMO_KEY
-from users.demo_guard import DEMO_READ_ONLY_DETAIL
+from users.demo.guard import DEMO_READ_ONLY_DETAIL
 
 
 def _demo_route(role: str) -> str:

simple_module_users-0.0.37/tests/test_admin_resend_invite.py → simple_module_users-0.0.39/tests/invites/test_users_admin_resend_invite.py

@@ -10,6 +10,7 @@ message nobody received.
 from __future__ import annotations
 
 import logging
+import re
 from datetime import UTC, datetime, timedelta
 
 import pytest
@@ -174,14 +175,15 @@ class TestResendInvite:
 
 class TestInviteTokenClaims:
     @pytest.mark.anyio
-    async def test_invite_token_names_the_inviter(self, admin_client, users_app, caplog):
+    async def test_invite_token_names_the_inviter(self, admin_client, users_app, captured_mail):
         """The accept-invite card says who invited you; the claim carries it."""
         import jwt
 
-        with caplog.at_level(logging.INFO, logger="users.mailer"):
-            await _invite(admin_client, "whosent@example.com")
-        link = next(r for r in caplog.records if r.getMessage() == "users.invite.email").link
-        token = link.split("token=", 1)[1]
+        await _invite(admin_client, "whosent@example.com")
+        text = next(
+            m.text for m in captured_mail.to("whosent@example.com") if "invited you" in m.subject
+        )
+        token = re.search(r"token=(\S+)", text).group(1)
 
         payload = jwt.decode(
             token,
@@ -200,7 +202,7 @@ class TestMailerFailureIsNotEchoed:
     async def test_the_admin_gets_the_link_and_a_generic_reason(
         self, admin_client, users_app, caplog
     ):
-        from users.admin.bulk_invite import MAILER_FAILURE_DETAIL
+        from users.invites.bulk import MAILER_FAILURE_DETAIL
 
         class _BrokenMailer(_SpyMailer):
             async def send_invite(self, email, token, invited_by_name, message=None):
@@ -210,7 +212,7 @@ class TestMailerFailureIsNotEchoed:
         original = users_app.state.users.mailer
         users_app.state.users.mailer = _BrokenMailer()
         try:
-            with caplog.at_level(logging.ERROR, logger="users.admin.resend_invite"):
+            with caplog.at_level(logging.ERROR, logger="users.invites.resend"):
                 resp = await admin_client.post(f"/api/users/admin/{user_id}/resend-invite")
         finally:
             users_app.state.users.mailer = original

{simple_module_users-0.0.37/tests → simple_module_users-0.0.39/tests/invites}/test_users_bulk_invite.py

@@ -139,7 +139,7 @@ class TestBulkInvite:
 
     async def test_address_count_is_capped(self, authenticated_client: httpx.AsyncClient):
         """One submit must not be able to mint unbounded live invite tokens."""
-        from users.admin.bulk_invite import MAX_ADDRESSES
+        from users.invites.bulk import MAX_ADDRESSES
 
         emails = [f"bulk{i}@example.com" for i in range(MAX_ADDRESSES + 5)]
         resp = await authenticated_client.post(_URL, json={"emails": emails, "role_names": []})
@@ -151,7 +151,7 @@ class TestBulkInvite:
     ):
         """Silent truncation reports "100 invites sent" while 5 people are
         never contacted, with nothing on screen saying so."""
-        from users.admin.bulk_invite import MAX_ADDRESSES
+        from users.invites.bulk import MAX_ADDRESSES
 
         emails = [f"over{i}@example.com" for i in range(MAX_ADDRESSES + 5)]
         resp = await authenticated_client.post(_URL, json={"emails": emails, "role_names": []})

simple_module_users-0.0.37/tests/test_bulk_invite_message.py → simple_module_users-0.0.39/tests/invites/test_users_bulk_invite_message.py

@@ -8,8 +8,6 @@ rather than stopping at the API boundary.
 
 from __future__ import annotations
 
-import logging
-
 import pytest
 
 _URL = "/api/users/admin/invite/bulk"
@@ -111,11 +109,15 @@ class TestBulkInviteMessage:
         assert row["state"] == "invited"
 
 
-class TestConsoleMailerMessage:
+class TestTemplatedMailerMessage:
+    @pytest.mark.anyio
+    async def test_mailer_quotes_the_message(self, users_app, captured_mail):
+        mailer = users_app.state.users.mailer
+        await mailer.send_invite("x@example.com", "tok", "Alex Doyle", "See you Monday.")
+        assert "See you Monday." in captured_mail.to("x@example.com")[0].text
+
     @pytest.mark.anyio
-    async def test_console_mailer_logs_the_message(self, users_app, caplog):
+    async def test_blank_message_leaves_no_quote(self, users_app, captured_mail):
         mailer = users_app.state.users.mailer
-        with caplog.at_level(logging.INFO, logger="users.mailer"):
-            await mailer.send_invite("x@example.com", "tok", "Alex Doyle", "See you Monday.")
-        record = next(r for r in caplog.records if r.getMessage() == "users.invite.email")
-        assert record.message_body == "See you Monday."
+        await mailer.send_invite("x@example.com", "tok", "Alex Doyle", "   \n ")
+        assert "See you" not in captured_mail.to("x@example.com")[0].text