serversdown 68161298a4 fix(auth): hide /admin/users when flag off; pass OPTIONS preflight through gate ...

- operator_users router now depends on _require_auth_enabled, which raises
  404 when OPERATOR_AUTH_ENABLED is false — prevents world-open pre-seeding
  of a superadmin while the flag is off (the default).  Flag is read as a
  live module attribute (operator_auth.OPERATOR_AUTH_ENABLED) so monkeypatching
  in tests and a runtime flip both take effect.
- operator_gate passes OPTIONS requests through immediately before the exempt-
  path check, so CORS preflight reaches CORSMiddleware rather than being
  303/401'd by the gate.
- Two new tests: test_admin_surface_404s_when_flag_off (test_operator_users)
  and test_options_preflight_passes_through_gate (test_operator_gate).
  Full suite: 90 passed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-06-17 20:27:01 +00:00

..

__init__.py

test: stand up pytest harness + add argon2-cffi

2026-06-15 23:23:41 +00:00

conftest.py

feat(auth): deny-by-default gate middleware + require_role

2026-06-17 19:27:41 +00:00

test_auth_passwords.py

refactor: simplify verify_password except clause; drop unused import

2026-06-15 23:31:14 +00:00

test_cookie_secure.py

feat: env-driven Secure flag on portal session cookie

2026-06-16 00:16:54 +00:00

test_operator_admin_cli.py

feat(auth): operator admin/break-glass CLI

2026-06-17 19:50:37 +00:00

test_operator_authenticate.py

feat(auth): authenticate + lockout + operator data helpers

2026-06-17 19:19:36 +00:00

test_operator_cookies.py

feat(auth): generic HMAC signed-cookie module for operator auth

2026-06-17 19:05:56 +00:00

test_operator_gate.py

fix(auth): hide /admin/users when flag off; pass OPTIONS preflight through gate

2026-06-17 20:27:01 +00:00

test_operator_login.py

feat(auth): login/logout/change-password routes + pages

2026-06-17 19:38:55 +00:00

test_operator_machine_endpoints.py

test(auth): regression guard — gate never blocks machine endpoints

2026-06-17 20:14:30 +00:00

test_operator_model.py

feat(auth): OperatorUser model + role ladder

2026-06-17 19:08:18 +00:00

test_operator_session.py

feat(auth): operator session cookie + current_operator DB re-validation

2026-06-17 19:11:41 +00:00

test_operator_users.py

fix(auth): hide /admin/users when flag off; pass OPTIONS preflight through gate

2026-06-17 20:27:01 +00:00

test_portal_access_admin.py

feat: operator portal-access endpoints (enable/password/disable/state)

2026-06-15 23:55:10 +00:00

test_portal_auth_helpers.py

fix: link project to its portal client (project.client_id) so the portal isn't empty

2026-06-15 23:53:19 +00:00

test_portal_gate.py

fix: treat enabled-but-passwordless portal as inactive (no dead form / self-lockout)

2026-06-15 23:46:14 +00:00

test_portal_migration.py

feat: add per-project portal gate columns + migration

2026-06-15 23:32:41 +00:00

test_portal_scope.py

refactor: final-review cleanup

2026-06-16 00:28:23 +00:00

test_retired_routes.py

fix: retire portal_admin mint-link (dead /portal/enter URL); refresh docstrings; assert revoke route gone

2026-06-16 00:15:09 +00:00