[imit]

What changes

users.find_by_identifier now searches the app's users with the secret key and never creates a user.

• How: it uses the user list (GET /v1/:app_id/users with q=), a loose search over email, phone and name. It keeps only an exact match: the email in any case, or the phone compared as digits (so pass it with the country code).
• None: it returns None when nobody by that identifier uses the app, and makes no call for an identifier with nothing to search for.
• Paging: it follows the list's pages, up to 10 pages of 100.
• What it returns: the user as users.get shows it.
• Signature: unchanged.

It used to call the public identifier lookup (GET /v1/auth/:app_id/users?identifier=), which now returns only what sign-in needs.

sessions.list / sessions.revoke: they work with the app's secret key alone, with no user session. The API now accepts that. The docstrings and README say so.

README: also says meta / user_meta keys have to be the app's declared user meta fields. Other keys are left out on create (listed in user_meta_errors) and refused on update.

Tests

• Unit: the fake API's user list now answers loosely and pages by 2. New tests cover:

  • an exact email in any case, found on page 2
  • phones compared as digits
  • near misses returning None after every page
  • no call for an empty identifier
  • the page cap
  • that the public route isn't used

• Live: the strict xfails from Live suite: scute-python against a real Scute API (pytest -m live) #2 now pass, so they're normal tests again:

  • a refreshed token verifying locally
  • listing and revoking sessions
  • find_by_identifier returning None for nobody

  A new live test checks that only the exact email counts when the search also answers a near-identical one.

Results

• Unit suite: 140 passed.
• ruff, mypy src, mypy --strict src tests/live: clean.
• pytest -m live against scute-api-v2 v23: 53 passed, 0 failed, 0 xfailed. It used five sign-ins.
• After the run: the app has no users, roles, resources, agents or properties, and its settings are back as they were.

Run it with pytest -m live (setup in the README's "Live suite" section).