stkit 17.2.7__tar.gz → 17.3.1__tar.gz

{stkit-17.2.7 → stkit-17.3.1}/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## v17.3.1 (2026-10-31)
+
+No migration required.
+
+- Versioned static responses were marked public and immutable for a year even when they were a 404 or carried a session cookie change, such as clearing a stale login. A shared cache could then replay them to other visitors. Only a 200 with no cookie change is cached publicly now; a response that changes the session is `private, no-store`.
+- `stk smoke`'s raw-score rule could take tens of seconds on a page with a long run of blanks after the word "score", from two adjacent optional-blank patterns backtracking. It is linear now (Build Loop).
+
+## v17.3.0 (2026-10-31)
+
+Run `uv run stk db upgrade`: `stk_0007` marks every existing account confirmed. Requires quart-security 2.1.0.
+
+- Password reset by email at `/reset`, on by default once `MAIL_SERVER` and `STK_PUBLIC_URL` are both set (`SECURITY_RECOVERABLE` overrides). Links work once, for one hour, and die if the email or password changes. A reset signs out every session, revokes MCP tokens and clears a lockout (Authentication).
+- Public sign-up now requires email confirmation (`SECURITY_CONFIRMABLE`, default on). An unconfirmed account fails login exactly like a wrong password, which closes the last way to find accounts through sign-up. With `SECURITY_REGISTERABLE=true`, startup fails without `MAIL_SERVER`; set `SECURITY_CONFIRMABLE=false` to keep unconfirmed sign-up (Authentication).
+- Users created by code, the CLI, admins or OAuth start confirmed: `User()` sets `confirmed_at` unless given one.
+- A locked account now fails login with the same message as a wrong password.
+- Auth mail links come from `STK_PUBLIC_URL` (as `SECURITY_PUBLIC_URL`), never the Host header. The 17.2.7 sign-up notice now comes from quart-security.
+- The reset, resend and confirm pages use the current auth layout.
+
 ## v17.2.7 (2026-10-31)
 
 No migration required. Requires quart-security 2.0.6.

{stkit-17.2.7 → stkit-17.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stkit
-Version: 17.2.7
+Version: 17.3.1
 Summary: An async Quart framework optimized for AI-assisted development workflows
 Project-URL: Documentation, https://docs.stkit.dev
 Project-URL: Source, https://github.com/level09/stk
@@ -28,7 +28,7 @@ Requires-Dist: pillow>=13.0.0
 Requires-Dist: psycopg2-binary>=2.9.10
 Requires-Dist: python-dotenv>=1.2.2
 Requires-Dist: qrcode>=8.2
-Requires-Dist: quart-security<3,>=2.0.6
+Requires-Dist: quart-security<3,>=2.1.0
 Requires-Dist: quart-session>=3.0.0
 Requires-Dist: quart>=0.20.0
 Requires-Dist: rich>=14.0.0

{stkit-17.2.7 → stkit-17.3.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stkit"
-version = "17.2.7"
+version = "17.3.1"
 description = "An async Quart framework optimized for AI-assisted development workflows"
 authors = [
     {name = "Level09", email = "hello@level09.com"}
@@ -30,7 +30,7 @@ dependencies = [
     "python-dotenv>=1.2.2",
     "qrcode>=8.2",
     "quart>=0.20.0",
-    "quart-security>=2.0.6,<3",
+    "quart-security>=2.1.0,<3",
     "quart-session>=3.0.0",
     "rich>=14.0.0",
     "sqlalchemy[asyncio]>=2.0.41",

{stkit-17.2.7 → stkit-17.3.1}/stk/__init__.py

@@ -3,7 +3,7 @@ stk Framework
 A modern Python web framework optimized for AI-assisted development.
 """
 
-__version__ = "17.2.7"
+__version__ = "17.3.1"
 
 
 def __getattr__(name):

{stkit-17.2.7 → stkit-17.3.1}/stk/app.py

@@ -18,7 +18,8 @@ from quart import (
     send_from_directory,
     url_for,
 )
-from quart_security import Security, SQLAlchemyUserDatastore, user_register_conflict
+from quart import session as quart_session
+from quart_security import Security, SQLAlchemyUserDatastore
 from quart_security.views import _ensure_csrf_token
 from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
 from werkzeug.exceptions import HTTPException, NotFound
@@ -172,19 +173,37 @@ def register_extensions(app):
         except TimeoutError:
             app.logger.warning("Timed out while disposing SQLAlchemy engine")
 
-    from stk.security import notify_register_conflict, register_security_controls
+    from stk.security import register_security_controls
+    from stk.utils.email import send_email
     from stk.utils.ratelimit import register_rate_limits
 
     register_rate_limits(app)
     register_security_controls(app)
 
+    config = app.config
+    # Links in auth email come from the public URL, never the Host header.
+    config.setdefault("SECURITY_PUBLIC_URL", config.get("STK_PUBLIC_URL"))
+    if config.get("SECURITY_RECOVERABLE") is None:
+        config["SECURITY_RECOVERABLE"] = bool(
+            config.get("MAIL_SERVER") and config["SECURITY_PUBLIC_URL"]
+        )
+    if (
+        config.get("SECURITY_REGISTERABLE")
+        and config.get("SECURITY_CONFIRMABLE", True)
+        and not config.get("MAIL_SERVER")
+    ):
+        raise RuntimeError(
+            "SECURITY_REGISTERABLE needs MAIL_SERVER to send confirmation links;"
+            " set it, or set SECURITY_CONFIRMABLE=false to allow unconfirmed sign-up"
+        )
+
     Security(
         app,
         user_datastore,
         register_form=ExtendedRegisterForm,
         change_password_form=OAuthAwareChangePasswordForm,
+        send_mail=send_email,
     )
-    user_register_conflict.connect(notify_register_conflict, sender=app, weak=False)
     # The library resets its session before loading the user. Share that session
     # so signals and application routes participate in the same transaction.
     app.before_request(_open_session)
@@ -235,11 +254,15 @@ def register_static_versioning(app):
     @app.after_request
     async def _cache_static(response):
         if request.path.startswith(f"{app.static_url_path}/"):
-            response.headers["Cache-Control"] = (
-                "public, max-age=31536000, immutable"
-                if request.args.get("v")
-                else "no-cache"
-            )
+            if quart_session.modified:
+                # This response sets or clears a session cookie; a shared cache
+                # must never replay it to someone else.
+                policy = "private, no-store"
+            elif request.args.get("v") and response.status_code == 200:
+                policy = "public, max-age=31536000, immutable"
+            else:
+                policy = "no-cache"
+            response.headers["Cache-Control"] = policy
         return response
 
     def import_map():

{stkit-17.2.7 → stkit-17.3.1}/stk/cli/copy_rules.py

@@ -41,7 +41,8 @@ HEX = re.compile(r"[0-9a-f]{6,}", re.I)
 HASH_LABEL = re.compile(r"(?:sha-?256|sha|md5|hash|digest|fingerprint)\W{0,3}$", re.I)
 SNAKE = re.compile(r"(?<![\w./@-])[a-z][a-z0-9]*(?:_[a-z0-9]+)+(?![\w@-]|\.\w)")
 SCORE = re.compile(
-    r"\b(?:score|similarity|confidence|distance|cosine)\b\s*[:=]?\s*-?\d*\.\d+", re.I
+    r"\b(?:score|similarity|confidence|distance|cosine)\b\s*(?:[:=]\s*)?-?\d*\.\d+",
+    re.I,
 )
 ONE = re.compile(r"(?<![\d.,:/-])\b1[ \t]+([A-Za-z]+s)\b")
 # Words ending in s after a 1 that are not plurals: "1 is", "1 status".

stkit-17.3.1/stk/migrations/versions/stk_0007_confirm_existing_users.py

@@ -0,0 +1,28 @@
+"""Mark every existing account confirmed.
+
+stk 17.3 turns on email confirmation, and an account with no `confirmed_at` can
+no longer sign in. No account before this revision ever had to confirm, so all
+of them count as confirmed; only sign-ups from now on wait for the email.
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "stk_0007"
+down_revision = "stk_0006"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    user = sa.table("user", sa.column("confirmed_at", sa.DateTime()))
+    op.execute(
+        user.update()
+        .where(user.c.confirmed_at.is_(None))
+        .values(confirmed_at=sa.func.current_timestamp())
+    )
+
+
+def downgrade() -> None:
+    # Which accounts were unconfirmed before is not recorded; leave them all.
+    pass

{stkit-17.2.7 → stkit-17.3.1}/stk/security.py

@@ -124,31 +124,6 @@ def register_security_controls(app):
         return response
 
 
-async def notify_register_conflict(app, user):
-    """Tell an account's owner that someone tried to register with their email.
-
-    Registration answers as if it succeeded, so this mail is the owner's only
-    sign. It goes out in the background: waiting on SMTP would make this one
-    response slower and reveal the account. Links come from STK_PUBLIC_URL,
-    never the request's Host header, which the sender controls."""
-    if not app.config.get("MAIL_SERVER"):
-        app.logger.warning("Sign-up attempt for an existing account: no MAIL_SERVER")
-        return
-    from stk.utils.email import send_email
-
-    public_url = app.config.get("STK_PUBLIC_URL")
-    where = f" at {public_url}" if public_url else ""
-    sign_in = f"\n\nSign in at {public_url.rstrip('/')}/login" if public_url else ""
-    body = (
-        f"Someone tried to create a {app.config['APP_NAME']} account{where} with"
-        " this email address. You already have one, so nothing changed."
-        f"{sign_in}\n\nIf it was not you, you can ignore this email."
-    )
-    app.add_background_task(
-        send_email, "Sign-up attempt with your email", user.email, body
-    )
-
-
 async def check_password_policy(password):
     from quart import current_app
 

{stkit-17.2.7 → stkit-17.3.1}/stk/settings.py

@@ -36,8 +36,10 @@ class Config:
     SECURITY_REGISTERABLE = (
         os.environ.get("SECURITY_REGISTERABLE", "False").lower() == "true"
     )
-    SECURITY_RECOVERABLE = False
-    SECURITY_CONFIRMABLE = False
+    # Self-registered accounts sign in only after confirming their email.
+    SECURITY_CONFIRMABLE = (
+        os.environ.get("SECURITY_CONFIRMABLE", "True").lower() == "true"
+    )
     SECURITY_CHANGEABLE = True
     SECURITY_TRACKABLE = True
     SECURITY_PASSWORD_HASH = "argon2"
@@ -106,6 +108,12 @@ class Config:
     MAIL_USERNAME = os.environ.get("MAIL_USERNAME")
     MAIL_PASSWORD = os.environ.get("MAIL_PASSWORD")
     SECURITY_EMAIL_SENDER = os.environ.get("SECURITY_EMAIL_SENDER", "info@domain.com")
+    # Password reset by email. Unset: on once MAIL_SERVER and STK_PUBLIC_URL are.
+    SECURITY_RECOVERABLE = (
+        os.environ["SECURITY_RECOVERABLE"].lower() == "true"
+        if "SECURITY_RECOVERABLE" in os.environ
+        else None
+    )
     SECURITY_SEND_PASSWORD_CHANGE_EMAIL = False
 
     # Google OAuth Settings
@@ -142,5 +150,6 @@ class TestingConfig(Config):
     DISABLE_MULTIPLE_SESSIONS = False
     STK_ENABLE_AGENT_LOGIN = False
     MAIL_SERVER = None
+    SECURITY_RECOVERABLE = False
     GOOGLE_AUTH_ENABLED = False
     GITHUB_AUTH_ENABLED = False

stkit-17.3.1/stk/templates/security/confirm_email.html

@@ -0,0 +1,30 @@
+{% extends 'login-layout.html' %}
+
+{% block content %}
+<v-main class="d-flex flex-column align-center justify-center" style="min-height: 100vh; background: rgb(var(--v-theme-background));">
+    <v-card class="mx-auto pa-8 w-100" rounded="lg" style="max-width: 424px;">
+        <div class="text-center mb-6">
+            <div class="mb-4">{% include "_brand.html" %}</div>
+            <div class="text-headline-small font-weight-bold">Confirm your email</div>
+            <div class="text-body-medium text-medium-emphasis">Confirm only if you created this account. If you did not, close this page.</div>
+        </div>
+
+        <form action="{{ url_for_security('confirm_email', token=confirm_email_token) }}" method="POST">
+            {{ confirm_email_form.hidden_tag() }}
+            {% include "security/_messages.html" %}
+            <v-btn type="submit" color="primary" size="large" block class="mb-4">Confirm my email</v-btn>
+        </form>
+    </v-card>
+</v-main>
+{% endblock %}
+
+{% block js %}
+<script>
+    const { createApp } = Vue;
+    const { createVuetify } = Vuetify;
+    const vuetify = createVuetify(vuetifyConfig);
+
+    const app = createApp({ delimiters: delimiters });
+    app.use(vuetify).mount('#app');
+</script>
+{% endblock %}

stkit-17.3.1/stk/templates/security/forgot_password.html

@@ -0,0 +1,44 @@
+{% extends 'login-layout.html' %}
+
+{% block content %}
+<v-main class="d-flex flex-column align-center justify-center" style="min-height: 100vh; background: rgb(var(--v-theme-background));">
+    <v-card class="mx-auto pa-8 w-100" rounded="lg" style="max-width: 424px;">
+        <div class="text-center mb-6">
+            <div class="mb-4">{% include "_brand.html" %}</div>
+            <div class="text-headline-small font-weight-bold">Reset password</div>
+            <div class="text-body-medium text-medium-emphasis">We will email you a link to choose a new password</div>
+        </div>
+
+        <form action="{{ url_for_security('forgot_password') }}" method="POST">
+            {{ forgot_password_form.hidden_tag() }}
+            <v-text-field name="email" type="email" label="Email" autocomplete="email" required class="mb-4"></v-text-field>
+
+            {% include "security/_messages.html" %}
+
+            {% for field, errors in forgot_password_form.errors.items() %}
+            <v-alert type="error" variant="tonal" density="compact" class="mb-4">{{ errors[0] }}</v-alert>
+            {% endfor %}
+
+            <v-btn type="submit" color="primary" size="large" block class="mb-4">Send reset link</v-btn>
+        </form>
+    </v-card>
+
+    <div class="mt-6 w-100" style="max-width: 424px;">
+        <v-btn href="{{ url_for_security('login') }}" variant="text" color="primary">
+            <i class="ti ti-chevron-left mr-1"></i>
+            Back to log in
+        </v-btn>
+    </div>
+</v-main>
+{% endblock %}
+
+{% block js %}
+<script>
+    const { createApp } = Vue;
+    const { createVuetify } = Vuetify;
+    const vuetify = createVuetify(vuetifyConfig);
+
+    const app = createApp({ delimiters: delimiters });
+    app.use(vuetify).mount('#app');
+</script>
+{% endblock %}

{stkit-17.2.7 → stkit-17.3.1}/stk/templates/security/login_user.html

@@ -157,6 +157,11 @@
                                 <span class="text-medium-emphasis">New to {{ config.APP_NAME }}? </span>
                                 <a href="{{ url_for_security('register') }}" class="text-decoration-none">Sign up</a>
                             </div>
+                            {% if security.confirmable %}
+                            <div class="text-center mt-2">
+                                <a href="{{ url_for_security('send_confirmation') }}" class="text-decoration-none text-body-small">Resend confirmation link</a>
+                            </div>
+                            {% endif %}
                             {% endif %}
                         </v-card-text>
                     </v-card>

stkit-17.3.1/stk/templates/security/reset_password.html

@@ -0,0 +1,45 @@
+{% extends 'login-layout.html' %}
+
+{% block content %}
+<v-main class="d-flex flex-column align-center justify-center" style="min-height: 100vh; background: rgb(var(--v-theme-background));">
+    <v-card class="mx-auto pa-8 w-100" rounded="lg" style="max-width: 424px;">
+        <div class="text-center mb-6">
+            <div class="mb-4">{% include "_brand.html" %}</div>
+            <div class="text-headline-small font-weight-bold">Choose a new password</div>
+            <div class="text-body-medium text-medium-emphasis">Every signed-in session will be signed out</div>
+        </div>
+
+        <form action="{{ url_for_security('reset_password', token=reset_password_token) }}" method="POST">
+            {{ reset_password_form.hidden_tag() }}
+            <v-text-field name="password" type="password" label="New password" autocomplete="new-password" required class="mb-2"></v-text-field>
+            <v-text-field name="password_confirm" type="password" label="Confirm new password" autocomplete="new-password" required class="mb-4"></v-text-field>
+
+            {% include "security/_messages.html" %}
+
+            {% for field, errors in reset_password_form.errors.items() %}
+            <v-alert type="error" variant="tonal" density="compact" class="mb-4">{{ errors[0] }}</v-alert>
+            {% endfor %}
+
+            <v-btn type="submit" color="primary" size="large" block class="mb-4">Reset password</v-btn>
+        </form>
+    </v-card>
+
+    <div class="mt-6 w-100" style="max-width: 424px;">
+        <v-btn href="{{ url_for_security('login') }}" variant="text" color="primary">
+            <i class="ti ti-chevron-left mr-1"></i>
+            Back to log in
+        </v-btn>
+    </div>
+</v-main>
+{% endblock %}
+
+{% block js %}
+<script>
+    const { createApp } = Vue;
+    const { createVuetify } = Vuetify;
+    const vuetify = createVuetify(vuetifyConfig);
+
+    const app = createApp({ delimiters: delimiters });
+    app.use(vuetify).mount('#app');
+</script>
+{% endblock %}

stkit-17.3.1/stk/templates/security/send_confirmation.html

@@ -0,0 +1,44 @@
+{% extends 'login-layout.html' %}
+
+{% block content %}
+<v-main class="d-flex flex-column align-center justify-center" style="min-height: 100vh; background: rgb(var(--v-theme-background));">
+    <v-card class="mx-auto pa-8 w-100" rounded="lg" style="max-width: 424px;">
+        <div class="text-center mb-6">
+            <div class="mb-4">{% include "_brand.html" %}</div>
+            <div class="text-headline-small font-weight-bold">Resend confirmation</div>
+            <div class="text-body-medium text-medium-emphasis">We will email you a new link to confirm your account</div>
+        </div>
+
+        <form action="{{ url_for_security('send_confirmation') }}" method="POST">
+            {{ send_confirmation_form.hidden_tag() }}
+            <v-text-field name="email" type="email" label="Email" autocomplete="email" required class="mb-4"></v-text-field>
+
+            {% include "security/_messages.html" %}
+
+            {% for field, errors in send_confirmation_form.errors.items() %}
+            <v-alert type="error" variant="tonal" density="compact" class="mb-4">{{ errors[0] }}</v-alert>
+            {% endfor %}
+
+            <v-btn type="submit" color="primary" size="large" block class="mb-4">Send link</v-btn>
+        </form>
+    </v-card>
+
+    <div class="mt-6 w-100" style="max-width: 424px;">
+        <v-btn href="{{ url_for_security('login') }}" variant="text" color="primary">
+            <i class="ti ti-chevron-left mr-1"></i>
+            Back to log in
+        </v-btn>
+    </div>
+</v-main>
+{% endblock %}
+
+{% block js %}
+<script>
+    const { createApp } = Vue;
+    const { createVuetify } = Vuetify;
+    const vuetify = createVuetify(vuetifyConfig);
+
+    const app = createApp({ delimiters: delimiters });
+    app.use(vuetify).mount('#app');
+</script>
+{% endblock %}

{stkit-17.2.7 → stkit-17.3.1}/stk/user/models.py

@@ -69,6 +69,13 @@ class User(Base, UserMixin):
     password_set = Column(Boolean, default=True, nullable=False)
     active = Column(Boolean, default=False, nullable=True)
 
+    def __init__(self, **kwargs):
+        # Accounts made by code, the CLI, admins or OAuth start confirmed. Only
+        # self-registration sets None afterwards, until the emailed link is
+        # opened; a column default would refill that None at insert.
+        kwargs.setdefault("confirmed_at", datetime.now())
+        super().__init__(**kwargs)
+
     @validates("email")
     def _normalize_email(self, key, value):
         # Login lowercases what it is given; store the same form so one address

stkit-17.3.1/tests/test_confirm_migration.py

@@ -0,0 +1,28 @@
+"""stk_0007 confirms every account that existed before email confirmation."""
+
+import sqlite3
+import tempfile
+import unittest
+from pathlib import Path
+
+from alembic import command
+
+from stk.migrations import build_alembic_config
+
+
+class ConfirmExistingUsersTest(unittest.TestCase):
+    def test_existing_accounts_count_as_confirmed(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            path = Path(tmp) / "db.sqlite"
+            config = build_alembic_config(url=f"sqlite:///{path}", quiet=True)
+            command.upgrade(config, "stk_0006")
+            with sqlite3.connect(path) as db:
+                db.execute(
+                    "INSERT INTO user (email, password, password_set, active,"
+                    " fs_uniquifier, created_at, failed_login_count) VALUES"
+                    " ('a@example.com', 'h', 1, 1, 'u', '2026-01-01', 0)"
+                )
+            command.upgrade(config, "heads")
+            with sqlite3.connect(path) as db:
+                rows = db.execute("select confirmed_at from user").fetchall()
+            self.assertIsNotNone(rows[0][0])

{stkit-17.2.7 → stkit-17.3.1}/tests/test_copy_rules.py

@@ -1,3 +1,4 @@
+import time
 import unittest
 
 from stk.cli.copy_rules import (
@@ -49,6 +50,11 @@ class CopyRuleTests(unittest.TestCase):
             ["jane_doe@example.com", "/static/app_icon.png", "STK_ENV", "Pending"],
         )
 
+    def test_raw_score_is_linear_on_long_blank_runs(self):
+        start = time.perf_counter()
+        self.assertEqual(raw_score("score" + " " * 50_000 + "!"), [])
+        self.assertLess(time.perf_counter() - start, 1)
+
     def test_raw_score(self):
         self.assertRule(
             raw_score,

{stkit-17.2.7 → stkit-17.3.1}/tests/test_security_compatibility.py

@@ -1,5 +1,7 @@
 """Exercise stk's authentication integration with quart-security 2."""
 
+import asyncio
+import re
 import unittest
 
 import pyotp
@@ -146,34 +148,105 @@ class SecurityCompatibilityTests(unittest.IsolatedAsyncioTestCase):
         )
         self.assertNotEqual((await second.get("/dashboard/")).status_code, 200)
 
-    async def test_registering_an_existing_email_mails_the_owner_in_background(self):
+    def mailbox(self):
+        """Turn on sign-up and reset with mail; collect what would be sent."""
         self.app.config.update(
             SECURITY_REGISTERABLE=True,
+            SECURITY_RECOVERABLE=True,
             MAIL_SERVER="smtp.example.com",
-            STK_PUBLIC_URL="http://localhost",
+            SECURITY_PUBLIC_URL="http://localhost",
         )
-        queued = []
-        self.app.add_background_task = lambda func, *args: queued.append(args)
-        client = self.app.test_client()
+        sent = []
+
+        async def send_mail(subject, recipient, body):
+            sent.append((subject, recipient, body))
+
+        self.app.extensions["security"].send_mail = send_mail
+        return sent
+
+    async def post(self, client, path, **form):
         await client.get("/login")
         async with client.session_transaction() as cookie:
-            csrf = cookie["_csrf_token"]
-        form = {
-            "email": "USER@example.com",
-            "password": "AnotherPassword123!",
-            "password_confirm": "AnotherPassword123!",
-            "csrf_token": csrf,
-        }
-        response = await client.post("/register", form=form)
+            form["csrf_token"] = cookie["_csrf_token"]
+        response = await client.post(path, form=form)
+        # Auth mail and account lookups run after the response; wait for them.
+        while self.app.background_tasks:
+            await asyncio.gather(*list(self.app.background_tasks))
+        return response
+
+    @staticmethod
+    def link(message):
+        return re.search(r"http://localhost(/\S+)", message[2]).group(1)
+
+    async def test_sign_up_waits_for_the_email_and_hides_existing_accounts(self):
+        sent = self.mailbox()
+        client = self.app.test_client()
+        password = "AnotherPassword123!"
+        for email in ("new@example.com", "USER@example.com"):
+            response = await self.post(
+                client,
+                "/register",
+                email=email,
+                password=password,
+                password_confirm=password,
+            )
+            self.assertEqual(response.status_code, 302)
+        self.assertEqual([m[1] for m in sent], ["new@example.com", "user@example.com"])
+
+        login = {"email": "new@example.com", "password": password}
+        self.assertNotIn("_user_id", await self.login_as(login))
+        # Opening the link confirms nothing; the button on that page does.
+        self.assertEqual((await client.get(self.link(sent[0]))).status_code, 200)
+        self.assertNotIn("_user_id", await self.login_as(login))
+        await self.post(client, self.link(sent[0]))
+        self.assertIn("_user_id", await self.login_as(login))
+
+        # A forged Host header never reaches the links in the mail.
+        await self.post(
+            client,
+            "/register",
+            email="user@example.com",
+            password=password,
+            password_confirm=password,
+        )
+        self.assertNotIn("evil.example", sent[-1][2])
+
+    async def login_as(self, form):
+        client = self.app.test_client()
+        await self.post(client, "/login", **form)
+        async with client.session_transaction() as cookie:
+            return dict(cookie)
+
+    async def test_password_reset_replaces_the_password_and_logs_activity(self):
+        sent = self.mailbox()
+        signed_in = self.app.test_client()
+        await self.login(signed_in)
+        client = self.app.test_client()
+        page = await client.get("/reset")
+        self.assertEqual(page.status_code, 200)
+        await self.post(client, "/reset", email="user@example.com")
+        path = self.link(sent[0])
+        self.assertEqual((await client.get(path)).status_code, 200)
+        new = "ReplacementPass123!"
+        response = await self.post(client, path, password=new, password_confirm=new)
         self.assertEqual(response.status_code, 302)
-        self.assertEqual(len(queued), 1)
-        subject, recipient, body = queued[0]
-        self.assertEqual(recipient, "user@example.com")
-        self.assertIn("http://localhost/login", body)
-        # A forged Host header never reaches the mail's links.
-        self.app.config["STK_PUBLIC_URL"] = None
-        await client.post("/register", form=form, headers={"Host": "evil.example"})
-        self.assertNotIn("evil.example", queued[1][2])
+        self.assertIn(
+            "_user_id",
+            await self.login_as({"email": "user@example.com", "password": new}),
+        )
+        self.assertNotEqual((await signed_in.get("/dashboard/")).status_code, 200)
+
+    def test_sign_up_without_mail_refuses_to_start(self):
+        class Config(SecurityConfig):
+            SECURITY_REGISTERABLE = True
+
+        with self.assertRaisesRegex(RuntimeError, "MAIL_SERVER"):
+            Stk(__name__, config=Config)
+
+        class Unconfirmed(Config):
+            SECURITY_CONFIRMABLE = False
+
+        Stk(__name__, config=Unconfirmed)
 
     def test_cookie_setting_preserves_local_http_support(self):
         self.assertFalse(self.app.config["SESSION_COOKIE_SECURE"])

{stkit-17.2.7 → stkit-17.3.1}/tests/test_static_versioning.py

@@ -22,6 +22,21 @@ class StaticVersioningTests(unittest.IsolatedAsyncioTestCase):
         bare = await client.get("/static/js/config.js")
         self.assertEqual(bare.headers["Cache-Control"], "no-cache")
 
+    async def test_errors_and_session_cookies_are_never_cached_publicly(self):
+        app = Stk(__name__, config=TestingConfig)
+        client = app.test_client()
+        missing = await client.get("/static/missing.css?v=1")
+        self.assertEqual(missing.status_code, 404)
+        self.assertNotIn("public", missing.headers["Cache-Control"])
+        # A stale login is cleared on any request, static ones included; that
+        # response carries a cookie change and must stay private.
+        async with client.session_transaction() as cookie:
+            cookie["_user_id"] = "gone"
+        async with app.test_request_context("/"):
+            url = url_for("static", filename="js/config.js")
+        cleared = await client.get(url)
+        self.assertEqual(cleared.headers["Cache-Control"], "private, no-store")
+
 
 if __name__ == "__main__":
     unittest.main()