simple-module-users 0.0.38__tar.gz → 0.0.40__tar.gz

{simple_module_users-0.0.38 → simple_module_users-0.0.40}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_users
-Version: 0.0.38
+Version: 0.0.40
 Summary: Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -21,15 +21,15 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Typing :: Typed
 Requires-Python: >=3.12
-Requires-Dist: cachetools>=5.3
+Requires-Dist: cachetools<8,>=5.3
 Requires-Dist: fastapi-users[oauth,sqlalchemy]<16,>=15
-Requires-Dist: simple-module-auth==0.0.38
-Requires-Dist: simple-module-core==0.0.38
-Requires-Dist: simple-module-db==0.0.38
-Requires-Dist: simple-module-hosting==0.0.38
-Requires-Dist: simple-module-mail==0.0.38
-Requires-Dist: simple-module-settings==0.0.38
-Requires-Dist: typer>=0.12
+Requires-Dist: simple-module-auth==0.0.40
+Requires-Dist: simple-module-core==0.0.40
+Requires-Dist: simple-module-db==0.0.40
+Requires-Dist: simple-module-hosting==0.0.40
+Requires-Dist: simple-module-mail==0.0.40
+Requires-Dist: simple-module-settings==0.0.40
+Requires-Dist: typer<0.28,>=0.12
 Description-Content-Type: text/markdown
 
 # simple_module_users

{simple_module_users-0.0.38 → simple_module_users-0.0.40}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simple-module-py/users",
-  "version": "0.0.38",
+  "version": "0.0.40",
   "private": true,
   "description": "Frontend assets for the Users module",
   "peerDependencies": {

{simple_module_users-0.0.38 → simple_module_users-0.0.40}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_users"
-version = "0.0.38"
+version = "0.0.40"
 description = "Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps"
 readme = "README.md"
 license = "MIT"
@@ -21,20 +21,20 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "simple_module_core==0.0.38",
-    "simple_module_db==0.0.38",
-    "simple_module_hosting==0.0.38",
-    "simple_module_settings==0.0.38",
-    "simple_module_auth==0.0.38",
+    "simple_module_core==0.0.40",
+    "simple_module_db==0.0.40",
+    "simple_module_hosting==0.0.40",
+    "simple_module_settings==0.0.40",
+    "simple_module_auth==0.0.40",
     # Sends through the framework mail sender; `mail` owns the SMTP transport
     # (GH #496), so an upgrade keeps delivering mail.
-    "simple_module_mail==0.0.38",
+    "simple_module_mail==0.0.40",
     # Pinned to a narrow range: `deps.py` relies on mutating CookieTransport
     # fields after construction (see reconfigure_cookie_transport in backend.py).
     # Bumping the major version requires re-checking those field names.
     "fastapi-users[sqlalchemy,oauth]>=15,<16",
-    "cachetools>=5.3",
-    "typer>=0.12",
+    "cachetools>=5.3,<8",
+    "typer>=0.12,<0.28",
 ]
 
 [project.entry-points.simple_module]

{simple_module_users-0.0.38 → simple_module_users-0.0.40}/tests/_users_app_builders.py

@@ -84,6 +84,11 @@ async def _seed_roles(application) -> None:
         if "user" not in existing:
             session.add(Role(id=USER_ROLE_ID, name="user", description="Standard user"))
         await session.commit()
+    # Direct inserts bypass the role service that would refresh the cache; startup
+    # already warmed it (with the role it seeds), so refresh like a real write would.
+    from users.roles_cache import refresh_roles_cache
+
+    await refresh_roles_cache(application)
 
 
 async def _seed_users_settings(

{simple_module_users-0.0.38 → simple_module_users-0.0.40}/tests/_users_oauth_support.py

@@ -25,12 +25,15 @@ class _FakeOAuthClient:
     async def get_id_email(self, access_token: str) -> tuple[str, str]:
         return self._account_id, self._account_email
 
+    async def get_profile(self, access_token: str) -> dict:
+        return {"sub": self._account_id, "email": self._account_email, "email_verified": True}
+
 
 def install_fake_provider(app, account_id: str, account_email: str) -> None:
     from users.oauth import OAuthProvider
 
-    app.state.users.oauth_clients["microsoft"] = OAuthProvider(
-        "microsoft", "Microsoft", _FakeOAuthClient(account_id, account_email)
+    app.state.users.oauth_clients["oidc"] = OAuthProvider(
+        "oidc", "OIDC", _FakeOAuthClient(account_id, account_email)
     )
 
 
@@ -70,11 +73,11 @@ async def seed_password_user(app, email: str, **fields) -> uuid.UUID:
 
 async def oauth_callback(client: httpx.AsyncClient) -> httpx.Response:
     """Drive /login then /callback; return the callback response."""
-    login = await client.get("/api/users/auth/microsoft/login", follow_redirects=False)
+    login = await client.get("/api/users/auth/oidc/login", follow_redirects=False)
     assert login.status_code == 302
     state = parse_qs(urlparse(login.headers["location"]).query)["state"][0]
     return await client.get(
-        f"/api/users/auth/microsoft/callback?code=abc&state={state}",
+        f"/api/users/auth/oidc/callback?code=abc&state={state}",
         follow_redirects=False,
     )
 

simple_module_users-0.0.40/tests/demo/test_users_demo_credentials.py

@@ -0,0 +1,147 @@
+"""Demo read-only mode follows identities authenticated without demo cookies."""
+
+import httpx
+import pytest
+from api_tokens.constants import TokenKind
+from api_tokens.service import ApiTokenService
+from simple_module_test import forge_session_cookie
+from users.auth_local.token_api import _create_token_pair
+from users.demo import ensure_demo_users
+from users.models import User
+
+
+@pytest.fixture
+async def demo_credentials(demo_app):
+    settings = demo_app.state.users.settings
+    settings.demo_admin_password = "DemoPass1!"
+    await ensure_demo_users(demo_app)
+    user_id = demo_app.state.users.demo_user_ids[0]
+    async with demo_app.state.sm.db.session_factory() as db:
+        pair = await _create_token_pair(db, user_id, settings)
+        _, pat = await ApiTokenService(db).create(
+            kind=TokenKind.PERSONAL,
+            name="pre-existing demo PAT",
+            scopes=["users.manage", "api_tokens.use"],
+            expires_in_days=1,
+            max_lifetime_days=30,
+            owner_user_id=user_id,
+        )
+        await db.commit()
+    return {"bearer": pair.access_token, "pat": pat, "refresh": pair.refresh_token}
+
+
+@pytest.mark.parametrize("credential", ["bearer", "pat"])
+@pytest.mark.parametrize("read_only", [True, False])
+async def test_demo_token_writes_follow_read_only_setting(
+    demo_app, demo_client, demo_credentials, credential, read_only
+):
+    demo_app.state.users.settings.demo_read_only = read_only
+    headers = {"Authorization": f"Bearer {demo_credentials[credential]}"}
+    # A successful read proves this credential actually resolves the demo identity.
+    assert (await demo_client.get("/api/users/admin", headers=headers)).status_code == 200
+    # A role-less account: the PAT's scopes (users.manage, api_tokens.use) cover it, so
+    # only the demo read-only gate decides. A target holding permissions beyond the
+    # token's scopes is refused regardless (#624).
+    async with demo_app.state.sm.db.session_factory() as db:
+        plain = User(email="plain@example.com", hashed_password=None, is_external=True)
+        db.add(plain)
+        await db.commit()
+        target = str(plain.id)
+    response = await demo_client.patch(
+        f"/api/users/admin/{target}",
+        json={"email": "plain@example.com", "full_name": "Changed"},
+        headers=headers,
+    )
+    assert response.status_code == (403 if read_only else 200), response.text
+    if read_only:
+        assert response.json() == {"detail": "DEMO_READ_ONLY"}
+    else:
+        assert response.json()["full_name"] == "Changed"
+
+
+@pytest.mark.parametrize("credential", ["bearer", "pat"])
+async def test_demo_token_inertia_write_uses_existing_refusal(
+    demo_app, demo_client, demo_credentials, credential
+):
+    response = await demo_client.patch(
+        f"/api/users/admin/{demo_app.state.users.demo_user_ids[1]}",
+        json={"email": demo_app.state.users.settings.demo_user_email, "full_name": "Changed"},
+        headers={
+            "Authorization": f"Bearer {demo_credentials[credential]}",
+            "X-Inertia": "true",
+            "Referer": "http://testserver/admin/users/",
+        },
+    )
+    assert response.status_code == 409
+    assert response.headers["X-Inertia-Location"] == "http://testserver/admin/users/"
+
+
+@pytest.mark.parametrize("operation", ["login", "refresh"])
+async def test_demo_cannot_mint_token_pair_without_session(
+    demo_app, demo_client, demo_credentials, operation
+):
+    if operation == "login":
+        path = "/api/users/auth/token"
+        body = {"email": demo_app.state.users.settings.demo_admin_email, "password": "DemoPass1!"}
+    else:
+        path = "/api/users/auth/token/refresh"
+        body = {"refresh_token": demo_credentials["refresh"]}
+    response = await demo_client.post(path, json=body)
+    assert response.status_code == 403, response.text
+    assert response.json() == {"detail": "DEMO_READ_ONLY"}
+    # Refusal must not consume the refresh token or leave a login lockout slot.
+    demo_app.state.users.settings.demo_read_only = False
+    assert (await demo_client.post(path, json=body)).status_code == 200
+
+
+async def test_demo_session_cannot_create_pat(demo_app):
+    cookie = forge_session_cookie(
+        str(demo_app.state.sm.settings.secret_key),
+        {"user_id": str(demo_app.state.users.demo_user_ids[0]), "sm_csrf_token": "csrf"},
+    )
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=demo_app),
+        base_url="http://testserver",
+        cookies={"session": cookie},
+    ) as client:
+        response = await client.post(
+            "/api/api_tokens/tokens/",
+            json={"name": "demo", "scopes": ["users.manage"], "expires_in_days": 1},
+            headers={"X-CSRF-Token": "csrf"},
+        )
+    assert response.status_code == 403
+    assert response.json() == {"detail": "DEMO_READ_ONLY"}
+
+
+async def test_real_bearer_account_can_still_write_on_demo_instance(demo_app, demo_client):
+    response = await demo_client.post(
+        "/api/users/auth/token", json={"email": "admin@example.com", "password": "AdminPass1!"}
+    )
+    assert response.status_code == 200
+    response = await demo_client.patch(
+        f"/api/users/admin/{demo_app.state.users.demo_user_ids[1]}",
+        json={
+            "email": demo_app.state.users.settings.demo_user_email,
+            "full_name": "Real admin write",
+        },
+        headers={"Authorization": f"Bearer {response.json()['access_token']}"},
+    )
+    assert response.status_code == 200
+    assert response.json()["full_name"] == "Real admin write"
+
+
+async def test_demo_token_login_still_checks_password(demo_app, demo_client, demo_credentials):
+    response = await demo_client.post(
+        "/api/users/auth/token",
+        json={"email": demo_app.state.users.settings.demo_admin_email, "password": "wrong"},
+    )
+    assert response.status_code == 401
+
+
+@pytest.mark.parametrize("credential", ["bearer", "pat"])
+async def test_demo_token_can_still_logout(demo_client, demo_credentials, credential):
+    response = await demo_client.post(
+        "/api/users/auth/logout",
+        headers={"Authorization": f"Bearer {demo_credentials[credential]}"},
+    )
+    assert response.status_code == 204

simple_module_users-0.0.38/tests/test_demo_guard.py → simple_module_users-0.0.40/tests/demo/test_users_demo_guard.py

@@ -9,7 +9,7 @@ from __future__ import annotations
 import httpx
 from users.constants import ADMIN_ROLE_NAME, SESSION_USER_ID_KEY, USER_ROLE_NAME
 from users.demo import SESSION_DEMO_KEY
-from users.demo_guard import DEMO_READ_ONLY_DETAIL
+from users.demo.guard import DEMO_READ_ONLY_DETAIL
 
 
 def _demo_route(role: str) -> str:

simple_module_users-0.0.38/tests/test_admin_resend_invite.py → simple_module_users-0.0.40/tests/invites/test_users_admin_resend_invite.py

@@ -202,7 +202,7 @@ class TestMailerFailureIsNotEchoed:
     async def test_the_admin_gets_the_link_and_a_generic_reason(
         self, admin_client, users_app, caplog
     ):
-        from users.admin.bulk_invite import MAILER_FAILURE_DETAIL
+        from users.invites.bulk import MAILER_FAILURE_DETAIL
 
         class _BrokenMailer(_SpyMailer):
             async def send_invite(self, email, token, invited_by_name, message=None):
@@ -212,7 +212,7 @@ class TestMailerFailureIsNotEchoed:
         original = users_app.state.users.mailer
         users_app.state.users.mailer = _BrokenMailer()
         try:
-            with caplog.at_level(logging.ERROR, logger="users.admin.resend_invite"):
+            with caplog.at_level(logging.ERROR, logger="users.invites.resend"):
                 resp = await admin_client.post(f"/api/users/admin/{user_id}/resend-invite")
         finally:
             users_app.state.users.mailer = original

{simple_module_users-0.0.38/tests → simple_module_users-0.0.40/tests/invites}/test_users_bulk_invite.py

@@ -139,7 +139,7 @@ class TestBulkInvite:
 
     async def test_address_count_is_capped(self, authenticated_client: httpx.AsyncClient):
         """One submit must not be able to mint unbounded live invite tokens."""
-        from users.admin.bulk_invite import MAX_ADDRESSES
+        from users.invites.bulk import MAX_ADDRESSES
 
         emails = [f"bulk{i}@example.com" for i in range(MAX_ADDRESSES + 5)]
         resp = await authenticated_client.post(_URL, json={"emails": emails, "role_names": []})
@@ -151,7 +151,7 @@ class TestBulkInvite:
     ):
         """Silent truncation reports "100 invites sent" while 5 people are
         never contacted, with nothing on screen saying so."""
-        from users.admin.bulk_invite import MAX_ADDRESSES
+        from users.invites.bulk import MAX_ADDRESSES
 
         emails = [f"over{i}@example.com" for i in range(MAX_ADDRESSES + 5)]
         resp = await authenticated_client.post(_URL, json={"emails": emails, "role_names": []})

simple_module_users-0.0.40/tests/lockout/test_users_lockout_checkpoint.py

@@ -0,0 +1,114 @@
+"""Checkpoint isolation on file SQLite, where overlapping writers cannot hide."""
+
+from datetime import UTC, datetime
+
+import pytest
+from _users_app_builders import ALICE, _build_users_app, _client, _make_standard_user, user_row
+from pwdlib.hashers.bcrypt import BcryptHasher
+from simple_module_core.rate_limit import InProcessWindowStore
+from sqlalchemy import select
+from users.auth_local.lockout import LoginAttempt, admit
+from users.models import Role, User
+
+
+@pytest.fixture
+async def checkpoint_app(monkeypatch, tmp_path):
+    app, context = await _build_users_app(
+        monkeypatch,
+        allow_signup=False,
+        database_url=f"sqlite+aiosqlite:///{tmp_path / 'auth-checkpoint.db'}",
+    )
+    await _make_standard_user(app, ALICE)
+    try:
+        yield app
+    finally:
+        await context.__aexit__(None, None, None)
+
+
+async def test_admission_never_flushes_or_commits_unrelated_request_work(checkpoint_app):
+    observed = []
+    factory = checkpoint_app.state.sm.db.session_factory
+    attempt = LoginAttempt.build(
+        ALICE,
+        "1.2.3.4",
+        InProcessWindowStore(),
+        checkpoint_app.state.users.settings,
+        datetime.now(UTC),
+    )
+    async with factory() as request:
+        pending = Role(name="pending-request-role")
+        request.add(pending)
+        request.on_commit(lambda: observed.append("request"))
+        admission = await admit(request, attempt)
+        assert admission.count == 1
+        assert pending in request.new
+        assert observed == []
+        await request.rollback()
+    assert (await user_row(checkpoint_app, ALICE)).failed_login_count == 1
+    async with factory() as reader:
+        assert (
+            await reader.execute(select(Role).where(Role.name == "pending-request-role"))
+        ).scalar_one_or_none() is None
+
+
+async def test_unverified_legacy_password_releases_slot_without_overlapping_writers(checkpoint_app):
+    factory = checkpoint_app.state.sm.db.session_factory
+    async with factory() as session:
+        user = (await session.execute(select(User).where(User.email == ALICE))).scalar_one()
+        user.is_verified = False
+        user.hashed_password = BcryptHasher(rounds=4).hash("UserPass1!")
+        await session.commit()
+    checkpoint_app.state.users.settings = checkpoint_app.state.users.settings.model_copy(
+        update={"require_verification": True}
+    )
+    async with _client(checkpoint_app, "1.2.3.4") as client:
+        response = await client.post(
+            "/api/users/auth/token", json={"email": ALICE, "password": "UserPass1!"}
+        )
+    assert response.status_code == 400, response.text
+    assert response.json()["detail"] == "LOGIN_USER_NOT_VERIFIED"
+    assert (await user_row(checkpoint_app, ALICE)).failed_login_count == 0
+
+
+@pytest.mark.parametrize("kind", ["cookie", "token"])
+async def test_unverified_logins_release_request_connections_before_checkpoint(
+    checkpoint_app, monkeypatch, kind
+):
+    import asyncio
+
+    from users.auth_local import api, token_api
+
+    # SQLite's default pool has five connections plus ten overflow connections.
+    emails = [f"unverified-{i}@example.com" for i in range(15)]
+    for email in emails:
+        await _make_standard_user(checkpoint_app, email)
+    async with checkpoint_app.state.sm.db.session_factory() as session:
+        for user in (await session.execute(select(User).where(User.email.in_(emails)))).scalars():
+            user.is_verified = False
+        await session.commit()
+    checkpoint_app.state.users.settings = checkpoint_app.state.users.settings.model_copy(
+        update={"require_verification": True}
+    )
+    endpoint = api if kind == "cookie" else token_api
+    real_release = endpoint.release
+    ready = asyncio.Barrier(len(emails))
+
+    async def together(session, attempt, admission):
+        await ready.wait()
+        return await real_release(session, attempt, admission)
+
+    monkeypatch.setattr(endpoint, "release", together)
+
+    async def login(email):
+        async with _client(checkpoint_app, "1.2.3.4") as client:
+            if kind == "cookie":
+                return await client.post(
+                    "/api/users/auth/login", data={"username": email, "password": "UserPass1!"}
+                )
+            return await client.post(
+                "/api/users/auth/token", json={"email": email, "password": "UserPass1!"}
+            )
+
+    responses = await asyncio.wait_for(asyncio.gather(*(login(email) for email in emails)), 5)
+    assert [response.status_code for response in responses] == [400] * 15
+    assert all(response.json()["detail"] == "LOGIN_USER_NOT_VERIFIED" for response in responses)

{simple_module_users-0.0.38/tests → simple_module_users-0.0.40/tests/lockout}/test_users_lockout_service.py

@@ -5,7 +5,6 @@ from __future__ import annotations
 from datetime import UTC, datetime, timedelta
 
 from _users_app_builders import ALICE
-from fastapi import HTTPException
 from simple_module_core.rate_limit import InProcessWindowStore
 from sqlalchemy import select
 from users.auth_local import lockout
@@ -16,6 +15,7 @@ from users.auth_local.lockout import (
     record_failure,
     record_success,
 )
+from users.exceptions import LoginLockedError
 from users.models import User
 from users.settings import UsersSettings
 
@@ -38,17 +38,17 @@ async def _fail(session, attempt: LoginAttempt) -> int:
     """One wrong password: admit, then settle. Returns the status it would answer."""
     try:
         admission = await admit(session, attempt)
-    except HTTPException as exc:
-        return exc.status_code
+    except LoginLockedError:
+        return 429
     locked = await record_failure(session, attempt, admission)
-    return locked.status_code if locked else 400
+    return 429 if locked else 400
 
 
 async def _admit_or_status(session, attempt: LoginAttempt) -> Admission | int:
     try:
         return await admit(session, attempt)
-    except HTTPException as exc:
-        return exc.status_code
+    except LoginLockedError:
+        return 429
 
 
 async def _row(users_db, user) -> User:
@@ -160,7 +160,7 @@ async def test_success_mid_burst_does_not_lift_a_lock(users_db, alice) -> None:
     owner_slot = await admit(users_db, owner)  # admitted before the lock
     attacker = _attempt(ip="10.0.0.3", store=store, account=3)
     locked = await record_failure(users_db, attacker, await admit(users_db, attacker))
-    assert locked is not None and locked.status_code == 429
+    assert isinstance(locked, LoginLockedError)
 
     await record_success(users_db, owner, owner_slot)  # the owner's password lands last
     await users_db.commit()
@@ -188,8 +188,8 @@ async def test_lock_landing_after_the_read_reports_the_time_left(users_db, alice
     mid = _attempt(now=T0 + timedelta(seconds=300), ip="9.9.9.9", account=3)
     try:
         await lockout._admit_account(users_db, mid, [None])  # read before the lock landed
-    except HTTPException as exc:
-        assert (exc.status_code, exc.headers) == (429, {"Retry-After": "600"})
+    except LoginLockedError as exc:
+        assert exc.retry_after == 600
     else:
         raise AssertionError("a locked row was admitted")
 

{simple_module_users-0.0.38 → simple_module_users-0.0.40}/tests/test_bearer_token_age.py

@@ -9,6 +9,7 @@ clause or the two disagree about what "expired" means.
 
 from __future__ import annotations
 
+import hashlib
 import uuid
 from datetime import UTC, datetime, timedelta
 
@@ -27,17 +28,18 @@ async def _mint(users_app) -> str:
         user_id = (
             await session.execute(select(User.id).where(User.email == "admin@example.com"))
         ).scalar_one()
-        token = UserAccessToken(token=uuid.uuid4().hex, user_id=user_id)
+        secret = uuid.uuid4().hex
+        token = UserAccessToken(token=hashlib.sha256(secret.encode()).hexdigest(), user_id=user_id)
         session.add(token)
         await session.commit()
-        return token.token
+        return secret
 
 
 async def _backdate(users_app, token: str, *, seconds: int) -> None:
     async with users_app.state.sm.db.session_factory() as session:
         await session.execute(
             update(UserAccessToken)
-            .where(UserAccessToken.token == token)
+            .where(UserAccessToken.token == hashlib.sha256(token.encode()).hexdigest())
             .values(created_at=datetime.now(UTC) - timedelta(seconds=seconds))
         )
         await session.commit()

{simple_module_users-0.0.38 → simple_module_users-0.0.40}/tests/test_bearer_token_expiry.py

@@ -17,6 +17,7 @@ under, and both bearer read paths enforce them: ``ExpiringDatabaseStrategy``
 
 from __future__ import annotations
 
+import hashlib
 import uuid
 from datetime import UTC, datetime, timedelta
 
@@ -78,7 +79,7 @@ async def _expire(app, token: str) -> None:
     out.
     """
     async with app.state.sm.db.session_factory() as session:
-        row = await session.get(UserAccessToken, token)
+        row = await session.get(UserAccessToken, hashlib.sha256(token.encode()).hexdigest())
         row.expires_at = datetime.now(UTC) - timedelta(seconds=1)
         await session.commit()
 
@@ -234,7 +235,8 @@ class TestTheMintedCounterIsCurrent:
             row = (
                 await session.execute(
                     select(UserAccessToken).where(
-                        UserAccessToken.token == rotated.json()["access_token"]
+                        UserAccessToken.token
+                        == hashlib.sha256(rotated.json()["access_token"].encode()).hexdigest()
                     )
                 )
             ).scalar_one()

{simple_module_users-0.0.38 → simple_module_users-0.0.40}/tests/test_service_admin_crud.py

@@ -144,7 +144,11 @@ async def test_delete_user_removes_user_and_all_child_rows(users_app):
                 account_email="todelete@example.com",
             )
         )
-        session.add(RefreshToken(user_id=user.id, expires_at=datetime.now(UTC) + timedelta(days=1)))
+        session.add(
+            RefreshToken(
+                token="a" * 64, user_id=user.id, expires_at=datetime.now(UTC) + timedelta(days=1)
+            )
+        )
         await session.flush()
 
         svc = _build_service(session, users_app)

{simple_module_users-0.0.38 → simple_module_users-0.0.40}/tests/test_sessions_revoke.py

@@ -104,6 +104,7 @@ class TestRevokeAll:
 
         async with users_app.state.sm.db.session_factory() as session:
             token = RefreshToken(
+                token="a" * 64,
                 user_id=signed_in_admin,
                 expires_at=datetime.now(UTC) + timedelta(days=1),
             )

simple_module_users-0.0.40/tests/test_users_admin_effective_permissions.py

@@ -0,0 +1,70 @@
+"""Delegated management compares effective permissions (#624): direct grants and token scopes."""
+
+import httpx
+import pytest
+from api_tokens.constants import TokenKind
+from api_tokens.service import ApiTokenService
+from simple_module_test import forge_session_cookie
+from sqlalchemy import select
+from test_api_admin import _make_user
+from users.models import Role, User
+
+pytestmark = pytest.mark.anyio
+
+
+async def _client(app, headers=None, cookies=None):
+    return httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=app),
+        base_url="http://testserver",
+        headers=headers,
+        cookies=cookies,
+    )
+
+
+async def test_delegate_cannot_manage_user_with_unheld_direct_grant(users_app, users_db):
+    users_db.add(Role(name="manager"))
+    await users_db.commit()
+    users_app.state.sm.permissions.map_role("manager", ["users.manage"])
+    actor = await _make_user(users_db, "manager@example.com", role_names=["manager", "user"])
+    target = await _make_user(users_db, "granted@example.com", role_names=["user"])
+    ordinary = await _make_user(users_db, "plain@example.com", role_names=["user"])
+
+    async def direct_grants(request, user):
+        return {"files.delete"} if user.id == str(target.id) else set()
+
+    users_app.state.sm.permissions.add_grant_source(direct_grants)
+    cookie = forge_session_cookie(
+        str(users_app.state.sm.settings.secret_key), {"user_id": str(actor.id)}
+    )
+    async with await _client(users_app, cookies={"session": cookie}) as client:
+        denied = await client.patch(f"/api/users/admin/{target.id}/disable")
+        allowed = await client.patch(f"/api/users/admin/{ordinary.id}/disable")
+    assert denied.status_code == 403
+    assert allowed.status_code == 200
+    await users_db.refresh(target)
+    assert target.is_active is True
+
+
+async def test_admin_pat_cannot_grant_role_beyond_its_scopes(users_app, users_db):
+    users_db.add(Role(name="deleter"))
+    await users_db.commit()
+    users_app.state.sm.permissions.map_role("deleter", ["files.delete"])
+    admin = (
+        await users_db.execute(select(User).where(User.email == "admin@example.com"))
+    ).scalar_one()
+    target = await _make_user(users_db, "target@example.com", role_names=[])
+    _, pat = await ApiTokenService(users_db).create(
+        kind=TokenKind.PERSONAL,
+        name="scoped admin",
+        scopes=["users.manage", "api_tokens.use"],
+        expires_in_days=1,
+        max_lifetime_days=30,
+        owner_user_id=admin.id,
+    )
+    await users_db.commit()
+    async with await _client(users_app, headers={"Authorization": f"Bearer {pat}"}) as client:
+        url = f"/api/users/admin/{target.id}/roles"
+        beyond = await client.put(url, json={"role_names": ["deleter"]})
+        assert beyond.status_code == 403
+        within = await client.put(url, json={"role_names": []})
+        assert within.status_code == 200