authx-identity 0.1.0rc1__tar.gz

authx_identity-0.1.0rc1/LICENSE

@@ -0,0 +1,22 @@
+
+MIT License
+
+Copyright (c) 2026 codefleet chandrashekhar-bhosale
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

authx_identity-0.1.0rc1/PKG-INFO

@@ -0,0 +1,156 @@
+Metadata-Version: 2.4
+Name: authx-identity
+Version: 0.1.0rc1
+Summary: Standalone OIDC identity microservice and client library for DjangoPlay and Python applications.
+Author: CodeFleet Labs
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/codefleetx/authx
+Project-URL: Repository, https://github.com/codefleetx/authx
+Project-URL: Issues, https://github.com/codefleetx/authx/issues
+Keywords: authx,oidc,oauth2,identity,authentication,jwt,fastapi,microservice,djangoplay
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Framework :: FastAPI
+Classifier: Environment :: Web Environment
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: fastapi>=0.111.0
+Requires-Dist: uvicorn[standard]>=0.29.0
+Requires-Dist: sqlalchemy>=2.0.0
+Requires-Dist: alembic>=1.13.0
+Requires-Dist: asyncpg>=0.29.0
+Requires-Dist: psycopg2-binary>=2.9.0
+Requires-Dist: passlib[bcrypt]>=1.7.4
+Requires-Dist: python-jose[cryptography]>=3.3.0
+Requires-Dist: cryptography>=42.0.0
+Requires-Dist: python-multipart>=0.0.9
+Requires-Dist: pydantic>=2.7.0
+Requires-Dist: pydantic-settings>=2.2.0
+Requires-Dist: email-validator>=2.0.0
+Requires-Dist: httpx>=0.27.0
+Requires-Dist: python-dotenv>=1.0.0
+Requires-Dist: structlog>=24.1.0
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: pytest-asyncio>=0.23.0; extra == "dev"
+Requires-Dist: pytest-cov>=5.0.0; extra == "dev"
+Requires-Dist: aiosqlite>=0.20.0; extra == "dev"
+Requires-Dist: ruff>=0.4.0; extra == "dev"
+Requires-Dist: build>=1.2.0; extra == "dev"
+Requires-Dist: twine>=5.0.0; extra == "dev"
+Dynamic: license-file
+
+# AuthX
+<p align="left">
+  Maintained by 
+  <img
+    src="static/logo/dp/icon.svg"
+    alt="DjangoPlay Icon"
+    width="20"
+    valign="middle"
+  />
+  <img
+    src="static/logo/dp/name.svg"
+    alt="DjangoPlay"
+    width="72"
+    valign="middle"
+  />
+</p>
+<a href="https://djangoplay.org">https://djangoplay.org</a>
+
+## 
+
+![Python](https://img.shields.io/pypi/pyversions/authx)
+![License](https://img.shields.io/badge/license-MIT-green)
+
+Standalone OIDC identity microservice for codefleetx applications.
+
+## What it does
+
+AuthX is a standards-compliant OpenID Connect (OIDC) identity provider built with FastAPI. It:
+
+- Issues signed JWT access tokens and refresh tokens
+- Exposes public OIDC endpoints (`/token`, `/userinfo`, `/jwks`, `/.well-known/openid-configuration`)
+- Exposes an internal API (`/internal/identities`) for trusted services (e.g. DjangoPlay) to create and look up identities
+- Supports email/password and SSO (Google, Apple) identity providers
+- Is stateless and horizontally scalable
+
+## Architecture
+
+```
+┌──────────────────────────────────────┐
+│  Client (browser, mobile, CLI)       │
+│  → POST /token (login)               │
+│  → GET  /userinfo (who am I?)        │
+└────────────────┬─────────────────────┘
+                 │ JWT
+     ┌───────────▼──────────────────┐
+     │         AuthX                │
+     │  FastAPI + PostgreSQL        │
+     │  Issues & validates JWTs     │
+     └───────────┬──────────────────┘
+                 │ Internal API (service token)
+     ┌───────────▼──────────────────┐
+     │       DjangoPlay             │
+     │  Trusts AuthX JWTs           │
+     │  Owns EmploymentProfile      │
+     │  Owns MemberProfile          │
+     └──────────────────────────────┘
+```
+
+## Endpoints
+
+### Public OIDC
+| Method | Path | Description |
+|--------|------|-------------|
+| GET | `/.well-known/openid-configuration` | OIDC discovery document |
+| GET | `/jwks` | Public keys for JWT verification |
+| POST | `/token` | Issue access + refresh token |
+| POST | `/token/refresh` | Refresh access token |
+| GET | `/userinfo` | Get identity info from token |
+
+### Internal (service token required)
+| Method | Path | Description |
+|--------|------|-------------|
+| POST | `/internal/identities` | Create identity |
+| GET | `/internal/identities/{id}` | Get identity by ID |
+| GET | `/internal/identities/by-email/{email}` | Lookup by email |
+| GET | `/internal/identities/by-sso` | Lookup by SSO provider + ID |
+| PATCH | `/internal/identities/{id}` | Update identity fields |
+| DELETE | `/internal/identities/{id}` | Soft delete identity |
+
+## Running locally
+
+```bash
+cp .env.example .env
+# fill in values
+
+docker compose up
+```
+
+Migrations run automatically on startup.
+
+## Running in production
+
+```bash
+docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
+```
+
+## Environment variables
+
+See `.env.example` for all required variables.
+
+## JWT verification (for consumers)
+
+Consumers (DjangoPlay, etc.) should:
+1. Fetch public keys from `/jwks` on startup (cache them)
+2. Verify JWT signatures locally — no AuthX call needed per request
+3. Only call `/userinfo` for server-to-server lookups without a JWT in hand

authx_identity-0.1.0rc1/README.md

@@ -0,0 +1,106 @@
+# AuthX
+<p align="left">
+  Maintained by 
+  <img
+    src="static/logo/dp/icon.svg"
+    alt="DjangoPlay Icon"
+    width="20"
+    valign="middle"
+  />
+  <img
+    src="static/logo/dp/name.svg"
+    alt="DjangoPlay"
+    width="72"
+    valign="middle"
+  />
+</p>
+<a href="https://djangoplay.org">https://djangoplay.org</a>
+
+## 
+
+![Python](https://img.shields.io/pypi/pyversions/authx)
+![License](https://img.shields.io/badge/license-MIT-green)
+
+Standalone OIDC identity microservice for codefleetx applications.
+
+## What it does
+
+AuthX is a standards-compliant OpenID Connect (OIDC) identity provider built with FastAPI. It:
+
+- Issues signed JWT access tokens and refresh tokens
+- Exposes public OIDC endpoints (`/token`, `/userinfo`, `/jwks`, `/.well-known/openid-configuration`)
+- Exposes an internal API (`/internal/identities`) for trusted services (e.g. DjangoPlay) to create and look up identities
+- Supports email/password and SSO (Google, Apple) identity providers
+- Is stateless and horizontally scalable
+
+## Architecture
+
+```
+┌──────────────────────────────────────┐
+│  Client (browser, mobile, CLI)       │
+│  → POST /token (login)               │
+│  → GET  /userinfo (who am I?)        │
+└────────────────┬─────────────────────┘
+                 │ JWT
+     ┌───────────▼──────────────────┐
+     │         AuthX                │
+     │  FastAPI + PostgreSQL        │
+     │  Issues & validates JWTs     │
+     └───────────┬──────────────────┘
+                 │ Internal API (service token)
+     ┌───────────▼──────────────────┐
+     │       DjangoPlay             │
+     │  Trusts AuthX JWTs           │
+     │  Owns EmploymentProfile      │
+     │  Owns MemberProfile          │
+     └──────────────────────────────┘
+```
+
+## Endpoints
+
+### Public OIDC
+| Method | Path | Description |
+|--------|------|-------------|
+| GET | `/.well-known/openid-configuration` | OIDC discovery document |
+| GET | `/jwks` | Public keys for JWT verification |
+| POST | `/token` | Issue access + refresh token |
+| POST | `/token/refresh` | Refresh access token |
+| GET | `/userinfo` | Get identity info from token |
+
+### Internal (service token required)
+| Method | Path | Description |
+|--------|------|-------------|
+| POST | `/internal/identities` | Create identity |
+| GET | `/internal/identities/{id}` | Get identity by ID |
+| GET | `/internal/identities/by-email/{email}` | Lookup by email |
+| GET | `/internal/identities/by-sso` | Lookup by SSO provider + ID |
+| PATCH | `/internal/identities/{id}` | Update identity fields |
+| DELETE | `/internal/identities/{id}` | Soft delete identity |
+
+## Running locally
+
+```bash
+cp .env.example .env
+# fill in values
+
+docker compose up
+```
+
+Migrations run automatically on startup.
+
+## Running in production
+
+```bash
+docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
+```
+
+## Environment variables
+
+See `.env.example` for all required variables.
+
+## JWT verification (for consumers)
+
+Consumers (DjangoPlay, etc.) should:
+1. Fetch public keys from `/jwks` on startup (cache them)
+2. Verify JWT signatures locally — no AuthX call needed per request
+3. Only call `/userinfo` for server-to-server lookups without a JWT in hand

authx_identity-0.1.0rc1/authx/api/deps.py

@@ -0,0 +1,59 @@
+from __future__ import annotations
+
+import uuid
+
+from fastapi import Depends, Header, HTTPException, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+from jose import JWTError
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from authx.core.security import decode_token
+from authx.core.settings import get_settings
+from authx.db.session import get_db
+from authx.models.user_identity import UserIdentity
+from authx.services.identity_service import IdentityNotFoundError, IdentityService
+
+bearer_scheme = HTTPBearer()
+
+
+async def require_internal_token(
+    x_service_token: str = Header(..., alias="X-Service-Token"),
+) -> None:
+    """Guard for /internal/* endpoints. DjangoPlay must send X-Service-Token header."""
+    if x_service_token != get_settings().internal_service_token:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Invalid service token.")
+
+
+async def get_current_identity(
+    credentials: HTTPAuthorizationCredentials = Depends(bearer_scheme),
+    db: AsyncSession = Depends(get_db),
+) -> UserIdentity:
+    """Decode Bearer JWT and return the UserIdentity. Used by /userinfo."""
+    exc = HTTPException(
+        status_code=status.HTTP_401_UNAUTHORIZED,
+        detail="Invalid or expired token.",
+        headers={"WWW-Authenticate": "Bearer"},
+    )
+    try:
+        payload = decode_token(credentials.credentials)
+    except JWTError:
+        raise exc
+
+    if payload.get("type") != "access":
+        raise exc
+
+    try:
+        identity_id = uuid.UUID(payload["sub"])
+    except (KeyError, ValueError):
+        raise exc
+
+    service = IdentityService(db)
+    try:
+        identity = await service.get_by_id(identity_id)
+    except IdentityNotFoundError:
+        raise exc
+
+    if not identity.is_active:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Account is inactive.")
+
+    return identity

authx_identity-0.1.0rc1/authx/api/v1/endpoints/oidc.py

@@ -0,0 +1,76 @@
+"""Public OIDC endpoints: discovery, JWKS, token, refresh, userinfo."""
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from authx.api.deps import get_current_identity
+from authx.core.security import get_jwks
+from authx.core.settings import get_settings
+from authx.db.session import get_db
+from authx.models.user_identity import UserIdentity
+from authx.schemas.identity import (
+    IdentityPublicResponse,
+    JWKSResponse,
+    RefreshRequest,
+    TokenRequest,
+    TokenResponse,
+)
+from authx.services.identity_service import IdentityService, InvalidCredentialsError, TokenError
+
+router = APIRouter(tags=["OIDC"])
+
+
+@router.get("/.well-known/openid-configuration")
+async def openid_configuration():
+    s = get_settings()
+    base = s.app_base_url.rstrip("/")
+    return {
+        "issuer": s.jwt_issuer,
+        "token_endpoint": f"{base}/token",
+        "userinfo_endpoint": f"{base}/userinfo",
+        "jwks_uri": f"{base}/jwks",
+        "response_types_supported": ["token"],
+        "subject_types_supported": ["public"],
+        "id_token_signing_alg_values_supported": [s.jwt_algorithm],
+        "scopes_supported": ["openid", "email", "profile"],
+        "grant_types_supported": ["password", "refresh_token"],
+    }
+
+
+@router.get("/jwks", response_model=JWKSResponse)
+async def jwks():
+    """Public keys for JWT verification. Consumers cache this on startup."""
+    return get_jwks()
+
+
+@router.post("/token", response_model=TokenResponse)
+async def token(data: TokenRequest, db: AsyncSession = Depends(get_db)):
+    """Issue access + refresh tokens (email/password login)."""
+    try:
+        return await IdentityService(db).authenticate(data.email, data.password)
+    except InvalidCredentialsError as e:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=str(e),
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+
+@router.post("/token/refresh", response_model=TokenResponse)
+async def token_refresh(data: RefreshRequest, db: AsyncSession = Depends(get_db)):
+    """Rotate refresh token and issue a new access + refresh pair."""
+    try:
+        return await IdentityService(db).refresh(data.refresh_token)
+    except TokenError as e:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail=str(e))
+
+
+@router.get("/userinfo", response_model=IdentityPublicResponse)
+async def userinfo(identity: UserIdentity = Depends(get_current_identity)):
+    """Standard OIDC /userinfo endpoint."""
+    return IdentityPublicResponse(
+        sub=str(identity.id),
+        email=identity.email,
+        email_verified=identity.is_verified,
+        preferred_username=identity.username,
+    )

authx_identity-0.1.0rc1/authx/api/v1/internal/identities.py

@@ -0,0 +1,142 @@
+"""
+Internal API — service-to-service endpoints.
+
+All routes require X-Service-Token header.
+DjangoPlay calls these to create, lookup, and update identities.
+
+These are NOT public OIDC endpoints. They are a private contract
+between AuthX and trusted backend services.
+"""
+
+from __future__ import annotations
+
+import uuid
+
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from authx.api.deps import require_internal_token
+from authx.db.session import get_db
+from authx.schemas.identity import (
+    IdentityCreateRequest,
+    IdentityResponse,
+    IdentityUpdateRequest,
+)
+from authx.services.identity_service import (
+    IdentityAlreadyExistsError,
+    IdentityNotFoundError,
+    IdentityService,
+)
+
+router = APIRouter(
+    prefix="/internal/identities",
+    tags=["Internal"],
+    dependencies=[Depends(require_internal_token)],
+)
+
+
+def _service(db: AsyncSession = Depends(get_db)) -> IdentityService:
+    return IdentityService(db)
+
+
+# ------------------------------------------------------------------
+# Create
+# ------------------------------------------------------------------
+
+@router.post("", response_model=IdentityResponse, status_code=status.HTTP_201_CREATED)
+async def create_identity(
+    data: IdentityCreateRequest,
+    service: IdentityService = Depends(_service),
+):
+    """
+    Create a new UserIdentity.
+
+    Called by DjangoPlay when:
+    - Admin creates an Employee (→ EmploymentProfile)
+    - Social signup creates a Member (→ MemberProfile)
+    """
+    try:
+        identity = await service.create(data)
+        return identity
+    except IdentityAlreadyExistsError as e:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail=str(e),
+        )
+
+
+# ------------------------------------------------------------------
+# Read — by ID
+# ------------------------------------------------------------------
+
+@router.get("/{identity_id}", response_model=IdentityResponse)
+async def get_identity(
+    identity_id: uuid.UUID,
+    service: IdentityService = Depends(_service),
+):
+    try:
+        return await service.get_by_id(identity_id)
+    except IdentityNotFoundError as e:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(e))
+
+
+# ------------------------------------------------------------------
+# Read — by email
+# ------------------------------------------------------------------
+
+@router.get("/by-email/{email}", response_model=IdentityResponse)
+async def get_identity_by_email(
+    email: str,
+    service: IdentityService = Depends(_service),
+):
+    try:
+        return await service.get_by_email(email)
+    except IdentityNotFoundError as e:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(e))
+
+
+# ------------------------------------------------------------------
+# Read — by SSO provider + ID
+# ------------------------------------------------------------------
+
+@router.get("/by-sso/lookup", response_model=IdentityResponse)
+async def get_identity_by_sso(
+    provider: str = Query(..., description="SSO provider code: GOOGLE | APPLE"),
+    sso_id: str = Query(..., description="Provider-issued UID"),
+    service: IdentityService = Depends(_service),
+):
+    try:
+        return await service.get_by_sso(provider, sso_id)
+    except IdentityNotFoundError as e:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(e))
+
+
+# ------------------------------------------------------------------
+# Update
+# ------------------------------------------------------------------
+
+@router.patch("/{identity_id}", response_model=IdentityResponse)
+async def update_identity(
+    identity_id: uuid.UUID,
+    data: IdentityUpdateRequest,
+    service: IdentityService = Depends(_service),
+):
+    try:
+        return await service.update(identity_id, data)
+    except IdentityNotFoundError as e:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(e))
+
+
+# ------------------------------------------------------------------
+# Soft delete
+# ------------------------------------------------------------------
+
+@router.delete("/{identity_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_identity(
+    identity_id: uuid.UUID,
+    service: IdentityService = Depends(_service),
+):
+    try:
+        await service.soft_delete(identity_id)
+    except IdentityNotFoundError as e:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(e))

authx_identity-0.1.0rc1/authx/core/logging.py

@@ -0,0 +1,37 @@
+import logging
+import sys
+
+import structlog
+
+
+def configure_logging(is_production: bool = False) -> None:
+    shared_processors = [
+        structlog.contextvars.merge_contextvars,
+        structlog.stdlib.add_logger_name,
+        structlog.stdlib.add_log_level,
+        structlog.processors.TimeStamper(fmt="iso"),
+        structlog.processors.StackInfoRenderer(),
+    ]
+
+    if is_production:
+        processors = [*shared_processors, structlog.processors.JSONRenderer()]
+    else:
+        processors = [*shared_processors, structlog.dev.ConsoleRenderer(colors=True)]
+
+    structlog.configure(
+        processors=processors,
+        wrapper_class=structlog.stdlib.BoundLogger,
+        context_class=dict,
+        logger_factory=structlog.stdlib.LoggerFactory(),
+        cache_logger_on_first_use=True,
+    )
+
+    handler = logging.StreamHandler(sys.stdout)
+    root_logger = logging.getLogger()
+    root_logger.handlers = [handler]
+    root_logger.setLevel(logging.INFO)
+    logging.getLogger("uvicorn.access").setLevel(logging.WARNING)
+
+
+def get_logger(name: str):
+    return structlog.get_logger(name)