3 Commits

Include renames

Author	SHA1	Message	Date
curo1305	30ad9fd015	security(07.2-02): add user_nbf Redis NBF check to get_current_user ... - Added import logging + _logger = logging.getLogger(__name__) to deps/auth.py - Inserted user_nbf Redis check block after decode_access_token in get_current_user - Check reads user_nbf:{payload['sub']} from Redis; rejects if payload['iat'] < stored timestamp - Uses strict < comparison (token issued exactly at event second is allowed — D-02) - Handles both bytes and str returns from Redis for FakeRedis/aioredis compatibility - except HTTPException: raise guard precedes broad except Exception (T-7.2-02 Pitfall 1) - Broad except logs warning and fails open (D-04 — Redis outage must not block requests) - Promoted all 3 Wave 0 NBF xfail stubs to passing assertions in test_auth_deps.py	2026-06-05 19:19:06 +02:00
curo1305	49c63337db	test(07.2-01): mount FakeRedis on test_auth_deps app + add NBF-check xfail stubs ... - Import FakeRedis from tests.test_auth_api (no redefinition) - Set test_app.state.redis = FakeRedis() in make_test_app() (Pitfall 4 guard) - Add xfail(strict=False) stubs: reject iat<nbf, allow iat>nbf, fail-open on Redis error - All 7 existing auth-dep tests unaffected (zero regressions)	2026-06-05 19:05:55 +02:00
curo1305	c4613b6b87	feat(02-01): implement deps/auth.py FastAPI dependency chain with tests ... - get_current_user: validates Bearer JWT via decode_access_token, loads User from DB raises HTTP 401 on invalid/expired token, missing user, or deactivated account - get_current_admin: wraps get_current_user, raises HTTP 403 on role != 'admin' (T-02-07) - Admin impersonation architecturally excluded (ADMIN-07, T-02-08) — no code path bypasses role check - tests/test_auth_deps.py: 7 tests covering happy path, tampered token, inactive user, 403 non-admin, 200 admin	2026-05-22 19:25:16 +02:00