simple-module-users 0.0.40__tar.gz → 0.0.41__tar.gz

{simple_module_users-0.0.40 → simple_module_users-0.0.41}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_users
-Version: 0.0.40
+Version: 0.0.41
 Summary: Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -23,12 +23,12 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.12
 Requires-Dist: cachetools<8,>=5.3
 Requires-Dist: fastapi-users[oauth,sqlalchemy]<16,>=15
-Requires-Dist: simple-module-auth==0.0.40
-Requires-Dist: simple-module-core==0.0.40
-Requires-Dist: simple-module-db==0.0.40
-Requires-Dist: simple-module-hosting==0.0.40
-Requires-Dist: simple-module-mail==0.0.40
-Requires-Dist: simple-module-settings==0.0.40
+Requires-Dist: simple-module-auth==0.0.41
+Requires-Dist: simple-module-core==0.0.41
+Requires-Dist: simple-module-db==0.0.41
+Requires-Dist: simple-module-hosting==0.0.41
+Requires-Dist: simple-module-mail==0.0.41
+Requires-Dist: simple-module-settings==0.0.41
 Requires-Dist: typer<0.28,>=0.12
 Description-Content-Type: text/markdown
 

{simple_module_users-0.0.40 → simple_module_users-0.0.41}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simple-module-py/users",
-  "version": "0.0.40",
+  "version": "0.0.41",
   "private": true,
   "description": "Frontend assets for the Users module",
   "peerDependencies": {

{simple_module_users-0.0.40 → simple_module_users-0.0.41}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_users"
-version = "0.0.40"
+version = "0.0.41"
 description = "Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps"
 readme = "README.md"
 license = "MIT"
@@ -21,14 +21,14 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "simple_module_core==0.0.40",
-    "simple_module_db==0.0.40",
-    "simple_module_hosting==0.0.40",
-    "simple_module_settings==0.0.40",
-    "simple_module_auth==0.0.40",
+    "simple_module_core==0.0.41",
+    "simple_module_db==0.0.41",
+    "simple_module_hosting==0.0.41",
+    "simple_module_settings==0.0.41",
+    "simple_module_auth==0.0.41",
     # Sends through the framework mail sender; `mail` owns the SMTP transport
     # (GH #496), so an upgrade keeps delivering mail.
-    "simple_module_mail==0.0.40",
+    "simple_module_mail==0.0.41",
     # Pinned to a narrow range: `deps.py` relies on mutating CookieTransport
     # fields after construction (see reconfigure_cookie_transport in backend.py).
     # Bumping the major version requires re-checking those field names.

{simple_module_users-0.0.40 → simple_module_users-0.0.41}/tests/test_bearer_token_expiry.py

@@ -32,6 +32,30 @@ _ME = "/api/users/me"
 _CREDS = {"username": "admin@example.com", "password": "AdminPass1!"}
 
 
+async def _cookie_strategy_user(app, client):
+    """Resolve the ``sm_auth`` cookie through the cookie strategy itself.
+
+    ``/api/users/me`` now resolves the request principal (session or bearer,
+    #658), so it no longer exercises ``ExpiringDatabaseStrategy``; read the row
+    the way ``fastapi_users.current_user`` does instead.
+    """
+    from users.backend import build_strategy
+    from users.db_adapter import PruningAccessTokenDatabase
+    from users.models import UserAccessToken
+
+    async with app.state.sm.db.session_factory() as session:
+
+        class _Manager:
+            def parse_id(self, value):
+                return value if isinstance(value, uuid.UUID) else uuid.UUID(str(value))
+
+            async def get(self, user_id):
+                return await session.get(User, user_id)
+
+        strategy = build_strategy(PruningAccessTokenDatabase(session, UserAccessToken), 900)
+        return await strategy.read_token(client.cookies.get("sm_auth"), _Manager())
+
+
 async def _tokens(app) -> list[UserAccessToken]:
     async with app.state.sm.db.session_factory() as session:
         return list((await session.execute(select(UserAccessToken))).scalars())
@@ -129,15 +153,14 @@ class TestAnExpiredRowStopsAuthenticating:
     async def test_the_cookie_strategy_path_refuses_it(self, users_app, anon_client):
         """`fastapi_users.current_user`, via ExpiringDatabaseStrategy.
 
-        ``/api/users/me`` is the probe because it depends on ``current_user``,
-        which is what reads the ``sm_auth`` row. The row stays well inside the
-        thirty-day read ceiling — only the deadline it was issued for has passed.
+        The row stays well inside the thirty-day read ceiling — only the
+        deadline it was issued for has passed.
         """
         assert (await anon_client.post(_LOGIN, data=_CREDS)).status_code == 204
-        assert (await anon_client.get(_ME)).status_code == 200
+        assert await _cookie_strategy_user(users_app, anon_client) is not None
 
         await _expire_all(users_app)
-        assert (await anon_client.get(_ME)).status_code == 401
+        assert await _cookie_strategy_user(users_app, anon_client) is None
 
     @pytest.mark.anyio
     async def test_the_provider_path_refuses_it(self, users_app, anon_client):

{simple_module_users-0.0.40 → simple_module_users-0.0.41}/tests/test_remember_me.py

@@ -77,6 +77,30 @@ async def _age_access_tokens(app, *, days: int) -> None:
         await session.commit()
 
 
+async def _cookie_strategy_user(app, client):
+    """Resolve the ``sm_auth`` cookie through the cookie strategy itself.
+
+    ``/api/users/me`` now resolves the request principal (session or bearer,
+    #658), so it no longer exercises ``ExpiringDatabaseStrategy``; read the row
+    the way ``fastapi_users.current_user`` does instead.
+    """
+    from users.backend import build_strategy
+    from users.db_adapter import PruningAccessTokenDatabase
+    from users.models import UserAccessToken
+
+    async with app.state.sm.db.session_factory() as session:
+
+        class _Manager:
+            def parse_id(self, value):
+                return value if isinstance(value, uuid.UUID) else uuid.UUID(str(value))
+
+            async def get(self, user_id):
+                return await session.get(User, user_id)
+
+        strategy = build_strategy(PruningAccessTokenDatabase(session, UserAccessToken), 900)
+        return await strategy.read_token(client.cookies.get("sm_auth"), _Manager())
+
+
 class TestRemembered:
     @pytest.mark.anyio
     async def test_the_auth_cookie_lasts_thirty_days(self, anon_client, users_db):
@@ -104,14 +128,13 @@ class TestRemembered:
         know which sign-ins asked to be remembered — a row minted to last
         thirty days therefore has to be accepted for thirty, or the cookie
         outlives the credential it carries and the checkbox starts lying on
-        day fourteen. ``/api/users/me`` is the probe because it depends on
-        ``current_user``, which is the code path that reads the row.
+        day fourteen.
         """
         await _make_user(users_db, "remember-token@example.com")
         await _login(anon_client, "remember-token@example.com", remember=True)
 
         await _age_access_tokens(users_app, days=29)
-        assert (await anon_client.get("/api/users/me")).status_code == 200
+        assert await _cookie_strategy_user(users_app, anon_client) is not None
 
     @pytest.mark.anyio
     async def test_a_token_past_the_window_stops_being_read(self, anon_client, users_db, users_app):
@@ -121,7 +144,7 @@ class TestRemembered:
         await _login(anon_client, "stale-token@example.com", remember=True)
 
         await _age_access_tokens(users_app, days=31)
-        assert (await anon_client.get("/api/users/me")).status_code == 401
+        assert await _cookie_strategy_user(users_app, anon_client) is None
 
 
 class TestTheWindowSurvivesLaterRequests:

simple_module_users-0.0.41/tests/test_users_me_credentials.py

@@ -0,0 +1,46 @@
+"""Self-profile routes accept local bearer tokens as well as browser cookies."""
+
+import pytest
+from _users_app_builders import user_row
+
+
+@pytest.mark.parametrize("credential", ["bearer", "cookie"])
+async def test_users_me_reads_and_updates_profile(anon_client, alice, users_app, credential):
+    if credential == "bearer":
+        login = await anon_client.post(
+            "/api/users/auth/token",
+            json={"email": alice.email, "password": "UserPass1!"},
+        )
+        assert login.status_code == 200
+        anon_client.cookies.clear()
+        headers = {"Authorization": f"Bearer {login.json()['access_token']}"}
+    else:
+        login = await anon_client.post(
+            "/api/users/auth/login",
+            data={"username": alice.email, "password": "UserPass1!"},
+        )
+        assert login.status_code == 204
+        headers = {}
+
+    profile = await anon_client.get("/api/users/me", headers=headers)
+    assert profile.status_code == 200
+    assert profile.json()["id"] == str(alice.id)
+    assert profile.json()["email"] == alice.email
+    assert "hashed_password" not in profile.json()
+
+    updated = await anon_client.patch(
+        "/api/users/me", headers=headers, json={"full_name": "Updated Profile"}
+    )
+    assert updated.status_code == 200
+    assert updated.json()["id"] == str(alice.id)
+    assert updated.json()["full_name"] == "Updated Profile"
+    assert (await user_row(users_app, alice.email)).full_name == "Updated Profile"
+
+
+@pytest.mark.parametrize("method", ["GET", "PATCH"])
+@pytest.mark.parametrize("headers", [{}, {"Authorization": "Bearer invalid-token"}])
+async def test_users_me_requires_valid_credentials(anon_client, method, headers):
+    response = await anon_client.request(
+        method, "/api/users/me", headers=headers, json={"full_name": "Unauthorized"}
+    )
+    assert response.status_code == 401

simple_module_users-0.0.41/tests/test_users_oauth_error_responses.py

@@ -0,0 +1,111 @@
+"""Exercise callback error responses without a database or provider network."""
+
+from types import SimpleNamespace
+from unittest.mock import AsyncMock
+
+import httpx
+import pytest
+from fastapi import APIRouter, FastAPI
+from fastapi_users.exceptions import UserNotExists
+from httpx_oauth.exceptions import GetProfileError
+from starlette.middleware.sessions import SessionMiddleware
+from users.deps import auth_backend, get_user_manager
+from users.oauth.api import register_oauth_routes
+from users.oauth.providers import OAuthProvider
+
+
+@pytest.mark.anyio
+@pytest.mark.parametrize(
+    ("failure", "detail", "public_code", "status"),
+    [
+        ("unverified", "OAUTH_ACCOUNT_NOT_VERIFIED", "account_not_verified", 403),
+        ("signup", "OAUTH_SIGNUP_DISABLED", "signup_disabled", 403),
+        ("provider", "OAUTH_PROVIDER_ERROR", "signin_failed", 400),
+        ("profile", "OAUTH_PROVIDER_ERROR", "signin_failed", 400),
+        ("token", "OAUTH_PROVIDER_ERROR", "signin_failed", 400),
+        ("state", "OAUTH_INVALID_STATE", "signin_failed", 400),
+        ("missing_code", "OAUTH_MISSING_CODE", "signin_failed", 400),
+    ],
+)
+@pytest.mark.parametrize("accept", ["text/html", "application/json", "*/*", "xhr"])
+async def test_oauth_callback_error_response(failure, detail, public_code, status, accept):
+    app = FastAPI()
+    app.add_middleware(SessionMiddleware, secret_key="test-secret")
+    provider_client = AsyncMock()
+    provider_client.get_authorization_url.side_effect = lambda url, state: (
+        f"https://idp/?state={state}"
+    )
+    provider_client.get_access_token.return_value = {"access_token": "test-token"}
+    provider_client.get_profile.return_value = {"sub": "test-id", "email": "test@example.com"}
+    if failure == "token":
+        provider_client.get_access_token.side_effect = httpx.ConnectError("private details")
+    if failure == "profile":
+        provider_client.get_profile.side_effect = GetProfileError("private provider details")
+    app.state.users = SimpleNamespace(
+        oauth_clients={"oidc": OAuthProvider("oidc", "OIDC", provider_client)},
+        settings=SimpleNamespace(allow_signup=False),
+    )
+    manager = AsyncMock()
+    manager.get_by_oauth_account.side_effect = UserNotExists()
+    if failure == "unverified":
+        manager.get_by_email.return_value = SimpleNamespace(is_verified=False, invited_at=None)
+    else:
+        manager.get_by_email.side_effect = UserNotExists()
+
+    async def manager_dep():
+        return manager
+
+    async def strategy_dep():
+        return None
+
+    app.dependency_overrides[get_user_manager] = manager_dep
+    app.dependency_overrides[auth_backend.get_strategy] = strategy_dep
+    router = APIRouter(prefix="/api/users")
+    register_oauth_routes(router)
+    app.include_router(router)
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=app), base_url="http://test"
+    ) as client:
+        login = await client.get("/api/users/auth/oidc/login")
+        state = httpx.URL(login.headers["location"]).params["state"]
+        params = {"state": "bad" if failure == "state" else state}
+        if failure == "provider":
+            params["error"] = "<script>untrusted provider text</script>"
+        elif failure != "missing_code":
+            params["code"] = "test-code"
+        headers = {"accept": accept}
+        if accept == "xhr":
+            headers = {"accept": "text/html", "x-requested-with": "XMLHttpRequest"}
+        response = await client.get("/api/users/auth/oidc/callback", params=params, headers=headers)
+    if accept == "text/html":
+        assert response.status_code == 303
+        assert response.headers["location"] == f"/users/login?oauth_error={public_code}"
+    else:
+        assert response.status_code == status
+        assert response.json() == {"detail": detail}
+
+
+@pytest.mark.anyio
+@pytest.mark.parametrize(
+    "code", ["account_not_verified", "signup_disabled", "signin_failed", "<script>"]
+)
+async def test_login_view_filters_oauth_error_codes(code):
+    from starlette.requests import Request
+    from users.auth_local.views import login_page
+    from users.settings import UsersSettings
+
+    app = FastAPI()
+    app.state.users = SimpleNamespace(settings=UsersSettings(), oauth_providers=[])
+    app.state.sm = SimpleNamespace(settings=SimpleNamespace(is_development=False), modules=[])
+    request = Request(
+        {
+            "type": "http",
+            "app": app,
+            "session": {},
+            "query_string": str(httpx.QueryParams({"oauth_error": code})).encode(),
+        }
+    )
+    inertia = SimpleNamespace(render=AsyncMock())
+    await login_page(request, inertia)
+    props = inertia.render.call_args.args[1]
+    assert props["oauth_error"] == (None if code == "<script>" else code)

simple_module_users-0.0.41/tests/test_users_oauth_login_errors.py

@@ -0,0 +1,51 @@
+"""Browser OAuth refusals return to login; API clients keep JSON (#654)."""
+
+from urllib.parse import parse_qs, urlparse
+
+import pytest
+from _users_oauth_support import install_fake_provider, oauth_callback, seed_password_user
+
+
+@pytest.mark.anyio
+async def test_browser_unverified_account_returns_to_login(users_app, anon_client):
+    await seed_password_user(users_app, "refused@example.com", is_verified=False)
+    install_fake_provider(users_app, "refused", "refused@example.com")
+    anon_client.headers["accept"] = "text/html"
+
+    response = await oauth_callback(anon_client)
+
+    assert response.status_code == 303
+    assert response.headers["location"] == "/users/login?oauth_error=account_not_verified"
+    assert users_app.state.users.settings.cookie_name not in response.cookies
+
+
+@pytest.mark.anyio
+@pytest.mark.parametrize("browser", [True, False])
+async def test_provider_refusal_is_sanitized(users_app, anon_client, browser):
+    install_fake_provider(users_app, "refused", "refused@example.com")
+    login = await anon_client.get("/api/users/auth/oidc/login", follow_redirects=False)
+    state = parse_qs(urlparse(login.headers["location"]).query)["state"][0]
+    response = await anon_client.get(
+        "/api/users/auth/oidc/callback",
+        params={"state": state, "error": "<script>provider text</script>"},
+        headers={"accept": "text/html" if browser else "application/json"},
+        follow_redirects=False,
+    )
+    if browser:
+        assert response.status_code == 303
+        assert response.headers["location"] == "/users/login?oauth_error=signin_failed"
+    else:
+        assert response.status_code == 400
+        assert response.json()["detail"] == "OAUTH_PROVIDER_ERROR"
+
+
+@pytest.mark.anyio
+@pytest.mark.parametrize(
+    "code", ["account_not_verified", "signup_disabled", "signin_failed", "<script>"]
+)
+async def test_login_only_exposes_known_oauth_errors(anon_client, code):
+    response = await anon_client.get(
+        "/users/login", params={"oauth_error": code}, headers={"X-Inertia": "true"}
+    )
+    assert response.status_code == 200
+    assert response.json()["props"]["oauth_error"] == (None if code == "<script>" else code)

simple_module_users-0.0.41/tests/test_users_refresh_family_max_age.py

@@ -0,0 +1,178 @@
+"""Absolute refresh-family age bounds retained rotation history (#656)."""
+
+import asyncio
+import uuid
+from datetime import UTC, datetime, timedelta
+from types import SimpleNamespace
+
+import pytest
+import sqlalchemy as sa
+from pydantic import ValidationError
+from sqlalchemy.orm import Session
+from starlette.responses import JSONResponse
+from users.auth_local.token_api import RefreshRequest, TokenResponse, token_refresh
+from users.db_adapter import get_access_token_db
+from users.models import Base, RefreshToken, User, UserAccessToken
+from users.settings import UsersSettings
+from users.token_storage import hash_token, prune_tokens
+
+
+@pytest.fixture
+def family_db():
+    engine = sa.create_engine("sqlite://")
+    Base.metadata.create_all(engine)
+    try:
+        with Session(engine) as session:
+            owner = uuid.uuid4()
+            session.add(User(id=owner, email="family@example.com"))
+            session.flush()
+            yield session, owner
+    finally:
+        engine.dispose()
+
+
+class _AsyncSession:
+    def __init__(self, session):
+        self.session = session
+
+    def add(self, row):
+        self.session.add(row)
+
+    async def flush(self):
+        self.session.flush()
+
+    async def commit(self):
+        self.session.commit()
+
+    async def refresh(self, row):
+        self.session.refresh(row)
+
+    async def scalar(self, statement):
+        return self.session.scalar(statement)
+
+    async def execute(self, statement):
+        return self.session.execute(statement)
+
+
+def _family(session, owner, now, age_days, *, children=1):
+    family = uuid.uuid4()
+    session.add(
+        RefreshToken(
+            token=str(uuid.uuid4()),
+            user_id=owner,
+            family_id=family,
+            created_at=now - timedelta(days=age_days),
+            expires_at=now - timedelta(days=1),
+            revoked_at=now - timedelta(days=1),
+        )
+    )
+    secrets = [str(uuid.uuid4()) for _ in range(children)]
+    for secret in secrets:
+        session.add(
+            RefreshToken(
+                token=hash_token(secret),
+                user_id=owner,
+                family_id=family,
+                created_at=now,
+                expires_at=now + timedelta(days=30),
+            )
+        )
+    session.flush()
+    return secrets
+
+
+@pytest.mark.parametrize("age_days", [7, 8, 91])
+@pytest.mark.parametrize("expired", [False, True])
+def test_users_refresh_refuses_old_family_and_revokes_all_live_children(
+    family_db, expired, age_days
+):
+    session, owner = family_db
+    now = datetime.now(UTC)
+    secrets = _family(session, owner, now, age_days, children=2)
+    if expired:
+        session.get(RefreshToken, hash_token(secrets[0])).expires_at = now - timedelta(seconds=1)
+        session.flush()
+    settings = (
+        UsersSettings() if age_days == 91 else UsersSettings(refresh_token_family_max_age_days=7)
+    )
+    request = _request(settings)
+    response = asyncio.run(
+        token_refresh(RefreshRequest(refresh_token=secrets[0]), request, _AsyncSession(session))
+    )
+    assert isinstance(response, JSONResponse)
+    assert response.status_code == 401
+    session.expire_all()
+    assert all(row.revoked_at is not None for row in session.scalars(sa.select(RefreshToken)))
+    assert session.scalar(sa.select(sa.func.count()).select_from(UserAccessToken)) == 0
+
+
+def test_users_prune_revokes_old_family_before_bounded_deletion(family_db):
+    session, owner = family_db
+    now = datetime.now(UTC)
+    _family(session, owner, now, 8, children=101)
+    recent = _family(session, owner, now, 6)
+    other = uuid.uuid4()
+    session.add(User(id=other, email="other@example.com"))
+    session.flush()
+    other_old = _family(session, other, now, 8)
+
+    for _ in range(2):
+        asyncio.run(prune_tokens(_AsyncSession(session), owner, now, family_max_age_days=7))
+        session.expire_all()
+        # Even if the oldest ancestor was in the first batch, no child becomes live again.
+        remaining = list(
+            session.scalars(
+                sa.select(RefreshToken).where(
+                    RefreshToken.user_id == owner, RefreshToken.token != hash_token(recent[0])
+                )
+            )
+        )
+        assert all(row.revoked_at is not None for row in remaining)
+    assert session.scalar(sa.select(sa.func.count()).select_from(RefreshToken)) == 4
+    assert session.get(RefreshToken, hash_token(recent[0])).revoked_at is None
+    assert session.get(RefreshToken, hash_token(other_old[0])).revoked_at is None
+
+
+def test_users_family_max_age_rejects_zero():
+    with pytest.raises(ValidationError):
+        UsersSettings(refresh_token_family_max_age_days=0)
+
+
+def _request(settings):
+    return SimpleNamespace(
+        app=SimpleNamespace(
+            state=SimpleNamespace(users=SimpleNamespace(settings=settings, demo_user_ids=set()))
+        )
+    )
+
+
+def test_users_recent_family_rotates_and_keeps_expired_ancestor_reuse_evidence(family_db):
+    session, owner = family_db
+    now = datetime.now(UTC)
+    secrets = _family(session, owner, now, 6)
+    ancestor = session.scalar(sa.select(RefreshToken).where(RefreshToken.revoked_at.is_not(None)))
+    ancestor_secret = str(uuid.uuid4())
+    ancestor.token = hash_token(ancestor_secret)
+    session.flush()
+    request = _request(UsersSettings(refresh_token_family_max_age_days=7))
+    db = _AsyncSession(session)
+    rotated = asyncio.run(token_refresh(RefreshRequest(refresh_token=secrets[0]), request, db))
+    assert isinstance(rotated, TokenResponse)
+    assert session.get(RefreshToken, hash_token(ancestor_secret)) is not None
+    for secret in (ancestor_secret, rotated.refresh_token):
+        refused = asyncio.run(token_refresh(RefreshRequest(refresh_token=secret), request, db))
+        assert refused.status_code == 401
+
+
+def test_users_cookie_cleanup_uses_configured_family_max_age(family_db):
+    session, owner = family_db
+    now = datetime.now(UTC)
+    _family(session, owner, now, 8)
+    request = _request(UsersSettings(refresh_token_family_max_age_days=7))
+
+    async def login():
+        async for database in get_access_token_db(request, _AsyncSession(session)):
+            await database.create({"token": "cookie", "user_id": owner})
+
+    asyncio.run(login())
+    assert session.scalar(sa.select(sa.func.count()).select_from(RefreshToken)) == 0

{simple_module_users-0.0.40 → simple_module_users-0.0.41}/tests/test_users_refresh_reuse.py

@@ -56,7 +56,7 @@ async def test_users_concurrent_refresh_has_one_winner(monkeypatch, tmp_path):
                 ):
                     frozen = result.freeze()
                     row = frozen().scalar_one_or_none()
-                    if row is not None and row.revoked_at is None:
+                    if isinstance(row, RefreshToken) and row.revoked_at is None:
                         # Force both stale reads before either request can burn the token.
                         await readers.wait()
                     return frozen()

simple_module_users-0.0.41/tests/test_users_reset_password_retry.py

@@ -0,0 +1,40 @@
+"""A password policy rejection must leave a fresh reset token usable (#667)."""
+
+from urllib.parse import parse_qs, urlsplit
+
+import pytest
+from _users_app_builders import _make_standard_user
+
+
+@pytest.mark.parametrize(
+    ("password", "reason"),
+    [
+        ("short", "Password must be at least 8 characters, not counting spaces"),
+        ("12345678", "Password cannot be all numbers"),
+    ],
+)
+async def test_users_reset_rejected_password_allows_same_token_retry(
+    admin_client, anon_client, users_app, password, reason
+):
+    user = await _make_standard_user(users_app)
+    link = await admin_client.post(f"/api/users/admin/{user.id}/reset-password-link")
+    assert link.status_code == 200, link.text
+    token = parse_qs(urlsplit(link.json()["link"]).query)["token"][0]
+
+    rejected = await anon_client.post(
+        "/api/users/auth/reset-password", json={"token": token, "password": password}
+    )
+    assert rejected.status_code == 400, rejected.text
+    assert rejected.json()["detail"] == {
+        "code": "RESET_PASSWORD_INVALID_PASSWORD",
+        "reason": reason,
+    }
+
+    accepted = await anon_client.post(
+        "/api/users/auth/reset-password", json={"token": token, "password": "CompliantPass1!"}
+    )
+    assert accepted.status_code == 200, accepted.text
+    login = await anon_client.post(
+        "/api/users/auth/login", data={"username": user.email, "password": "CompliantPass1!"}
+    )
+    assert login.status_code == 204, login.text

{simple_module_users-0.0.40 → simple_module_users-0.0.41}/tests/test_users_token_pruning.py

@@ -105,7 +105,9 @@ def test_users_token_pair_persists_only_digests_with_sync_sqlite():
                     _SyncSession(session),
                     user_id,
                     SimpleNamespace(
-                        bearer_token_lifetime_seconds=900, refresh_token_lifetime_seconds=3600
+                        bearer_token_lifetime_seconds=900,
+                        refresh_token_lifetime_seconds=3600,
+                        refresh_token_family_max_age_days=90,
                     ),
                 )
             )

{simple_module_users-0.0.40 → simple_module_users-0.0.41}/tests-js/users_Login.test.tsx

@@ -42,6 +42,22 @@ afterEach(() => {
 });
 
 describe('users Login', () => {
+  it.each([
+    ['account_not_verified', keys.users.login.oauth_account_not_verified],
+    ['signup_disabled', keys.users.login.oauth_signup_disabled],
+    ['signin_failed', keys.users.login.oauth_signin_failed],
+  ])('shows the translated OAuth message for %s', (code, key) => {
+    configureI18n({ locale: 'en', messages: { [key]: 'Sign-in was refused.' } });
+    render(<Login {...props} oauth_error={code} />);
+    expect(screen.getByRole('alert')).toHaveTextContent('Sign-in was refused.');
+    configureI18n({ locale: 'en', messages: {} });
+  });
+
+  it('ignores unknown OAuth codes instead of displaying query text', () => {
+    render(<Login {...props} oauth_error="<script>untrusted text</script>" />);
+    expect(screen.queryByRole('alert')).toBeNull();
+  });
+
   it('posts the form-encoded credentials and follows the server redirect on 204', async () => {
     const mock = stubFetch(() => new Response(null, { status: 204 }));
     render(<Login {...props} />);