simple-module-users 0.0.38__tar.gz → 0.0.39__tar.gz

{simple_module_users-0.0.38 → simple_module_users-0.0.39}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_users
-Version: 0.0.38
+Version: 0.0.39
 Summary: Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -21,15 +21,15 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Typing :: Typed
 Requires-Python: >=3.12
-Requires-Dist: cachetools>=5.3
+Requires-Dist: cachetools<8,>=5.3
 Requires-Dist: fastapi-users[oauth,sqlalchemy]<16,>=15
-Requires-Dist: simple-module-auth==0.0.38
-Requires-Dist: simple-module-core==0.0.38
-Requires-Dist: simple-module-db==0.0.38
-Requires-Dist: simple-module-hosting==0.0.38
-Requires-Dist: simple-module-mail==0.0.38
-Requires-Dist: simple-module-settings==0.0.38
-Requires-Dist: typer>=0.12
+Requires-Dist: simple-module-auth==0.0.39
+Requires-Dist: simple-module-core==0.0.39
+Requires-Dist: simple-module-db==0.0.39
+Requires-Dist: simple-module-hosting==0.0.39
+Requires-Dist: simple-module-mail==0.0.39
+Requires-Dist: simple-module-settings==0.0.39
+Requires-Dist: typer<0.28,>=0.12
 Description-Content-Type: text/markdown
 
 # simple_module_users

{simple_module_users-0.0.38 → simple_module_users-0.0.39}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simple-module-py/users",
-  "version": "0.0.38",
+  "version": "0.0.39",
   "private": true,
   "description": "Frontend assets for the Users module",
   "peerDependencies": {

{simple_module_users-0.0.38 → simple_module_users-0.0.39}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_users"
-version = "0.0.38"
+version = "0.0.39"
 description = "Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps"
 readme = "README.md"
 license = "MIT"
@@ -21,20 +21,20 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "simple_module_core==0.0.38",
-    "simple_module_db==0.0.38",
-    "simple_module_hosting==0.0.38",
-    "simple_module_settings==0.0.38",
-    "simple_module_auth==0.0.38",
+    "simple_module_core==0.0.39",
+    "simple_module_db==0.0.39",
+    "simple_module_hosting==0.0.39",
+    "simple_module_settings==0.0.39",
+    "simple_module_auth==0.0.39",
     # Sends through the framework mail sender; `mail` owns the SMTP transport
     # (GH #496), so an upgrade keeps delivering mail.
-    "simple_module_mail==0.0.38",
+    "simple_module_mail==0.0.39",
     # Pinned to a narrow range: `deps.py` relies on mutating CookieTransport
     # fields after construction (see reconfigure_cookie_transport in backend.py).
     # Bumping the major version requires re-checking those field names.
     "fastapi-users[sqlalchemy,oauth]>=15,<16",
-    "cachetools>=5.3",
-    "typer>=0.12",
+    "cachetools>=5.3,<8",
+    "typer>=0.12,<0.28",
 ]
 
 [project.entry-points.simple_module]

{simple_module_users-0.0.38 → simple_module_users-0.0.39}/tests/_users_app_builders.py

@@ -84,6 +84,11 @@ async def _seed_roles(application) -> None:
         if "user" not in existing:
             session.add(Role(id=USER_ROLE_ID, name="user", description="Standard user"))
         await session.commit()
+    # Direct inserts bypass the role service that would refresh the cache; startup
+    # already warmed it (with the role it seeds), so refresh like a real write would.
+    from users.roles_cache import refresh_roles_cache
+
+    await refresh_roles_cache(application)
 
 
 async def _seed_users_settings(

simple_module_users-0.0.39/tests/demo/test_users_demo_credentials.py

@@ -0,0 +1,139 @@
+"""Demo read-only mode follows identities authenticated without demo cookies."""
+
+import httpx
+import pytest
+from api_tokens.constants import TokenKind
+from api_tokens.service import ApiTokenService
+from simple_module_test import forge_session_cookie
+from users.auth_local.token_api import _create_token_pair
+from users.demo import ensure_demo_users
+
+
+@pytest.fixture
+async def demo_credentials(demo_app):
+    settings = demo_app.state.users.settings
+    settings.demo_admin_password = "DemoPass1!"
+    await ensure_demo_users(demo_app)
+    user_id = demo_app.state.users.demo_user_ids[0]
+    async with demo_app.state.sm.db.session_factory() as db:
+        pair = await _create_token_pair(db, user_id, settings)
+        _, pat = await ApiTokenService(db).create(
+            kind=TokenKind.PERSONAL,
+            name="pre-existing demo PAT",
+            scopes=["users.manage", "api_tokens.use"],
+            expires_in_days=1,
+            max_lifetime_days=30,
+            owner_user_id=user_id,
+        )
+        await db.commit()
+    return {"bearer": pair.access_token, "pat": pat, "refresh": pair.refresh_token}
+
+
+@pytest.mark.parametrize("credential", ["bearer", "pat"])
+@pytest.mark.parametrize("read_only", [True, False])
+async def test_demo_token_writes_follow_read_only_setting(
+    demo_app, demo_client, demo_credentials, credential, read_only
+):
+    demo_app.state.users.settings.demo_read_only = read_only
+    headers = {"Authorization": f"Bearer {demo_credentials[credential]}"}
+    # A successful read proves this credential actually resolves the demo identity.
+    target = demo_app.state.users.demo_user_ids[1]
+    assert (await demo_client.get("/api/users/admin", headers=headers)).status_code == 200
+    response = await demo_client.patch(
+        f"/api/users/admin/{target}",
+        json={"email": demo_app.state.users.settings.demo_user_email, "full_name": "Changed"},
+        headers=headers,
+    )
+    assert response.status_code == (403 if read_only else 200), response.text
+    if read_only:
+        assert response.json() == {"detail": "DEMO_READ_ONLY"}
+    else:
+        assert response.json()["full_name"] == "Changed"
+
+
+@pytest.mark.parametrize("credential", ["bearer", "pat"])
+async def test_demo_token_inertia_write_uses_existing_refusal(
+    demo_app, demo_client, demo_credentials, credential
+):
+    response = await demo_client.patch(
+        f"/api/users/admin/{demo_app.state.users.demo_user_ids[1]}",
+        json={"email": demo_app.state.users.settings.demo_user_email, "full_name": "Changed"},
+        headers={
+            "Authorization": f"Bearer {demo_credentials[credential]}",
+            "X-Inertia": "true",
+            "Referer": "http://testserver/admin/users/",
+        },
+    )
+    assert response.status_code == 409
+    assert response.headers["X-Inertia-Location"] == "http://testserver/admin/users/"
+
+
+@pytest.mark.parametrize("operation", ["login", "refresh"])
+async def test_demo_cannot_mint_token_pair_without_session(
+    demo_app, demo_client, demo_credentials, operation
+):
+    if operation == "login":
+        path = "/api/users/auth/token"
+        body = {"email": demo_app.state.users.settings.demo_admin_email, "password": "DemoPass1!"}
+    else:
+        path = "/api/users/auth/token/refresh"
+        body = {"refresh_token": demo_credentials["refresh"]}
+    response = await demo_client.post(path, json=body)
+    assert response.status_code == 403, response.text
+    assert response.json() == {"detail": "DEMO_READ_ONLY"}
+    # Refusal must not consume the refresh token or leave a login lockout slot.
+    demo_app.state.users.settings.demo_read_only = False
+    assert (await demo_client.post(path, json=body)).status_code == 200
+
+
+async def test_demo_session_cannot_create_pat(demo_app):
+    cookie = forge_session_cookie(
+        str(demo_app.state.sm.settings.secret_key),
+        {"user_id": str(demo_app.state.users.demo_user_ids[0]), "sm_csrf_token": "csrf"},
+    )
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=demo_app),
+        base_url="http://testserver",
+        cookies={"session": cookie},
+    ) as client:
+        response = await client.post(
+            "/api/api_tokens/tokens/",
+            json={"name": "demo", "scopes": ["users.manage"], "expires_in_days": 1},
+            headers={"X-CSRF-Token": "csrf"},
+        )
+    assert response.status_code == 403
+    assert response.json() == {"detail": "DEMO_READ_ONLY"}
+
+
+async def test_real_bearer_account_can_still_write_on_demo_instance(demo_app, demo_client):
+    response = await demo_client.post(
+        "/api/users/auth/token", json={"email": "admin@example.com", "password": "AdminPass1!"}
+    )
+    assert response.status_code == 200
+    response = await demo_client.patch(
+        f"/api/users/admin/{demo_app.state.users.demo_user_ids[1]}",
+        json={
+            "email": demo_app.state.users.settings.demo_user_email,
+            "full_name": "Real admin write",
+        },
+        headers={"Authorization": f"Bearer {response.json()['access_token']}"},
+    )
+    assert response.status_code == 200
+    assert response.json()["full_name"] == "Real admin write"
+
+
+async def test_demo_token_login_still_checks_password(demo_app, demo_client, demo_credentials):
+    response = await demo_client.post(
+        "/api/users/auth/token",
+        json={"email": demo_app.state.users.settings.demo_admin_email, "password": "wrong"},
+    )
+    assert response.status_code == 401
+
+
+@pytest.mark.parametrize("credential", ["bearer", "pat"])
+async def test_demo_token_can_still_logout(demo_client, demo_credentials, credential):
+    response = await demo_client.post(
+        "/api/users/auth/logout",
+        headers={"Authorization": f"Bearer {demo_credentials[credential]}"},
+    )
+    assert response.status_code == 204

simple_module_users-0.0.38/tests/test_demo_guard.py → simple_module_users-0.0.39/tests/demo/test_users_demo_guard.py

@@ -9,7 +9,7 @@ from __future__ import annotations
 import httpx
 from users.constants import ADMIN_ROLE_NAME, SESSION_USER_ID_KEY, USER_ROLE_NAME
 from users.demo import SESSION_DEMO_KEY
-from users.demo_guard import DEMO_READ_ONLY_DETAIL
+from users.demo.guard import DEMO_READ_ONLY_DETAIL
 
 
 def _demo_route(role: str) -> str:

simple_module_users-0.0.38/tests/test_admin_resend_invite.py → simple_module_users-0.0.39/tests/invites/test_users_admin_resend_invite.py

@@ -202,7 +202,7 @@ class TestMailerFailureIsNotEchoed:
     async def test_the_admin_gets_the_link_and_a_generic_reason(
         self, admin_client, users_app, caplog
     ):
-        from users.admin.bulk_invite import MAILER_FAILURE_DETAIL
+        from users.invites.bulk import MAILER_FAILURE_DETAIL
 
         class _BrokenMailer(_SpyMailer):
             async def send_invite(self, email, token, invited_by_name, message=None):
@@ -212,7 +212,7 @@ class TestMailerFailureIsNotEchoed:
         original = users_app.state.users.mailer
         users_app.state.users.mailer = _BrokenMailer()
         try:
-            with caplog.at_level(logging.ERROR, logger="users.admin.resend_invite"):
+            with caplog.at_level(logging.ERROR, logger="users.invites.resend"):
                 resp = await admin_client.post(f"/api/users/admin/{user_id}/resend-invite")
         finally:
             users_app.state.users.mailer = original

{simple_module_users-0.0.38/tests → simple_module_users-0.0.39/tests/invites}/test_users_bulk_invite.py

@@ -139,7 +139,7 @@ class TestBulkInvite:
 
     async def test_address_count_is_capped(self, authenticated_client: httpx.AsyncClient):
         """One submit must not be able to mint unbounded live invite tokens."""
-        from users.admin.bulk_invite import MAX_ADDRESSES
+        from users.invites.bulk import MAX_ADDRESSES
 
         emails = [f"bulk{i}@example.com" for i in range(MAX_ADDRESSES + 5)]
         resp = await authenticated_client.post(_URL, json={"emails": emails, "role_names": []})
@@ -151,7 +151,7 @@ class TestBulkInvite:
     ):
         """Silent truncation reports "100 invites sent" while 5 people are
         never contacted, with nothing on screen saying so."""
-        from users.admin.bulk_invite import MAX_ADDRESSES
+        from users.invites.bulk import MAX_ADDRESSES
 
         emails = [f"over{i}@example.com" for i in range(MAX_ADDRESSES + 5)]
         resp = await authenticated_client.post(_URL, json={"emails": emails, "role_names": []})

simple_module_users-0.0.39/tests/lockout/test_users_lockout_checkpoint.py

@@ -0,0 +1,114 @@
+"""Checkpoint isolation on file SQLite, where overlapping writers cannot hide."""
+
+from datetime import UTC, datetime
+
+import pytest
+from _users_app_builders import ALICE, _build_users_app, _client, _make_standard_user, user_row
+from pwdlib.hashers.bcrypt import BcryptHasher
+from simple_module_core.rate_limit import InProcessWindowStore
+from sqlalchemy import select
+from users.auth_local.lockout import LoginAttempt, admit
+from users.models import Role, User
+
+
+@pytest.fixture
+async def checkpoint_app(monkeypatch, tmp_path):
+    app, context = await _build_users_app(
+        monkeypatch,
+        allow_signup=False,
+        database_url=f"sqlite+aiosqlite:///{tmp_path / 'auth-checkpoint.db'}",
+    )
+    await _make_standard_user(app, ALICE)
+    try:
+        yield app
+    finally:
+        await context.__aexit__(None, None, None)
+
+
+async def test_admission_never_flushes_or_commits_unrelated_request_work(checkpoint_app):
+    observed = []
+    factory = checkpoint_app.state.sm.db.session_factory
+    attempt = LoginAttempt.build(
+        ALICE,
+        "1.2.3.4",
+        InProcessWindowStore(),
+        checkpoint_app.state.users.settings,
+        datetime.now(UTC),
+    )
+    async with factory() as request:
+        pending = Role(name="pending-request-role")
+        request.add(pending)
+        request.on_commit(lambda: observed.append("request"))
+        admission = await admit(request, attempt)
+        assert admission.count == 1
+        assert pending in request.new
+        assert observed == []
+        await request.rollback()
+    assert (await user_row(checkpoint_app, ALICE)).failed_login_count == 1
+    async with factory() as reader:
+        assert (
+            await reader.execute(select(Role).where(Role.name == "pending-request-role"))
+        ).scalar_one_or_none() is None
+
+
+async def test_unverified_legacy_password_releases_slot_without_overlapping_writers(checkpoint_app):
+    factory = checkpoint_app.state.sm.db.session_factory
+    async with factory() as session:
+        user = (await session.execute(select(User).where(User.email == ALICE))).scalar_one()
+        user.is_verified = False
+        user.hashed_password = BcryptHasher(rounds=4).hash("UserPass1!")
+        await session.commit()
+    checkpoint_app.state.users.settings = checkpoint_app.state.users.settings.model_copy(
+        update={"require_verification": True}
+    )
+    async with _client(checkpoint_app, "1.2.3.4") as client:
+        response = await client.post(
+            "/api/users/auth/token", json={"email": ALICE, "password": "UserPass1!"}
+        )
+    assert response.status_code == 400, response.text
+    assert response.json()["detail"] == "LOGIN_USER_NOT_VERIFIED"
+    assert (await user_row(checkpoint_app, ALICE)).failed_login_count == 0
+
+
+@pytest.mark.parametrize("kind", ["cookie", "token"])
+async def test_unverified_logins_release_request_connections_before_checkpoint(
+    checkpoint_app, monkeypatch, kind
+):
+    import asyncio
+
+    from users.auth_local import api, token_api
+
+    # SQLite's default pool has five connections plus ten overflow connections.
+    emails = [f"unverified-{i}@example.com" for i in range(15)]
+    for email in emails:
+        await _make_standard_user(checkpoint_app, email)
+    async with checkpoint_app.state.sm.db.session_factory() as session:
+        for user in (await session.execute(select(User).where(User.email.in_(emails)))).scalars():
+            user.is_verified = False
+        await session.commit()
+    checkpoint_app.state.users.settings = checkpoint_app.state.users.settings.model_copy(
+        update={"require_verification": True}
+    )
+    endpoint = api if kind == "cookie" else token_api
+    real_release = endpoint.release
+    ready = asyncio.Barrier(len(emails))
+
+    async def together(session, attempt, admission):
+        await ready.wait()
+        return await real_release(session, attempt, admission)
+
+    monkeypatch.setattr(endpoint, "release", together)
+
+    async def login(email):
+        async with _client(checkpoint_app, "1.2.3.4") as client:
+            if kind == "cookie":
+                return await client.post(
+                    "/api/users/auth/login", data={"username": email, "password": "UserPass1!"}
+                )
+            return await client.post(
+                "/api/users/auth/token", json={"email": email, "password": "UserPass1!"}
+            )
+
+    responses = await asyncio.wait_for(asyncio.gather(*(login(email) for email in emails)), 5)
+    assert [response.status_code for response in responses] == [400] * 15
+    assert all(response.json()["detail"] == "LOGIN_USER_NOT_VERIFIED" for response in responses)

{simple_module_users-0.0.38/tests → simple_module_users-0.0.39/tests/lockout}/test_users_lockout_service.py

@@ -5,7 +5,6 @@ from __future__ import annotations
 from datetime import UTC, datetime, timedelta
 
 from _users_app_builders import ALICE
-from fastapi import HTTPException
 from simple_module_core.rate_limit import InProcessWindowStore
 from sqlalchemy import select
 from users.auth_local import lockout
@@ -16,6 +15,7 @@ from users.auth_local.lockout import (
     record_failure,
     record_success,
 )
+from users.exceptions import LoginLockedError
 from users.models import User
 from users.settings import UsersSettings
 
@@ -38,17 +38,17 @@ async def _fail(session, attempt: LoginAttempt) -> int:
     """One wrong password: admit, then settle. Returns the status it would answer."""
     try:
         admission = await admit(session, attempt)
-    except HTTPException as exc:
-        return exc.status_code
+    except LoginLockedError:
+        return 429
     locked = await record_failure(session, attempt, admission)
-    return locked.status_code if locked else 400
+    return 429 if locked else 400
 
 
 async def _admit_or_status(session, attempt: LoginAttempt) -> Admission | int:
     try:
         return await admit(session, attempt)
-    except HTTPException as exc:
-        return exc.status_code
+    except LoginLockedError:
+        return 429
 
 
 async def _row(users_db, user) -> User:
@@ -160,7 +160,7 @@ async def test_success_mid_burst_does_not_lift_a_lock(users_db, alice) -> None:
     owner_slot = await admit(users_db, owner)  # admitted before the lock
     attacker = _attempt(ip="10.0.0.3", store=store, account=3)
     locked = await record_failure(users_db, attacker, await admit(users_db, attacker))
-    assert locked is not None and locked.status_code == 429
+    assert isinstance(locked, LoginLockedError)
 
     await record_success(users_db, owner, owner_slot)  # the owner's password lands last
     await users_db.commit()
@@ -188,8 +188,8 @@ async def test_lock_landing_after_the_read_reports_the_time_left(users_db, alice
     mid = _attempt(now=T0 + timedelta(seconds=300), ip="9.9.9.9", account=3)
     try:
         await lockout._admit_account(users_db, mid, [None])  # read before the lock landed
-    except HTTPException as exc:
-        assert (exc.status_code, exc.headers) == (429, {"Retry-After": "600"})
+    except LoginLockedError as exc:
+        assert exc.retry_after == 600
     else:
         raise AssertionError("a locked row was admitted")
 

simple_module_users-0.0.39/tests/test_users_default_role.py

@@ -0,0 +1,75 @@
+"""Which registrations receive the standard role, using real checkpoint sessions."""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+from unittest.mock import AsyncMock, MagicMock
+
+from sqlalchemy import select
+from users.constants import OAUTH_REGISTRATION_REQUEST_FLAG, USER_ROLE_ID
+from users.db_adapter import UserDatabaseWithRoles
+from users.manager import UserManager
+from users.models import OAuthAccount, Role, User, UserRole
+
+
+def _manager(app, session, *, allow_signup: bool) -> UserManager:
+    settings = app.state.users.settings.model_copy(update={"allow_signup": allow_signup})
+    return UserManager(
+        UserDatabaseWithRoles(session, User, OAuthAccount),
+        MagicMock(send_verification=AsyncMock()),
+        settings,
+    )
+
+
+def _request(*, oauth: bool) -> MagicMock:
+    request = MagicMock()
+    request.app.state.sm.event_bus = MagicMock(publish=AsyncMock())
+    request.state = SimpleNamespace(**({OAUTH_REGISTRATION_REQUEST_FLAG: True} if oauth else {}))
+    return request
+
+
+async def _user(session) -> User:
+    user = User(email="new@example.com", is_verified=True)
+    session.add(user)
+    await session.commit()  # fastapi-users creates the account before invoking its hook
+    return user
+
+
+async def _roles(session, user: User) -> list:
+    return list(
+        (
+            await session.execute(select(UserRole.role_id).where(UserRole.user_id == user.id))
+        ).scalars()
+    )
+
+
+async def test_oauth_provisioning_with_signup_closed_gets_no_role(users_app, users_db):
+    manager = _manager(users_app, users_db, allow_signup=False)
+    user = await _user(users_db)
+    await manager.on_after_register(user, _request(oauth=True))
+    assert await _roles(users_db, user) == []
+
+
+async def test_oauth_provisioning_with_signup_open_gets_the_user_role(users_app, users_db):
+    manager = _manager(users_app, users_db, allow_signup=True)
+    user = await _user(users_db)
+    await manager.on_after_register(user, _request(oauth=True))
+    assert await _roles(users_db, user) == [USER_ROLE_ID]
+
+
+async def test_request_bound_registration_gets_the_user_role(users_app, users_db):
+    manager = _manager(users_app, users_db, allow_signup=True)
+    user = await _user(users_db)
+    await manager.on_after_register(user, _request(oauth=False))
+    assert await _roles(users_db, user) == [USER_ROLE_ID]
+
+
+async def test_a_deleted_user_role_is_not_recreated(users_app, users_db):
+    role = await users_db.get(Role, USER_ROLE_ID)
+    await users_db.delete(role)
+    await users_db.commit()
+    manager = _manager(users_app, users_db, allow_signup=True)
+    user = await _user(users_db)
+    await manager.on_after_register(user, _request(oauth=False))
+    assert await _roles(users_db, user) == []
+    assert await users_db.get(Role, USER_ROLE_ID) is None

simple_module_users-0.0.39/tests/test_users_domain_errors.py

@@ -0,0 +1,40 @@
+"""Domain failures remain usable outside HTTP request handlers."""
+
+import uuid
+
+from fastapi import HTTPException
+from users.auth_local.lockout import too_many_attempts
+from users.exceptions import UserNotFoundError
+
+
+def test_lockout_is_a_domain_error():
+    error = too_many_attempts(0)
+    assert not isinstance(error, HTTPException)
+    assert error.retry_after == 1
+
+
+def test_user_errors_share_a_module_base():
+    from users.exceptions import UsersError
+
+    assert isinstance(UserNotFoundError(uuid.uuid4()), UsersError)
+
+
+async def test_lockout_http_mapping_preserves_body_and_retry_after():
+    import httpx
+    from fastapi import FastAPI
+    from users.module import UsersModule
+
+    app = FastAPI()
+    UsersModule().register_exception_handlers(app)
+
+    @app.get("/locked")
+    async def locked():
+        raise too_many_attempts(0)
+
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=app), base_url="http://test"
+    ) as client:
+        response = await client.get("/locked")
+    assert response.status_code == 429
+    assert response.content == '{"detail":"Too many attempts — try again later"}'.encode()
+    assert response.headers["Retry-After"] == "1"

simple_module_users-0.0.38/tests/test_user_manager.py → simple_module_users-0.0.39/tests/test_users_manager.py

@@ -134,39 +134,6 @@ class TestOnAfterRegister:
         assert event.user_id == fake_user.id
         assert event.email == fake_user.email
 
-    @pytest.mark.anyio
-    async def test_request_bound_registration_gets_the_user_role(
-        self, manager, fake_user, fake_user_db
-    ):
-        """GH #488: a signup with no role holds no permissions at all."""
-        from users.models import UserRole
-
-        request = MagicMock()
-        request.state = MagicMock(spec=[])  # a local signup, not OAuth
-        request.app.state.sm.event_bus = MagicMock(publish=AsyncMock())
-        fake_user.is_verified = True
-        role = MagicMock(id=uuid.uuid4())
-        fake_user_db.session.execute = AsyncMock(
-            return_value=MagicMock(scalar_one_or_none=MagicMock(return_value=role))
-        )
-        await manager.on_after_register(fake_user, request)
-
-        (added,) = fake_user_db.session.add.call_args.args
-        assert isinstance(added, UserRole)
-        assert (added.user_id, added.role_id) == (fake_user.id, role.id)
-
-    @pytest.mark.anyio
-    async def test_a_deleted_user_role_is_not_recreated(self, manager, fake_user, fake_user_db):
-        """An admin who removed the role meant it; a public signup must not undo that."""
-        request = MagicMock()
-        request.app.state.sm.event_bus = MagicMock(publish=AsyncMock())
-        fake_user.is_verified = True
-        fake_user_db.session.execute = AsyncMock(
-            return_value=MagicMock(scalar_one_or_none=MagicMock(return_value=None))
-        )
-        await manager.on_after_register(fake_user, request)
-        fake_user_db.session.add.assert_not_called()
-
     @pytest.mark.anyio
     async def test_without_request_skips_publish(self, manager, fake_user, fake_user_db):
         """CLI/bootstrap and admin flows pass request=None — no crash, no role:

simple_module_users-0.0.39/tests/test_users_register_single_connection.py

@@ -0,0 +1,55 @@
+"""Registration must release its connection before the durable role checkpoint."""
+
+import asyncio
+
+import pytest
+from simple_module_hosting.settings import Settings
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import create_async_engine
+from users.constants import USER_ROLE_NAME
+from users.models import Role, User, UserRole
+
+
+@pytest.fixture
+def settings(settings: Settings, tmp_path) -> Settings:
+    database_url = settings.database_url
+    if database_url.startswith("sqlite"):
+        database_url = f"sqlite+aiosqlite:///{tmp_path / 'signup.db'}"
+    return settings.model_copy(
+        update={"database_url": database_url, "multi_tenant": False, "tenant_header": ""}
+    )
+
+
+async def test_signup_attaches_default_role_with_one_connection(app, client):
+    # Constrain registration after startup, which has its own DB operations.
+    db = app.state.sm.db
+    engine = create_async_engine(db.engine.url, pool_size=1, max_overflow=0)
+    await db.engine.dispose()
+    db.engine = engine
+    db.session_factory.configure(bind=engine)
+    app.state.users.settings = app.state.users.settings.model_copy(
+        update={"allow_signup": True, "require_verification": False}
+    )
+    email = "single-connection@example.com"
+
+    async with asyncio.timeout(3):
+        response = await client.post(
+            "/api/users/auth/register", json={"email": email, "password": "SecurePass1!"}
+        )
+
+    assert response.status_code == 201, response.text
+    assert response.json()["email"] == email
+    async with app.state.sm.db.session_factory() as session:
+        roles = (
+            (
+                await session.execute(
+                    select(Role.name)
+                    .join(UserRole, UserRole.role_id == Role.id)
+                    .join(User, User.id == UserRole.user_id)
+                    .where(User.email == email)
+                )
+            )
+            .scalars()
+            .all()
+        )
+    assert roles == [USER_ROLE_NAME]