20206205tech-python-auth 0.0.0__py3-none-any.whl

20206205tech_python_auth-0.0.0.dist-info/METADATA

@@ -0,0 +1,9 @@
+Metadata-Version: 2.4
+Name: 20206205tech-python-auth
+Version: 0.0.0
+Summary: Add your description here
+Requires-Python: >=3.13
+Requires-Dist: fastapi>=0.115.8
+Requires-Dist: loguru>=0.7.3
+Requires-Dist: pydantic>=2.10.6
+Requires-Dist: pyjwt[crypto]>=2.10.1

20206205tech_python_auth-0.0.0.dist-info/RECORD

@@ -0,0 +1,8 @@
+tech_auth/__init__.py,sha256=WyaazASkfcfR-LToY17PEZC9R9W_xlAhiIQ_1MUXrRY,317
+tech_auth/dependencies.py,sha256=KTrnvnmSyExrya6d0bi46lvmLgGj7zdQYX94IXPvqe0,1022
+tech_auth/enums.py,sha256=8LtdrkdtGS5964uhkUfjvNHf5dD6t2Fp7qKOvuWS5JE,98
+tech_auth/schemas.py,sha256=LXVcwIN3osOG8FszyIGuqVyyAjryiMs4LUL2HBQN2f8,155
+tech_auth/security.py,sha256=Vda7pD38yRPetCC649Q5BGI5rltMQ_DzI-FOKJESEYk,1575
+20206205tech_python_auth-0.0.0.dist-info/METADATA,sha256=-NjHyQYc3wTo1woOHnxufOAbk-ZdNGRKGbX8NesW6P4,257
+20206205tech_python_auth-0.0.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+20206205tech_python_auth-0.0.0.dist-info/RECORD,,

20206205tech_python_auth-0.0.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.29.0
+Root-Is-Purelib: true
+Tag: py3-none-any

tech_auth/__init__.py

@@ -0,0 +1,13 @@
+from .dependencies import get_current_user, get_current_user_id, require_admin
+from .enums import UserRole
+from .schemas import CurrentUser
+from .security import verify_token
+
+__all__ = [
+    "get_current_user",
+    "get_current_user_id",
+    "require_admin",
+    "UserRole",
+    "CurrentUser",
+    "verify_token",
+]

tech_auth/dependencies.py

@@ -0,0 +1,35 @@
+from fastapi import Depends, HTTPException, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+
+from .enums import UserRole
+from .schemas import CurrentUser
+from .security import verify_token
+
+security = HTTPBearer()
+
+
+def get_current_user(
+    credentials: HTTPAuthorizationCredentials = Depends(security),
+) -> CurrentUser:
+    token = credentials.credentials
+    payload = verify_token(token)
+
+    app_metadata = payload.get("app_metadata", {})
+    role = app_metadata.get("role") or payload.get("role")
+
+    return CurrentUser(
+        user_id=payload.get("sub"), email=payload.get("email"), role=role
+    )
+
+
+def get_current_user_id(user: CurrentUser = Depends(get_current_user)) -> str:
+    return user.user_id
+
+
+def require_admin(user: CurrentUser = Depends(get_current_user)) -> CurrentUser:
+    if user.role != UserRole.ADMIN:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Forbidden - Requires Admin role",
+        )
+    return user

tech_auth/enums.py

@@ -0,0 +1,6 @@
+from enum import Enum
+
+
+class UserRole(str, Enum):
+    ADMIN = "admin"
+    USER = "authenticated"

tech_auth/schemas.py

@@ -0,0 +1,9 @@
+from typing import Optional
+
+from pydantic import BaseModel
+
+
+class CurrentUser(BaseModel):
+    user_id: str
+    email: Optional[str] = None
+    role: str

tech_auth/security.py

@@ -0,0 +1,50 @@
+import os
+
+import jwt
+from fastapi import HTTPException, status
+from jwt import PyJWKClient
+
+# Configuration from environment variables
+JWKS_URL = os.getenv("SUPABASE_JWKS_URL")
+AUDIENCE = os.getenv("SUPABASE_AUDIENCE", "authenticated")
+ISSUER = os.getenv("SUPABASE_ISSUER")
+
+# Fallback for Supabase projects
+if not JWKS_URL or not ISSUER:
+    PROJECT_ID = os.getenv("SUPABASE_PROJECT_ID")
+    if PROJECT_ID:
+        if not JWKS_URL:
+            JWKS_URL = f"https://{PROJECT_ID}.supabase.co/auth/v1/.well-known/jwks.json"
+        if not ISSUER:
+            ISSUER = f"https://{PROJECT_ID}.supabase.co/auth/v1"
+
+if not JWKS_URL:
+    raise RuntimeError("SUPABASE_JWKS_URL or SUPABASE_PROJECT_ID must be set")
+
+jwks_client = PyJWKClient(JWKS_URL, cache_keys=True)
+
+
+def verify_token(token: str) -> dict:
+    try:
+        signing_key = jwks_client.get_signing_key_from_jwt(token)
+        payload = jwt.decode(
+            token,
+            signing_key.key,
+            algorithms=["RS256", "ES256"],
+            audience=AUDIENCE,
+            issuer=ISSUER,
+        )
+        return payload
+    except jwt.PyJWKClientError:
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail="Unable to fetch JWKS",
+        )
+    except jwt.ExpiredSignatureError:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED, detail="Token has expired"
+        )
+    except jwt.InvalidTokenError:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid token"
+        )