svc-infra 0.1.595__py3-none-any.whl → 1.1.0__py3-none-any.whl

svc_infra/security/jwt_rotation.py

@@ -1,9 +1,11 @@
 from __future__ import annotations
 
-from typing import Iterable, List, Optional, Union
+from collections.abc import Iterable
+from typing import Any
 
-import jwt as pyjwt
+import jwt
 from fastapi_users.authentication.strategy.jwt import JWTStrategy
+from fastapi_users.jwt import decode_jwt
 
 
 class RotatingJWTStrategy(JWTStrategy):
@@ -18,36 +20,83 @@ class RotatingJWTStrategy(JWTStrategy):
         *,
         secret: str,
         lifetime_seconds: int,
-        old_secrets: Optional[Iterable[str]] = None,
-        token_audience: Optional[Union[str, List[str]]] = None,
+        old_secrets: Iterable[str] | None = None,
+        token_audience: str | list[str] | None = None,
     ):
-        super().__init__(
-            secret=secret, lifetime_seconds=lifetime_seconds, token_audience=token_audience
-        )
-        self._verify_secrets: List[str] = [secret] + list(old_secrets or [])
-
-    async def read_token(self, token: str, audience: Optional[str] = None):  # type: ignore[override]
-        # Try with current strategy's configured secret first
-        eff_aud = audience or self.token_audience
-        try:
-            return await super().read_token(token, audience=eff_aud)
-        except Exception:
-            pass
-        # Try older secrets
-        for s in self._verify_secrets[1:]:
+        # Normalize token_audience to list as required by parent JWTStrategy
+        aud_list: list[str] = (
+            [token_audience]
+            if isinstance(token_audience, str)
+            else list(token_audience)
+            if token_audience
+            else []
+        ) or ["fastapi-users:auth"]
+        super().__init__(secret=secret, lifetime_seconds=lifetime_seconds, token_audience=aud_list)
+        self._verify_secrets: list[str] = [secret, *list(old_secrets or [])]
+        self._lifetime_seconds = lifetime_seconds
+
+    async def read_token(
+        self,
+        token: str | None,
+        user_manager: Any = None,
+        *,
+        audience: str | list[str] | None = None,
+    ) -> Any:
+        """Read/verify a token against the active + rotated secrets.
+
+        Compatibility:
+        - fastapi-users signature: (token, user_manager) -> user | None
+        - legacy/test helper usage: (token, *, audience=...) -> claims | None
+        """
+
+        if token is None:
+            return None
+
+        if user_manager is None:
+            aud_list: list[str]
+            if audience is None:
+                aud_list = self.token_audience
+            elif isinstance(audience, str):
+                aud_list = [audience]
+            else:
+                aud_list = audience
             try:
-                data = pyjwt.decode(
-                    token,
-                    s,
-                    algorithms=["HS256"],
-                    audience=eff_aud,
-                )
-                if data is not None:
-                    return data
-            except Exception:
+                return decode_jwt(token, self.decode_key, aud_list, algorithms=[self.algorithm])
+            except jwt.PyJWTError:
                 pass
-        # If none of the secrets validated the token, raise a generic error
-        raise ValueError("Invalid token for all configured secrets")
+
+            for secret in self._verify_secrets[1:]:
+                candidate: JWTStrategy[Any, Any] = JWTStrategy(
+                    secret=secret,
+                    lifetime_seconds=self._lifetime_seconds,
+                    token_audience=self.token_audience,
+                )
+                try:
+                    return decode_jwt(
+                        token,
+                        candidate.decode_key,
+                        aud_list,
+                        algorithms=[candidate.algorithm],
+                    )
+                except jwt.PyJWTError:
+                    continue
+            raise ValueError("Invalid token for all configured secrets")
+
+        user = await super().read_token(token, user_manager)
+        if user is not None:
+            return user
+
+        for secret in self._verify_secrets[1:]:
+            candidate = JWTStrategy(
+                secret=secret,
+                lifetime_seconds=self._lifetime_seconds,
+                token_audience=self.token_audience,
+            )
+            user = await candidate.read_token(token, user_manager)
+            if user is not None:
+                return user
+
+        return None
 
 
 __all__ = ["RotatingJWTStrategy"]

svc_infra/security/lockout.py

@@ -1,16 +1,18 @@
 from __future__ import annotations
 
 import uuid
+from collections.abc import Sequence
 from dataclasses import dataclass
-from datetime import datetime, timedelta, timezone
-from typing import Any, Optional, Sequence
+from datetime import UTC, datetime, timedelta
+from typing import Any
 
 try:
-    from sqlalchemy import select
+    from sqlalchemy import or_, select
     from sqlalchemy.ext.asyncio import AsyncSession
 except Exception:  # pragma: no cover - optional import for type hints
-    AsyncSession = Any  # type: ignore[misc]
-    select = None  # type: ignore
+    AsyncSession = Any  # type: ignore[misc,assignment]
+    select = None  # type: ignore[assignment]
+    or_ = None  # type: ignore[assignment]
 
 from svc_infra.security.models import FailedAuthAttempt
 
@@ -26,7 +28,7 @@ class LockoutConfig:
 @dataclass
 class LockoutStatus:
     locked: bool
-    next_allowed_at: Optional[datetime]
+    next_allowed_at: datetime | None
     failure_count: int
 
 
@@ -34,9 +36,9 @@ class LockoutStatus:
 
 
 def compute_lockout(
-    fail_count: int, *, cfg: LockoutConfig, now: Optional[datetime] = None
+    fail_count: int, *, cfg: LockoutConfig, now: datetime | None = None
 ) -> LockoutStatus:
-    now = now or datetime.now(timezone.utc)
+    now = now or datetime.now(UTC)
     if fail_count < cfg.threshold:
         return LockoutStatus(False, None, fail_count)
     # cooldown factor exponent = fail_count - threshold
@@ -53,8 +55,8 @@ def compute_lockout(
 async def record_attempt(
     session: AsyncSession,
     *,
-    user_id: Optional[uuid.UUID],
-    ip_hash: Optional[str],
+    user_id: uuid.UUID | None,
+    ip_hash: str | None,
     success: bool,
 ) -> None:
     attempt = FailedAuthAttempt(user_id=user_id, ip_hash=ip_hash, success=success)
@@ -65,22 +67,27 @@ async def record_attempt(
 async def get_lockout_status(
     session: AsyncSession,
     *,
-    user_id: Optional[uuid.UUID],
-    ip_hash: Optional[str],
-    cfg: Optional[LockoutConfig] = None,
+    user_id: uuid.UUID | None,
+    ip_hash: str | None,
+    cfg: LockoutConfig | None = None,
 ) -> LockoutStatus:
     cfg = cfg or LockoutConfig()
-    now = datetime.now(timezone.utc)
+    now = datetime.now(UTC)
     window_start = now - timedelta(minutes=cfg.window_minutes)
 
     q = select(FailedAuthAttempt).where(
         FailedAuthAttempt.ts >= window_start,
         FailedAuthAttempt.success == False,  # noqa: E712
     )
+    # Use OR logic: lock out if EITHER user_id OR ip_hash has too many failures
+    # This prevents attackers from rotating IPs to bypass lockout
+    filters = []
     if user_id:
-        q = q.where(FailedAuthAttempt.user_id == user_id)
+        filters.append(FailedAuthAttempt.user_id == user_id)
     if ip_hash:
-        q = q.where(FailedAuthAttempt.ip_hash == ip_hash)
+        filters.append(FailedAuthAttempt.ip_hash == ip_hash)
+    if filters:
+        q = q.where(or_(*filters))
 
     rows: Sequence[FailedAuthAttempt] = (await session.execute(q)).scalars().all()
     fail_count = len(rows)

svc_infra/security/models.py

@@ -3,10 +3,19 @@ from __future__ import annotations
 import hashlib
 import json
 import uuid
-from datetime import datetime, timedelta, timezone
-from typing import Optional
-
-from sqlalchemy import JSON, Boolean, DateTime, ForeignKey, Index, String, Text, UniqueConstraint
+from datetime import UTC, datetime, timedelta
+
+from sqlalchemy import (
+    JSON,
+    Boolean,
+    DateTime,
+    ForeignKey,
+    Index,
+    String,
+    Text,
+    UniqueConstraint,
+    text,
+)
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
 from svc_infra.db.sql.base import ModelBase
@@ -22,19 +31,21 @@ class AuthSession(ModelBase):
     user_id: Mapped[uuid.UUID] = mapped_column(
         GUID(), ForeignKey("users.id", ondelete="CASCADE"), index=True
     )
-    tenant_id: Mapped[Optional[str]] = mapped_column(String(64), index=True)
-    user_agent: Mapped[Optional[str]] = mapped_column(String(512))
-    ip_hash: Mapped[Optional[str]] = mapped_column(String(64), index=True)
-    last_seen_at: Mapped[Optional[datetime]] = mapped_column(DateTime(timezone=True))
-    revoked_at: Mapped[Optional[datetime]] = mapped_column(DateTime(timezone=True))
-    revoke_reason: Mapped[Optional[str]] = mapped_column(Text)
-
-    refresh_tokens: Mapped[list["RefreshToken"]] = relationship(
+    tenant_id: Mapped[str | None] = mapped_column(String(64), index=True)
+    user_agent: Mapped[str | None] = mapped_column(String(512))
+    ip_hash: Mapped[str | None] = mapped_column(String(64), index=True)
+    last_seen_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    revoked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    revoke_reason: Mapped[str | None] = mapped_column(Text)
+
+    refresh_tokens: Mapped[list[RefreshToken]] = relationship(
         back_populates="session", cascade="all, delete-orphan", lazy="selectin"
     )
 
     created_at = mapped_column(
-        DateTime(timezone=True), server_default="CURRENT_TIMESTAMP", nullable=False
+        DateTime(timezone=True),
+        server_default=text("CURRENT_TIMESTAMP"),
+        nullable=False,
     )
 
 
@@ -48,13 +59,15 @@ class RefreshToken(ModelBase):
     session: Mapped[AuthSession] = relationship(back_populates="refresh_tokens")
 
     token_hash: Mapped[str] = mapped_column(String(64), index=True, nullable=False)
-    rotated_at: Mapped[Optional[datetime]] = mapped_column(DateTime(timezone=True))
-    revoked_at: Mapped[Optional[datetime]] = mapped_column(DateTime(timezone=True))
-    revoke_reason: Mapped[Optional[str]] = mapped_column(Text)
-    expires_at: Mapped[Optional[datetime]] = mapped_column(DateTime(timezone=True), index=True)
+    rotated_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    revoked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    revoke_reason: Mapped[str | None] = mapped_column(Text)
+    expires_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), index=True)
 
     created_at = mapped_column(
-        DateTime(timezone=True), server_default="CURRENT_TIMESTAMP", nullable=False
+        DateTime(timezone=True),
+        server_default=text("CURRENT_TIMESTAMP"),
+        nullable=False,
     )
 
     __table_args__ = (UniqueConstraint("token_hash", name="uq_refresh_token_hash"),)
@@ -66,19 +79,21 @@ class RefreshTokenRevocation(ModelBase):
     id: Mapped[uuid.UUID] = mapped_column(GUID(), primary_key=True, default=uuid.uuid4)
     token_hash: Mapped[str] = mapped_column(String(64), index=True, nullable=False)
     revoked_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
-    reason: Mapped[Optional[str]] = mapped_column(Text)
+    reason: Mapped[str | None] = mapped_column(Text)
 
 
 class FailedAuthAttempt(ModelBase):
     __tablename__ = "failed_auth_attempts"
 
     id: Mapped[uuid.UUID] = mapped_column(GUID(), primary_key=True, default=uuid.uuid4)
-    user_id: Mapped[Optional[uuid.UUID]] = mapped_column(
+    user_id: Mapped[uuid.UUID | None] = mapped_column(
         GUID(), ForeignKey("users.id", ondelete="CASCADE"), index=True, nullable=True
     )
-    ip_hash: Mapped[Optional[str]] = mapped_column(String(64), index=True)
+    ip_hash: Mapped[str | None] = mapped_column(String(64), index=True)
     ts: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), nullable=False, default=lambda: datetime.now(timezone.utc)
+        DateTime(timezone=True),
+        nullable=False,
+        default=lambda: datetime.now(UTC),
     )
     success: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
 
@@ -99,17 +114,17 @@ class AuditLog(ModelBase):
     ts: Mapped[datetime] = mapped_column(
         DateTime(timezone=True),
         nullable=False,
-        default=lambda: datetime.now(timezone.utc),
+        default=lambda: datetime.now(UTC),
         index=True,
     )
-    actor_id: Mapped[Optional[uuid.UUID]] = mapped_column(
+    actor_id: Mapped[uuid.UUID | None] = mapped_column(
         GUID(), ForeignKey("users.id", ondelete="SET NULL"), nullable=True, index=True
     )
-    tenant_id: Mapped[Optional[str]] = mapped_column(String(64), index=True)
+    tenant_id: Mapped[str | None] = mapped_column(String(64), index=True)
     event_type: Mapped[str] = mapped_column(String(128), nullable=False, index=True)
-    resource_ref: Mapped[Optional[str]] = mapped_column(String(255), index=True)
+    resource_ref: Mapped[str | None] = mapped_column(String(255), index=True)
     event_metadata: Mapped[dict] = mapped_column("metadata", JSON, default=dict)
-    prev_hash: Mapped[Optional[str]] = mapped_column(String(64))
+    prev_hash: Mapped[str | None] = mapped_column(String(64))
     hash: Mapped[str] = mapped_column(String(64), nullable=False, index=True)
 
     __table_args__ = (Index("ix_audit_chain", "tenant_id", "id"),)
@@ -123,10 +138,12 @@ class Organization(ModelBase):
 
     id: Mapped[uuid.UUID] = mapped_column(GUID(), primary_key=True, default=uuid.uuid4)
     name: Mapped[str] = mapped_column(String(128), nullable=False)
-    slug: Mapped[Optional[str]] = mapped_column(String(64), index=True)
-    tenant_id: Mapped[Optional[str]] = mapped_column(String(64), index=True)
+    slug: Mapped[str | None] = mapped_column(String(64), index=True)
+    tenant_id: Mapped[str | None] = mapped_column(String(64), index=True)
     created_at = mapped_column(
-        DateTime(timezone=True), server_default="CURRENT_TIMESTAMP", nullable=False
+        DateTime(timezone=True),
+        server_default=text("CURRENT_TIMESTAMP"),
+        nullable=False,
     )
 
 
@@ -139,7 +156,9 @@ class Team(ModelBase):
     )
     name: Mapped[str] = mapped_column(String(128), nullable=False)
     created_at = mapped_column(
-        DateTime(timezone=True), server_default="CURRENT_TIMESTAMP", nullable=False
+        DateTime(timezone=True),
+        server_default=text("CURRENT_TIMESTAMP"),
+        nullable=False,
     )
 
 
@@ -155,9 +174,11 @@ class OrganizationMembership(ModelBase):
     )
     role: Mapped[str] = mapped_column(String(64), nullable=False, index=True)
     created_at = mapped_column(
-        DateTime(timezone=True), server_default="CURRENT_TIMESTAMP", nullable=False
+        DateTime(timezone=True),
+        server_default=text("CURRENT_TIMESTAMP"),
+        nullable=False,
     )
-    deactivated_at: Mapped[Optional[datetime]] = mapped_column(DateTime(timezone=True))
+    deactivated_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
 
     __table_args__ = (UniqueConstraint("org_id", "user_id", name="uq_org_user_membership"),)
 
@@ -172,17 +193,24 @@ class OrganizationInvitation(ModelBase):
     email: Mapped[str] = mapped_column(String(255), index=True)
     role: Mapped[str] = mapped_column(String(64), nullable=False)
     token_hash: Mapped[str] = mapped_column(String(64), index=True)
-    expires_at: Mapped[Optional[datetime]] = mapped_column(DateTime(timezone=True), index=True)
-    created_by: Mapped[Optional[uuid.UUID]] = mapped_column(
+    expires_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), index=True)
+    created_by: Mapped[uuid.UUID | None] = mapped_column(
         GUID(), ForeignKey("users.id", ondelete="SET NULL"), index=True
     )
     created_at = mapped_column(
-        DateTime(timezone=True), server_default="CURRENT_TIMESTAMP", nullable=False
+        DateTime(timezone=True),
+        server_default=text("CURRENT_TIMESTAMP"),
+        nullable=False,
     )
-    last_sent_at: Mapped[Optional[datetime]] = mapped_column(DateTime(timezone=True))
+    last_sent_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
     resend_count: Mapped[int] = mapped_column(default=0)
-    used_at: Mapped[Optional[datetime]] = mapped_column(DateTime(timezone=True))
-    revoked_at: Mapped[Optional[datetime]] = mapped_column(DateTime(timezone=True))
+    used_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    revoked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+
+
+# ------------------------ OAuth Provider Accounts -----------------------------
+# MOVED to svc_infra.security.oauth_models for opt-in OAuth support
+# Projects that enable OAuth should import ProviderAccount from there
 
 
 # ------------------------ Utilities -------------------------------------------
@@ -198,13 +226,13 @@ def hash_refresh_token(raw: str) -> str:
 
 
 def compute_audit_hash(
-    prev_hash: Optional[str],
+    prev_hash: str | None,
     *,
     ts: datetime,
-    actor_id: Optional[uuid.UUID],
-    tenant_id: Optional[str],
+    actor_id: uuid.UUID | None,
+    tenant_id: str | None,
     event_type: str,
-    resource_ref: Optional[str],
+    resource_ref: str | None,
     metadata: dict,
 ) -> str:
     """Compute SHA256 hash chaining previous hash + canonical event payload."""
@@ -227,7 +255,7 @@ def rotate_refresh_token(
     """Rotate: returns (new_raw, new_hash, expires_at)."""
     new_raw = generate_refresh_token()
     new_hash = hash_refresh_token(new_raw)
-    expires_at = datetime.now(timezone.utc) + timedelta(minutes=ttl_minutes)
+    expires_at = datetime.now(UTC) + timedelta(minutes=ttl_minutes)
     return new_raw, new_hash, expires_at
 
 
@@ -238,6 +266,11 @@ __all__ = [
     "FailedAuthAttempt",
     "RolePermission",
     "AuditLog",
+    "Organization",
+    "Team",
+    "OrganizationMembership",
+    "OrganizationInvitation",
+    # ProviderAccount moved to svc_infra.security.oauth_models (opt-in)
     "generate_refresh_token",
     "hash_refresh_token",
     "compute_audit_hash",

svc_infra/security/oauth_models.py

@@ -0,0 +1,73 @@
+"""
+OAuth provider account models (opt-in).
+
+These models are only registered when a project explicitly enables OAuth.
+Import this module only when enable_oauth=True is passed to add_auth_users.
+"""
+
+from __future__ import annotations
+
+import uuid
+from datetime import UTC, datetime
+from typing import TYPE_CHECKING
+
+from sqlalchemy import (
+    JSON,
+    DateTime,
+    ForeignKey,
+    Index,
+    String,
+    Text,
+    UniqueConstraint,
+    text,
+)
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from svc_infra.db.sql.base import ModelBase
+from svc_infra.db.sql.types import GUID
+
+if TYPE_CHECKING:
+    from typing import Any
+
+    # User model is application-specific; this is a forward reference for type hints
+    User = Any
+
+
+class ProviderAccount(ModelBase):
+    """OAuth provider account linking (Google, GitHub, etc.)."""
+
+    __tablename__ = "provider_accounts"
+
+    id: Mapped[uuid.UUID] = mapped_column(GUID(), primary_key=True, default=uuid.uuid4)
+    user_id: Mapped[uuid.UUID] = mapped_column(
+        GUID(), ForeignKey("users.id", ondelete="CASCADE"), index=True, nullable=False
+    )
+    provider: Mapped[str] = mapped_column(String(50), nullable=False, index=True)
+    provider_account_id: Mapped[str] = mapped_column(String(255), nullable=False)
+    access_token: Mapped[str | None] = mapped_column(Text)
+    refresh_token: Mapped[str | None] = mapped_column(Text)
+    expires_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    raw_claims: Mapped[dict | None] = mapped_column(JSON)
+
+    # Bidirectional relationship to User model
+    user: Mapped[User] = relationship(back_populates="provider_accounts")
+
+    created_at = mapped_column(
+        DateTime(timezone=True),
+        server_default=text("CURRENT_TIMESTAMP"),
+        nullable=False,
+    )
+    updated_at = mapped_column(
+        DateTime(timezone=True),
+        server_default=text("CURRENT_TIMESTAMP"),
+        onupdate=lambda: datetime.now(UTC),
+        nullable=False,
+    )
+
+    __table_args__ = (
+        UniqueConstraint("provider", "provider_account_id", name="uq_provider_account"),
+        Index("ix_provider_accounts_user_provider", "user_id", "provider"),
+    )
+
+
+__all__ = ["ProviderAccount"]

svc_infra/security/org_invites.py

@@ -2,15 +2,15 @@ from __future__ import annotations
 
 import hashlib
 import uuid
-from datetime import datetime, timedelta, timezone
-from typing import Any, Optional
+from datetime import UTC, datetime, timedelta
+from typing import Any
 
 try:
     from sqlalchemy import select
     from sqlalchemy.ext.asyncio import AsyncSession
 except Exception:  # pragma: no cover
-    AsyncSession = object  # type: ignore
-    select = None  # type: ignore
+    AsyncSession = object  # type: ignore[misc,assignment]
+    select = None  # type: ignore[assignment]
 
 from .models import OrganizationInvitation, OrganizationMembership
 
@@ -29,7 +29,7 @@ async def issue_invitation(
     org_id: uuid.UUID,
     email: str,
     role: str,
-    created_by: Optional[uuid.UUID] = None,
+    created_by: uuid.UUID | None = None,
     ttl_hours: int = 72,
 ) -> tuple[str, OrganizationInvitation]:
     """Create a new invitation; revoke any existing active invites for the same email+org."""
@@ -50,7 +50,7 @@ async def issue_invitation(
                 .scalars()
                 .all()
             )
-            now = datetime.now(timezone.utc)
+            now = datetime.now(UTC)
             for r in rows:
                 r.revoked_at = now
         except Exception:  # pragma: no cover
@@ -58,8 +58,8 @@ async def issue_invitation(
     else:
         # FakeDB path: revoke in-memory invites
         if hasattr(db, "added"):
-            now = datetime.now(timezone.utc)
-            for r in list(getattr(db, "added")):
+            now = datetime.now(UTC)
+            for r in list(db.added):
                 if (
                     isinstance(r, OrganizationInvitation)
                     and r.org_id == org_id
@@ -75,9 +75,9 @@ async def issue_invitation(
         email=email.lower().strip(),
         role=role,
         token_hash=_hash_token(raw),
-        expires_at=datetime.now(timezone.utc) + timedelta(hours=ttl_hours),
+        expires_at=datetime.now(UTC) + timedelta(hours=ttl_hours),
         created_by=created_by,
-        last_sent_at=datetime.now(timezone.utc),
+        last_sent_at=datetime.now(UTC),
         resend_count=0,
     )
     if hasattr(db, "add"):
@@ -90,7 +90,7 @@ async def issue_invitation(
 async def resend_invitation(db: Any, *, invitation: OrganizationInvitation) -> str:
     raw = _new_token()
     invitation.token_hash = _hash_token(raw)
-    invitation.last_sent_at = datetime.now(timezone.utc)
+    invitation.last_sent_at = datetime.now(UTC)
     invitation.resend_count = (invitation.resend_count or 0) + 1
     if hasattr(db, "flush"):
         await db.flush()
@@ -103,7 +103,7 @@ async def accept_invitation(
     invitation: OrganizationInvitation,
     user_id: uuid.UUID,
 ) -> OrganizationMembership:
-    now = datetime.now(timezone.utc)
+    now = datetime.now(UTC)
     if invitation.revoked_at or invitation.used_at:
         raise ValueError("invitation_unusable")
     if invitation.expires_at and invitation.expires_at < now:

svc_infra/security/passwords.py

@@ -1,8 +1,8 @@
 from __future__ import annotations
 
 import re
+from collections.abc import Callable, Iterable
 from dataclasses import dataclass
-from typing import Callable, Iterable, Optional
 
 COMMON_PASSWORDS = {"password", "123456", "qwerty", "letmein", "admin"}
 
@@ -36,10 +36,10 @@ SYMBOL = re.compile(r"[!@#$%^&*()_+=\-{}\[\]:;,.?/]")
 BreachedChecker = Callable[[str], bool]
 
 
-_breached_checker: Optional[BreachedChecker] = None
+_breached_checker: BreachedChecker | None = None
 
 
-def configure_breached_checker(checker: Optional[BreachedChecker]) -> None:
+def configure_breached_checker(checker: BreachedChecker | None) -> None:
     global _breached_checker
     _breached_checker = checker