AccessGate 0.2.0a1__py3-none-any.whl

access_gate/adapters/__init__.py

@@ -0,0 +1,5 @@
+"""Optional framework adapters.
+
+Adapters are intentionally excluded from the top-level import so the core has
+no framework dependency.
+"""

access_gate/adapters/django.py

@@ -0,0 +1,177 @@
+"""Django integration for AccessGate."""
+
+from __future__ import annotations
+
+from collections.abc import Awaitable, Callable, Mapping
+from dataclasses import dataclass
+from functools import wraps
+from inspect import isawaitable
+from typing import TypeVar, cast
+
+from asgiref.sync import iscoroutinefunction
+from django.core.exceptions import PermissionDenied
+from django.http import HttpRequest
+
+from ..engine import AuthorizationEngine
+from ..types import AuthorizationRequest, Decision, Resource, Subject
+
+View = TypeVar("View", bound=Callable[..., object])
+Resolved = TypeVar("Resolved")
+SubjectResolverFunction = Callable[[HttpRequest], Subject | Awaitable[Subject]]
+ResourceResolverFunction = Callable[..., Resource | None | Awaitable[Resource | None]]
+ContextResolverFunction = Callable[
+    [HttpRequest],
+    Mapping[str, object] | Awaitable[Mapping[str, object]],
+]
+ActionAttributesResolverFunction = Callable[
+    [HttpRequest, str],
+    Mapping[str, object] | Awaitable[Mapping[str, object]],
+]
+DenialHandler = Callable[[HttpRequest, Decision], object | Awaitable[object]]
+
+
+def default_subject_resolver(request: HttpRequest) -> Subject:
+    """Resolve Django's user without assuming a project-specific user model.
+
+    Applications can expose ``access_gate_roles`` and
+    ``access_gate_attributes`` on their user object, or replace this resolver.
+    """
+
+    user = getattr(request, "user", None)
+    authenticated = bool(user is not None and getattr(user, "is_authenticated", False))
+    identifier_value = getattr(user, "pk", None)
+    if identifier_value is None:
+        identifier_value = getattr(user, "id", None)
+    roles_value = getattr(user, "access_gate_roles", ())
+    attributes_value = getattr(user, "access_gate_attributes", {})
+    if isinstance(roles_value, str):
+        roles_value = (roles_value,)
+    if not isinstance(attributes_value, Mapping):
+        attributes_value = {}
+    return Subject(
+        identifier="" if identifier_value is None else str(identifier_value),
+        authenticated=authenticated,
+        roles=frozenset(str(role) for role in roles_value),
+        attributes=dict(attributes_value),
+    )
+
+
+def default_context_resolver(request: HttpRequest) -> Mapping[str, object]:
+    return {
+        "method": getattr(request, "method", ""),
+        "path": getattr(request, "path", ""),
+    }
+
+
+def default_action_attributes_resolver(
+    request: HttpRequest,
+    action: str,
+) -> Mapping[str, object]:
+    del request, action
+    return {}
+
+
+def raise_permission_denied(request: HttpRequest, decision: Decision) -> object:
+    del request
+    raise PermissionDenied(decision.reason)
+
+
+def _sync_value(value: Resolved | Awaitable[Resolved], *, resolver: str) -> Resolved:
+    if isawaitable(value):
+        close = getattr(value, "close", None)
+        if callable(close):
+            close()
+        raise TypeError(f"{resolver} returned an awaitable for a synchronous Django view.")
+    return value
+
+
+async def _async_value(value: Resolved | Awaitable[Resolved]) -> Resolved:
+    if isawaitable(value):
+        return await value
+    return value
+
+
+@dataclass(slots=True)
+class DjangoAuthorizer:
+    """Create authorization decorators from a configured engine and resolvers."""
+
+    engine: AuthorizationEngine
+    subject_resolver: SubjectResolverFunction = default_subject_resolver
+    context_resolver: ContextResolverFunction = default_context_resolver
+    action_attributes_resolver: ActionAttributesResolverFunction = (
+        default_action_attributes_resolver
+    )
+    denial_handler: DenialHandler = raise_permission_denied
+
+    def require(
+        self,
+        action: str,
+        *,
+        resource_resolver: ResourceResolverFunction | None = None,
+    ) -> Callable[[View], View]:
+        """Decorate a Django view with an authorization requirement."""
+
+        def decorator(view: View) -> View:
+            if iscoroutinefunction(view):
+
+                @wraps(view)
+                async def async_wrapped(
+                    request: HttpRequest,
+                    *args: object,
+                    **kwargs: object,
+                ) -> object:
+                    resource = None
+                    if resource_resolver is not None:
+                        resource = await _async_value(resource_resolver(request, *args, **kwargs))
+                    authorization_request = AuthorizationRequest(
+                        subject=await _async_value(self.subject_resolver(request)),
+                        action=action,
+                        resource=resource,
+                        context=await _async_value(self.context_resolver(request)),
+                        action_attributes=await _async_value(
+                            self.action_attributes_resolver(request, action)
+                        ),
+                    )
+                    decision = self.engine.decide(authorization_request)
+                    if not decision.allowed:
+                        return await _async_value(self.denial_handler(request, decision))
+                    async_view = cast(Callable[..., Awaitable[object]], view)
+                    return await async_view(request, *args, **kwargs)
+
+                return cast(View, async_wrapped)
+
+            @wraps(view)
+            def wrapped(request: HttpRequest, *args: object, **kwargs: object) -> object:
+                resource = None
+                if resource_resolver is not None:
+                    resource = _sync_value(
+                        resource_resolver(request, *args, **kwargs),
+                        resolver="resource_resolver",
+                    )
+                authorization_request = AuthorizationRequest(
+                    subject=_sync_value(
+                        self.subject_resolver(request),
+                        resolver="subject_resolver",
+                    ),
+                    action=action,
+                    resource=resource,
+                    context=_sync_value(
+                        self.context_resolver(request),
+                        resolver="context_resolver",
+                    ),
+                    action_attributes=_sync_value(
+                        self.action_attributes_resolver(request, action),
+                        resolver="action_attributes_resolver",
+                    ),
+                )
+                decision = self.engine.decide(authorization_request)
+                if not decision.allowed:
+                    return _sync_value(
+                        self.denial_handler(request, decision),
+                        resolver="denial_handler",
+                    )
+                return view(request, *args, **kwargs)
+
+            return cast(View, wrapped)
+
+        return decorator

access_gate/engine.py

@@ -0,0 +1,224 @@
+"""The framework-neutral authorization engine."""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Callable, Iterable, Mapping
+from enum import Enum
+from inspect import isawaitable
+from typing import cast
+
+from .exceptions import AuthorizationDenied
+from .protocols import AuditSink, DecisionStrategy, Policy
+from .strategies import DenyOverrides
+from .types import AuthorizationRequest, Decision, Resource, Subject
+
+
+class ErrorMode(str, Enum):
+    """How extension failures are handled."""
+
+    DENY = "deny"
+    RAISE = "raise"
+    IGNORE = "ignore"
+
+
+class AuthorizationEngine:
+    """Evaluate policies with secure defaults and explicit extension points."""
+
+    def __init__(
+        self,
+        policies: Iterable[Policy],
+        *,
+        strategy: DecisionStrategy | None = None,
+        audit_sink: AuditSink | None = None,
+        policy_error_mode: ErrorMode = ErrorMode.DENY,
+        strategy_error_mode: ErrorMode = ErrorMode.DENY,
+        audit_error_mode: ErrorMode = ErrorMode.DENY,
+        policy_set_id: str | None = None,
+    ) -> None:
+        if not isinstance(policy_error_mode, ErrorMode):
+            raise TypeError("policy_error_mode must be an ErrorMode value.")
+        if not isinstance(strategy_error_mode, ErrorMode):
+            raise TypeError("strategy_error_mode must be an ErrorMode value.")
+        if strategy_error_mode is ErrorMode.IGNORE:
+            raise ValueError("strategy_error_mode cannot ignore a missing final decision.")
+        if not isinstance(audit_error_mode, ErrorMode):
+            raise TypeError("audit_error_mode must be an ErrorMode value.")
+        if policy_set_id is not None and (
+            not isinstance(policy_set_id, str)
+            or len(policy_set_id) > 256
+            or re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._:/+-]*", policy_set_id) is None
+        ):
+            raise ValueError(
+                "policy_set_id must be a bounded identifier containing safe characters."
+            )
+        self._policies = tuple(policies)
+        policy_names: list[str] = []
+        for policy in self._policies:
+            name = getattr(policy, "name", None)
+            if not isinstance(name, str) or not name:
+                raise TypeError("Every policy must have a non-empty string name.")
+            policy_names.append(name)
+        if len(set(policy_names)) != len(policy_names):
+            raise ValueError("Policy names must be unique within an authorization engine.")
+        global_policies: list[tuple[int, Policy]] = []
+        policies_by_action: dict[str, list[tuple[int, Policy]]] = {}
+        for index, policy in enumerate(self._policies):
+            actions = getattr(policy, "actions", None)
+            if isinstance(actions, frozenset) and actions and all(
+                isinstance(action, str) and action for action in actions
+            ):
+                for action in actions:
+                    policies_by_action.setdefault(action, []).append((index, policy))
+            else:
+                global_policies.append((index, policy))
+        self._global_policies = tuple(global_policies)
+        self._policies_by_action = {
+            action: tuple(indexed) for action, indexed in policies_by_action.items()
+        }
+        self._strategy = strategy or DenyOverrides()
+        self._audit_sink = audit_sink
+        self._policy_error_mode = policy_error_mode
+        self._strategy_error_mode = strategy_error_mode
+        self._audit_error_mode = audit_error_mode
+        self._policy_set_id = policy_set_id
+
+    @property
+    def policies(self) -> tuple[Policy, ...]:
+        return self._policies
+
+    @property
+    def policy_set_id(self) -> str | None:
+        return self._policy_set_id
+
+    def decide(self, request: AuthorizationRequest) -> Decision:
+        decisions: list[Decision] = []
+        for policy in self._policies_for_action(request.action):
+            try:
+                decision = policy.evaluate(request)
+                if decision is not None and not isinstance(decision, Decision):
+                    self._close_awaitable(decision)
+                    raise TypeError("A policy returned an invalid decision value.")
+            except Exception as error:
+                if self._policy_error_mode is ErrorMode.RAISE:
+                    raise
+                if self._policy_error_mode is ErrorMode.DENY:
+                    decisions.append(
+                        Decision.deny(
+                            "A policy failed during evaluation.",
+                            policy=getattr(policy, "name", type(policy).__name__),
+                            metadata={"error_type": type(error).__name__},
+                        )
+                    )
+                continue
+            if decision is not None:
+                decisions.append(decision)
+
+        try:
+            final = self._strategy.combine(request, decisions)
+            if not isinstance(final, Decision):
+                self._close_awaitable(final)
+                raise TypeError("The decision strategy returned an invalid value.")
+        except Exception as error:
+            if self._strategy_error_mode is ErrorMode.RAISE:
+                raise
+            final = Decision.deny(
+                "The decision strategy failed.",
+                policy="access_gate.strategy",
+                metadata={"error_type": type(error).__name__},
+            )
+        return self._record(request, self._annotate(final))
+
+    def decide_many(self, requests: Iterable[AuthorizationRequest]) -> tuple[Decision, ...]:
+        """Evaluate a batch while preserving request order and audit behavior."""
+
+        return tuple(self.decide(request) for request in requests)
+
+    def authorize(
+        self,
+        subject: Subject,
+        action: str,
+        resource: Resource | None = None,
+        *,
+        context: Mapping[str, object] | None = None,
+        action_attributes: Mapping[str, object] | None = None,
+    ) -> Decision:
+        """Convenience API for callers that do not need to construct a request."""
+
+        return self.decide(
+            AuthorizationRequest(
+                subject=subject,
+                action=action,
+                resource=resource,
+                context=context or {},
+                action_attributes=action_attributes or {},
+            )
+        )
+
+    def enforce(self, request: AuthorizationRequest) -> Decision:
+        """Return an allowed decision or raise :class:`AuthorizationDenied`."""
+
+        decision = self.decide(request)
+        if not decision.allowed:
+            raise AuthorizationDenied(decision)
+        return decision
+
+    def _record(self, request: AuthorizationRequest, decision: Decision) -> Decision:
+        if self._audit_sink is None:
+            return decision
+        try:
+            audit_record = cast(
+                Callable[[AuthorizationRequest, Decision], object],
+                self._audit_sink.record,
+            )
+            audit_result = audit_record(request, decision)
+            if audit_result is not None:
+                self._close_awaitable(audit_result)
+                raise TypeError("The audit sink returned an invalid value.")
+        except Exception as error:
+            if self._audit_error_mode is ErrorMode.RAISE:
+                raise
+            if self._audit_error_mode is ErrorMode.DENY:
+                return self._annotate(
+                    Decision.deny(
+                        "The authorization decision could not be audited.",
+                        policy="access_gate.audit",
+                        metadata={"error_type": type(error).__name__},
+                    )
+                )
+        return decision
+
+    def _annotate(self, decision: Decision) -> Decision:
+        if self._policy_set_id is None:
+            return decision
+        metadata = dict(decision.metadata)
+        metadata["policy_set_id"] = self._policy_set_id
+        return Decision(decision.effect, decision.reason, decision.policy, metadata)
+
+    @staticmethod
+    def _close_awaitable(value: object) -> None:
+        if not isawaitable(value):
+            return
+        close = getattr(value, "close", None)
+        if callable(close):
+            close()
+
+    def _policies_for_action(self, action: str) -> tuple[Policy, ...]:
+        targeted = self._policies_by_action.get(action, ())
+        if not targeted:
+            return tuple(policy for _, policy in self._global_policies)
+        selected: list[Policy] = []
+        global_index = 0
+        targeted_index = 0
+        while global_index < len(self._global_policies) and targeted_index < len(targeted):
+            global_item = self._global_policies[global_index]
+            targeted_item = targeted[targeted_index]
+            if global_item[0] < targeted_item[0]:
+                selected.append(global_item[1])
+                global_index += 1
+            else:
+                selected.append(targeted_item[1])
+                targeted_index += 1
+        selected.extend(policy for _, policy in self._global_policies[global_index:])
+        selected.extend(policy for _, policy in targeted[targeted_index:])
+        return tuple(selected)

access_gate/exceptions.py

@@ -0,0 +1,13 @@
+"""AccessGate exceptions."""
+
+from __future__ import annotations
+
+from .types import Decision
+
+
+class AuthorizationDenied(PermissionError):
+    """Raised when enforcement receives a denied decision."""
+
+    def __init__(self, decision: Decision) -> None:
+        self.decision = decision
+        super().__init__(decision.reason)

access_gate/integrity.py

@@ -0,0 +1,262 @@
+"""Deterministic policy identity and externally supplied signature verification."""
+
+from __future__ import annotations
+
+import base64
+import binascii
+import hashlib
+import json
+import re
+from collections.abc import Iterable, Mapping
+from inspect import isawaitable
+from typing import Protocol, cast
+
+from .abac import (
+    MAX_POLICY_DOCUMENT_CHARS,
+    AttributePolicy,
+    OperatorRegistry,
+    PolicySchemaError,
+    attribute_policy_from_dict,
+)
+
+CANONICAL_POLICY_FORMAT = "access_gate.canonical-json.v1"
+POLICY_SET_SCHEMA_VERSION = "access_gate.policy_set.v1"
+SIGNED_POLICY_ENVELOPE_VERSION = "access_gate.signed_policy.v1"
+MAX_SIGNED_POLICY_DOCUMENT_CHARS = MAX_POLICY_DOCUMENT_CHARS + 32_768
+MAX_SIGNATURE_BYTES = 16_384
+
+_SAFE_IDENTIFIER = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:/+@-]*$")
+_BASE64URL = re.compile(r"^[A-Za-z0-9_-]+$")
+
+
+class PolicyIntegrityError(PolicySchemaError):
+    """Raised when policy identity or signature verification fails."""
+
+
+class PolicySigner(Protocol):
+    """Sign canonical bytes using keys managed outside AccessGate."""
+
+    key_id: str
+    algorithm: str
+
+    def sign(self, payload: bytes) -> bytes: ...
+
+
+class PolicySignatureVerifier(Protocol):
+    """Verify canonical bytes using an application-controlled trust store."""
+
+    def verify(
+        self,
+        payload: bytes,
+        signature: bytes,
+        *,
+        key_id: str,
+        algorithm: str,
+    ) -> bool: ...
+
+
+def _canonical_json_bytes(value: object) -> bytes:
+    try:
+        document = json.dumps(
+            value,
+            allow_nan=False,
+            ensure_ascii=False,
+            separators=(",", ":"),
+            sort_keys=True,
+        )
+    except (TypeError, ValueError) as error:
+        raise PolicyIntegrityError("The policy is not canonically serializable.") from error
+    return document.encode("utf-8")
+
+
+def canonical_policy_bytes(policy: AttributePolicy) -> bytes:
+    """Return deterministic UTF-8 bytes for one validated ABAC policy."""
+
+    if not isinstance(policy, AttributePolicy):
+        raise TypeError("policy must be an AttributePolicy.")
+    return _canonical_json_bytes(policy.to_dict())
+
+
+def policy_fingerprint(policy: AttributePolicy) -> str:
+    """Return a stable, algorithm-labelled digest for a policy."""
+
+    return f"sha256:{hashlib.sha256(canonical_policy_bytes(policy)).hexdigest()}"
+
+
+def policy_set_fingerprint(policies: Iterable[AttributePolicy]) -> str:
+    """Fingerprint an ordered ABAC policy set, including evaluation order."""
+
+    normalized = tuple(policies)
+    if not all(isinstance(policy, AttributePolicy) for policy in normalized):
+        raise TypeError("policies must contain only AttributePolicy instances.")
+    names = [policy.name for policy in normalized]
+    if len(set(names)) != len(names):
+        raise PolicyIntegrityError("Policy names must be unique within a policy set.")
+    payload = {
+        "schema_version": POLICY_SET_SCHEMA_VERSION,
+        "policies": [policy.to_dict() for policy in normalized],
+    }
+    return f"sha256:{hashlib.sha256(_canonical_json_bytes(payload)).hexdigest()}"
+
+
+def _validated_identifier(value: object, *, field_name: str, max_length: int) -> str:
+    if (
+        not isinstance(value, str)
+        or not value
+        or len(value) > max_length
+        or _SAFE_IDENTIFIER.fullmatch(value) is None
+    ):
+        raise PolicyIntegrityError(
+            f"{field_name} must be a bounded identifier containing only safe characters."
+        )
+    return value
+
+
+def _protected_document(
+    policy: AttributePolicy,
+    *,
+    key_id: str,
+    algorithm: str,
+) -> dict[str, object]:
+    return {
+        "envelope_version": SIGNED_POLICY_ENVELOPE_VERSION,
+        "canonicalization": CANONICAL_POLICY_FORMAT,
+        "key_id": key_id,
+        "algorithm": algorithm,
+        "policy": policy.to_dict(),
+    }
+
+
+def dumps_signed_policy(policy: AttributePolicy, signer: PolicySigner) -> str:
+    """Create a signed policy envelope without owning signing keys or algorithms."""
+
+    if not isinstance(policy, AttributePolicy):
+        raise TypeError("policy must be an AttributePolicy.")
+    key_id = _validated_identifier(signer.key_id, field_name="key_id", max_length=512)
+    algorithm = _validated_identifier(signer.algorithm, field_name="algorithm", max_length=128)
+    protected = _protected_document(policy, key_id=key_id, algorithm=algorithm)
+    try:
+        signature = signer.sign(_canonical_json_bytes(protected))
+    except Exception as error:
+        raise PolicyIntegrityError("The policy signer failed.") from error
+    if isawaitable(signature):
+        _close_awaitable(signature)
+        raise PolicyIntegrityError("Policy signers must be synchronous.")
+    if not isinstance(signature, bytes):
+        raise PolicyIntegrityError("Policy signers must return bytes.")
+    if not signature or len(signature) > MAX_SIGNATURE_BYTES:
+        raise PolicyIntegrityError("The policy signature has an invalid size.")
+    envelope = {
+        **protected,
+        "signature": base64.urlsafe_b64encode(signature).rstrip(b"=").decode("ascii"),
+    }
+    document = _canonical_json_bytes(envelope).decode("utf-8")
+    if len(document) > MAX_SIGNED_POLICY_DOCUMENT_CHARS:
+        raise PolicyIntegrityError("The signed policy document exceeds the size limit.")
+    return document
+
+
+def _decode_signature(value: object) -> bytes:
+    if not isinstance(value, str) or not value or _BASE64URL.fullmatch(value) is None:
+        raise PolicyIntegrityError("signature must be canonical unpadded base64url.")
+    try:
+        signature = base64.b64decode(
+            value + "=" * (-len(value) % 4),
+            altchars=b"-_",
+            validate=True,
+        )
+    except (binascii.Error, ValueError) as error:
+        raise PolicyIntegrityError("signature must be canonical unpadded base64url.") from error
+    canonical = base64.urlsafe_b64encode(signature).rstrip(b"=").decode("ascii")
+    if canonical != value or not signature or len(signature) > MAX_SIGNATURE_BYTES:
+        raise PolicyIntegrityError("The policy signature is not canonical or has an invalid size.")
+    return signature
+
+
+def loads_signed_policy(
+    document: str,
+    verifier: PolicySignatureVerifier,
+    *,
+    operators: OperatorRegistry | None = None,
+) -> AttributePolicy:
+    """Verify a signed envelope before constructing its policy."""
+
+    if not isinstance(document, str):
+        raise TypeError("signed policy document must be a string.")
+    if len(document) > MAX_SIGNED_POLICY_DOCUMENT_CHARS:
+        raise PolicyIntegrityError("The signed policy document exceeds the size limit.")
+    try:
+        value = json.loads(
+            document,
+            parse_constant=_reject_json_constant,
+            object_pairs_hook=_reject_duplicate_json_object,
+        )
+    except (json.JSONDecodeError, RecursionError, ValueError) as error:
+        raise PolicyIntegrityError("The signed policy document is not valid JSON.") from error
+    if not isinstance(value, Mapping) or not all(isinstance(key, str) for key in value):
+        raise PolicyIntegrityError("The signed policy envelope must be an object.")
+    envelope = cast(Mapping[str, object], value)
+    expected_fields = {
+        "envelope_version",
+        "canonicalization",
+        "key_id",
+        "algorithm",
+        "policy",
+        "signature",
+    }
+    if set(envelope) != expected_fields:
+        raise PolicyIntegrityError("The signed policy envelope has missing or unknown fields.")
+    if envelope["envelope_version"] != SIGNED_POLICY_ENVELOPE_VERSION:
+        raise PolicyIntegrityError("The signed policy envelope version is unsupported.")
+    if envelope["canonicalization"] != CANONICAL_POLICY_FORMAT:
+        raise PolicyIntegrityError("The signed policy canonicalization is unsupported.")
+    key_id = _validated_identifier(envelope["key_id"], field_name="key_id", max_length=512)
+    algorithm = _validated_identifier(envelope["algorithm"], field_name="algorithm", max_length=128)
+    raw_policy = envelope["policy"]
+    if not isinstance(raw_policy, Mapping) or not all(isinstance(key, str) for key in raw_policy):
+        raise PolicyIntegrityError("policy must be an object.")
+    policy_document = cast(Mapping[str, object], raw_policy)
+    signature = _decode_signature(envelope["signature"])
+    protected = {
+        "envelope_version": envelope["envelope_version"],
+        "canonicalization": envelope["canonicalization"],
+        "key_id": key_id,
+        "algorithm": algorithm,
+        "policy": policy_document,
+    }
+    try:
+        verified = verifier.verify(
+            _canonical_json_bytes(protected),
+            signature,
+            key_id=key_id,
+            algorithm=algorithm,
+        )
+    except Exception as error:
+        raise PolicyIntegrityError("The policy signature verifier failed.") from error
+    if isawaitable(verified):
+        _close_awaitable(verified)
+        raise PolicyIntegrityError("Policy signature verifiers must be synchronous.")
+    if not isinstance(verified, bool):
+        raise PolicyIntegrityError("Policy signature verifiers must return a boolean.")
+    if not verified:
+        raise PolicyIntegrityError("The policy signature is invalid.")
+    return attribute_policy_from_dict(policy_document, operators=operators)
+
+
+def _reject_json_constant(value: str) -> None:
+    raise ValueError(f"Unsupported JSON constant: {value}")
+
+
+def _reject_duplicate_json_object(pairs: list[tuple[str, object]]) -> dict[str, object]:
+    value: dict[str, object] = {}
+    for key, item in pairs:
+        if key in value:
+            raise ValueError(f"Duplicate JSON object key: {key}")
+        value[key] = item
+    return value
+
+
+def _close_awaitable(value: object) -> None:
+    close = getattr(value, "close", None)
+    if callable(close):
+        close()

access_gate/mcp/__init__.py

@@ -0,0 +1 @@
+"""AccessGate's dependency-free public MCP server."""