agios-auth-verify 1.0.0__tar.gz

agios_auth_verify-1.0.0/PKG-INFO

@@ -0,0 +1,61 @@
+Metadata-Version: 2.4
+Name: agios-auth-verify
+Version: 1.0.0
+Summary: FastAPI dependency that verifies a user's RBAC permission against the auth-service
+License-Expression: ISC
+Project-URL: Repository, https://github.com/AGIOS-AI-RT/auth-verify-python
+Keywords: fastapi,rbac,authorization,permissions,auth,middleware
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: fastapi>=0.100
+Requires-Dist: httpx>=0.24
+
+# agios-auth-verify
+
+FastAPI dependency that verifies a user's RBAC permission by calling
+`POST {AUTH_SERVICE_URL}/api/auth/check-permission`.
+
+## Install
+
+```bash
+pip install agios-auth-verify
+```
+
+Requires `fastapi` and `httpx`. Set `AUTH_SERVICE_URL` in the environment
+(e.g. `http://127.0.0.1:8000`).
+
+## Usage
+
+```python
+from fastapi import Depends, FastAPI
+from auth_verify import authorize
+
+app = FastAPI()
+
+# An upstream middleware must set `request.state.user`
+# (a dict or object with `userId`, optionally `tenantId`).
+
+@app.delete("/users/{user_id}", dependencies=[Depends(authorize("users:delete"))])
+async def delete_user(user_id: str):
+    return {"ok": True}
+```
+
+The request forwards the incoming `Authorization` header and a `tenant-id`
+header (`user["tenantId"]`, falling back to the request's `tenant-id` header)
+to the auth-service, and sends `{"userId": ..., "permissionKey": ...}` as the body.
+
+## Responses
+
+Raises `fastapi.HTTPException` with body `{"success": false, "message": ...}`:
+
+| Status | When                                                          |
+| ------ | ----------------------------------------------------------- |
+| `401`  | No authenticated user, or the auth-service returns 401       |
+| `403`  | The auth-service responds with `allowed: false`             |
+| `503`  | The auth-service is unreachable or errors                   |
+
+## Build
+
+```bash
+python -m build
+```

agios_auth_verify-1.0.0/README.md

@@ -0,0 +1,49 @@
+# agios-auth-verify
+
+FastAPI dependency that verifies a user's RBAC permission by calling
+`POST {AUTH_SERVICE_URL}/api/auth/check-permission`.
+
+## Install
+
+```bash
+pip install agios-auth-verify
+```
+
+Requires `fastapi` and `httpx`. Set `AUTH_SERVICE_URL` in the environment
+(e.g. `http://127.0.0.1:8000`).
+
+## Usage
+
+```python
+from fastapi import Depends, FastAPI
+from auth_verify import authorize
+
+app = FastAPI()
+
+# An upstream middleware must set `request.state.user`
+# (a dict or object with `userId`, optionally `tenantId`).
+
+@app.delete("/users/{user_id}", dependencies=[Depends(authorize("users:delete"))])
+async def delete_user(user_id: str):
+    return {"ok": True}
+```
+
+The request forwards the incoming `Authorization` header and a `tenant-id`
+header (`user["tenantId"]`, falling back to the request's `tenant-id` header)
+to the auth-service, and sends `{"userId": ..., "permissionKey": ...}` as the body.
+
+## Responses
+
+Raises `fastapi.HTTPException` with body `{"success": false, "message": ...}`:
+
+| Status | When                                                          |
+| ------ | ----------------------------------------------------------- |
+| `401`  | No authenticated user, or the auth-service returns 401       |
+| `403`  | The auth-service responds with `allowed: false`             |
+| `503`  | The auth-service is unreachable or errors                   |
+
+## Build
+
+```bash
+python -m build
+```

agios_auth_verify-1.0.0/pyproject.toml

@@ -0,0 +1,22 @@
+[build-system]
+requires = ["setuptools>=77", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "agios-auth-verify"
+version = "1.0.0"
+description = "FastAPI dependency that verifies a user's RBAC permission against the auth-service"
+readme = "README.md"
+requires-python = ">=3.9"
+license = "ISC"
+keywords = ["fastapi", "rbac", "authorization", "permissions", "auth", "middleware"]
+dependencies = [
+    "fastapi>=0.100",
+    "httpx>=0.24",
+]
+
+[project.urls]
+Repository = "https://github.com/AGIOS-AI-RT/auth-verify-python"
+
+[tool.setuptools.packages.find]
+where = ["src"]

agios_auth_verify-1.0.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

agios_auth_verify-1.0.0/src/agios_auth_verify.egg-info/PKG-INFO

@@ -0,0 +1,61 @@
+Metadata-Version: 2.4
+Name: agios-auth-verify
+Version: 1.0.0
+Summary: FastAPI dependency that verifies a user's RBAC permission against the auth-service
+License-Expression: ISC
+Project-URL: Repository, https://github.com/AGIOS-AI-RT/auth-verify-python
+Keywords: fastapi,rbac,authorization,permissions,auth,middleware
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: fastapi>=0.100
+Requires-Dist: httpx>=0.24
+
+# agios-auth-verify
+
+FastAPI dependency that verifies a user's RBAC permission by calling
+`POST {AUTH_SERVICE_URL}/api/auth/check-permission`.
+
+## Install
+
+```bash
+pip install agios-auth-verify
+```
+
+Requires `fastapi` and `httpx`. Set `AUTH_SERVICE_URL` in the environment
+(e.g. `http://127.0.0.1:8000`).
+
+## Usage
+
+```python
+from fastapi import Depends, FastAPI
+from auth_verify import authorize
+
+app = FastAPI()
+
+# An upstream middleware must set `request.state.user`
+# (a dict or object with `userId`, optionally `tenantId`).
+
+@app.delete("/users/{user_id}", dependencies=[Depends(authorize("users:delete"))])
+async def delete_user(user_id: str):
+    return {"ok": True}
+```
+
+The request forwards the incoming `Authorization` header and a `tenant-id`
+header (`user["tenantId"]`, falling back to the request's `tenant-id` header)
+to the auth-service, and sends `{"userId": ..., "permissionKey": ...}` as the body.
+
+## Responses
+
+Raises `fastapi.HTTPException` with body `{"success": false, "message": ...}`:
+
+| Status | When                                                          |
+| ------ | ----------------------------------------------------------- |
+| `401`  | No authenticated user, or the auth-service returns 401       |
+| `403`  | The auth-service responds with `allowed: false`             |
+| `503`  | The auth-service is unreachable or errors                   |
+
+## Build
+
+```bash
+python -m build
+```

agios_auth_verify-1.0.0/src/agios_auth_verify.egg-info/SOURCES.txt

@@ -0,0 +1,9 @@
+README.md
+pyproject.toml
+src/agios_auth_verify.egg-info/PKG-INFO
+src/agios_auth_verify.egg-info/SOURCES.txt
+src/agios_auth_verify.egg-info/dependency_links.txt
+src/agios_auth_verify.egg-info/requires.txt
+src/agios_auth_verify.egg-info/top_level.txt
+src/auth_verify/__init__.py
+src/auth_verify/authorize.py

agios_auth_verify-1.0.0/src/agios_auth_verify.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

agios_auth_verify-1.0.0/src/agios_auth_verify.egg-info/requires.txt

@@ -0,0 +1,2 @@
+fastapi>=0.100
+httpx>=0.24

agios_auth_verify-1.0.0/src/agios_auth_verify.egg-info/top_level.txt

@@ -0,0 +1 @@
+auth_verify

agios_auth_verify-1.0.0/src/auth_verify/__init__.py

@@ -0,0 +1,4 @@
+from .authorize import authorize
+
+__all__ = ["authorize"]
+__version__ = "1.0.0"

agios_auth_verify-1.0.0/src/auth_verify/authorize.py

@@ -0,0 +1,48 @@
+import os
+
+import httpx
+from fastapi import HTTPException, Request
+
+AUTH_SERVICE_URL = os.environ.get("AUTH_SERVICE_URL", "")
+
+
+def authorize(required_permission: str):
+    async def middleware(request: Request) -> None:
+        user = getattr(request.state, "user", None)
+        user_id = (user or {}).get("userId") if isinstance(user, dict) else getattr(user, "userId", None)
+        if not user_id:
+            raise HTTPException(status_code=401, detail={"success": False, "message": "Authentication required"})
+
+        tenant_id = None
+        if isinstance(user, dict):
+            tenant_id = user.get("tenantId")
+        elif user is not None:
+            tenant_id = getattr(user, "tenantId", None)
+
+        try:
+            async with httpx.AsyncClient() as client:
+                response = await client.post(
+                    f"{AUTH_SERVICE_URL}/api/auth/check-permission",
+                    json={"userId": user_id, "permissionKey": required_permission},
+                    headers={
+                        "Authorization": request.headers.get("authorization", ""),
+                        "tenant-id": tenant_id or request.headers.get("tenant-id", ""),
+                    },
+                )
+                response.raise_for_status()
+
+            if not response.json().get("allowed"):
+                raise HTTPException(
+                    status_code=403,
+                    detail={"success": False, "message": "You do not have permission to perform this action"},
+                )
+        except HTTPException:
+            raise
+        except httpx.HTTPStatusError as error:
+            if error.response.status_code == 401:
+                raise HTTPException(status_code=401, detail={"success": False, "message": "Authentication required"})
+            raise HTTPException(status_code=503, detail={"success": False, "message": "Authorization service unavailable"})
+        except httpx.RequestError:
+            raise HTTPException(status_code=503, detail={"success": False, "message": "Authorization service unavailable"})
+
+    return middleware