stkit 17.2.0__tar.gz → 17.2.2__tar.gz

{stkit-17.2.0 → stkit-17.2.2}/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## v17.2.2 (2026-10-31)
+
+No migration required.
+
+- `stk add-role` and `stk cleanup-sessions` crashed with `TypeError: 'NoneType' object is not callable` because they used the database before the app was built. Every command that runs async work now builds the app first. Run `cleanup-sessions` from cron again if you had stopped it.
+- `stk worker` stops on SIGTERM or Ctrl-C at a safe point: it cancels only the running job, hands it back, and exits without a traceback.
+- The home page describes stk as running on Quart, not Flask.
+- Requires quart-security 2.0.5: login takes the same time whether or not an email has an account, and passkey registration refuses a credential ID another user already holds (Authentication).
+
+## v17.2.1 (2026-10-31)
+
+No migration required.
+
+- Emails are stored trimmed and lowercased, and the CLI, agent login and OAuth look users up regardless of case, matching what the login form does. Before, a user created as `Ada@Example.com` from the admin page or `stk create` could not sign in, because login lowercases what it is given (Authentication).
+- Requires quart-security 2.0.4, which matches login emails regardless of case and drops the unused `remember` login field and `SECURITY_FRESHNESS_GRACE_PERIOD` setting. stk's own `SECURITY_FRESHNESS_GRACE_PERIOD` is removed with it.
+
+### Upgrade considerations
+
+- Existing rows keep their stored case and still sign in. Two rows whose emails differ only by case make login for that address fail: merge or rename one. To find them: `uv run stk shell -c "await sql('select lower(email), count(*) from \"user\" group by 1 having count(*) > 1')"`.
+- A custom login template that renders `form.remember` must drop it.
+
 ## v17.2.0 (2026-10-31)
 
 Run `uv run stk db upgrade`: four new core tables (`stk_job`, `stk_file`, `stk_notification`, `mcp_token`).

{stkit-17.2.0 → stkit-17.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stkit
-Version: 17.2.0
+Version: 17.2.2
 Summary: An async Quart framework optimized for AI-assisted development workflows
 Project-URL: Documentation, https://docs.stkit.dev
 Project-URL: Source, https://github.com/level09/stk
@@ -28,7 +28,7 @@ Requires-Dist: pillow>=13.0.0
 Requires-Dist: psycopg2-binary>=2.9.10
 Requires-Dist: python-dotenv>=1.2.2
 Requires-Dist: qrcode>=8.2
-Requires-Dist: quart-security<3,>=2.0.3
+Requires-Dist: quart-security<3,>=2.0.5
 Requires-Dist: quart-session>=3.0.0
 Requires-Dist: quart>=0.20.0
 Requires-Dist: rich>=14.0.0

{stkit-17.2.0 → stkit-17.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stkit"
-version = "17.2.0"
+version = "17.2.2"
 description = "An async Quart framework optimized for AI-assisted development workflows"
 authors = [
     {name = "Level09", email = "hello@level09.com"}
@@ -30,7 +30,7 @@ dependencies = [
     "python-dotenv>=1.2.2",
     "qrcode>=8.2",
     "quart>=0.20.0",
-    "quart-security>=2.0.3,<3",
+    "quart-security>=2.0.5,<3",
     "quart-session>=3.0.0",
     "rich>=14.0.0",
     "sqlalchemy[asyncio]>=2.0.41",

{stkit-17.2.0 → stkit-17.2.2}/stk/__init__.py

@@ -3,7 +3,7 @@ stk Framework
 A modern Python web framework optimized for AI-assisted development.
 """
 
-__version__ = "17.2.0"
+__version__ = "17.2.2"
 
 
 def __getattr__(name):

{stkit-17.2.0 → stkit-17.2.2}/stk/agent_login.py

@@ -69,7 +69,7 @@ async def agent_login():
         return "", 403
 
     user = (
-        await g.db_session.execute(select(User).where(User.email == email))
+        await g.db_session.execute(select(User).where(User.email_is(email)))
     ).scalar_one_or_none()
     if user is None or not user.active:
         return "", 403

{stkit-17.2.0 → stkit-17.2.2}/stk/cli/base.py

@@ -68,6 +68,9 @@ def cli_app():
 
 def run_async(coro):
     """Run an async function in sync context (for CLI commands)."""
+    # The engine and session factory exist only once the app is built; loading it
+    # here means no command can reach the database without it.
+    cli_app()
 
     async def _wrapper():
         try:

{stkit-17.2.0 → stkit-17.2.2}/stk/cli/develop.py

@@ -1,6 +1,5 @@
 """Starting an app, serving it locally, and running its durable jobs."""
 
-import asyncio
 from pathlib import Path
 
 import click
@@ -82,7 +81,5 @@ def worker(timeout):
             await work(timeout)
 
     console.print("[green]Worker started[/]")
-    try:
-        run_async(run())
-    except (KeyboardInterrupt, asyncio.CancelledError):
-        console.print("Worker stopped")
+    run_async(run())
+    console.print("Worker stopped")

{stkit-17.2.0 → stkit-17.2.2}/stk/cli/users.py

@@ -125,7 +125,7 @@ def create(email, password):
     async def _run():
         async with ext.async_session_factory() as session:
             existing = (
-                await session.execute(select(User).where(User.email == email))
+                await session.execute(select(User).where(User.email_is(email)))
             ).scalar_one_or_none()
             if existing is not None:
                 console.print("[yellow]User already exists![/]")
@@ -153,7 +153,7 @@ def add_role(email, role):
 
         async with ext.async_session_factory() as session:
             u = (
-                await session.execute(select(User).where(User.email == email))
+                await session.execute(select(User).where(User.email_is(email)))
             ).scalar_one_or_none()
 
             if u is None:
@@ -196,7 +196,7 @@ def reset(email, password):
         async def _run():
             async with ext.async_session_factory() as session:
                 u = (
-                    await session.execute(select(User).where(User.email == email))
+                    await session.execute(select(User).where(User.email_is(email)))
                 ).scalar_one_or_none()
                 if not u:
                     console.print(f'[red]User with email "{email}" not found.[/]')

{stkit-17.2.0 → stkit-17.2.2}/stk/public/views.py

@@ -126,7 +126,7 @@ async def handle_oauth_callback(provider_name, token, user_info):
         user = account.user
     else:
         # Email ownership at an IdP does not authorize linking local credentials.
-        existing = await g.db_session.scalar(select(User).where(User.email == email))
+        existing = await g.db_session.scalar(select(User).where(User.email_is(email)))
         if existing:
             return await authentication_failed()
         user = create_oauth_user(

{stkit-17.2.0 → stkit-17.2.2}/stk/settings.py

@@ -58,7 +58,6 @@ class Config:
     SECURITY_API_ENABLED_METHODS = ["session"]
 
     SECURITY_FRESHNESS = timedelta(minutes=60)
-    SECURITY_FRESHNESS_GRACE_PERIOD = timedelta(minutes=60)
     SECURITY_PASSWORD_LENGTH_MIN = 12
 
     SECURITY_TOTP_ISSUER = "stk"

{stkit-17.2.0 → stkit-17.2.2}/stk/tasks/__init__.py

@@ -25,6 +25,7 @@ from stk.tasks.models import Job
 logger = logging.getLogger(__name__)
 
 JOBS = {}
+_running = None  # the job task `stk worker` is awaiting, for a clean shutdown
 TIMEOUT = 3600
 POLL_SECONDS = 2
 RECOVER_SECONDS = 60
@@ -164,8 +165,13 @@ async def run_next(timeout=TIMEOUT):
     job_id, name, payload, attempts, max_attempts = claimed
     async with ext.async_session_factory() as session:
         try:
-            async with asyncio.timeout(timeout):
-                await JOBS[name](session, **payload)
+            global _running
+            _running = asyncio.create_task(JOBS[name](session, **payload))
+            try:
+                # wait_for cancels the job itself on timeout or when this is cancelled.
+                await asyncio.wait_for(_running, timeout)
+            finally:
+                _running = None
             done = await session.execute(
                 _owned(job_id, lease).values(
                     status="done", locked_until=None, last_error=None
@@ -216,11 +222,28 @@ async def recover():
 
 async def work(timeout=TIMEOUT):
     """Run due jobs one at a time until SIGTERM or Ctrl-C."""
-    asyncio.get_running_loop().add_signal_handler(
-        signal.SIGTERM, asyncio.current_task().cancel
-    )
+    stop = asyncio.Event()
+
+    def shutdown():
+        # Cancel only the job, never the worker mid-query: it hands the job back
+        # and the loop ends at its next check.
+        stop.set()
+        if _running is not None:
+            _running.cancel()
+
+    loop = asyncio.get_running_loop()
+    for sig in (signal.SIGTERM, signal.SIGINT):
+        loop.add_signal_handler(sig, shutdown)
+    try:
+        await _drain(timeout, stop)
+    except asyncio.CancelledError:
+        if not stop.is_set():
+            raise
+
+
+async def _drain(timeout, stop):
     recovered = None
-    while True:
+    while not stop.is_set():
         # Also between jobs, so a queue that never empties still recovers.
         if recovered is None or datetime.now() - recovered >= timedelta(
             seconds=RECOVER_SECONDS
@@ -228,4 +251,7 @@ async def work(timeout=TIMEOUT):
             await recover()
             recovered = datetime.now()
         if not await run_next(timeout):
-            await asyncio.sleep(POLL_SECONDS)
+            try:
+                await asyncio.wait_for(stop.wait(), POLL_SECONDS)
+            except TimeoutError:
+                pass

{stkit-17.2.0 → stkit-17.2.2}/stk/templates/index.html

@@ -8,7 +8,7 @@
 
                 <h1 class="text-headline-large font-weight-bold mb-3">Build faster with stk</h1>
                 <p class="text-body-large text-medium-emphasis mb-8">
-                    A modern Flask framework for building web applications.
+                    An async Python framework for building web applications, on Quart.
                 </p>
 
                 {% if current_user.is_authenticated %}

{stkit-17.2.0 → stkit-17.2.2}/stk/user/models.py

@@ -19,9 +19,10 @@ from sqlalchemy import (
     Table,
     UniqueConstraint,
     delete,
+    func,
     select,
 )
-from sqlalchemy.orm import declared_attr, relationship
+from sqlalchemy.orm import declared_attr, relationship, validates
 
 from stk.extensions import Base
 
@@ -68,6 +69,17 @@ class User(Base, UserMixin):
     password_set = Column(Boolean, default=True, nullable=False)
     active = Column(Boolean, default=False, nullable=True)
 
+    @validates("email")
+    def _normalize_email(self, key, value):
+        # Login lowercases what it is given; store the same form so one address
+        # cannot become two accounts that differ only by case.
+        return value.strip().lower() if value is not None else value
+
+    @classmethod
+    def email_is(cls, email):
+        """Match an email regardless of case, including rows stored before 17.2.1."""
+        return func.lower(cls.email) == email.strip().lower()
+
     roles = relationship(
         "Role", secondary=roles_users, backref="users", lazy="selectin"
     )

{stkit-17.2.0 → stkit-17.2.2}/tests/test_cli.py

@@ -61,3 +61,20 @@ class DowngradeArgumentTest(unittest.TestCase):
             result = CliRunner().invoke(main, ["db", "downgrade", "-1"])
         self.assertEqual(result.exit_code, 0, result.output)
         self.assertEqual(run.call_args.args[-1], "-1")
+
+
+class DatabaseCommandTest(unittest.TestCase):
+    def test_run_async_builds_the_app_before_touching_the_database(self):
+        """`add-role` and `cleanup-sessions` crashed: nothing had built the engine."""
+        with (
+            patch("stk.cli.base.cli_app") as load,
+            patch("stk.tasks.cleanup_expired_sessions") as cleanup,
+        ):
+            cleanup.side_effect = lambda: _done()
+            result = CliRunner().invoke(main, ["cleanup-sessions"])
+        self.assertEqual(result.exit_code, 0, result.output)
+        load.assert_called()
+
+
+async def _done():
+    return None

{stkit-17.2.0 → stkit-17.2.2}/tests/test_jobs.py

@@ -1,6 +1,8 @@
 """Durable jobs: enqueue, claim, retry, failure, and recovery of a dead worker's job."""
 
 import asyncio
+import os
+import signal
 import unittest
 from datetime import datetime, timedelta
 
@@ -11,7 +13,7 @@ from sqlalchemy import select, update
 import stk.extensions as ext
 from stk.app import Stk
 from stk.settings import TestingConfig
-from stk.tasks import enqueue, job, recover, run_next
+from stk.tasks import enqueue, job, recover, run_next, work
 from stk.tasks.models import Job
 from stk.user.models import Activity, Base, User
 from stk.user.views import api_jobs
@@ -163,6 +165,20 @@ class JobTests(unittest.IsolatedAsyncioTestCase):
         self.assertEqual(row.status, "running")
         self.assertNotIn("lost race", await self.activities())
 
+    async def test_sigterm_hands_back_the_running_job_and_stops_cleanly(self):
+        job_id = await enqueue("jobs_test_slow")
+        worker = asyncio.create_task(work())
+        for _ in range(50):
+            await asyncio.sleep(0.05)
+            if (await self.get(job_id)).status == "running":
+                break
+        os.kill(os.getpid(), signal.SIGTERM)
+        await asyncio.wait_for(worker, 5)  # returns, not CancelledError
+        row = await self.get(job_id)
+        self.assertEqual(
+            (row.status, row.attempts, row.locked_until), ("queued", 0, None)
+        )
+
     async def test_recovers_job_left_running_by_a_dead_worker(self):
         lost = await enqueue("jobs_test_record", user_id=self.user_id, action="lost")
         spent = await enqueue("jobs_test_record", user_id=self.user_id, action="spent")

{stkit-17.2.0 → stkit-17.2.2}/tests/test_security_compatibility.py

@@ -5,7 +5,7 @@ import unittest
 import pyotp
 from quart import g
 from quart_security import hash_password
-from sqlalchemy import select
+from sqlalchemy import select, update
 
 import stk.extensions as ext
 from stk.app import Stk
@@ -52,6 +52,34 @@ class SecurityCompatibilityTests(unittest.IsolatedAsyncioTestCase):
         async with client.session_transaction() as cookie:
             return dict(cookie)
 
+    async def test_emails_are_stored_lowercase_and_matched_regardless_of_case(self):
+        self.assertEqual(User(email="  New@Example.COM ").email, "new@example.com")
+        # A row stored before normalization keeps its case; lookups still find it.
+        async with ext.async_session_factory() as db:
+            await db.execute(
+                update(User)
+                .where(User.id == self.user_id)
+                .values(email="User@Example.com")
+            )
+            await db.commit()
+            found = await db.scalar(
+                select(User).where(User.email_is(" USER@example.COM"))
+            )
+            self.assertEqual(found.id, self.user_id)
+        client = self.app.test_client()
+        await client.get("/login")
+        async with client.session_transaction() as cookie:
+            csrf = cookie["_csrf_token"]
+        response = await client.post(
+            "/login",
+            form={
+                "email": " user@EXAMPLE.com ",
+                "password": "TestPassword123!",
+                "csrf_token": csrf,
+            },
+        )
+        self.assertEqual(response.status_code, 302)
+
     async def test_startup_validates_state_table_without_request(self):
         async with self.app.test_app():
             pass