simple-module-users 0.0.3__tar.gz → 0.0.4__tar.gz

{simple_module_users-0.0.3 → simple_module_users-0.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simple_module_users
-Version: 0.0.3
+Version: 0.0.4
 Summary: Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -24,10 +24,10 @@ Requires-Python: >=3.12
 Requires-Dist: aiosmtplib>=3.0
 Requires-Dist: cachetools>=5.3
 Requires-Dist: fastapi-users[sqlalchemy]<16,>=15
-Requires-Dist: simple-module-auth==0.0.3
-Requires-Dist: simple-module-core==0.0.3
-Requires-Dist: simple-module-db==0.0.3
-Requires-Dist: simple-module-hosting==0.0.3
+Requires-Dist: simple-module-auth==0.0.4
+Requires-Dist: simple-module-core==0.0.4
+Requires-Dist: simple-module-db==0.0.4
+Requires-Dist: simple-module-hosting==0.0.4
 Requires-Dist: typer>=0.12
 Description-Content-Type: text/markdown
 

{simple_module_users-0.0.3 → simple_module_users-0.0.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_users"
-version = "0.0.3"
+version = "0.0.4"
 description = "Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps"
 readme = "README.md"
 license = "MIT"
@@ -21,10 +21,10 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "simple_module_core==0.0.3",
-    "simple_module_db==0.0.3",
-    "simple_module_hosting==0.0.3",
-    "simple_module_auth==0.0.3",             # workspace module — contracts
+    "simple_module_core==0.0.4",
+    "simple_module_db==0.0.4",
+    "simple_module_hosting==0.0.4",
+    "simple_module_auth==0.0.4",             # workspace module — contracts
     # Pinned to a narrow range: `deps.py` relies on mutating CookieTransport
     # fields after construction (see reconfigure_cookie_transport in backend.py).
     # Bumping the major version requires re-checking those field names.

{simple_module_users-0.0.3 → simple_module_users-0.0.4}/users/endpoints/views.py

@@ -68,7 +68,11 @@ async def login_page(request: Request, inertia: InertiaDep) -> InertiaResponse:
             dev_accounts.append({"label": "User", "email": user_email, "password": user_password})
     return await inertia.render(
         _PAGE_LOGIN,
-        {"allow_signup": users_settings.allow_signup, "dev_accounts": dev_accounts},
+        {
+            "allow_signup": users_settings.allow_signup,
+            "dev_accounts": dev_accounts,
+            "login_redirect_url": users_settings.login_redirect_url,
+        },
     )
 
 

{simple_module_users-0.0.3 → simple_module_users-0.0.4}/users/module.py

@@ -82,9 +82,10 @@ class UsersModule(ModuleBase):
                 label="Users",
                 url=_URL_USERS_ADMIN,
                 icon=_ICON_USERS,
-                order=30,
+                order=100,
                 section=MenuSection.SIDEBAR,
                 roles=[ADMIN_ROLE_NAME],
+                group="Administration",
             )
         )
         # Self-service: profile + logout live in the user dropdown.
@@ -147,6 +148,14 @@ class UsersModule(ModuleBase):
             window_seconds=s.auth_rate_limit_window_seconds,
         )
 
+        # Auto-fall-back from the default ``/dashboard/`` to ``/`` when the
+        # Dashboard module isn't installed, so ``--preset minimal`` doesn't
+        # 404 on login. Operator-set overrides are preserved.
+        if s.login_redirect_url == "/dashboard/" and not any(
+            m.meta.name == "Dashboard" for m in app.state.sm.modules
+        ):
+            s.login_redirect_url = "/"
+
         reconfigure_cookie_transport(auth_backend, s)
 
         await asyncio.gather(

{simple_module_users-0.0.3 → simple_module_users-0.0.4}/users/pages/Login.tsx

@@ -21,10 +21,12 @@ interface DevAccount {
 interface Props {
   allow_signup: boolean;
   dev_accounts: DevAccount[];
+  login_redirect_url: string;
 }
 
 function Login() {
-  const { allow_signup, dev_accounts } = usePage<{ props: Props }>().props as unknown as Props;
+  const { allow_signup, dev_accounts, login_redirect_url } = usePage<{ props: Props }>()
+    .props as unknown as Props;
 
   const [email, setEmail] = useState('');
   const [password, setPassword] = useState('');
@@ -34,8 +36,8 @@ function Login() {
 
   const nextUrl =
     typeof window !== 'undefined'
-      ? new URLSearchParams(window.location.search).get('next') || '/dashboard/'
-      : '/dashboard/';
+      ? new URLSearchParams(window.location.search).get('next') || login_redirect_url
+      : login_redirect_url;
 
   const submitLogin = (username: string, pwd: string) => {
     setError(null);

{simple_module_users-0.0.3 → simple_module_users-0.0.4}/users/settings.py

@@ -1,13 +1,11 @@
 """Users module settings — DB-backed via ``register_module_settings``.
 
-Construction no longer reads ``SM_USERS_*`` environment variables. Values
-come from pydantic defaults at boot, then get hydrated from the DB by the
-hosting lifespan before module ``on_startup`` runs. Runtime changes go
-through ``settings.reload.apply_changes_and_reload``.
-
-The one remaining env read is ``SM_ENVIRONMENT``, consulted by the
-``@model_validator`` to refuse placeholder token secrets in production —
-that's a host-level setting, not a users-module field.
+Most fields hydrate from the DB after boot, with pydantic defaults filling in
+until then. Runtime changes go through ``settings.reload.apply_changes_and_reload``.
+
+The two token-secret fields read ``SM_USERS_*`` at import time as a bootstrap
+path: a fresh production deploy needs to clear the validator below before any
+DB-backed settings can be seeded, otherwise the two paths deadlock.
 """
 
 from __future__ import annotations
@@ -16,6 +14,7 @@ import os
 
 from pydantic import Field, model_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
+from simple_module_core.dotenv import env_str
 from simple_module_core.environments import NON_PROD_ENVIRONMENTS
 
 _PLACEHOLDER_RESET_SECRET = "dev-reset-token-secret-change-me"
@@ -31,10 +30,23 @@ class UsersSettings(BaseSettings):
     allow_signup: bool = False
     require_verification: bool = True
 
+    # Where the login page sends a successful sign-in. Sites without the
+    # bundled ``dashboard`` module (``sm new --preset minimal``) override
+    # this to wherever their post-login landing lives.
+    login_redirect_url: str = "/dashboard/"
+
     # Token secrets — MUST be set in production. Dev default is a deterministic
     # placeholder that's obvious in logs so it can't be mistaken for a real key.
-    reset_password_token_secret: str = "dev-reset-token-secret-change-me"
-    verification_token_secret: str = "dev-verify-token-secret-change-me"
+    # Resolved at module-import time so ``info.default`` stays serializable
+    # for the settings admin UI.
+    reset_password_token_secret: str = env_str(
+        "SM_USERS_RESET_PASSWORD_TOKEN_SECRET",
+        _PLACEHOLDER_RESET_SECRET,
+    )
+    verification_token_secret: str = env_str(
+        "SM_USERS_VERIFICATION_TOKEN_SECRET",
+        _PLACEHOLDER_VERIFY_SECRET,
+    )
     reset_password_token_lifetime_seconds: int = 60 * 60  # 1 hour
     verification_token_lifetime_seconds: int = 60 * 60 * 24 * 7  # 7 days