Conversation
- Split user existence check from banned/verified checks in get_jwt_user() - Prevents AttributeError when trying to access properties on None user - Add proper validation for deleted users in API key authentication - Now returns 401 Unauthorized instead of 500 Internal Server Error - Fixes issue where valid tokens from deleted users caused server crashes
Signed-off-by: Grant Ramsay <seapagan@gmail.com>
…O.md Signed-off-by: Grant Ramsay <seapagan@gmail.com>
Coverage summary from CodacySee diff coverage on Codacy
Coverage variation details
Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: Diff coverage details
Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: See your quality gate settings Change summary preferences |
1 similar comment
Coverage summary from CodacySee diff coverage on Codacy
Coverage variation details
Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: Diff coverage details
Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: See your quality gate settings Change summary preferences |
1 participant
This pull request improves authentication error handling for deleted users and enhances test coverage for these scenarios. It also makes minor documentation and formatting updates. The most important changes are as follows:
Authentication Error Handling Improvements:
app/managers/api_key.pyso that if an API key is used for a user who has been deleted, authentication now raises a 401 Unauthorized error with an appropriate message instead of returning a generic error.app/managers/auth.pyto ensure that if a JWT is presented for a deleted user, authentication fails with a 401 Unauthorized error and a clear message.Test Coverage Enhancements:
tests/unit/test_api_key_auth.pyto verify that using an API key for a deleted user results in a 401 Unauthorized error with the correct error message.tests/unit/test_jwt_auth.pyto verify that using a JWT for a deleted user results in a 401 Unauthorized error with the correct error message.Documentation and Formatting:
SECURITY.mdto indicate support for version>=0.7.0instead of>=0.7.1.TODO.mdand made minor formatting improvements in the CLI section. [1] [2]