statewire 0.7.2__tar.gz → 0.8.0__tar.gz

{statewire-0.7.2 → statewire-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: statewire
-Version: 0.7.2
+Version: 0.8.0
 Summary: Replicate one JSON object over an SSE op stream + a command endpoint
 Project-URL: Repository, https://github.com/assistant-ui/harness-sdk
 License-Expression: MIT

{statewire-0.7.2 → statewire-0.8.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "statewire"
-version = "0.7.2"
+version = "0.8.0"
 description = "Replicate one JSON object over an SSE op stream + a command endpoint"
 readme = "README.md"
 license = "MIT"

{statewire-0.7.2 → statewire-0.8.0}/src/statewire/api.py

@@ -9,8 +9,7 @@ socket). ``POST /frames`` submits follow-up frames under the lease
 request header and answers instantly: ``200 {}`` admitted whole, ``429``/
 ``409`` the ``{syn}`` refusal body (with/without ``retry``; the 429 also
 carries ``Retry-After`` in whole seconds, rounded up), ``423``
-stale lease, ``400`` malformed (the stream also fins ``error``), ``401``
-unauthorized.
+stale lease, ``400`` malformed (the stream also fins ``error``).
 
 Admission is per lane, per statement: strictly consecutive seqs, where
 at-or-below the watermark absorbs (a replayed cmd statement re-emits its
@@ -54,11 +53,13 @@ Handlers that declare a keyword-only ``ctx`` parameter receive a
 ``StatewireCommandContext``: ``ctx.caller`` is the submitting client's
 handle (holdable across a long run), ``ctx.applied()`` states the
 broadcast state now contains the command's effects.
-``authorize`` gates every ingress and returns the caller's identity
-(``None`` = anonymous); the server stamps it on the client record per
-attach and per admitted command submission — never client-supplied,
-never on a rejected ingress — and drops it with the record. Handlers
-read it as ``ctx.caller.identity``: the current session owner, live —
+``authorize`` (inherited from ``PinnedAPI``) gates every attach and
+every subclass ``@route``, and returns the caller's identity (``None`` =
+anonymous); the server stamps it on the client record per attach — never
+client-supplied — and drops it with the record. Frame submissions under
+a valid lease run with the lease's stamped identity; an invalid or
+missing lease answers ``423``. Handlers read the identity as
+``ctx.caller.identity``: the current session owner, live —
 a newer authorized attach re-stamps it, so per-command trust decisions
 read it before the first await. A client id is a within-thread session
 id, not an authorization boundary: ``authorize`` must gate the thread
@@ -82,8 +83,9 @@ over WS, holding the connection is the lease.
 Subclass ``@route`` handlers are gated behind ``authorize`` automatically:
 the request is authorized before the handler body runs (an ``HTTPException``
 propagates as its status; a WebSocket handshake is denied with close code
-1008), and a handler that declares an ``identity`` parameter receives the
-authorized identity in it.
+1008), and a handler consumes the authorized identity with stock FastAPI
+DI: ``identity=Depends(identity)`` with the ``identity`` marker from
+``pinned``.
 
 Expected usage::
 
@@ -105,7 +107,6 @@ one atomic envelope, flushed when control returns to the event loop.
 
 import asyncio
 import contextlib
-import functools
 import inspect
 import json
 import logging
@@ -113,14 +114,13 @@ import math
 import secrets
 import sys
 import time
-import typing
 from dataclasses import dataclass, field
 from typing import Any, AsyncIterator, Awaitable, Callable, Coroutine, Sequence
 
 from fastapi import HTTPException, Request, WebSocket, WebSocketException
 from pinned import HostableContext, PinnedAPI
 from pinned.host import invalid_id_reason
-from pinned.routing import route, routes_of
+from pinned.routing import route, routes_of, ungated
 from starlette.requests import HTTPConnection
 from starlette.responses import JSONResponse, Response, StreamingResponse
 from starlette.websockets import WebSocketDisconnect
@@ -556,54 +556,6 @@ def _reserved_paths() -> set[str]:
     return {spec.path for fn in vars(Statewire).values() for spec in routes_of(fn)}
 
 
-def _authorized_route(fn: Any) -> Any:
-    """Gate a subclass ``@route`` handler behind ``authorize``: the identity is
-    injected into an ``identity`` parameter when the handler declares one."""
-    is_ws = any(spec.method == "WEBSOCKET" for spec in routes_of(fn))
-    conn_name = "websocket" if is_ws else "request"
-    sig = inspect.signature(fn)
-    injects_identity = "identity" in sig.parameters
-    has_conn = conn_name in sig.parameters
-
-    @functools.wraps(fn)
-    async def wrapped(self: "Statewire", **kwargs: Any) -> Any:
-        connection = kwargs[conn_name] if has_conn else kwargs.pop(conn_name)
-        if is_ws:
-            try:
-                identity = await self.authorize(connection)
-            except HTTPException as exc:
-                detail = exc.detail if isinstance(exc.detail, str) else "unauthorized"
-                raise WebSocketException(code=1008, reason=detail) from exc
-        else:
-            identity = await self.authorize(connection)
-        if injects_identity:
-            kwargs["identity"] = identity
-        return await fn(self, **kwargs)
-
-    # Resolve hints against fn's own module so pinned's signature-driven mount
-    # sees real annotations, and expose a FastAPI-injectable connection param.
-    conn_type = WebSocket if is_ws else Request
-    hints = typing.get_type_hints(fn)
-    hints.setdefault(conn_name, conn_type)
-    params = [
-        p.replace(annotation=hints.get(p.name, p.annotation))
-        for p in sig.parameters.values()
-        if p.name != "identity"
-    ]
-    if not has_conn:
-        params.insert(
-            1,
-            inspect.Parameter(
-                conn_name,
-                inspect.Parameter.POSITIONAL_OR_KEYWORD,
-                annotation=conn_type,
-            ),
-        )
-    wrapped.__signature__ = sig.replace(parameters=params)  # type: ignore[attr-defined]
-    wrapped.__annotations__ = {k: v for k, v in hints.items() if k != "identity"}
-    return wrapped
-
-
 class Statewire(PinnedAPI):
     stream_queue_size: int = 256
     heartbeat_interval: float = 15.0
@@ -618,15 +570,13 @@ class Statewire(PinnedAPI):
     def __init_subclass__(cls, **kwargs: Any) -> None:
         super().__init_subclass__(**kwargs)
         reserved = _reserved_paths()
-        for name, fn in list(vars(cls).items()):
+        for fn in list(vars(cls).values()):
             for spec in routes_of(fn):
                 if spec.path in reserved:
                     raise TypeError(
                         f"{cls.__name__}.{fn.__name__} declares @route on reserved "
                         f"path {spec.path!r}; it is a Statewire protocol endpoint"
                     )
-            if routes_of(fn):
-                setattr(cls, name, _authorized_route(fn))
         # Full-MRO scan so plain mixins (no Statewire base) contribute their
         # @command handlers; the most derived registration of a method wins.
         merged: dict[str, str] = {}
@@ -927,14 +877,6 @@ class Statewire(PinnedAPI):
 
     # ─── GET /stream ────────────────────────────────────────
 
-    async def authorize(self, request: HTTPConnection) -> Any:
-        """Auth seam: override to gate /stream, /commands and /ws; raise
-        HTTPException to reject. The return value is the caller's identity —
-        any host-chosen object, ``None`` for anonymous — stamped on the client
-        record at each attach and each admitted command submission (fresh
-        identity wins) and read by handlers via ``ctx.caller.identity``."""
-        return None
-
     def _register(
         self, client_id: str, identity: Any
     ) -> tuple[asyncio.Queue[Any], bytes]:
@@ -993,14 +935,14 @@ class Statewire(PinnedAPI):
             q.put_nowait(item)
 
     @route.get("/statewire")
-    async def legacy_statewire_meta(self, request: Request) -> dict[str, Any]:
+    async def legacy_statewire_meta(self) -> dict[str, Any]:
         # legacy: superseded by the statewire/commands command
-        await self.authorize(request)
         return {
             "protocol": ops.PROTOCOL_VERSION,
             "commands": sorted(type(self)._statewire_commands),
         }
 
+    @ungated
     @route.get("/stream")
     async def stream(self, request: Request) -> Response:
         identity = await self.authorize(request)
@@ -1008,6 +950,7 @@ class Statewire(PinnedAPI):
         q, snapshot = self._register(client_id, identity)
         return self._stream_response(q, snapshot, self._clients[client_id].lease)
 
+    @ungated
     @route.post("/stream")
     async def stream_attach(self, request: Request) -> Response:
         received = time.perf_counter()
@@ -1132,10 +1075,10 @@ class Statewire(PinnedAPI):
 
     # ─── POST /frames ───────────────────────────────────────
 
+    @ungated
     @route.post("/frames")
     async def frames(self, request: Request) -> Any:
         received = time.perf_counter()
-        identity = await self.authorize(request)
         client_id = _client_id_of(request)
         raw = await request.body()
         try:
@@ -1157,7 +1100,7 @@ class Statewire(PinnedAPI):
         lease = request.headers.get(LEASE_HEADER)
         if client is None or lease is None or lease != client.lease:
             return JSONResponse({"error": "stale-lease"}, status_code=423)
-        outcome, retry = self._admit_frame(client, frame, received, identity)
+        outcome, retry = self._admit_frame(client, frame, received)
         if outcome == "refuse":
             if retry is None:
                 return JSONResponse(self._refusal_syn(client, retry), status_code=409)
@@ -1182,7 +1125,7 @@ class Statewire(PinnedAPI):
         self._evict_streams(client_id, ([ops.encode_envelope({"fin": fin})], True))
 
     def _admit_frame(
-        self, client: _Client, frame: _Frame, received: float, identity: Any = _UNSET
+        self, client: _Client, frame: _Frame, received: float
     ) -> tuple[str, int | None]:
         """One admission law, both lanes: absorbed statements answer from the
         record, then the new suffix is admitted whole or the frame is refused
@@ -1212,8 +1155,6 @@ class Statewire(PinnedAPI):
                 for statement in cmd_new:
                     observer.on_admit(statement["method"], "refused")
             return "refuse", retry
-        if identity is not _UNSET and (ctx_new or cmd_new):
-            client.identity = identity
         for seq, value in ctx_new:
             client.context = value
             client.ctx_seq = seq
@@ -1233,10 +1174,10 @@ class Statewire(PinnedAPI):
 
     # ─── POST /commands (legacy) ────────────────────────────
 
+    @ungated
     @route.post("/commands")
     async def legacy_commands(self, request: Request) -> Any:
         received = time.perf_counter()
-        identity = await self.authorize(request)
         client_id = _client_id_of(request)
         seq = _legacy_command_seq_of(request)
         lease = request.headers.get(LEASE_HEADER)
@@ -1247,7 +1188,7 @@ class Statewire(PinnedAPI):
             raise HTTPException(status_code=400, detail="body must be JSON") from None
         if not isinstance(body, dict):
             raise HTTPException(status_code=400, detail="body must be a JSON object")
-        return await self._legacy_submit(client_id, seq, body, lease, identity, received)
+        return await self._legacy_submit(client_id, seq, body, lease, received)
 
     def _legacy_validate_submission(
         self, body: dict[str, Any]
@@ -1331,10 +1272,9 @@ class Statewire(PinnedAPI):
         body: Any,
         lease: str | None,
         received: float,
-        identity: Any = _UNSET,
     ) -> tuple[str, Any]:
         outcome, detail = await self._legacy_admission(
-            client_id, seq, body, lease, received, identity
+            client_id, seq, body, lease, received
         )
         self._legacy_observe_admit(body, outcome, detail)
         return outcome, detail
@@ -1380,7 +1320,6 @@ class Statewire(PinnedAPI):
         body: Any,
         lease: str | None,
         received: float,
-        identity: Any,
     ) -> tuple[str, Any]:
         client = self._clients.get(client_id)
         if client is None:
@@ -1393,10 +1332,6 @@ class Statewire(PinnedAPI):
         if seq > client.last_seq + 1:
             return "gap", client.last_seq + 1
         context, slots, rejections = self._legacy_validate_submission(body)
-        # Only an admitted submission may re-stamp; _UNSET keeps the
-        # attach-time identity (WS frames, facade dispatch).
-        if identity is not _UNSET:
-            client.identity = identity
         if context is not _UNSET:
             client.context = context
         if slots:
@@ -1420,11 +1355,10 @@ class Statewire(PinnedAPI):
         seq: int,
         body: Any,
         lease: str | None,
-        identity: Any,
         received: float,
     ) -> Any:
         outcome, detail = await self._legacy_admit(
-            client_id, seq, body, lease, received, identity
+            client_id, seq, body, lease, received
         )
         match outcome:
             case "unknown-client":
@@ -1608,6 +1542,7 @@ class Statewire(PinnedAPI):
 
     # ─── WS /ws ─────────────────────────────────────────────
 
+    @ungated
     @route.websocket("/ws")
     async def ws(self, websocket: WebSocket) -> None:
         client_id = websocket.query_params.get("client", "")
@@ -1659,7 +1594,7 @@ class Statewire(PinnedAPI):
                 websocket.receive_text(), self.ws_init_timeout
             )
         except TimeoutError:
-            await websocket.close(code=4401, reason=denial)
+            await self._ws_deny(websocket, denial)
             return None
         except WebSocketDisconnect:
             return None
@@ -1669,22 +1604,29 @@ class Statewire(PinnedAPI):
         try:
             frame = _parse_frame(json.loads(raw), first=True)
         except (json.JSONDecodeError, UnicodeDecodeError):
-            await websocket.close(code=4401, reason=denial)
+            await self._ws_deny(websocket, denial)
             return None
         except _Violation as exc:
             await websocket.close(code=1008, reason=exc.reason)
             return None
         if frame.headers is None:
-            await websocket.close(code=4401, reason=denial)
+            await self._ws_deny(websocket, denial)
             return None
         try:
             identity = await self.authorize(_headers_connection(websocket, frame.headers))
         except HTTPException as exc:
             reason = exc.detail if isinstance(exc.detail, str) else "unauthorized"
-            await websocket.close(code=4401, reason=reason)
+            await self._ws_deny(websocket, reason)
             return None
         return identity, frame
 
+    async def _ws_deny(self, websocket: WebSocket, denial: str) -> None:
+        with contextlib.suppress(Exception):
+            await websocket.send_text(
+                json.dumps({"fin": {"reason": "unauthorized", "message": denial}})
+            )
+        await websocket.close(code=4401, reason=denial)
+
     async def _ws_pump(
         self,
         websocket: WebSocket,
@@ -1816,7 +1758,7 @@ class Statewire(PinnedAPI):
             identity = await self.authorize(connection)
         except HTTPException as exc:
             reason = exc.detail if isinstance(exc.detail, str) else "unauthorized"
-            await websocket.close(code=4401, reason=reason)
+            await self._ws_deny(websocket, reason)
             return False
         client = self._clients.get(client_id)
         if client is not None:

{statewire-0.7.2 → statewire-0.8.0}/src/statewire/client.py

@@ -990,7 +990,7 @@ class StatewireClient:
         if fin is not None:
             self._release_holds()
             reason = fin.get("reason")
-            if reason in ("evicted", "error"):
+            if reason in ("evicted", "error", "unauthorized"):
                 self._episode = reason
                 return "reattach"
             if reason == "idle":

{statewire-0.7.2 → statewire-0.8.0}/src/statewire/ops.py

@@ -116,7 +116,7 @@ response header; ``POST /frames`` presents it as the request header and
 answers ``200 {}`` (admitted whole, instantly), ``429`` + the syn
 refusal with ``retry`` and a ``Retry-After`` header (whole seconds,
 rounded up), ``409`` + the syn refusal without, ``423`` stale
-lease, ``400`` malformed, ``401`` unauthorized. One frame in flight per
+lease, ``400`` malformed. One frame in flight per
 lane over HTTP; a retry may grow (re-include the unadmitted statements
 and continue consecutively), never drop. ``statewire/`` is the reserved
 method namespace; ``statewire/commands`` answers with the sorted

{statewire-0.7.2 → statewire-0.8.0}/tests/test_authorize.py

@@ -1,4 +1,11 @@
-from statewire_helpers import post_command, replayed_res, statewire_client, stream_of, ws_of
+from statewire_helpers import (
+    post_command,
+    post_frame,
+    replayed_res,
+    statewire_client,
+    stream_of,
+    ws_of,
+)
 from fastapi import HTTPException, Request
 
 from statewire import Statewire, command
@@ -31,14 +38,14 @@ async def test_stream_attach_without_token_is_401_and_registers_nothing():
         assert instances[-1]._subscribers == {}
 
 
-async def test_command_without_token_is_401_and_handler_never_runs():
+async def test_command_under_a_valid_lease_runs_without_reauthorization():
     async with statewire_client(Guarded) as (app, client):
         async with stream_of(app, headers={"x-token": "secret"}) as stream:
             await stream.next_event()
-        before = len(runs)
-        response = await post_command(client, {"method": "inc", "params": []}, seq=1)
-        assert response.status_code == 401
-        assert len(runs) == before
+            before = len(runs)
+            response = await post_command(client, {"method": "inc", "params": []}, seq=1)
+            assert response.status_code == 200
+            assert len(runs) == before + 1
 
 
 async def test_authorized_requests_succeed():
@@ -151,7 +158,7 @@ async def test_forged_client_id_with_bad_lease_cannot_overwrite_identity():
                 assert instance.caller.identity == "alice"
 
 
-async def test_unadmitted_lease_valid_submissions_do_not_restamp_identity():
+async def test_submissions_never_restamp_identity():
     async with statewire_client(Identified) as (app, client):
         async with stream_of(app, headers={"x-user": "alice"}) as stream:
             await stream.next_event()
@@ -174,16 +181,44 @@ async def test_unadmitted_lease_valid_submissions_do_not_restamp_identity():
             )
             assert gap.status_code == 409
             assert instance.caller.identity == "alice"
-            # a statically-rejected submission is still admitted: it consumes
-            # its seq and restamps the identity
-            rejected = await post_command(
+            admitted = await post_command(
                 client,
-                {"method": "no-such-method", "params": []},
+                {"method": "whoami", "params": []},
                 seq=2,
                 headers={"x-user": "mallory"},
             )
-            assert rejected.status_code == 422
-            assert instance.caller.identity == "mallory"
+            assert admitted.status_code == 200
+            assert instance.caller.identity == "alice"
+
+
+async def test_frames_ride_the_attach_identity_even_when_authorize_would_reject():
+    class GuardedIdentity(Statewire):
+        async def lifespan(self):
+            self.state = {}
+            yield
+
+        async def authorize(self, request):
+            user = request.headers.get("x-user")
+            if user is None:
+                raise HTTPException(status_code=401, detail="unauthorized")
+            return user
+
+        @command
+        async def whoami(self, *, ctx):
+            return {"identity": ctx.caller.identity}
+
+    async with statewire_client(GuardedIdentity) as (app, client):
+        async with stream_of(app, headers={"x-user": "alice"}) as stream:
+            await stream.next_event()
+            frame = {"cmd": [{"method": "whoami", "params": [], "seq": 1}]}
+            # No x-user header: an attach with these credentials would be 401.
+            response = await post_frame(client, frame)
+            assert response.status_code == 200
+            env = await stream.next_event()
+            while not any(c.get("type") == "result" for c in env.get("cmd", [])):
+                env = await stream.next_event()
+            (verdict,) = [c for c in env["cmd"] if c.get("type") == "result"]
+            assert verdict["payload"] == {"identity": "alice"}
 
 
 async def test_identity_is_not_settable_via_context_updates():
@@ -211,33 +246,42 @@ async def test_ws_headers_frame_authorizes_and_releases_the_snapshot():
             assert (await ws.command({"method": "inc", "params": []}))["ack"] == 1
 
 
-async def test_ws_unauthorized_headers_frame_closes_4401():
+async def test_ws_unauthorized_headers_frame_fins_and_closes_4401():
     async with statewire_client(Guarded) as (app, client):
         async with ws_of(app) as ws:
             assert ws.accepted
             await ws.send_frame({"headers": {"x-token": "wrong"}})
+            assert await ws.next_frame() == {
+                "fin": {"reason": "unauthorized", "message": "unauthorized"}
+            }
             assert await ws.next_frame() is None
             assert ws.close_code == 4401
             assert ws.close_reason == "unauthorized"
         assert instances[-1]._subscribers == {}
 
 
-async def test_ws_init_timeout_closes_unauthenticated_sockets_4401():
+async def test_ws_init_timeout_fins_and_closes_unauthenticated_sockets_4401():
     class Quick(Guarded):
         ws_init_timeout = 0.05
 
     async with statewire_client(Quick) as (app, client):
         async with ws_of(app) as ws:
             assert ws.accepted
+            assert await ws.next_frame() == {
+                "fin": {"reason": "unauthorized", "message": "unauthorized"}
+            }
             assert await ws.next_frame() is None
             assert ws.close_code == 4401
 
 
-async def test_ws_non_headers_first_frame_on_a_guarded_host_closes_4401():
+async def test_ws_non_headers_first_frame_on_a_guarded_host_fins_and_closes_4401():
     async with statewire_client(Guarded) as (app, client):
         async with ws_of(app) as ws:
             assert ws.accepted
             await ws.send_frame({"method": "inc", "params": [], "seq": 1})
+            assert await ws.next_frame() == {
+                "fin": {"reason": "unauthorized", "message": "unauthorized"}
+            }
             assert await ws.next_frame() is None
             assert ws.close_code == 4401
 

{statewire-0.7.2 → statewire-0.8.0}/tests/test_frames.py

@@ -305,7 +305,7 @@ async def test_frames_non_array_params_settles_rejected():
             ]
 
 
-async def test_frames_unauthorized_is_401():
+async def test_frames_under_a_valid_lease_skip_authorize():
     from fastapi import HTTPException
 
     class Guarded(make_counter()):
@@ -319,7 +319,7 @@ async def test_frames_unauthorized_is_401():
         ) as stream:
             await stream.next_event()
             response = await post_frame(client, {"cmd": [cmd_statement(1)]})
-            assert response.status_code == 401
+            assert response.status_code == 200
 
 
 # ─── Ctx lane ───────────────────────────────────────────────

{statewire-0.7.2 → statewire-0.8.0}/tests/test_route_auth.py

@@ -2,14 +2,15 @@
 
 - an unauthorized request answers with the authorize HTTPException's status
   and the handler never runs,
-- a handler declaring ``identity`` receives the authorized identity,
-- a handler without ``identity`` is still gated,
-- FastAPI body/query parameters on the handler keep working through the wrap,
+- a handler consumes the identity via ``Depends(identity)``,
+- a handler declaring no dependency is still gated,
+- FastAPI body/query parameters on the handler keep working,
 - a WebSocket subclass route denies the handshake when authorize rejects.
 """
 
 from statewire_helpers import WSStream, statewire_client
-from fastapi import HTTPException, Request
+from fastapi import Depends, HTTPException, Request, WebSocket
+from pinned import identity
 from pinned.routing import route
 
 from statewire import Statewire
@@ -28,7 +29,7 @@ class Domain(Statewire):
         return request.headers.get("x-user")
 
     @route.get("/whoami")
-    async def whoami(self, identity):
+    async def whoami(self, identity=Depends(identity)):
         return {"identity": identity}
 
     @route.post("/bump")
@@ -37,11 +38,11 @@ class Domain(Statewire):
         return {"count": self.state["count"] + by, "echo": payload}
 
     @route.get("/peek")
-    async def peek(self, request: Request, identity):
+    async def peek(self, request: Request, identity=Depends(identity)):
         return {"identity": identity, "path": request.url.path}
 
     @route.websocket("/tap")
-    async def tap(self, websocket, identity):
+    async def tap(self, websocket: WebSocket, identity=Depends(identity)):
         await websocket.accept()
         await websocket.send_json({"tapped": identity})
         await websocket.close()
@@ -55,7 +56,7 @@ async def test_unauthorized_route_answers_the_authorize_status():
         assert len(handled) == before
 
 
-async def test_identity_parameter_receives_the_authorized_identity():
+async def test_depends_identity_receives_the_authorized_identity():
     async with statewire_client(Domain) as (app, client):
         response = await client.get(
             "/threads/t1/whoami", headers={"x-token": "secret", "x-user": "alice"}
@@ -73,7 +74,7 @@ async def test_gated_handler_without_identity_still_runs_authorized():
         assert response.json() == {"count": 1, "echo": {"k": "v"}}
 
 
-async def test_body_and_query_params_survive_the_wrap():
+async def test_body_and_query_params_keep_working():
     async with statewire_client(Domain) as (app, client):
         response = await client.post(
             "/threads/t1/bump",

{statewire-0.7.2 → statewire-0.8.0}/tests/test_ws.py

@@ -439,6 +439,9 @@ async def test_authorize_rejection_closes_4401_and_registers_nothing():
     async with statewire_client(Guarded) as (app, client):
         async with ws_of(app) as ws:
             assert ws.accepted
+            assert await ws.next_frame() == {
+                "fin": {"reason": "unauthorized", "message": "unauthorized"}
+            }
             assert await ws.next_frame() is None
             assert ws.close_code == 4401
             assert ws.close_reason == "unauthorized"