aac-invoke-auth 0.1.0__py3-none-any.whl

aac_invoke_auth/__init__.py

@@ -0,0 +1,368 @@
+"""Loopback ``/invoke`` request authentication (Backlog A1; Eng Spec §III.2.4a).
+
+Since B82 PR-A (2026-07-09) this module is its own workspace member —
+distribution ``aac-invoke-auth``, import package ``aac_invoke_auth`` —
+moved out of ``aac-sdk`` so a tenant agent can install the verifier
+without the SDK's dependency footprint (see Backlog B82/B87).
+
+Threat model
+------------
+The sidecar POSTs verified chain context to the local agent's ``/invoke``
+endpoint. Before A1, loopback bind-isolation WAS the security boundary:
+any breach of that isolation (misconfigured container, host-networking
+mode, compromised neighbor in the pod) let an attacker feed arbitrary
+chain handles + payloads straight to the agent — bypassing ALL chain
+verification, because the agent never verifies anything itself. This
+module closes that gap: the sidecar signs every /invoke push with a
+pairing secret shared with exactly one agent, and the agent rejects
+requests that don't carry a valid, fresh signature.
+
+Why HMAC (and not mTLS or JWS)
+------------------------------
+The agent is deliberately crypto-blind (AAC Design §0): no macaroon
+bytes, no DPoP, no asymmetric crypto. A shared-secret HMAC keeps the
+agent-side verifier at "standard library only" in every language —
+which is what makes per-stack middleware ports mechanical (Backlog
+B79). mTLS would TLS-ify the loopback hop and its deployment story;
+JWS would drag a JOSE dependency into every agent stack.
+
+Wire format (normative text lives in Eng Spec §III.2.4a)
+--------------------------------------------------------
+Two headers ride the /invoke request::
+
+    X-AAC-Invoke-Timestamp: <unix seconds, decimal>
+    X-AAC-Invoke-Signature: AAC1-HMAC-SHA256 <hex hmac-sha256>
+
+The signature covers the string-to-sign::
+
+    AAC1-HMAC-SHA256 "\\n"
+    <HTTP method, uppercase> "\\n"
+    <URL path, no query/host> "\\n"
+    <timestamp, decimal> "\\n"
+    <sha256 of the raw body bytes, lowercase hex> "\\n"
+    <canonical X-AAC-* headers>
+
+where the canonical header block is every header whose lowercase name
+starts with ``x-aac-`` EXCEPT the two auth headers themselves, as
+``name:value`` lines — names lowercased, values byte-exact (NO
+whitespace normalization: the signature must authenticate exactly the
+value the agent's framework hands to business logic, review finding
+M1) — sorted by name and joined with ``\\n``. A repeated covered
+header name is REJECTED outright: the paired sidecar never sends
+duplicates, so a duplicate is either an attack or a broken proxy.
+Deriving the covered set by RULE (prefix match) rather than a fixed
+list means a request with any X-AAC-* header added, removed, or
+altered after signing fails verification, including headers
+introduced by future spec revisions.
+
+Replay posture: freshness-window only (locked at A1 design time).
+The threat A1 closes is forgery; a replayed message is one the sidecar
+legitimately signed seconds earlier, so within-window replay adds
+nothing against an idempotent /invoke. See Eng Spec §III.2.4a for the
+upgrade path if a future deployment needs per-request replay detection.
+
+The algorithm name is versioned (``AAC1-``) so a future scheme can ship
+as ``AAC2-...`` and verifiers can reject unknown prefixes loudly —
+mirroring the algorithm-agile root-signature convention (AAC Design §4.1).
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import os
+import time
+from collections.abc import Mapping
+from pathlib import Path
+
+__all__ = [
+    "DEFAULT_FRESHNESS_WINDOW_SECONDS",
+    "INVOKE_AUTH_ALGORITHM",
+    "MIN_SECRET_LENGTH_BYTES",
+    "SECRET_FILE_ENV_VAR",
+    "SIGNATURE_HEADER",
+    "TIMESTAMP_HEADER",
+    "InvokeAuthError",
+    "InvokeSignatureMismatch",
+    "InvokeTimestampOutsideWindow",
+    "MalformedInvokeAuthHeader",
+    "MissingInvokeAuthHeader",
+    "WeakInvokeAuthSecret",
+    "build_string_to_sign",
+    "load_invoke_auth_secret",
+    "load_invoke_auth_secret_from_env",
+    "sign_invoke_request",
+    "verify_invoke_request",
+]
+
+INVOKE_AUTH_ALGORITHM = "AAC1-HMAC-SHA256"
+SIGNATURE_HEADER = "X-AAC-Invoke-Signature"
+TIMESTAMP_HEADER = "X-AAC-Invoke-Timestamp"
+
+# ±30s tolerates realistic clock skew between two containers in the
+# same pod/compose network while keeping the forged-replay window
+# short. Locked at A1 design time (window-only, no nonce cache).
+DEFAULT_FRESHNESS_WINDOW_SECONDS = 30
+
+# 32 bytes ≈ 256 bits of secret material — matches the HMAC-SHA256
+# block-security level. Shorter files are almost certainly a
+# generation mistake (empty file, truncated mount), so fail loud.
+MIN_SECRET_LENGTH_BYTES = 32
+
+# Agents read their pairing secret path from this env var (compose /
+# K8s sets it). The FILE-path indirection (rather than the secret
+# itself in the env) keeps secrets out of `docker inspect` output.
+SECRET_FILE_ENV_VAR = "AAC_INVOKE_AUTH_SECRET_FILE"
+
+_COVERED_HEADER_PREFIX = "x-aac-"
+_AUTH_HEADER_NAMES_LOWER = frozenset(
+    {SIGNATURE_HEADER.lower(), TIMESTAMP_HEADER.lower()}
+)
+
+
+class InvokeAuthError(Exception):
+    """Base for every /invoke authentication failure.
+
+    Deliberately module-local (not in ``aac.exceptions``): the
+    exception family is part of the self-contained surface a B79
+    middleware port re-implements, so it lives with the algorithm.
+    """
+
+
+class MissingInvokeAuthHeader(InvokeAuthError):
+    """The request carries no signature and/or no timestamp header."""
+
+
+class MalformedInvokeAuthHeader(InvokeAuthError):
+    """A header is present but unparseable (bad shape, unknown
+    algorithm prefix, non-integer timestamp)."""
+
+
+class InvokeTimestampOutsideWindow(InvokeAuthError):
+    """The timestamp is valid but outside the freshness window."""
+
+
+class InvokeSignatureMismatch(InvokeAuthError):
+    """The recomputed HMAC does not match the presented signature —
+    the request was tampered with, signed with a different secret,
+    or canonicalized differently by the two sides."""
+
+
+class WeakInvokeAuthSecret(InvokeAuthError):
+    """The secret file's content is too short to be a real secret."""
+
+
+def load_invoke_auth_secret(path: str | Path) -> bytes:
+    """Read a pairing secret from ``path``.
+
+    The secret is the file's content with surrounding whitespace
+    stripped, treated as opaque bytes — no hex/base64 decoding, so a
+    B79 port never has to guess the encoding. Recommended generation:
+    ``openssl rand -hex 32`` (yields 64 bytes of hex text on disk).
+    """
+    secret = Path(path).read_bytes().strip()
+    if len(secret) < MIN_SECRET_LENGTH_BYTES:
+        raise WeakInvokeAuthSecret(
+            f"invoke-auth secret at {path} is {len(secret)} bytes after "
+            f"whitespace strip; at least {MIN_SECRET_LENGTH_BYTES} are "
+            f"required. Generate one with: openssl rand -hex 32"
+        )
+    return secret
+
+
+def load_invoke_auth_secret_from_env(
+    env_var: str = SECRET_FILE_ENV_VAR,
+) -> bytes | None:
+    """Low-level helper: load the secret named by ``env_var``.
+
+    Returns None when the env var is unset/empty; a set-but-unreadable
+    path raises — a deployment that CONFIGURED auth and got it wrong
+    must fail loud, not silently open up.
+
+    NOTE (B82 PR-B): returning None is NOT a license to run
+    unauthenticated. Policy lives one layer up — the FastAPI guard's
+    :meth:`~aac_invoke_auth.fastapi.InvokeAuthGuard.from_env` fails
+    fast at startup on a None here unless
+    ``AAC_INVOKE_AUTH_ALLOW_UNAUTHENTICATED=true`` was set explicitly.
+    A B79 middleware port for another stack must implement the same
+    interlock.
+    """
+    secret_path = os.environ.get(env_var, "").strip()
+    if not secret_path:
+        return None
+    return load_invoke_auth_secret(secret_path)
+
+
+def _canonical_header_block(headers: Mapping[str, str]) -> str:
+    """Build the canonical X-AAC-* header block (see module docstring).
+
+    Accepts any str→str mapping (a plain dict on the signing side; a
+    Starlette ``Headers`` object — whose ``.items()`` yields one entry
+    per raw header line — on the verify side). Values enter the block
+    BYTE-EXACT: any normalization here would let an attacker mutate
+    the raw value the agent's framework actually delivers without
+    breaking the signature (review finding M1). A repeated covered
+    name is rejected for the same reason — Starlette's ``get()``
+    returns only the first value, so a smuggled duplicate would
+    diverge from what business logic sees.
+    """
+    collected: dict[str, str] = {}
+    for name, value in headers.items():
+        lname = name.lower()
+        if not lname.startswith(_COVERED_HEADER_PREFIX):
+            continue
+        if lname in _AUTH_HEADER_NAMES_LOWER:
+            continue
+        if lname in collected:
+            raise MalformedInvokeAuthHeader(
+                f"covered header {lname!r} appears more than once — the "
+                f"paired sidecar never sends duplicate X-AAC-* headers, "
+                f"so a duplicate is rejected rather than canonicalized"
+            )
+        collected[lname] = value
+    lines = [f"{lname}:{value}" for lname, value in sorted(collected.items())]
+    return "\n".join(lines)
+
+
+def build_string_to_sign(
+    *,
+    method: str,
+    path: str,
+    timestamp: int,
+    body: bytes,
+    headers: Mapping[str, str],
+) -> str:
+    """Assemble the exact string both sides HMAC. Public so tests and
+    B79 ports can compare against the spec's known-answer vectors."""
+    body_sha256_hex = hashlib.sha256(body).hexdigest()
+    return "\n".join(
+        [
+            INVOKE_AUTH_ALGORITHM,
+            method.upper(),
+            path,
+            str(timestamp),
+            body_sha256_hex,
+            _canonical_header_block(headers),
+        ]
+    )
+
+
+def _compute_signature_hex(
+    *,
+    secret: bytes,
+    method: str,
+    path: str,
+    timestamp: int,
+    body: bytes,
+    headers: Mapping[str, str],
+) -> str:
+    string_to_sign = build_string_to_sign(
+        method=method, path=path, timestamp=timestamp, body=body, headers=headers
+    )
+    return hmac.new(secret, string_to_sign.encode("utf-8"), hashlib.sha256).hexdigest()
+
+
+def sign_invoke_request(
+    *,
+    secret: bytes,
+    method: str,
+    path: str,
+    headers: Mapping[str, str],
+    body: bytes,
+    timestamp: int | None = None,
+) -> dict[str, str]:
+    """Sidecar side: produce the two auth headers for an /invoke push.
+
+    ``headers`` is the outbound header dict as it will be sent (the
+    covered X-AAC-* subset is filtered out by rule here, so passing
+    Content-Type etc. is fine). Merge the returned dict into the
+    outbound headers AFTER every X-AAC-* header is final — a header
+    added after signing will fail verification on the agent side,
+    by design.
+    """
+    ts = int(time.time()) if timestamp is None else timestamp
+    signature_hex = _compute_signature_hex(
+        secret=secret, method=method, path=path, timestamp=ts, body=body, headers=headers
+    )
+    return {
+        TIMESTAMP_HEADER: str(ts),
+        SIGNATURE_HEADER: f"{INVOKE_AUTH_ALGORITHM} {signature_hex}",
+    }
+
+
+def verify_invoke_request(
+    *,
+    secret: bytes,
+    method: str,
+    path: str,
+    headers: Mapping[str, str],
+    body: bytes,
+    now: int | None = None,
+    freshness_window_seconds: int = DEFAULT_FRESHNESS_WINDOW_SECONDS,
+) -> None:
+    """Agent side: verify an inbound /invoke request or raise.
+
+    Raises a specific :class:`InvokeAuthError` subclass on failure;
+    returns None on success. ``headers`` should be the FULL inbound
+    header mapping (e.g. Starlette's ``request.headers``) — the
+    covered set is re-derived by rule from what was actually
+    received, so header insertion/removal after signing is caught.
+    """
+    signature_value = _get_single_header(headers, SIGNATURE_HEADER)
+    timestamp_value = _get_single_header(headers, TIMESTAMP_HEADER)
+    if signature_value is None or timestamp_value is None:
+        raise MissingInvokeAuthHeader(
+            f"/invoke request is missing {SIGNATURE_HEADER} and/or "
+            f"{TIMESTAMP_HEADER} — the paired sidecar signs every push "
+            f"(Eng Spec §III.2.4a); an unsigned request did not come "
+            f"from it"
+        )
+
+    algorithm, _, presented_hex = signature_value.strip().partition(" ")
+    if algorithm != INVOKE_AUTH_ALGORITHM or not presented_hex:
+        raise MalformedInvokeAuthHeader(
+            f"{SIGNATURE_HEADER} must be '{INVOKE_AUTH_ALGORITHM} <hex>'; "
+            f"got algorithm {algorithm!r}. Unknown algorithms are "
+            f"rejected rather than ignored (versioned-prefix agility)"
+        )
+
+    try:
+        ts = int(timestamp_value.strip())
+    except ValueError:
+        raise MalformedInvokeAuthHeader(
+            f"{TIMESTAMP_HEADER} must be decimal unix seconds; "
+            f"got {timestamp_value!r}"
+        ) from None
+
+    current = int(time.time()) if now is None else now
+    if abs(current - ts) > freshness_window_seconds:
+        raise InvokeTimestampOutsideWindow(
+            f"/invoke signature timestamp {ts} is {abs(current - ts)}s from "
+            f"now ({current}); window is ±{freshness_window_seconds}s. "
+            f"Check for clock skew between sidecar and agent containers"
+        )
+
+    expected_hex = _compute_signature_hex(
+        secret=secret, method=method, path=path, timestamp=ts, body=body, headers=headers
+    )
+    # hmac.compare_digest — constant-time compare; a plain `==` would
+    # leak match-prefix length through timing.
+    if not hmac.compare_digest(expected_hex, presented_hex.strip()):
+        raise InvokeSignatureMismatch(
+            "/invoke signature mismatch — the request was altered after "
+            "signing, signed with a different pairing secret, or the two "
+            "sides disagree on the canonical string (method/path/body/"
+            "X-AAC-* headers). See Eng Spec §III.2.4a for the "
+            "canonicalization rules"
+        )
+
+
+def _get_single_header(headers: Mapping[str, str], name: str) -> str | None:
+    """Case-insensitive single-header lookup over a plain dict or a
+    Starlette Headers object (whose ``get`` is already case-insensitive,
+    but a plain dict's is not — tests use plain dicts)."""
+    lname = name.lower()
+    for key, value in headers.items():
+        if key.lower() == lname:
+            return value
+    return None

aac_invoke_auth/fastapi.py

@@ -0,0 +1,369 @@
+"""FastAPI/Starlette mounting surfaces for invoke-push verification (B82).
+
+This submodule is the first per-stack middleware port of the B79
+delivery model: ``pip install aac-invoke-auth[fastapi]`` gives a tenant
+agent two one-line ways to authenticate ``/invoke`` pushes from its
+paired AAC sidecar, wrapping the frozen AAC1-HMAC-SHA256 core in
+:mod:`aac_invoke_auth` (which stays importable without FastAPI — this
+submodule is deliberately NOT imported from the package ``__init__``).
+
+Two mounting surfaces, one verifier underneath
+----------------------------------------------
+* Route-scoped dependency::
+
+      guard = InvokeAuthGuard.from_env()
+
+      @app.post("/invoke", dependencies=[Depends(guard)])
+      async def invoke(request: Request): ...
+
+* App-level middleware with a REQUIRED path filter (protect ``/invoke``
+  only; health probes and tenant business routes stay untouched)::
+
+      app.add_middleware(
+          InvokeAuthMiddleware,
+          guard=InvokeAuthGuard.from_env(),
+          protected_paths=("/invoke",),
+      )
+
+Both read the raw body bytes BEFORE verification and hand them back to
+the application afterwards, so a downstream ``await request.json()``
+works unchanged (the dependency relies on Starlette's request-body
+cache; the middleware replays the buffered receive stream).
+
+Fail-fast startup interlock (supersedes the A1 "unset = dev-only
+unauthenticated posture")
+--------------------------------------------------------------------
+:meth:`InvokeAuthGuard.from_env` REFUSES to construct when
+``AAC_INVOKE_AUTH_SECRET_FILE`` is unset — a missing secret on a
+tenant install is a security downgrade that must fail the process at
+startup, not degrade into a warning nobody reads. The single escape
+hatch is setting ``AAC_INVOKE_AUTH_ALLOW_UNAUTHENTICATED=true``
+explicitly (symmetric with the sidecar's ``dev_mode`` interlock, which
+gates the signing side of the same pair). It exists for extraordinary
+cases only — tenant test/pilot environments, debugging a suspected
+canonicalization mismatch — and an opted-out guard logs a prominent
+warning at construction so the posture is loud in the logs, never
+silent. See Eng Spec §III.2.4a and this package's README.
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+from collections.abc import Iterable
+
+from fastapi import HTTPException, Request
+from starlette.datastructures import Headers
+from starlette.responses import JSONResponse
+from starlette.types import ASGIApp, Message, Receive, Scope, Send
+
+from aac_invoke_auth import (
+    DEFAULT_FRESHNESS_WINDOW_SECONDS,
+    InvokeAuthError,
+    load_invoke_auth_secret_from_env,
+    verify_invoke_request,
+)
+
+__all__ = [
+    "ALLOW_UNAUTHENTICATED_ENV_VAR",
+    "InvokeAuthConfigurationError",
+    "InvokeAuthGuard",
+    "InvokeAuthMiddleware",
+]
+
+logger = logging.getLogger("aac_invoke_auth.fastapi")
+
+# The explicit opt-out for the fail-fast interlock. Only the exact
+# value "true" (case-insensitive) opts out — "1"/"yes"/typos do NOT,
+# so a mangled deployment manifest fails loud instead of silently
+# disabling authentication.
+ALLOW_UNAUTHENTICATED_ENV_VAR = "AAC_INVOKE_AUTH_ALLOW_UNAUTHENTICATED"
+
+# One generic wire detail for every rejection (A1 review finding S1):
+# the specific failure class goes to the agent's log only, denying a
+# probing attacker a free failure oracle.
+_REJECTION_DETAIL = "invoke auth failed"
+
+
+def _route_path(scope: Scope) -> str:
+    """The router's view of the request path: ``scope["path"]`` with the
+    ASGI ``root_path`` prefix stripped (same rule Starlette's routing
+    applies). BOTH surfaces filter and verify on this value (pre-PR
+    review H1/H2): matching on the raw ``scope["path"]`` would let a
+    ``root_path``/Mount deployment sail PAST an exact-match filter —
+    a fail-open — while the route it reaches is still ``/invoke``.
+    Consequence for signers: the paired sidecar signs the path as the
+    agent APP sees it (pairs share a pod; a prefix-rewriting proxy
+    between sidecar and agent breaks the signature by design).
+    """
+    root_path: str = scope.get("root_path", "")
+    path: str = scope["path"]
+    if root_path and path.startswith(root_path):
+        return path[len(root_path):]
+    return path
+
+
+class InvokeAuthConfigurationError(InvokeAuthError):
+    """Startup-time misconfiguration: no pairing secret and no explicit
+    unauthenticated opt-out. Raised by :meth:`InvokeAuthGuard.from_env`
+    BEFORE the app serves a single request — the fail-fast half of the
+    interlock whose signing half is the sidecar's ``dev_mode`` gate."""
+
+
+class InvokeAuthGuard:
+    """Verifies ``/invoke`` pushes against the pairing secret.
+
+    Construct directly with secret bytes (e.g. from a secret manager),
+    or via :meth:`from_env` which reads ``AAC_INVOKE_AUTH_SECRET_FILE``
+    and enforces the fail-fast interlock. The instance is itself a
+    FastAPI dependency — mount with ``Depends(guard)`` — and is the
+    ``guard=`` argument :class:`InvokeAuthMiddleware` requires. Both
+    surfaces call :meth:`verify_request`, so behavior cannot drift
+    between them.
+    """
+
+    def __init__(
+        self,
+        secret: bytes,
+        *,
+        freshness_window_seconds: int = DEFAULT_FRESHNESS_WINDOW_SECONDS,
+    ) -> None:
+        if not secret:
+            # Empty bytes here is always a wiring bug — the explicit
+            # unauthenticated posture goes through from_env()'s opt-out
+            # (or _unauthenticated()), never through a falsy secret.
+            raise InvokeAuthConfigurationError(
+                "InvokeAuthGuard requires non-empty secret bytes; for an "
+                f"explicitly unauthenticated guard set "
+                f"{ALLOW_UNAUTHENTICATED_ENV_VAR}=true and use from_env()"
+            )
+        self._init_fields(secret, freshness_window_seconds)
+
+    def _init_fields(
+        self, secret: bytes | None, freshness_window_seconds: int
+    ) -> None:
+        """THE single place instance fields are assigned — __init__ and
+        _unauthenticated() both delegate here, so a future field can't
+        be set on one construction path and missed on the other
+        (pre-PR review S5)."""
+        self._secret: bytes | None = secret
+        self._freshness_window_seconds = freshness_window_seconds
+
+    @classmethod
+    def _unauthenticated(
+        cls,
+        *,
+        freshness_window_seconds: int = DEFAULT_FRESHNESS_WINDOW_SECONDS,
+    ) -> InvokeAuthGuard:
+        """Internal: build a passthrough guard (explicit opt-out only)."""
+        guard = cls.__new__(cls)
+        guard._init_fields(None, freshness_window_seconds)
+        logger.warning(
+            "invoke-push authentication is DISABLED (%s=true): every "
+            "/invoke request will be accepted WITHOUT verifying it came "
+            "from the paired sidecar. This posture is for tenant "
+            "test/pilot debugging only — never production",
+            ALLOW_UNAUTHENTICATED_ENV_VAR,
+        )
+        return guard
+
+    @classmethod
+    def from_env(
+        cls,
+        *,
+        freshness_window_seconds: int = DEFAULT_FRESHNESS_WINDOW_SECONDS,
+    ) -> InvokeAuthGuard:
+        """Build a guard from the environment, failing fast at startup.
+
+        Resolution order:
+
+        * ``AAC_INVOKE_AUTH_SECRET_FILE`` set → load the secret from
+          that file (unreadable/too-short files raise, per the core's
+          fail-loud contract). A configured secret ALWAYS wins — the
+          opt-out var is ignored (with a log line) when both are set.
+        * unset, ``AAC_INVOKE_AUTH_ALLOW_UNAUTHENTICATED=true`` →
+          explicitly unauthenticated passthrough guard (prominent
+          warning logged).
+        * unset, no opt-out → :class:`InvokeAuthConfigurationError`.
+          The process must not come up half-secured by accident.
+        """
+        secret = load_invoke_auth_secret_from_env()
+        opt_out_value = os.environ.get(ALLOW_UNAUTHENTICATED_ENV_VAR, "")
+        opted_out = opt_out_value.strip().lower() == "true"
+        if secret is not None:
+            if opted_out:
+                logger.info(
+                    "%s=true is ignored because a pairing secret is "
+                    "configured — running authenticated",
+                    ALLOW_UNAUTHENTICATED_ENV_VAR,
+                )
+            return cls(
+                secret, freshness_window_seconds=freshness_window_seconds
+            )
+        if opted_out:
+            return cls._unauthenticated(
+                freshness_window_seconds=freshness_window_seconds
+            )
+        raise InvokeAuthConfigurationError(
+            "no invoke-auth pairing secret configured: set "
+            "AAC_INVOKE_AUTH_SECRET_FILE to the secret file shared with "
+            "the paired sidecar (generate with: openssl rand -hex 32). "
+            f"To run UNAUTHENTICATED (tenant test/pilot debugging only) "
+            f"set {ALLOW_UNAUTHENTICATED_ENV_VAR}=true explicitly. "
+            "Refusing to start half-secured (Eng Spec §III.2.4a)"
+        )
+
+    @property
+    def authenticated(self) -> bool:
+        """False only for an explicitly opted-out passthrough guard."""
+        return self._secret is not None
+
+    def verify_request(
+        self,
+        *,
+        method: str,
+        path: str,
+        headers: Headers,
+        body: bytes,
+    ) -> None:
+        """Verify one request or raise :class:`InvokeAuthError`.
+
+        The single verifier both mounting surfaces call. Passthrough
+        (opted-out) guards return immediately — the loud warning
+        already fired at construction.
+        """
+        if self._secret is None:
+            return
+        verify_invoke_request(
+            secret=self._secret,
+            method=method,
+            path=path,
+            headers=headers,
+            body=body,
+            freshness_window_seconds=self._freshness_window_seconds,
+        )
+
+    async def __call__(self, request: Request) -> None:
+        """FastAPI dependency surface: ``Depends(guard)``.
+
+        Reads the raw body BEFORE verification — Starlette caches it on
+        the request, so the route handler's own ``await request.body()``
+        / ``await request.json()`` sees the same bytes (the bofa-agent
+        A1 handler established this ordering as the precedent).
+        """
+        body_bytes = await request.body()
+        try:
+            self.verify_request(
+                method=request.method,
+                path=_route_path(request.scope),
+                headers=request.headers,
+                body=body_bytes,
+            )
+        except InvokeAuthError as e:
+            # 401, not a refuse() decision: a bad signature is a
+            # transport-trust failure, not a business refusal — the
+            # sidecar surfaces it as ERR_AGENT_REJECTED and an attacker
+            # gets no AgentDecision surface at all.
+            logger.warning("rejecting /invoke push: %s", e)
+            raise HTTPException(
+                status_code=401, detail=_REJECTION_DETAIL
+            ) from e
+
+
+class InvokeAuthMiddleware:
+    """Pure-ASGI middleware surface: one ``add_middleware`` line.
+
+    ``protected_paths`` is REQUIRED and exact-match: only those paths
+    are verified, so health probes and tenant business routes never
+    pay the buffering cost (nor break when unsigned). For anything
+    fancier than exact paths, mount ``Depends(guard)`` on the routes
+    instead.
+
+    Implemented against the raw ASGI protocol (not BaseHTTPMiddleware):
+    the request body is buffered message-by-message, verified, then the
+    buffered stream is replayed to the downstream app — so handlers
+    read the body exactly as if the middleware weren't there.
+    """
+
+    def __init__(
+        self,
+        app: ASGIApp,
+        *,
+        guard: InvokeAuthGuard,
+        protected_paths: Iterable[str],
+    ) -> None:
+        self._app = app
+        self._guard = guard
+        if isinstance(protected_paths, str):
+            # A bare string IS an Iterable[str] — frozenset("/invoke")
+            # would silently become per-character "paths" and protect
+            # nothing (pre-PR review M3). Fail loud instead.
+            raise InvokeAuthConfigurationError(
+                "protected_paths must be an iterable of paths, not a "
+                f'bare string — write protected_paths=("{protected_paths}",)'
+            )
+        self._protected_paths = frozenset(protected_paths)
+        if not self._protected_paths:
+            raise InvokeAuthConfigurationError(
+                "InvokeAuthMiddleware requires at least one protected "
+                'path (e.g. protected_paths=("/invoke",)) — an empty '
+                "filter would verify nothing while looking mounted"
+            )
+
+    async def __call__(
+        self, scope: Scope, receive: Receive, send: Send
+    ) -> None:
+        if scope["type"] != "http":
+            await self._app(scope, receive, send)
+            return
+        route_path = _route_path(scope)
+        if route_path not in self._protected_paths:
+            await self._app(scope, receive, send)
+            return
+
+        # Buffer the full request body. The paired sidecar sends small
+        # JSON envelopes (size caps tracked as Backlog B76), and the
+        # signature covers the body digest, so the whole body is needed
+        # before any verdict.
+        messages: list[Message] = []
+        body = b""
+        while True:
+            message = await receive()
+            messages.append(message)
+            if message["type"] == "http.disconnect":
+                break
+            body += message.get("body", b"")
+            if not message.get("more_body", False):
+                break
+
+        try:
+            self._guard.verify_request(
+                method=scope["method"],
+                path=route_path,
+                headers=Headers(scope=scope),
+                body=body,
+            )
+        except InvokeAuthError as e:
+            logger.warning("rejecting /invoke push: %s", e)
+            # Same envelope FastAPI's default HTTPException handler
+            # produces, so with default error handling the two mounting
+            # surfaces answer identically on the wire. Caveat (pre-PR
+            # review M4): this response is emitted OUTSIDE the app's
+            # exception-handler/middleware stack — an app that
+            # customizes 401 rendering (or stamps headers via other
+            # middleware) will see the Depends surface follow the
+            # customization while this one does not.
+            response = JSONResponse(
+                {"detail": _REJECTION_DETAIL}, status_code=401
+            )
+            await response(scope, receive, send)
+            return
+
+        replay = iter(messages)
+
+        async def replay_receive() -> Message:
+            for buffered in replay:
+                return buffered
+            return await receive()
+
+        await self._app(scope, replay_receive, send)

aac_invoke_auth/testing.py

@@ -0,0 +1,170 @@
+"""Test scaffold for agents behind invoke-push authentication (B82).
+
+Library-grade helper in the ``aac.tenant_siem.testing`` /
+``pandas.testing`` convention: agent test suites import from here
+instead of copy-pasting a signing helper 11 times.
+
+Since B82 PR-B the reference agents mount :class:`~aac_invoke_auth.
+fastapi.InvokeAuthMiddleware` at import time, and the repo-root
+``conftest.py`` pins ``AAC_INVOKE_AUTH_SECRET_FILE`` to a generated
+secret file BEFORE any agent module is imported — so every agent test
+runs fully authenticated (no test-only opt-out; the production code
+path is what gets exercised). :func:`signed_invoke_post` signs a test
+request with that same env-configured secret, exactly like the paired
+sidecar would.
+
+Std-lib + core only: no FastAPI import, so this module works for any
+httpx-compatible test client.
+"""
+
+from __future__ import annotations
+
+import json
+from typing import Any, Protocol
+
+from aac_invoke_auth import (
+    load_invoke_auth_secret_from_env,
+    sign_invoke_request,
+)
+
+__all__ = [
+    "InvokeSigningClient",
+    "signed_invoke_post",
+    "signing_test_client",
+]
+
+
+class _PostableClient(Protocol):
+    """The slice of TestClient/httpx.Client the helpers need. Kwargs
+    stay open (headers=/json=/content=/...) so both the signing path
+    and the passthrough path type-check against real clients."""
+
+    def post(
+        self, url: str, **kwargs: Any
+    ) -> Any: ...  # pragma: no cover - typing only
+
+
+def signed_invoke_post(
+    client: _PostableClient,
+    *,
+    headers: dict[str, str],
+    json_payload: Any | None = None,
+    content: bytes | None = None,
+    path: str = "/invoke",
+    secret: bytes | None = None,
+) -> Any:
+    """POST a signed request the way the paired sidecar would.
+
+    Exactly one of ``json_payload`` / ``content`` must be given. A
+    ``json_payload`` is serialized ONCE here so the signature and the
+    POST use the exact same bytes — the body digest covers bytes, not
+    JSON semantics. ``headers`` must already contain every X-AAC-*
+    header the request will carry (the canonical block is derived by
+    rule from them); the two auth headers are merged in last, after
+    everything covered is final.
+
+    ``secret`` defaults to the env-configured pairing secret
+    (``AAC_INVOKE_AUTH_SECRET_FILE`` — pinned by the repo-root
+    conftest for the in-repo suites). Pass it explicitly to exercise
+    wrong-secret rejection paths.
+    """
+    if (json_payload is None) == (content is None):
+        raise ValueError(
+            "signed_invoke_post needs exactly one of json_payload= or "
+            "content="
+        )
+    body = (
+        content
+        if content is not None
+        else json.dumps(json_payload).encode("utf-8")
+    )
+    if secret is None:
+        secret = load_invoke_auth_secret_from_env()
+        if secret is None:
+            raise ValueError(
+                "signed_invoke_post found no secret: set "
+                "AAC_INVOKE_AUTH_SECRET_FILE (the repo-root conftest "
+                "does this for the in-repo suites) or pass secret= "
+                "explicitly"
+            )
+    merged = dict(headers)
+    merged.setdefault("Content-Type", "application/json")
+    merged.update(
+        sign_invoke_request(
+            secret=secret,
+            method="POST",
+            path=path,
+            headers=merged,
+            body=body,
+        )
+    )
+    return client.post(path, headers=merged, content=body)
+
+
+class InvokeSigningClient:
+    """Transparent signing wrapper around a TestClient/httpx client.
+
+    ``post()`` calls to a protected path are signed via
+    :func:`signed_invoke_post`; everything else (GETs, posts to other
+    paths, attribute access) passes straight through to the wrapped
+    client. Lets an agent test suite keep its natural
+    ``client.post("/invoke", headers=..., json=...)`` shape while the
+    agent runs fully authenticated behind ``InvokeAuthMiddleware``.
+    """
+
+    def __init__(
+        self,
+        client: _PostableClient,
+        *,
+        protected_paths: tuple[str, ...] = ("/invoke",),
+        secret: bytes | None = None,
+    ) -> None:
+        self._client = client
+        self._protected_paths = frozenset(protected_paths)
+        self._secret = secret
+
+    def post(
+        self,
+        url: str,
+        *,
+        headers: dict[str, str] | None = None,
+        json: Any | None = None,
+        content: bytes | None = None,
+        **kwargs: Any,
+    ) -> Any:
+        if url not in self._protected_paths:
+            return self._client.post(  # type: ignore[call-arg]
+                url, headers=headers, json=json, content=content, **kwargs
+            )
+        if kwargs:
+            raise ValueError(
+                f"InvokeSigningClient.post to protected {url!r} supports "
+                f"only headers=/json=/content=; got {sorted(kwargs)}"
+            )
+        if json is None and content is None:
+            # An intentionally body-less push still gets signed — the
+            # digest of b"" is as good as any.
+            content = b""
+        return signed_invoke_post(
+            self._client,
+            headers=dict(headers or {}),
+            json_payload=json,
+            content=content,
+            path=url,
+            secret=self._secret,
+        )
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._client, name)
+
+
+def signing_test_client(app: Any, **testclient_kwargs: Any) -> InvokeSigningClient:
+    """One-call replacement for ``TestClient(app)`` in agent suites.
+
+    FastAPI's TestClient is imported lazily so this module (and the
+    package) stays importable in environments without the ``fastapi``
+    extra installed.
+    """
+    from fastapi.testclient import TestClient
+
+    return InvokeSigningClient(TestClient(app, **testclient_kwargs))

aac_invoke_auth-0.1.0.dist-info/METADATA

@@ -0,0 +1,147 @@
+Metadata-Version: 2.4
+Name: aac-invoke-auth
+Version: 0.1.0
+Summary: AAC sidecar-to-agent invoke-push authentication (AAC1-HMAC-SHA256) — signing and verification core, with FastAPI mounting surfaces.
+Author: Agent Authority Cloud Project
+License-Expression: Apache-2.0
+Keywords: aac,agent,authorization,hmac,middleware,fastapi,sidecar
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Framework :: FastAPI
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: fastapi
+Requires-Dist: fastapi>=0.115; extra == "fastapi"
+Provides-Extra: test
+Requires-Dist: pytest>=8.0; extra == "test"
+Requires-Dist: fastapi>=0.115; extra == "test"
+Requires-Dist: httpx>=0.28; extra == "test"
+Dynamic: license-file
+
+# aac-invoke-auth
+
+Authenticate `/invoke` pushes from your paired AAC sidecar.
+
+When your agent runs behind an AAC sidecar, the sidecar verifies the
+cross-organizational authority chain and then POSTs the verified context
+to your agent's `/invoke` endpoint. The `X-AAC-*` headers on that push
+are your agent's **entire view** of the verified chain — so your agent
+must be able to tell a genuine sidecar push from a forged one. This
+package is that check: the sidecar HMAC-signs every push with a pairing
+secret shared with exactly one agent, and your agent verifies the
+signature before trusting anything.
+
+The verification core is standard-library only (`hmac`, `hashlib`) and
+framework-agnostic. FastAPI mounting surfaces ship behind an extra:
+
+```bash
+pip install aac-invoke-auth[fastapi]
+```
+
+## Quick start (FastAPI)
+
+Generate the pairing secret once and share the file with your sidecar
+(the sidecar's `sidecar.agent_invoke_auth.secret_file` points at the
+same file; one secret per sidecar–agent pair, never shared across
+pairs):
+
+```bash
+openssl rand -hex 32 > /etc/aac/invoke-auth/invoke-auth.secret
+```
+
+Point your agent at it and mount the middleware:
+
+```bash
+export AAC_INVOKE_AUTH_SECRET_FILE=/etc/aac/invoke-auth/invoke-auth.secret
+```
+
+```python
+from fastapi import FastAPI
+from aac_invoke_auth.fastapi import InvokeAuthGuard, InvokeAuthMiddleware
+
+app = FastAPI()
+app.add_middleware(
+    InvokeAuthMiddleware,
+    guard=InvokeAuthGuard.from_env(),
+    protected_paths=("/invoke",),   # required, exact-match
+)
+```
+
+That's the whole integration. Unsigned, tampered, replayed-stale, or
+wrong-secret pushes get a `401` with a generic detail and never reach
+your business logic; your handlers read `request.json()` unchanged.
+
+Prefer route-scoped protection? The guard is also a plain FastAPI
+dependency:
+
+```python
+from fastapi import Depends
+
+guard = InvokeAuthGuard.from_env()
+
+@app.post("/invoke", dependencies=[Depends(guard)])
+async def invoke(request: Request): ...
+```
+
+Both surfaces call the same verifier — pick whichever fits your app.
+
+## Fail-fast startup, by design
+
+`InvokeAuthGuard.from_env()` **refuses to start** when
+`AAC_INVOKE_AUTH_SECRET_FILE` is unset. A missing secret is a security
+downgrade; it should fail your deployment loudly at boot, not degrade
+into a log line nobody reads.
+
+The single escape hatch — for extraordinary cases only, such as tenant
+test/pilot environments or debugging a suspected signing mismatch — is
+setting
+
+```bash
+export AAC_INVOKE_AUTH_ALLOW_UNAUTHENTICATED=true
+```
+
+explicitly (only the exact value `true`; a typo still fails the boot).
+An opted-out agent accepts every push unverified and logs a prominent
+warning at startup so the posture is visible in your logs. Never run
+this in production: the sidecar side has a symmetric `dev_mode`
+interlock, and both exist to make "unauthenticated" impossible to reach
+by accident.
+
+## Testing your agent
+
+`aac_invoke_auth.testing` ships with the package:
+
+```python
+from aac_invoke_auth.testing import signing_test_client
+
+client = signing_test_client(app)          # wraps FastAPI's TestClient
+response = client.post("/invoke", headers=aac_headers, json=payload)
+```
+
+`post()` calls to protected paths are signed exactly the way the paired
+sidecar signs them (secret read from `AAC_INVOKE_AUTH_SECRET_FILE`);
+everything else passes through. So your test suite exercises the real
+production verification path instead of opting out of it.
+
+## Wire format
+
+`AAC1-HMAC-SHA256` over method, path, timestamp, a SHA-256 body digest,
+and every `X-AAC-*` header (derived by rule, so header
+insertion/removal after signing fails verification). Freshness window
+±30s. The normative canonicalization text lives in the AAC Engineering
+Specification §III.2.4a; frozen known-answer vectors live in this
+package's test suite — a change that breaks a vector is a wire-format
+break, not a refactor.
+
+Ports of this middleware for other stacks (Express, Spring, Go
+net/http) follow the same model; the core stays standard-library-only
+in every language precisely to keep those ports mechanical.

aac_invoke_auth-0.1.0.dist-info/RECORD

@@ -0,0 +1,9 @@
+aac_invoke_auth/__init__.py,sha256=OWoh1mV278Vf4oiOuG2_qqmOLfYyAQfPeLRQo_sxNpY,14326
+aac_invoke_auth/fastapi.py,sha256=wVT6VVeEeZQ1FcRpOZxj4JbRElgdxExRZDSvwy7UlnI,14979
+aac_invoke_auth/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+aac_invoke_auth/testing.py,sha256=owAOpGd_IM1em6FOX5M_GMyCwSGdSFFgKdQ4-F3PFWU,5816
+aac_invoke_auth-0.1.0.dist-info/licenses/LICENSE,sha256=DVQuDIgE45qn836wDaWnYhSdxoLXgpRRKH4RuTjpRZQ,10174
+aac_invoke_auth-0.1.0.dist-info/METADATA,sha256=g5ic6fO8704qg6wGGHo4MpzaCsX8cvH9CqacIlxD9uo,5256
+aac_invoke_auth-0.1.0.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
+aac_invoke_auth-0.1.0.dist-info/top_level.txt,sha256=xuiAqCukQDD7NOO1LoPAoHYv2cH2nCTk3mFEg7Ve3I4,16
+aac_invoke_auth-0.1.0.dist-info/RECORD,,

aac_invoke_auth-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (83.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

aac_invoke_auth-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,177 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS

aac_invoke_auth-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+aac_invoke_auth