Bug Report: Request Context Not Set Before Groupfinder Is Called

[Korneliusz93]

Description

We are encountering an issue where the groupfinder function is being called before request.context is properly set, resulting in the error:
RuntimeError: Request context is not set before groupfinder is called.
Steps to Reproduce

1. Deploy the application in a test environment.
2. Attempt to authenticate or access a resource that triggers the groupfinder.
3. Observe the following error in the logs or console output:
   RuntimeError: Request context is not set before groupfinder is called.

Expected Behavior
The request should have a valid context set before the groupfinder is invoked, allowing the authentication system to properly function.

Actual Behavior
Groupfinder is called prematurely, causing the RuntimeError when attempting to access request.context.

Suggested Solution

Solution 1: Delay the use of request.context in the groupfinder function until it's properly set, or return None if request.context is unavailable.
Example modification for groupfinder:

def groupfinder(userid, request):
    """ A Pyramid authentication policy groupfinder callback."""
    if not hasattr(request, 'context') or request.context is None:
        return None  # Gracefully handle when context is not set
    context = request.context
    adapter = request.registry.queryMultiAdapter((context, request), IUserLocator)
    if adapter is None:
        adapter = DefaultUserLocator(context, request)
    return adapter.get_groupids(userid)

Solution 2: Ensure traversal occurs before authentication by adjusting the tween order in the Pyramid configuration.
Add the following line in your app configuration:
config.add_tween('substanced.tweens.transaction_manager', over='pyramid.authentication')

Solution 3: Log the request context and authentication steps to investigate further and ensure proper sequencing of middleware and tweens.

Environment

Pyramid Version: 2.0.2
Python Version: 3.11.3
Operating System: Mac OS 12.7.6

Additional Context

This issue occurs during the request lifecycle when authentication is handled via the Pyramid authentication policy.
The groupfinder function is invoked to locate groups for the authenticated user, but it fails if request.context has not been set during traversal.
Further debugging is required to identify the precise point in the middleware or tween lifecycle where context is not being established correctly.