From a139fd784eeff9f95f567521f9a85ff07fddd8a9 Mon Sep 17 00:00:00 2001
From: Helmut Merz <helmutm@cy55.de>
Date: Sun, 8 Nov 2026 22:27:07 +0100
Subject: [PATCH] api.auth: start with simple dummy (testing) authentication

---
 scopes/api/auth/user.py |  6 ++++--
 scopes/api/deps.py      |  7 ++++---
 tests/test_api.py       | 10 +++++++---
 3 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/scopes/api/auth/user.py b/scopes/api/auth/user.py
index 0d22e86..bec98ed 100644
--- a/scopes/api/auth/user.py
+++ b/scopes/api/auth/user.py
@@ -46,7 +46,7 @@ def getUser(storage: Storage, userName: str) -> User:
     user = users.queryLast(name=userName)
     return user.toObject(User)
 
-async def authenticate(storage: deps.Storage, token: deps.Auth):
+async def authenticate(storage: deps.Storage, token: deps.AuthUser):
     payload = jwt.decode(token, settings.jwt_key, algorithms=[settings.jwt_algorithm])
     userName = payload.get('sub')
     user = getUser(storage, userName)
@@ -63,7 +63,9 @@ async def get_users(storage: deps.Storage):
     return result
 
 @router.post('/users', response_model=User)
-async def post_user(user: Annotated[UserIn, Body()], storage: deps.Storage):
+async def post_user(user: Annotated[UserIn, Body()], storage: deps.Storage,
+                    auth_user: deps.AuthUser):
+    print('*** post_user', auth_user)
     users = storage.create(st_user.Users)
     tr = st_user.User.fromObject(user)
     users.save(tr)
diff --git a/scopes/api/deps.py b/scopes/api/deps.py
index 13fd638..5b2de77 100644
--- a/scopes/api/deps.py
+++ b/scopes/api/deps.py
@@ -10,13 +10,14 @@ from scopes.api.auth import config as auth_config
 from scopes.storage import common
 
 type Storage = Annotated[common.Storage, Depends(storage)]
-type Auth = Annotated[str, Depends(auth_method())]
+type AuthUser = Annotated[str, Depends(auth_user)]
 
 def storage():
     stf = config.StorageFactory(config.settings)
     return stf(config.settings.dbschema)
 
-def auth_method():
+def auth_user():
     auth = auth_config.auth_methods.get(auth_config.settings.auth_method)
-    return auth
+    if auth:
+        return auth()
 
diff --git a/tests/test_api.py b/tests/test_api.py
index 60d584f..49bb68a 100644
--- a/tests/test_api.py
+++ b/tests/test_api.py
@@ -7,7 +7,7 @@ config.settings = config.Settings(_env_file='tests/test.env')
 
 import pytest
 from fastapi.testclient import TestClient
-from httpx2 import ASGITransport, AsyncClient
+from httpx2 import ASGITransport, AsyncClient, BasicAuth
 
 from scopes.api import main
 from scopes.api.auth import config as auth_config
@@ -15,6 +15,9 @@ from scopes.api.main import app
 from scopes.storage import tracking, user as st_user
 from scopes.api.auth import user as api_user
 
+config.settings = config.Settings(_env_file='tests/test.env')
+auth_config.settings = auth_config.Settings(_env_file='tests/test.env')
+
 @pytest.fixture(scope='module')
 def storage():
     storage = config.StorageFactory(config.settings)(config.settings.dbschema)
@@ -73,13 +76,14 @@ def test_user(storage, caplog):
     storage.commit()
     with TestClient(app) as clt:
         caplog.set_level(config.settings.log_level)
+        auth = BasicAuth(username='jim', password='secret')
         users = clt.get('/users').json()
         assert len(users) == 1
         u01i = users[0]
         assert u01i.get(pw_hash) is None
         inp = {'name': 'jane', 'login': 'jane', 'display_name': 'Jane', 
                'email': 'jane@xmpl.org', 'password': 'secret'}
-        resp = clt.post('/users', json=inp)
+        resp = clt.post('/users', json=inp, auth=auth)
         assert resp.status_code == 200
         u02 = resp.json()
         assert u02['uid'] == 'user-2'
@@ -87,7 +91,7 @@ def test_user(storage, caplog):
         assert ts02 is not None
         del inp['password']
         inp['display_name'] = 'Jane Doe'
-        resp = clt.post('/users', json=inp)
+        resp = clt.post('/users', json=inp, auth=auth)
         assert resp.status_code == 200
         u02a = resp.json()
         assert u02a['uid'] == 'user-2'