simple-module-users 0.0.40__tar.gz → 0.0.42__tar.gz

{simple_module_users-0.0.40 → simple_module_users-0.0.42}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_users
-Version: 0.0.40
+Version: 0.0.42
 Summary: Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -23,12 +23,12 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.12
 Requires-Dist: cachetools<8,>=5.3
 Requires-Dist: fastapi-users[oauth,sqlalchemy]<16,>=15
-Requires-Dist: simple-module-auth==0.0.40
-Requires-Dist: simple-module-core==0.0.40
-Requires-Dist: simple-module-db==0.0.40
-Requires-Dist: simple-module-hosting==0.0.40
-Requires-Dist: simple-module-mail==0.0.40
-Requires-Dist: simple-module-settings==0.0.40
+Requires-Dist: simple-module-auth==0.0.42
+Requires-Dist: simple-module-core==0.0.42
+Requires-Dist: simple-module-db==0.0.42
+Requires-Dist: simple-module-hosting==0.0.42
+Requires-Dist: simple-module-mail==0.0.42
+Requires-Dist: simple-module-settings==0.0.42
 Requires-Dist: typer<0.28,>=0.12
 Description-Content-Type: text/markdown
 

{simple_module_users-0.0.40 → simple_module_users-0.0.42}/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@simple-module-py/users",
-  "version": "0.0.40",
+  "version": "0.0.42",
   "private": true,
   "description": "Frontend assets for the Users module",
   "peerDependencies": {
+    "@inertiajs/react": "^3.9.1",
+    "@simple-module-py/ui": "*",
     "react": "^19.0.0",
-    "react-dom": "^19.0.0",
-    "@inertiajs/react": "^3.7.0",
-    "@simple-module-py/ui": "*"
+    "react-dom": "^19.3.1"
   },
   "devDependencies": {
     "@simple-module-py/tsconfig": "*"

{simple_module_users-0.0.40 → simple_module_users-0.0.42}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_users"
-version = "0.0.40"
+version = "0.0.42"
 description = "Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps"
 readme = "README.md"
 license = "MIT"
@@ -21,14 +21,14 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "simple_module_core==0.0.40",
-    "simple_module_db==0.0.40",
-    "simple_module_hosting==0.0.40",
-    "simple_module_settings==0.0.40",
-    "simple_module_auth==0.0.40",
+    "simple_module_core==0.0.42",
+    "simple_module_db==0.0.42",
+    "simple_module_hosting==0.0.42",
+    "simple_module_settings==0.0.42",
+    "simple_module_auth==0.0.42",
     # Sends through the framework mail sender; `mail` owns the SMTP transport
     # (GH #496), so an upgrade keeps delivering mail.
-    "simple_module_mail==0.0.40",
+    "simple_module_mail==0.0.42",
     # Pinned to a narrow range: `deps.py` relies on mutating CookieTransport
     # fields after construction (see reconfigure_cookie_transport in backend.py).
     # Bumping the major version requires re-checking those field names.

simple_module_users-0.0.42/tests/invites/test_users_bulk_invite_error_privacy.py

@@ -0,0 +1,24 @@
+"""Invite responses never expose database statements or exception details (#698)."""
+
+import pytest
+from fastapi_users.exceptions import UserAlreadyExists
+from sqlalchemy.exc import IntegrityError
+from users.invites.bulk import _failure_detail
+
+
+@pytest.mark.parametrize(
+    "error",
+    [
+        IntegrityError(
+            "INSERT INTO users VALUES (:password)", {"password": "secret"}, Exception("db")
+        ),
+        RuntimeError("private backend details"),
+        Exception(),
+    ],
+)
+def test_users_bulk_invite_unknown_error_is_generic(error):
+    assert _failure_detail(error) == "The invitation could not be created. Please try again."
+
+
+def test_users_bulk_invite_already_exists_has_safe_message():
+    assert _failure_detail(UserAlreadyExists()) == "Already a member of this workspace"

{simple_module_users-0.0.40 → simple_module_users-0.0.42}/tests/test_bearer_token_expiry.py

@@ -32,6 +32,30 @@ _ME = "/api/users/me"
 _CREDS = {"username": "admin@example.com", "password": "AdminPass1!"}
 
 
+async def _cookie_strategy_user(app, client):
+    """Resolve the ``sm_auth`` cookie through the cookie strategy itself.
+
+    ``/api/users/me`` now resolves the request principal (session or bearer,
+    #658), so it no longer exercises ``ExpiringDatabaseStrategy``; read the row
+    the way ``fastapi_users.current_user`` does instead.
+    """
+    from users.backend import build_strategy
+    from users.db_adapter import PruningAccessTokenDatabase
+    from users.models import UserAccessToken
+
+    async with app.state.sm.db.session_factory() as session:
+
+        class _Manager:
+            def parse_id(self, value):
+                return value if isinstance(value, uuid.UUID) else uuid.UUID(str(value))
+
+            async def get(self, user_id):
+                return await session.get(User, user_id)
+
+        strategy = build_strategy(PruningAccessTokenDatabase(session, UserAccessToken), 900)
+        return await strategy.read_token(client.cookies.get("sm_auth"), _Manager())
+
+
 async def _tokens(app) -> list[UserAccessToken]:
     async with app.state.sm.db.session_factory() as session:
         return list((await session.execute(select(UserAccessToken))).scalars())
@@ -129,15 +153,14 @@ class TestAnExpiredRowStopsAuthenticating:
     async def test_the_cookie_strategy_path_refuses_it(self, users_app, anon_client):
         """`fastapi_users.current_user`, via ExpiringDatabaseStrategy.
 
-        ``/api/users/me`` is the probe because it depends on ``current_user``,
-        which is what reads the ``sm_auth`` row. The row stays well inside the
-        thirty-day read ceiling — only the deadline it was issued for has passed.
+        The row stays well inside the thirty-day read ceiling — only the
+        deadline it was issued for has passed.
         """
         assert (await anon_client.post(_LOGIN, data=_CREDS)).status_code == 204
-        assert (await anon_client.get(_ME)).status_code == 200
+        assert await _cookie_strategy_user(users_app, anon_client) is not None
 
         await _expire_all(users_app)
-        assert (await anon_client.get(_ME)).status_code == 401
+        assert await _cookie_strategy_user(users_app, anon_client) is None
 
     @pytest.mark.anyio
     async def test_the_provider_path_refuses_it(self, users_app, anon_client):

{simple_module_users-0.0.40 → simple_module_users-0.0.42}/tests/test_remember_me.py

@@ -77,6 +77,30 @@ async def _age_access_tokens(app, *, days: int) -> None:
         await session.commit()
 
 
+async def _cookie_strategy_user(app, client):
+    """Resolve the ``sm_auth`` cookie through the cookie strategy itself.
+
+    ``/api/users/me`` now resolves the request principal (session or bearer,
+    #658), so it no longer exercises ``ExpiringDatabaseStrategy``; read the row
+    the way ``fastapi_users.current_user`` does instead.
+    """
+    from users.backend import build_strategy
+    from users.db_adapter import PruningAccessTokenDatabase
+    from users.models import UserAccessToken
+
+    async with app.state.sm.db.session_factory() as session:
+
+        class _Manager:
+            def parse_id(self, value):
+                return value if isinstance(value, uuid.UUID) else uuid.UUID(str(value))
+
+            async def get(self, user_id):
+                return await session.get(User, user_id)
+
+        strategy = build_strategy(PruningAccessTokenDatabase(session, UserAccessToken), 900)
+        return await strategy.read_token(client.cookies.get("sm_auth"), _Manager())
+
+
 class TestRemembered:
     @pytest.mark.anyio
     async def test_the_auth_cookie_lasts_thirty_days(self, anon_client, users_db):
@@ -104,14 +128,13 @@ class TestRemembered:
         know which sign-ins asked to be remembered — a row minted to last
         thirty days therefore has to be accepted for thirty, or the cookie
         outlives the credential it carries and the checkbox starts lying on
-        day fourteen. ``/api/users/me`` is the probe because it depends on
-        ``current_user``, which is the code path that reads the row.
+        day fourteen.
         """
         await _make_user(users_db, "remember-token@example.com")
         await _login(anon_client, "remember-token@example.com", remember=True)
 
         await _age_access_tokens(users_app, days=29)
-        assert (await anon_client.get("/api/users/me")).status_code == 200
+        assert await _cookie_strategy_user(users_app, anon_client) is not None
 
     @pytest.mark.anyio
     async def test_a_token_past_the_window_stops_being_read(self, anon_client, users_db, users_app):
@@ -121,7 +144,7 @@ class TestRemembered:
         await _login(anon_client, "stale-token@example.com", remember=True)
 
         await _age_access_tokens(users_app, days=31)
-        assert (await anon_client.get("/api/users/me")).status_code == 401
+        assert await _cookie_strategy_user(users_app, anon_client) is None
 
 
 class TestTheWindowSurvivesLaterRequests:

{simple_module_users-0.0.40 → simple_module_users-0.0.42}/tests/test_revocation_broadcast.py

@@ -133,18 +133,20 @@ class TestRollbackDoesNotBroadcast:
     ):
         """Fail the endpoint *after* it has registered the on-commit callback.
 
-        ``delete`` is called for the access-token rows, which happens after the
-        bump and after ``db.on_commit(...)``. Making it raise reproduces "the
-        transaction did not commit" without needing to break the database.
+        Let the shared helper finish, then fail before the response commits.
+        This exercises rollback with an invalidation callback already queued.
         """
         import users.auth_local.self_account as self_account
 
         await _sign_in(anon_client)
 
-        def _explode(*args, **kwargs):
+        revoke = self_account.revoke_all_credentials
+
+        async def _explode(*args, **kwargs):
+            await revoke(*args, **kwargs)
             raise RuntimeError("simulated failure after the session_version bump")
 
-        monkeypatch.setattr(self_account, "delete", _explode)
+        monkeypatch.setattr(self_account, "revoke_all_credentials", _explode)
 
         with pytest.raises(RuntimeError, match="simulated failure"):
             await anon_client.post(_REVOKE)

simple_module_users-0.0.42/tests/test_users_admin_create_commit.py

@@ -0,0 +1,77 @@
+"""Single admin creation/invitation side effects follow the commit (#692, #627)."""
+
+import pytest
+from background_tasks.models import OutboxMessage
+from simple_module_db import transaction
+from sqlalchemy import event
+from sqlmodel import select
+from test_users_deletion_events import PausedUserTransport, record_user_event
+from users.contracts.events import UserCreated, UserInvited
+from users.models import User
+
+
+@pytest.mark.parametrize("operation,event_type", [("invite", UserInvited), ("create", UserCreated)])
+@pytest.mark.parametrize("durable", [False, True])
+@pytest.mark.parametrize("fail_commit", [True, False])
+async def test_admin_creation_side_effects_wait_for_commit(
+    admin_client, users_app, captured_mail, monkeypatch, operation, event_type, fail_commit, durable
+):
+    observed = []
+    before_commit = []
+
+    async def observe(message):
+        observed.append(message)
+
+    bus = users_app.state.sm.event_bus
+    bus.subscribe(event_type, observe)
+    if durable:
+        bus.durable_transport = PausedUserTransport()
+        bus.subscribe_durable(event_type, record_user_event)
+    email = "commit-boundary@example.com"
+
+    def fail(session):
+        raise RuntimeError("forced commit failure")
+
+    finalize = transaction.finalize_session
+
+    async def check_commit(session):
+        before_commit.append((list(captured_mail.messages), list(observed)))
+        if fail_commit:
+            event.listen(session.sync_session, "before_commit", fail, once=True)
+        await finalize(session)
+
+    monkeypatch.setattr(transaction, "finalize_session", check_commit)
+    db = users_app.state.sm.db
+    body = {"email": email, "role_names": []}
+    if operation == "create":
+        body["password"] = "CompliantPass1!"
+    response = await admin_client.post(
+        "/api/users/admin/invite" if operation == "invite" else "/api/users/admin", json=body
+    )
+
+    assert response.status_code == (500 if fail_commit else 201), response.text
+    assert before_commit == [([], [])]
+    async with db.session_factory() as session:
+        user = (await session.execute(select(User).where(User.email == email))).scalar_one_or_none()
+        outbox = (await session.execute(select(OutboxMessage))).scalars().all()
+    assert len(outbox) == (1 if durable and not fail_commit else 0)
+    if fail_commit:
+        assert captured_mail.messages == []
+        assert observed == []
+    else:
+        assert user is not None
+        assert len(observed) == 1
+        assert observed[0].user_id == user.id
+        assert observed[0].email == email
+        if operation == "invite":
+            assert any("/users/invite/accept?token=" in m.text for m in captured_mail.to(email))
+
+
+async def test_admin_invite_existing_email_is_a_conflict(admin_client, captured_mail):
+    body = {"email": "dup-invite@example.com", "role_names": []}
+    first = await admin_client.post("/api/users/admin/invite", json=body)
+    assert first.status_code == 201, first.text
+    sent = len(captured_mail.messages)
+    again = await admin_client.post("/api/users/admin/invite", json=body)
+    assert again.status_code == 409, again.text
+    assert len(captured_mail.messages) == sent

simple_module_users-0.0.42/tests/test_users_data_compatibility.py

@@ -0,0 +1,66 @@
+"""Semantic token checks accept current baselines and equivalent ports (#711)."""
+
+import pytest
+from sqlalchemy import text
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from users.module import UsersModule
+
+
+@pytest.mark.parametrize(
+    ("access_type", "refresh_type", "token", "incompatible"),
+    [
+        ("VARCHAR(64)", "VARCHAR(64)", None, False),
+        ("VARCHAR(64)", "VARCHAR(64)", "a" * 64, False),
+        ("VARCHAR(43)", "CHAR(32)", None, True),
+        ("VARCHAR(64)", "VARCHAR(64)", "plaintext", True),
+        ("VARCHAR(64)", "VARCHAR(64)", "z" * 64, True),
+    ],
+)
+async def test_users_semantic_token_compatibility(access_type, refresh_type, token, incompatible):
+    engine = create_async_engine("sqlite+aiosqlite:///:memory:")
+    try:
+        async with engine.begin() as conn:
+            for name, kind in [("access", access_type), ("refresh", refresh_type)]:
+                await conn.execute(text(f"CREATE TABLE users_{name}_token (token {kind})"))
+                if token:
+                    await conn.execute(
+                        text(f"INSERT INTO users_{name}_token VALUES (:token)"), {"token": token}
+                    )
+        async with async_sessionmaker(engine)() as db:
+            issues = await UsersModule().check_data_compatibility(db)
+            assert bool(issues) is incompatible
+            if incompatible:
+                assert issues[0].upgrade_id == "users.hashed_bearer_tokens_v1"
+                assert issues[0].severity == "error"
+            if token:
+                assert await db.scalar(text("SELECT token FROM users_access_token")) == token
+    finally:
+        await engine.dispose()
+
+
+async def test_missing_token_tables_are_not_a_finding():
+    # An unmigrated database is the migration check's problem; this must not
+    # refuse a production boot on its own.
+    engine = create_async_engine("sqlite+aiosqlite:///:memory:")
+    try:
+        async with async_sessionmaker(engine)() as db:
+            assert await UsersModule().check_data_compatibility(db) == []
+    finally:
+        await engine.dispose()
+
+
+async def test_plaintext_rows_behind_hashed_ones_are_found():
+    engine = create_async_engine("sqlite+aiosqlite:///:memory:")
+    try:
+        async with engine.begin() as conn:
+            for name in ("access", "refresh"):
+                await conn.execute(text(f"CREATE TABLE users_{name}_token (token VARCHAR(64))"))
+                for i in range(150):
+                    await conn.execute(
+                        text(f"INSERT INTO users_{name}_token VALUES (:t)"), {"t": f"{i:064x}"}
+                    )
+            await conn.execute(text("INSERT INTO users_access_token VALUES ('plaintext')"))
+        async with async_sessionmaker(engine)() as db:
+            assert await UsersModule().check_data_compatibility(db)
+    finally:
+        await engine.dispose()

simple_module_users-0.0.42/tests/test_users_mailer_templates.py

@@ -0,0 +1,148 @@
+"""Host template precedence, optional HTML, and startup configuration (#712)."""
+
+import json
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+from fastapi import FastAPI
+from jinja2 import TemplateNotFound, TemplateSyntaxError
+from jinja2.exceptions import SecurityError
+from simple_module_core.settings_hydrate import build_settings
+from users.mailer import build_mailer
+from users.mailer.templated import TemplatedMailer
+from users.settings import UsersSettings
+from users.startup import _build_mailer
+
+
+@pytest.mark.parametrize(
+    ("stem", "method", "args", "route"),
+    [
+        ("verify_email", "send_verification", (), "verify"),
+        ("reset_password", "send_password_reset", (), "reset-password"),
+        ("invite", "send_invite", ("<Alice>", " <note> "), "invite/accept"),
+    ],
+)
+async def test_html_only_override_keeps_bundled_text(
+    tmp_path, captured_mail, stem, method, args, route
+):
+    (tmp_path / f"{stem}.html").write_text(
+        "<p>{{ app_name }}|{{ link }}|{{ invited_by_name }}|{{ message }}</p>"
+    )
+    mailer = TemplatedMailer("https://example.com/", lambda: "<Acme>", template_dirs=[tmp_path])
+    await getattr(mailer, method)("a@example.com", "tok&x", *args)
+
+    (msg,) = captured_mail.messages
+    assert f"https://example.com/users/{route}?token=tok&x" in msg.text
+    assert "<Acme>" in msg.text
+    assert f"https://example.com/users/{route}?token=tok&amp;x" in msg.html
+    assert "&lt;Acme&gt;" in msg.html
+    if stem == "invite":
+        assert "&lt;Alice&gt;|&lt;note&gt;" in msg.html
+        assert "<Alice>" in msg.text and "<note>" in msg.text
+
+
+async def test_directory_order_and_independent_file_fallback(tmp_path, captured_mail):
+    first, second = tmp_path / "first", tmp_path / "second"
+    first.mkdir()
+    second.mkdir()
+    (first / "verify_email.txt").write_text("first {{ app_name }}")
+    (second / "verify_email.txt").write_text("second")
+    (second / "verify_email.html").write_text("<b>second {{ app_name }}</b>")
+    mailer = build_mailer(UsersSettings(), lambda: "<Acme>", template_dirs=[str(first), second])
+    await mailer.send_verification("a@example.com", "tok")
+    await mailer.send_password_reset("a@example.com", "reset")
+    verify, reset = captured_mail.messages
+    assert verify.text == "first <Acme>"
+    assert verify.html == "<b>second &lt;Acme&gt;</b>"
+    assert "/users/reset-password?token=reset" in reset.text
+    assert reset.html is None
+
+
+async def test_mailer_environments_are_isolated(tmp_path, captured_mail):
+    (tmp_path / "verify_email.txt").write_text("custom")
+    custom = TemplatedMailer("https://example.com", template_dirs=[tmp_path])
+    default = TemplatedMailer("https://example.com")
+    await custom.send_verification("a@example.com", "tok")
+    await default.send_verification("a@example.com", "tok")
+    await custom.send_verification("a@example.com", "tok")
+    assert [m.text for m in captured_mail.messages][::2] == ["custom", "custom"]
+    assert "Welcome to SimpleModule!" in captured_mail.messages[1].text
+    assert all(m.html is None for m in captured_mail.messages)
+
+
+@pytest.mark.parametrize(
+    ("source", "error"),
+    [
+        ("{% if %}", TemplateSyntaxError),
+        ('{% include "missing.html" %}', TemplateNotFound),
+        ('{% extends "missing.html" %}', TemplateNotFound),
+        ("{{ 1 / 0 }}", ZeroDivisionError),
+    ],
+)
+async def test_broken_html_prevents_delivery(tmp_path, captured_mail, source, error):
+    (tmp_path / "verify_email.html").write_text(source)
+    mailer = TemplatedMailer("https://example.com", template_dirs=[tmp_path])
+    with pytest.raises(error):
+        await mailer.send_verification("a@example.com", "tok")
+    assert not captured_mail.messages
+
+
+async def test_broken_text_is_not_hidden_by_bundled_fallback(tmp_path, captured_mail):
+    (tmp_path / "verify_email.txt").write_text("{% if %}")
+    mailer = TemplatedMailer("https://example.com", template_dirs=[tmp_path])
+    with pytest.raises(TemplateSyntaxError):
+        await mailer.send_verification("a@example.com", "tok")
+    assert not captured_mail.messages
+
+
+@pytest.mark.parametrize("kind", ["relative", "missing", "file"])
+def test_invalid_template_directory_is_skipped_with_warning(tmp_path, kind, caplog):
+    path = tmp_path / kind
+    if kind == "file":
+        path.write_text("not a directory")
+    if kind == "relative":
+        path = Path("relative")
+    settings = UsersSettings(mail_template_dirs=[str(path)])
+    state = SimpleNamespace()
+    _build_mailer(FastAPI(), state, settings)
+    assert state.mailer is not None
+    assert "Ignoring mail template path" in caplog.text
+
+
+async def test_startup_forwards_db_setting_and_keeps_branding_live(tmp_path, captured_mail):
+    (tmp_path / "verify_email.html").write_text("<p>{{ app_name }}</p>")
+    settings = build_settings(
+        UsersSettings, {"mail_template_dirs": (json.dumps([str(tmp_path)]), "json")}
+    )
+    app = FastAPI()
+    app.state.branding = SimpleNamespace(settings=SimpleNamespace(app_name="First"))
+    state = SimpleNamespace()
+    _build_mailer(app, state, settings)
+    app.state.branding.settings.app_name = "<Second>"
+    await state.mailer.send_verification("a@example.com", "tok")
+    (msg,) = captured_mail.messages
+    assert msg.html == "<p>&lt;Second&gt;</p>"
+    assert msg.subject == "Verify your email for <Second>"
+    assert "<Second>" in msg.text
+
+
+def test_template_setting_is_restart_required_and_defaults_are_independent(monkeypatch):
+    monkeypatch.setenv("SM_USERS_MAIL_TEMPLATE_DIRS", '["/ignored"]')
+    first, second = UsersSettings(), UsersSettings()
+    assert first.mail_template_dirs == []
+    first.mail_template_dirs.append("/trusted/templates")
+    assert second.mail_template_dirs == []
+    assert UsersSettings.model_fields["mail_template_dirs"].json_schema_extra == {
+        "requires_restart": True
+    }
+
+
+async def test_host_templates_render_sandboxed(tmp_path, captured_mail):
+    # The directory list is admin-editable, so a template must not reach Python
+    # internals (the classic ``__class__.__mro__`` escape).
+    (tmp_path / "verify_email.txt").write_text("{{ ''.__class__.__mro__[1].__subclasses__() }}")
+    mailer = TemplatedMailer("https://example.com", template_dirs=[tmp_path])
+    with pytest.raises(SecurityError):
+        await mailer.send_verification("a@example.com", "tok")
+    assert captured_mail.messages == []

simple_module_users-0.0.42/tests/test_users_me_credentials.py

@@ -0,0 +1,46 @@
+"""Self-profile routes accept local bearer tokens as well as browser cookies."""
+
+import pytest
+from _users_app_builders import user_row
+
+
+@pytest.mark.parametrize("credential", ["bearer", "cookie"])
+async def test_users_me_reads_and_updates_profile(anon_client, alice, users_app, credential):
+    if credential == "bearer":
+        login = await anon_client.post(
+            "/api/users/auth/token",
+            json={"email": alice.email, "password": "UserPass1!"},
+        )
+        assert login.status_code == 200
+        anon_client.cookies.clear()
+        headers = {"Authorization": f"Bearer {login.json()['access_token']}"}
+    else:
+        login = await anon_client.post(
+            "/api/users/auth/login",
+            data={"username": alice.email, "password": "UserPass1!"},
+        )
+        assert login.status_code == 204
+        headers = {}
+
+    profile = await anon_client.get("/api/users/me", headers=headers)
+    assert profile.status_code == 200
+    assert profile.json()["id"] == str(alice.id)
+    assert profile.json()["email"] == alice.email
+    assert "hashed_password" not in profile.json()
+
+    updated = await anon_client.patch(
+        "/api/users/me", headers=headers, json={"full_name": "Updated Profile"}
+    )
+    assert updated.status_code == 200
+    assert updated.json()["id"] == str(alice.id)
+    assert updated.json()["full_name"] == "Updated Profile"
+    assert (await user_row(users_app, alice.email)).full_name == "Updated Profile"
+
+
+@pytest.mark.parametrize("method", ["GET", "PATCH"])
+@pytest.mark.parametrize("headers", [{}, {"Authorization": "Bearer invalid-token"}])
+async def test_users_me_requires_valid_credentials(anon_client, method, headers):
+    response = await anon_client.request(
+        method, "/api/users/me", headers=headers, json={"full_name": "Unauthorized"}
+    )
+    assert response.status_code == 401