tempest-fastapi-sdk 0.87.0__tar.gz → 0.87.1__tar.gz

{tempest_fastapi_sdk-0.87.0 → tempest_fastapi_sdk-0.87.1}/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to **tempest-fastapi-sdk** are listed below.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.87.1] — 2026-07-02
+
+### Fixed
+
+- **`UserAuthService.current_user_dependency()` now honours cookie
+  delivery.** When `AUTH_TOKEN_DELIVERY` is `"cookie"` or `"both"` it
+  auto-derives the access-token cookie name from
+  `AUTH_ACCESS_COOKIE_NAME`, so any business route guarded by the
+  dependency authenticates off the cookie the bundled login set — the
+  `Authorization` header still wins when present. Previously the
+  dependency was bearer-only, so cookie-mode clients hit
+  `401 Authorization token is missing or invalid` on protected routes
+  even with the cookies in the browser. A new `cookie_name=` argument
+  lets callers force a specific cookie (or `None` for header-only).
+
 ## [0.87.0] — 2026-07-02
 
 ### Added

{tempest_fastapi_sdk-0.87.0 → tempest_fastapi_sdk-0.87.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tempest-fastapi-sdk
-Version: 0.87.0
+Version: 0.87.1
 Summary: Shared FastAPI building blocks: base schemas, ORM model, async repository, exceptions, pagination and settings — the conventions used across Tempest projects.
 Project-URL: Homepage, https://github.com/mauriciobenjamin700/tempest-fastapi-sdk
 Project-URL: Repository, https://github.com/mauriciobenjamin700/tempest-fastapi-sdk

{tempest_fastapi_sdk-0.87.0 → tempest_fastapi_sdk-0.87.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tempest-fastapi-sdk"
-version = "0.87.0"
+version = "0.87.1"
 description = "Shared FastAPI building blocks: base schemas, ORM model, async repository, exceptions, pagination and settings — the conventions used across Tempest projects."
 readme = "README.md"
 requires-python = ">=3.11"

{tempest_fastapi_sdk-0.87.0 → tempest_fastapi_sdk-0.87.1}/tempest_fastapi_sdk/__init__.py

@@ -359,7 +359,7 @@ from tempest_fastapi_sdk.websockets import (
     make_websocket_router,
 )
 
-__version__: str = "0.87.0"
+__version__: str = "0.87.1"
 
 __all__: list[str] = [
     "BASE_COLUMN_ORDER",

{tempest_fastapi_sdk-0.87.0 → tempest_fastapi_sdk-0.87.1}/tempest_fastapi_sdk/auth/service.py

@@ -816,6 +816,7 @@ class UserAuthService:
         *,
         soft: bool = False,
         session_dependency: Callable[..., Any] | None = None,
+        cookie_name: str | None = None,
     ) -> Callable[..., Coroutine[Any, Any, Any]]:
         """Build a FastAPI dependency that returns the authenticated user.
 
@@ -850,6 +851,15 @@ class UserAuthService:
             session_dependency (Callable[..., Any] | None): The
                 request-scoped session provider to share with
                 repositories. Defaults to ``self.db.session_dependency``.
+            cookie_name (str | None): Cookie to read the access token
+                from when the ``Authorization`` header is absent (the
+                header still wins). ``None`` (default) auto-derives it
+                from ``AUTH_ACCESS_COOKIE_NAME`` whenever
+                ``AUTH_TOKEN_DELIVERY`` is ``"cookie"`` or ``"both"`` —
+                so a route guarded by this dependency accepts the cookie
+                the bundled login set, with no extra wiring. Pass an
+                explicit name to force it, or a bearer-only delivery
+                mode leaves it ``None`` (header only).
 
         Returns:
             Callable[..., Coroutine[Any, Any, Any]]: An async FastAPI
@@ -867,10 +877,18 @@ class UserAuthService:
             make_jwt_user_dependency,
         )
 
+        resolved_cookie_name = cookie_name
+        if resolved_cookie_name is None and self.auth_settings.AUTH_TOKEN_DELIVERY in (
+            "cookie",
+            "both",
+        ):
+            resolved_cookie_name = self.auth_settings.AUTH_ACCESS_COOKIE_NAME
+
         return make_jwt_user_dependency(
             self.jwt,
             self.get_user,
             soft=soft,
+            cookie_name=resolved_cookie_name,
             session_dependency=session_dependency or self.db.session_dependency,
         )
 

{tempest_fastapi_sdk-0.87.0 → tempest_fastapi_sdk-0.87.1}/tests/auth/test_cookie_delivery.py

@@ -17,7 +17,7 @@ from collections.abc import AsyncIterator
 from typing import Any
 
 import pytest
-from fastapi import FastAPI
+from fastapi import Depends, FastAPI
 from httpx import ASGITransport, AsyncClient
 from sqlalchemy.ext.asyncio import (
     AsyncSession,
@@ -26,6 +26,7 @@ from sqlalchemy.ext.asyncio import (
 )
 
 from tempest_fastapi_sdk import (
+    AsyncDatabaseManager,
     BaseModel,
     BaseUserModel,
     TokenDelivery,
@@ -46,6 +47,17 @@ _CookieUserToken = make_user_token_model(
     class_name="_CookieUserToken",
 )
 
+
+class _DepUser(BaseUserModel):
+    __tablename__ = "cookie_dep_users"
+
+
+_DepUserToken = make_user_token_model(
+    user_table="cookie_dep_users",
+    tablename="cookie_dep_user_tokens",
+    class_name="_DepUserToken",
+)
+
 _PASSWORD = "strong-pass-12-chars"
 
 
@@ -301,3 +313,62 @@ class TestBothMode:
 
         assert r.status_code == 200, r.text
         assert r.cookies.get("access_token")
+
+
+class TestCurrentUserDependencyCookie:
+    """service.current_user_dependency() must honour cookie delivery.
+
+    A business route guarded by the dependency should authenticate off
+    the access cookie the bundled login set — with no Authorization
+    header — when AUTH_TOKEN_DELIVERY is cookie/both.
+    """
+
+    async def test_protected_route_reads_access_cookie(self) -> None:
+        db = AsyncDatabaseManager("sqlite+aiosqlite:///:memory:")
+        await db.connect()
+        await db.create_tables()
+        try:
+            service = UserAuthService(
+                user_model=_DepUser,
+                token_model=_DepUserToken,  # type: ignore[arg-type]
+                auth_settings=AuthSettings(
+                    AUTH_AUTO_ACTIVATE=True,
+                    AUTH_TOKEN_DELIVERY="both",
+                    AUTH_COOKIE_SECURE=False,
+                ),
+                jwt_settings=JWTSettings(JWT_SECRET="x" * 32),
+                email=None,
+                db=db,
+            )
+            async with db.get_session_context() as s:
+                await service.signup(s, email="dep@a.com", password=_PASSWORD)
+                await s.commit()
+
+            app = FastAPI()
+            app.include_router(
+                make_auth_router(service, session_factory=db.session_dependency)
+            )
+            current_user = service.current_user_dependency()
+
+            @app.get("/me")
+            async def me(user: _DepUser = Depends(current_user)) -> dict[str, str]:
+                return {"email": user.email}
+
+            transport = ASGITransport(app=app)
+            async with AsyncClient(transport=transport, base_url="http://t") as c:
+                # No cookie yet → guarded route rejects.
+                anon = await c.get("/me")
+                assert anon.status_code == 401, anon.text
+
+                await c.post(
+                    "/auth/cookie/login",
+                    json={"email": "dep@a.com", "password": _PASSWORD},
+                )
+                # Access cookie alone (no Authorization header) authenticates.
+                ok = await c.get("/me")
+
+            assert ok.status_code == 200, ok.text
+            assert ok.json()["email"] == "dep@a.com"
+        finally:
+            await db.drop_tables()
+            await db.disconnect()

{tempest_fastapi_sdk-0.87.0 → tempest_fastapi_sdk-0.87.1}/uv.lock

@@ -3110,7 +3110,7 @@ wheels = [
 
 [[package]]
 name = "tempest-fastapi-sdk"
-version = "0.87.0"
+version = "0.87.1"
 source = { editable = "." }
 dependencies = [
     { name = "alembic" },