supython 0.1.13__tar.gz → 0.1.14__tar.gz

{supython-0.1.13 → supython-0.1.14}/CHANGELOG.md

@@ -30,6 +30,30 @@ Each entry links the relevant `PROJECT.md` section and decision-log row
 
 ---
 
+## [0.1.14] — 2026-07-17
+
+### Added
+- Account activation gate for pre-created users (GHSA-27m9-35j7-7g5f B). New
+  `auth.users.activated_at` column (migration `0017`) plus
+  `supython.auth.service.activate_user(conn, user_id)`: a consumer that
+  pre-creates an `auth.users` row (e.g. an invite flow that provisions the user
+  plus a role/membership up front) can keep it from authenticating through the
+  passwordless endpoints until an explicit activation step. Self-serve signup
+  and OAuth sign-in activate inline; existing rows are backfilled to
+  `created_at` so live users are unaffected.
+
+### Security
+- Enforce account eligibility at session issuance (GHSA-27m9-35j7-7g5f). Every
+  grant type — password, refresh, magic-link, OTP, recover, OAuth — now checks
+  account eligibility before minting a token pair, at the `_issue_pair` funnel
+  and in `refresh_grant` (which mints its own pair), so an in-flight session
+  also dies at its next refresh. A banned account (`banned_until` in the future)
+  gets `403 account_disabled`; a not-yet-activated account (`activated_at is
+  null`) gets `403 account_inactive`. The `request_*` endpoints stay
+  enumeration-resistant (still `202` for a banned or inactive email).
+
+---
+
 ## [0.1.13] — 2026-07-16
 
 ### Added

{supython-0.1.13 → supython-0.1.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: supython
-Version: 0.1.13
+Version: 0.1.14
 Summary: A lightweight Postgres-first BaaS framework for Python
 Project-URL: Homepage, https://github.com/Tkeby/supython
 Project-URL: Repository, https://github.com/Tkeby/supython

{supython-0.1.13 → supython-0.1.14}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "supython"
-version = "0.1.13"
+version = "0.1.14"
 description = "A lightweight Postgres-first BaaS framework for Python"
 readme = "README.md"
 requires-python = ">=3.11"

{supython-0.1.13 → supython-0.1.14}/src/supython/auth/service.py

@@ -62,9 +62,46 @@ async def _audit_log(
     )
 
 
+async def _assert_can_authenticate(
+    conn: asyncpg.Connection, user_id: UUID
+) -> None:
+    """Refuse session issuance for an account that is not eligible to sign in.
+
+    Enforced at the issuance funnel so every grant type — password, refresh,
+    magic-link, OTP, recover, OAuth — is gated by the same rules:
+
+    - ``banned_until`` in the future ⇒ ``account_disabled`` (403), deliberately
+      distinct from ``invalid_credentials`` (401) so a caller can tell "wrong
+      password" apart from "correct credentials, but locked out".
+    - ``activated_at is null`` ⇒ ``account_inactive`` (403). A consumer can
+      pre-create an ``auth.users`` row (e.g. an invite flow that provisions the
+      user plus a role/membership up front) that must not authenticate until an
+      explicit ``activate_user`` call; signup and OAuth sign-in activate inline.
+
+    Gating at issuance (rather than only at password verification) means the
+    check also lands on the passwordless verifies and on ``refresh_grant``, so
+    an in-flight session dies at its next refresh — near-immediate revocation
+    with no token blocklist.
+    """
+    row = await conn.fetchrow(
+        "select banned_until, activated_at from auth.users where id = $1",
+        user_id,
+    )
+    if row is None:
+        # The row vanished between the caller's lookup and issuance (e.g. a
+        # concurrent delete). Fail closed rather than mint an orphan session.
+        raise AuthError("account_disabled", "Account is not eligible to sign in", 403)
+    banned_until = row["banned_until"]
+    if banned_until is not None and banned_until > datetime.now(UTC):
+        raise AuthError("account_disabled", "Account is disabled", 403)
+    if row["activated_at"] is None:
+        raise AuthError("account_inactive", "Account is not activated", 403)
+
+
 async def _issue_pair(
     conn: asyncpg.Connection, user: UserResponse
 ) -> tuple[str, str, int]:
+    await _assert_can_authenticate(conn, user.id)
     extra = await claims.collect(user, conn)
     access, ttl = tokens.issue_access_token(
         user.id, user.email, extra_claims=extra or None
@@ -163,8 +200,8 @@ async def signup(
     pw_hash = passwords.hash_password(password)
     row = await conn.fetchrow(
         """
-        insert into auth.users (email, encrypted_password, email_confirmed_at)
-        values ($1, $2, now())
+        insert into auth.users (email, encrypted_password, email_confirmed_at, activated_at)
+        values ($1, $2, now(), now())
         returning id, email, created_at
         """,
         email,
@@ -205,12 +242,14 @@ async def password_grant(
         logger.warning("auth.password_grant: bad password for %s", email)
         raise AuthError("invalid_credentials", "Invalid email or password", 401)
 
+    user = _row_to_user(row)
+    # Issue first: _issue_pair raises account_disabled (403) for a banned user,
+    # so we don't stamp last_sign_in_at for a sign-in that was refused.
+    access, refresh, ttl = await _issue_pair(conn, user)
     await conn.execute(
         "update auth.users set last_sign_in_at = now() where id = $1",
         row["id"],
     )
-    user = _row_to_user(row)
-    access, refresh, ttl = await _issue_pair(conn, user)
     return user, access, refresh, ttl
 
 
@@ -272,6 +311,10 @@ async def refresh_grant(
         )
 
     user = _row_to_user(row)
+    # refresh_grant mints its own pair rather than routing through _issue_pair,
+    # so the eligibility gate has to be applied here too. Check before rotating:
+    # a banned user is refused without burning their current refresh token.
+    await _assert_can_authenticate(conn, user.id)
     new_refresh = tokens.issue_refresh_token()
     async with conn.transaction():
         await conn.execute(
@@ -309,6 +352,36 @@ async def get_user(
     return _row_to_user(row) if row else None
 
 
+async def activate_user(conn: asyncpg.Connection, user_id: UUID) -> None:
+    """Mark a pre-created account eligible to authenticate.
+
+    A consumer that provisions an ``auth.users`` row up front (e.g. an invite
+    flow that creates the user plus a role/membership before the person has set
+    up credentials) calls this at its intended activation step. Until then the
+    row's ``activated_at`` is null and every session-issuing path refuses it with
+    ``account_inactive`` (403). Self-serve signup and OAuth sign-in activate
+    inline, so this is only needed for externally pre-created rows.
+
+    Idempotent: activating an already-active user is a no-op and does not move
+    the existing ``activated_at``. Raises ``AuthError('user_not_found', 404)``
+    when no such user exists, so a mistyped id surfaces instead of silently
+    doing nothing.
+    """
+    exists = await conn.fetchval(
+        "select 1 from auth.users where id = $1", user_id
+    )
+    if not exists:
+        raise AuthError("user_not_found", "User not found", 404)
+    await conn.execute(
+        """
+        update auth.users
+        set activated_at = now()
+        where id = $1 and activated_at is null
+        """,
+        user_id,
+    )
+
+
 async def request_recover(
     conn: asyncpg.Connection, email: str
 ) -> None:
@@ -668,5 +741,13 @@ async def oauth_finish(
                     },
                 )
 
+    # A successful OAuth exchange proves control of the external account, so it
+    # activates the user inline (no-op if already active). This also lets a
+    # consumer's pre-created invite row, matched here by email, come online via
+    # its first OAuth sign-in.
+    await conn.execute(
+        "update auth.users set activated_at = now() where id = $1 and activated_at is null",
+        user.id,
+    )
     access, refresh, ttl = await _issue_pair(conn, user)
     return user, access, refresh, ttl, redirect_uri

{supython-0.1.13 → supython-0.1.14}/src/supython/cli.py

@@ -1487,7 +1487,7 @@ def _bootstrap_test_db(timeout: int) -> None:
     The named volume in `docker-compose.test.yml` makes the second call
     cheap — schema survives between pytest sessions.
     """
-    _compose_with(_TEST_COMPOSE_FILE, "up", "-d", "--wait", "db")
+    _compose_with(_TEST_COMPOSE_FILE, "up", "-d", "--wait", "db", project_directory=".")
 
     prev = os.environ.get("DATABASE_URL")
     os.environ["DATABASE_URL"] = _TEST_DATABASE_URL
@@ -1531,7 +1531,7 @@ def test_up(
 @test_cli.command("down")
 def test_down() -> None:
     """Stop the test DB container. Keeps the volume (and migrations)."""
-    _compose_with(_TEST_COMPOSE_FILE, "down")
+    _compose_with(_TEST_COMPOSE_FILE, "down", project_directory=".")
 
 
 @test_cli.command("reset")
@@ -1540,7 +1540,7 @@ def test_reset() -> None:
     confirm = typer.confirm("This will delete the test DB volume. Continue?")
     if not confirm:
         raise typer.Abort()
-    _compose_with(_TEST_COMPOSE_FILE, "down", "-v")
+    _compose_with(_TEST_COMPOSE_FILE, "down", "-v", project_directory=".")
 
 
 @test_cli.command(
@@ -1667,7 +1667,7 @@ def _ensure_jwks_for_postgrest(s: Settings) -> None:
     typer.echo(f"  JWT_JWKS_PATH={s.jwt_jwks_path}")
 
 
-_TEST_COMPOSE_FILE = "docker-compose.test.yml"
+_TEST_COMPOSE_FILE = "tests/docker-compose.test.yml"
 _TEST_DATABASE_URL = "postgresql://supython:supython@localhost:54323/supython"
 
 
@@ -1676,12 +1676,17 @@ def _compose(*args: str) -> None:
 
 
 def _compose_with(
-    file: str | None, *args: str, profiles: tuple[str, ...] = ()
+    file: str | None,
+    *args: str,
+    profiles: tuple[str, ...] = (),
+    project_directory: str | None = None,
 ) -> None:
     """Run `docker compose [-f <file>] [--profile <p>]... <args...>`, surfacing common errors."""
     cmd = ["docker", "compose"]
     if file:
         cmd += ["-f", file]
+    if project_directory:
+        cmd += ["--project-directory", project_directory]
     for p in profiles:
         cmd += ["--profile", p]
     cmd += list(args)

supython-0.1.14/src/supython/migrations/0017_auth_activated_at.sql

@@ -0,0 +1,37 @@
+-- Add a per-user activation gate. A consumer can pre-create an auth.users row
+-- (e.g. an invite flow that provisions the user plus a role/membership before
+-- the person has credentials); such a row must not authenticate through the
+-- passwordless endpoints (magiclink / otp / recover) before the intended
+-- activation step. `activated_at` is null while the account is inactive;
+-- supython.auth.service._assert_can_authenticate refuses session issuance for
+-- those rows with `account_inactive` (403).
+--
+-- Activation is explicit: supython.auth.service.activate_user(conn, user_id)
+-- stamps it at the consumer's chosen step, while signup and OAuth sign-in stamp
+-- it inline for self-serve users. Existing rows are backfilled to `created_at`
+-- so live users keep authenticating across the migration.
+--
+-- The column-add and one-time backfill run together, guarded on the column not
+-- yet existing, so a re-run can never re-activate a row that was intentionally
+-- left inactive after the column was introduced.
+
+do $$
+begin
+    if not exists (
+        select 1
+        from information_schema.columns
+        where table_schema = 'auth'
+          and table_name = 'users'
+          and column_name = 'activated_at'
+    ) then
+        alter table auth.users
+            add column activated_at timestamptz;
+
+        update auth.users
+            set activated_at = created_at;
+    end if;
+end $$;
+
+create index if not exists users_activated_at_idx
+    on auth.users (activated_at)
+    where activated_at is null;