stkit 17.2.0__tar.gz → 17.2.1__tar.gz

{stkit-17.2.0 → stkit-17.2.1}/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## v17.2.1 (2026-10-31)
+
+No migration required.
+
+- Emails are stored trimmed and lowercased, and the CLI, agent login and OAuth look users up regardless of case, matching what the login form does. Before, a user created as `Ada@Example.com` from the admin page or `stk create` could not sign in, because login lowercases what it is given (Authentication).
+- Requires quart-security 2.0.4, which matches login emails regardless of case and drops the unused `remember` login field and `SECURITY_FRESHNESS_GRACE_PERIOD` setting. stk's own `SECURITY_FRESHNESS_GRACE_PERIOD` is removed with it.
+
+### Upgrade considerations
+
+- Existing rows keep their stored case and still sign in. Two rows whose emails differ only by case make login for that address fail: merge or rename one. To find them: `uv run stk shell -c "await sql('select lower(email), count(*) from \"user\" group by 1 having count(*) > 1')"`.
+- A custom login template that renders `form.remember` must drop it.
+
 ## v17.2.0 (2026-10-31)
 
 Run `uv run stk db upgrade`: four new core tables (`stk_job`, `stk_file`, `stk_notification`, `mcp_token`).

{stkit-17.2.0 → stkit-17.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stkit
-Version: 17.2.0
+Version: 17.2.1
 Summary: An async Quart framework optimized for AI-assisted development workflows
 Project-URL: Documentation, https://docs.stkit.dev
 Project-URL: Source, https://github.com/level09/stk
@@ -28,7 +28,7 @@ Requires-Dist: pillow>=13.0.0
 Requires-Dist: psycopg2-binary>=2.9.10
 Requires-Dist: python-dotenv>=1.2.2
 Requires-Dist: qrcode>=8.2
-Requires-Dist: quart-security<3,>=2.0.3
+Requires-Dist: quart-security<3,>=2.0.4
 Requires-Dist: quart-session>=3.0.0
 Requires-Dist: quart>=0.20.0
 Requires-Dist: rich>=14.0.0

{stkit-17.2.0 → stkit-17.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stkit"
-version = "17.2.0"
+version = "17.2.1"
 description = "An async Quart framework optimized for AI-assisted development workflows"
 authors = [
     {name = "Level09", email = "hello@level09.com"}
@@ -30,7 +30,7 @@ dependencies = [
     "python-dotenv>=1.2.2",
     "qrcode>=8.2",
     "quart>=0.20.0",
-    "quart-security>=2.0.3,<3",
+    "quart-security>=2.0.4,<3",
     "quart-session>=3.0.0",
     "rich>=14.0.0",
     "sqlalchemy[asyncio]>=2.0.41",

{stkit-17.2.0 → stkit-17.2.1}/stk/__init__.py

@@ -3,7 +3,7 @@ stk Framework
 A modern Python web framework optimized for AI-assisted development.
 """
 
-__version__ = "17.2.0"
+__version__ = "17.2.1"
 
 
 def __getattr__(name):

{stkit-17.2.0 → stkit-17.2.1}/stk/agent_login.py

@@ -69,7 +69,7 @@ async def agent_login():
         return "", 403
 
     user = (
-        await g.db_session.execute(select(User).where(User.email == email))
+        await g.db_session.execute(select(User).where(User.email_is(email)))
     ).scalar_one_or_none()
     if user is None or not user.active:
         return "", 403

{stkit-17.2.0 → stkit-17.2.1}/stk/cli/users.py

@@ -125,7 +125,7 @@ def create(email, password):
     async def _run():
         async with ext.async_session_factory() as session:
             existing = (
-                await session.execute(select(User).where(User.email == email))
+                await session.execute(select(User).where(User.email_is(email)))
             ).scalar_one_or_none()
             if existing is not None:
                 console.print("[yellow]User already exists![/]")
@@ -153,7 +153,7 @@ def add_role(email, role):
 
         async with ext.async_session_factory() as session:
             u = (
-                await session.execute(select(User).where(User.email == email))
+                await session.execute(select(User).where(User.email_is(email)))
             ).scalar_one_or_none()
 
             if u is None:
@@ -196,7 +196,7 @@ def reset(email, password):
         async def _run():
             async with ext.async_session_factory() as session:
                 u = (
-                    await session.execute(select(User).where(User.email == email))
+                    await session.execute(select(User).where(User.email_is(email)))
                 ).scalar_one_or_none()
                 if not u:
                     console.print(f'[red]User with email "{email}" not found.[/]')

{stkit-17.2.0 → stkit-17.2.1}/stk/public/views.py

@@ -126,7 +126,7 @@ async def handle_oauth_callback(provider_name, token, user_info):
         user = account.user
     else:
         # Email ownership at an IdP does not authorize linking local credentials.
-        existing = await g.db_session.scalar(select(User).where(User.email == email))
+        existing = await g.db_session.scalar(select(User).where(User.email_is(email)))
         if existing:
             return await authentication_failed()
         user = create_oauth_user(

{stkit-17.2.0 → stkit-17.2.1}/stk/settings.py

@@ -58,7 +58,6 @@ class Config:
     SECURITY_API_ENABLED_METHODS = ["session"]
 
     SECURITY_FRESHNESS = timedelta(minutes=60)
-    SECURITY_FRESHNESS_GRACE_PERIOD = timedelta(minutes=60)
     SECURITY_PASSWORD_LENGTH_MIN = 12
 
     SECURITY_TOTP_ISSUER = "stk"

{stkit-17.2.0 → stkit-17.2.1}/stk/user/models.py

@@ -19,9 +19,10 @@ from sqlalchemy import (
     Table,
     UniqueConstraint,
     delete,
+    func,
     select,
 )
-from sqlalchemy.orm import declared_attr, relationship
+from sqlalchemy.orm import declared_attr, relationship, validates
 
 from stk.extensions import Base
 
@@ -68,6 +69,17 @@ class User(Base, UserMixin):
     password_set = Column(Boolean, default=True, nullable=False)
     active = Column(Boolean, default=False, nullable=True)
 
+    @validates("email")
+    def _normalize_email(self, key, value):
+        # Login lowercases what it is given; store the same form so one address
+        # cannot become two accounts that differ only by case.
+        return value.strip().lower() if value is not None else value
+
+    @classmethod
+    def email_is(cls, email):
+        """Match an email regardless of case, including rows stored before 17.2.1."""
+        return func.lower(cls.email) == email.strip().lower()
+
     roles = relationship(
         "Role", secondary=roles_users, backref="users", lazy="selectin"
     )

{stkit-17.2.0 → stkit-17.2.1}/tests/test_security_compatibility.py

@@ -5,7 +5,7 @@ import unittest
 import pyotp
 from quart import g
 from quart_security import hash_password
-from sqlalchemy import select
+from sqlalchemy import select, update
 
 import stk.extensions as ext
 from stk.app import Stk
@@ -52,6 +52,34 @@ class SecurityCompatibilityTests(unittest.IsolatedAsyncioTestCase):
         async with client.session_transaction() as cookie:
             return dict(cookie)
 
+    async def test_emails_are_stored_lowercase_and_matched_regardless_of_case(self):
+        self.assertEqual(User(email="  New@Example.COM ").email, "new@example.com")
+        # A row stored before normalization keeps its case; lookups still find it.
+        async with ext.async_session_factory() as db:
+            await db.execute(
+                update(User)
+                .where(User.id == self.user_id)
+                .values(email="User@Example.com")
+            )
+            await db.commit()
+            found = await db.scalar(
+                select(User).where(User.email_is(" USER@example.COM"))
+            )
+            self.assertEqual(found.id, self.user_id)
+        client = self.app.test_client()
+        await client.get("/login")
+        async with client.session_transaction() as cookie:
+            csrf = cookie["_csrf_token"]
+        response = await client.post(
+            "/login",
+            form={
+                "email": " user@EXAMPLE.com ",
+                "password": "TestPassword123!",
+                "csrf_token": csrf,
+            },
+        )
+        self.assertEqual(response.status_code, 302)
+
     async def test_startup_validates_state_table_without_request(self):
         async with self.app.test_app():
             pass