buntu 0.1.0__py3-none-any.whl

buntu-0.1.0.dist-info/METADATA

@@ -0,0 +1,141 @@
+Metadata-Version: 2.4
+Name: buntu
+Version: 0.1.0
+Summary: OAuth 2.1 and OpenID Connect provider
+Author: Ibrahima Touré
+License-Expression: MIT
+Project-URL: Source, https://github.com/buntubi/buntu
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: flask>=3.1
+Requires-Dist: authlib<1.9,>=1.8
+Requires-Dist: sqlalchemy>=2.0.36
+Requires-Dist: alembic>=1.14
+Requires-Dist: psycopg[binary]>=3.2
+Requires-Dist: pydantic-settings>=2.6
+Requires-Dist: flask-limiter>=3.8
+Requires-Dist: requests>=2.32
+Requires-Dist: segno>=1.6
+Requires-Dist: email-validator>=2.2
+Requires-Dist: webauthn<4,>=3.0
+Requires-Dist: cryptography>=44
+Requires-Dist: joserfc<2,>=1.7
+Requires-Dist: gunicorn>=23
+Provides-Extra: dev
+Requires-Dist: pytest>=8.3; extra == "dev"
+Requires-Dist: ruff>=0.8; extra == "dev"
+Requires-Dist: mypy>=1.13; extra == "dev"
+Requires-Dist: openapi-spec-validator>=0.7; extra == "dev"
+Requires-Dist: jsonschema>=4.23; extra == "dev"
+Dynamic: license-file
+
+# The provider
+
+The OAuth 2.1 and OpenID Connect server, in Flask. It owns every account, every session and
+every token on the platform, and every rule about who may do what. The console, the portal and
+the sign-in pages hold no rules of their own: they call this server and show what it answers.
+
+Setup, deployment and the platform's concepts (accounts, organizations, apps, the catalogue) are
+in the [repository README](../README.md). Plugins are in [docs/plugins.md](../docs/plugins.md).
+
+## What it serves
+
+| Prefix | Who calls it | What |
+|---|---|---|
+| `/.well-known/openid-configuration`, `/.well-known/jwks.json` | Any client | Discovery and the signing keys |
+| `/.well-known/brand.json` | The console and the portal | The platform's name, colour and links |
+| `/oauth/*` | OAuth clients | `authorize`, `token`, `revoke`, `introspect`, `device_authorization`, `userinfo`, `logout`, `check-session` |
+| `/signin`, `/signup`, `/mfa`, `/consent`, `/accounts`, `/account/*`, ... | People, in a browser | The pages built from `frontend/`, rendered into `templates/shell.html` |
+| `/api/*` | Those pages | Sign-in steps, the account area, passkeys. Same-site, with a CSRF token |
+| `/developer/api/*` | The portal | Organizations, members, apps, secrets, test users, API keys. Bearer token with the `developer` scope |
+| `/admin/api/*` | The console | Users, organizations, reviews, the catalogue, the platform's apps. Bearer token with the `admin` scope and a two-step sign-in |
+| `/api/plugins/<id>/*` | Plugin pages in the console and portal | Each plugin's own API |
+| `/openapi.json` | Developers, Postman | The OAuth endpoints, the developer API and the admin API |
+
+Grants: authorization code with PKCE, refresh token (rotated, with reuse detection), client
+credentials, and the device code. Tokens are JWTs signed with the newest key in
+`IDP_SIGNING_KEYS_DIR`; every key in the directory still verifies.
+
+Sessions end everywhere they reached: a sign-out, a device signed out from the account area,
+or a deleted account sends an OpenID back-channel logout token to every app with a
+`backchannel_logout_uri` that took part in that session.
+
+## Layout
+
+```
+src/idp/
+  app.py          create_app: settings, extensions, blueprints, plugins
+  config.py       every setting, read from IDP_* variables and .env
+  cli.py          the flask commands
+  models/         SQLAlchemy models
+  db/             the session and utcnow
+  oauth/          Authlib server, grants, claims, JWT helpers
+  security/       passwords, TOTP, CSRF, signing keys, encryption at rest
+  services/       the rules: accounts, sessions, MFA, passkeys, platform, profile, ...
+  web/            the blueprints: pages, api, developer, admin, oidc, openapi
+  plugins/        the plugin interface and the catalogue sync
+  templates/      the page shell
+  static/idp/     the built sign-in pages (from frontend/, not edited here)
+migrations/       Alembic revisions
+tests/            pytest, against a real PostgreSQL database
+platform.example.toml   the platform's apps, copied to platform.toml per deployment
+```
+
+The rule of thumb when changing something: a view in `web/` parses the request and shapes the
+answer; the decision lives in `services/`. A rule that two endpoints share is one function in a
+service, never two copies in two views.
+
+## Commands
+
+Run from `idp/` as `../.venv/bin/flask --app idp.app:create_app <command>`.
+
+| Command | Does |
+|---|---|
+| `keys generate` | Adds a signing key; the newest signs from then on |
+| `admin create`, `admin check` | Creates the superadmin; checks one exists |
+| `users admins`, `users promote`, `users demote` | Lists admins; gives or takes the admin role |
+| `users delete <pattern> --yes` | Deletes accounts by email (a `*` pattern works), as deleting from the account page does: apps are signed out, plugins told, the audit trail kept without who it was |
+| `prune` | Deletes expired codes and tokens, sign-ins ended more than `IDP_SESSION_RETENTION_DAYS` ago and audit rows older than `IDP_AUDIT_RETENTION_DAYS`; schedule it daily |
+| `platform setup [--file] [--rotate-secrets]` | The platform organization, the apps `platform.toml` lists, and the plugins' catalogue |
+| `clients create`, `clients homepage <client_id> [url]` | A client by hand; set or clear the address it lives at |
+| `plugins list`, `plugins sync` | The plugins running; bring the catalogue in line with them |
+
+Migrations: `../.venv/bin/alembic upgrade head`, with `IDP_DATABASE_URL` set. A new revision
+goes in `migrations/versions/` and names its `down_revision`; there is one head.
+
+## Settings
+
+All of them are in `src/idp/config.py`, each with a comment, and read from the environment with
+the `IDP_` prefix or from `idp/.env` (see `.env.example`). The ones every deployment sets:
+
+| Setting | Meaning |
+|---|---|
+| `IDP_ISSUER` | The public origin, exactly as clients see it, no trailing slash |
+| `IDP_DATABASE_URL` | PostgreSQL |
+| `IDP_SECRET_KEY` | Signs the session cookie and CSRF tokens; 32 characters or more |
+| `IDP_SIGNING_KEYS_DIR` | The token signing keys |
+| `IDP_EMAIL_TEST_MODE`, `IDP_RESEND_API_KEY`, `IDP_EMAIL_FROM` | Email: logged in test mode (development only), sent through Resend otherwise |
+| `IDP_TRUSTED_PROXIES` | How many proxies in front set `X-Forwarded-For` and `X-Forwarded-Proto`; 0 when none |
+| `IDP_RATE_LIMIT_STORAGE` | Where rate limits are counted: `redis://...` shared by every process, or `memory://` for one |
+| `IDP_BRAND_*` | The platform's name, colour, logo and links |
+| `IDP_CORS_ORIGINS` | Browser origins allowed on the token, revocation and userinfo endpoints |
+| `IDP_PLUGINS`, `IDP_PLUGINS_SYNC_ON_START` | The plugins, as a JSON list (`["acme"]`); whether to sync the catalogue at start |
+
+With an issuer that is not on this machine, the provider refuses to start when the issuer is
+not https, email test mode is on, cookies are not Secure, or `IDP_RATE_LIMIT_STORAGE` is not
+set. It then also sends `Strict-Transport-Security`.
+
+Lifetimes (`IDP_ACCESS_TOKEN_TTL`, `IDP_REFRESH_TOKEN_TTL`, `IDP_SESSION_TTL`, ...) are in
+seconds. What `prune` keeps is in days: `IDP_SESSION_RETENTION_DAYS` (30) for ended sign-ins,
+`IDP_AUDIT_RETENTION_DAYS` (365) for the audit trail.
+
+## Checks
+
+```bash
+../.venv/bin/python -m pytest      # needs the idp_test database on localhost
+../.venv/bin/ruff check src tests
+../.venv/bin/mypy src
+```
+
+Every change to a rule comes with a test in `tests/` that fails without it.

buntu-0.1.0.dist-info/RECORD

@@ -0,0 +1,90 @@
+buntu-0.1.0.dist-info/licenses/LICENSE,sha256=0i_cY3H9AZOVIDYj7922S_jN83vhQNdPg9sm2HqB4R8,1072
+idp/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+idp/app.py,sha256=ztmtbSu1mM2fnfEnB-3oUtbDcjGL_5gld7xX1etNLjo,4989
+idp/cli.py,sha256=VsLT8ANUcaeYYAAE4MrS_pL7m2pSFpqTiDF18MRHFKQ,14995
+idp/config.py,sha256=jYKMUOG7Tz4bbZRcBjgq37QHz2pA7fEcJH9LyKWql9A,5010
+idp/extensions.py,sha256=XO3ARXfgVmdByvuZytY1dmMsNs5yaQweyAxjj3kztyE,211
+idp/db/__init__.py,sha256=28UETZvOaB2CSlUQZz38ZdqZBgVHlK1vNHhuw5scBcM,2232
+idp/models/__init__.py,sha256=B4k0NSAti0bfWyUUHsDKZ0XThE2CjNvvXdznjNga4Jc,1110
+idp/models/account.py,sha256=Y9uhryZ77R_EBEjOguse1FeBbabYNCFpe68ttb3s6tQ,6417
+idp/models/clients.py,sha256=cjAC9iZbYLea_Y1shC0z0UhoPq0_UC_WBI3RrI7MIbo,7750
+idp/models/grants.py,sha256=TIbNw6LrjSAcIhGeiUa3VyHCO25JApLuqcvM6DdHnB0,6912
+idp/models/platform.py,sha256=Ocwwnj9uOuef4W2akmBr6m1nJMMH5OKAX-5XDfUgK-c,11927
+idp/models/users.py,sha256=z3s5P5qYDbAaQ0RuhFu8Bc5uy_qgAjIaMgf0ppbr1u0,4070
+idp/oauth/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+idp/oauth/claims.py,sha256=8Uv2i44ivuZwQ_Ts9Ga09GU3CpU_NjrkpYsH2r0djKU,1290
+idp/oauth/grants.py,sha256=97fsLMALs0V0pJRnpLVPOmIYvKSTOunq_3R9pL0NHxE,12494
+idp/oauth/jwt.py,sha256=7gNbEeVfI5j5Lhzjv-02G-LTtL4BPnbcb9dTVHnpLlw,2988
+idp/oauth/server.py,sha256=Z4teDppC24gejuDmt9I0BQyFPW5iByJxVB3JmsxZLSQ,14716
+idp/plugins/__init__.py,sha256=1Xr0cILaW0vPSZHTSCMaYDVt1SxV4gk3oHPoPF4ulKM,8771
+idp/plugins/sync.py,sha256=oeF7HHh1zQBP6b5WDvVIuOptzOj-a_lk0uYeHN11kq4,6572
+idp/security/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+idp/security/crypto.py,sha256=7vzVGMni4lfFRrgz938aqbmXmzSxr1g2neytT-1eGsE,867
+idp/security/csrf.py,sha256=BZ60FXYstIX6SXeQE7dFzZ_TLDquvfOPESQvoLh20VI,966
+idp/security/keys.py,sha256=piOIBTtn0lCewBdhBveEr0qRXe_YMmGVS6Fi6JLRNKA,2330
+idp/security/passwords.py,sha256=6lppGt-hqv4h-vES9LaFLj9lbyTyPFhHiNTTP9TfdYI,1517
+idp/security/tokens.py,sha256=vL9YN_imgCexnyg8NhnH17ivc_ZVVNWDdHI0WDPP1QQ,1322
+idp/security/totp.py,sha256=73XDq5kOrg4L4PMNW11YRDeRMd03ekmxabUDs-g8vxU,1940
+idp/security/data/breached.txt.gz,sha256=ACk-h0bGJld_dE3pNxI2a0EDBGt4Hdj0hAMVmF_ekss,681212
+idp/services/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+idp/services/accounts.py,sha256=BZBcoJx0GuwzchRrOyZMRQQPQDzRI10JfGTBginHtsg,17510
+idp/services/activity.py,sha256=Wfet1b0o51N50cOCH0JAW2x7b-VMJOHqxW8XGIv2nHg,2605
+idp/services/audit.py,sha256=xf_bVDvwxfN9vSSLZhrTJSVM_jaG5EI5gl21wkm8yrQ,805
+idp/services/backchannel.py,sha256=oqX9MdIMQvuGuDNkXJOQDq6hFCWCDA1qb1EvheLv1Ec,5159
+idp/services/closing.py,sha256=2v8SOWR-7J5RVy5QQWcHQK1HMg8eNbaQ6WttQYv-ZWQ,5573
+idp/services/connected.py,sha256=rnn47m3Y1s2heNcTEr4celVkLIN_F-HSeGXKBHdFWTk,7387
+idp/services/consent.py,sha256=OrtFtkqIhSOMdJluSBOZX0MGlHU4il5evTh2S4-mJXM,1038
+idp/services/credentials.py,sha256=facYeHwlgOrMyxnE0o6o8X-XnvatzwEvS04HnFS-hdg,2033
+idp/services/devices.py,sha256=KMNeeDJC91wIel5H_3qqUXJNK5RP_l2ow2FsHsAG6jk,1005
+idp/services/mail.py,sha256=DNk0MOcHlu4EN7w_Y-Dr_sRriVTDGB4AaTl4W0siEd0,2902
+idp/services/mfa.py,sha256=4lxgRoYePKdmQmIq6hRhNgLYwQaMRnSyYo6V9QT_bjk,5656
+idp/services/own_apps.py,sha256=8Qdardppnyh7RvyMI-dn77xhXkY7wI8ota1aawxtIyk,787
+idp/services/passkeys.py,sha256=HN5OujIgow8e-jt2NfwmOWyCjS9Nuyh3G1gSsg5TT9o,9333
+idp/services/platform.py,sha256=IrgDowFrk-gO02w05eWDgA5QM0y6bCt3Mw64im-QO7U,42280
+idp/services/profile.py,sha256=uwyP1HBZM2g4GDocowN-1NtQd9r-wiWhXPQ09sJ8kCA,7214
+idp/services/retention.py,sha256=TeETx5o1EO6rsJxeLYKJlE9HeWZcEGk4FTYQ64M0k3s,3523
+idp/services/security_prompt.py,sha256=ozRuF6s-RYbaISO1jgfiAx2Da6Uc_dAzk8EjbiqhZQk,660
+idp/services/session_check.py,sha256=-Nubu-VjwKGfLAJfu-3TmgNH3FFA_sFHBwvIYTCaQzQ,3515
+idp/services/sessions.py,sha256=uQHs9PrWNCjjufZMlft2z4TR8VJnD7YtR6UZfkm6-is,7541
+idp/services/setup.py,sha256=14ThMoLzuGY00EpqrBmEVHrx9R3GYlvKp505v8_UPFU,6535
+idp/static/idp/idp.css,sha256=ZQT1KQWJWUWUcAod-47KVN1h_n8wGm0kUMc_kRK2g84,154483
+idp/static/idp/idp.js,sha256=AkOWkjlv6JWaR_dgsK8EyoujaSpXWikZekCWMPbohvc,62598
+idp/static/idp/assets/account-D-MHfC1z.js,sha256=ovkoMR8zC8ixljQAwng45VAyt3en_TAdZpcZoLFnL50,66
+idp/static/idp/assets/account-DN_Addf0.js,sha256=Q6qyIt_Dvxai63lQdP6FOSl7xe51QmCZaZGtMYTPSM4,48
+idp/static/idp/assets/app-CzfYFveQ.js,sha256=XJTSpi8sU6e05Dr59sDrE8BJSTv8Bgv0FtTxqwckCJ8,194891
+idp/static/idp/assets/di-D0iZ5SU4.js,sha256=8nDpOVoKz3qEbvh3vn1bpCdiYqgEMA6zilcRne2POZ4,75973
+idp/static/idp/assets/di-dx_XE3Av.js,sha256=RyLaiVPqMklSjbVKnriDk7MSIfSyetI6B1v8-ZILgv8,190
+idp/static/idp/assets/geist-cyrillic-ext-wght-normal-DjL33-gN.woff2,sha256=Ixf6S7KTycCxEOGDFdUpI1xHoN3TM4zqPYx5VekniZ4,7420
+idp/static/idp/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2,sha256=aJRDlpSUalidFX7OADCGlgpqQBPXSoE9q3YC79s9jAk,15084
+idp/static/idp/assets/geist-latin-ext-wght-normal-DC-KSUi6.woff2,sha256=gk9IW10m4vLaPCsjYTLs4byOTkM3NFKVC7DkBUi0MT8,16512
+idp/static/idp/assets/geist-latin-wght-normal-BgDaEnEv.woff2,sha256=GfnJJUaqMAwxIjXjElrxuBOU2NuaS8SkJc1bZB0tVOE,29400
+idp/static/idp/assets/geist-mono-cyrillic-ext-wght-normal-X_5orZeX.woff2,sha256=zYgAmZBwtynhzAv3pI2mw6wJagRCURcbmnV0tW2W1LQ,6176
+idp/static/idp/assets/geist-mono-cyrillic-wght-normal-DiZS0aHC.woff2,sha256=SGZ4f8lS29vVkdaSPWe8IcLYlLk_NKtp0M3yXUe_st8,12940
+idp/static/idp/assets/geist-mono-latin-ext-wght-normal-Bwz-egvJ.woff2,sha256=GhieuZfD4uzmg3Pjh6-uyehhdCQYbEsas8_3xUumIjs,14696
+idp/static/idp/assets/geist-mono-latin-wght-normal-XN7g48iV.woff2,sha256=aErVtTH4HUPB6McDgmLV23zcH2gAbgTWx3ae-o0zyMw,23128
+idp/static/idp/assets/geist-mono-symbols2-wght-normal-CO5SzqOn.woff2,sha256=W7Ztgxm6FgK7LrZ9zo15wrRoe-jOGDoFdEM-lJs8YK0,5812
+idp/static/idp/assets/geist-mono-vietnamese-wght-normal-DadHysG0.woff2,sha256=05tgiJqUpSen9zx5iKLW77bAgWFK72g7CzhsAtdMIXU,7696
+idp/static/idp/assets/geist-vietnamese-wght-normal-6IgcOCM7.woff2,sha256=j6QOXSSCR3NeuXoL1ZO4hSRAQwYA1roBNkwx_gq8H-E,8004
+idp/static/idp/assets/i18n-BZyjOlbu.js,sha256=lZ_fa1mJ08lnL7-3VeHQ7nIgwPKgSBbix9XwB6by3PY,21873
+idp/static/idp/assets/i18n-Dog5o8z6.js,sha256=-I0bXPYB401JQcWqjnypZSohpKJmWKw05D2Wfxvk-4g,50
+idp/static/idp/assets/roboto-latin-variable-ccAYIvAh.woff2,sha256=FATKNIvXXvg29N2LbyzHGUWGQtEjfDaClrL8ZS3KR9w,43136
+idp/static/idp/assets/schemas-Bl_iabpv.js,sha256=cTP5DkER2DtU8cSec9zPLKJoScFiAx116wkyr85L1Ww,125041
+idp/static/idp/assets/secure-account-Dl1pS_Wo.js,sha256=Z5NW_nQ6I0CmCcyvS_M5Ri5ABziltF8A8cfK2NGFW7o,6925
+idp/static/idp/assets/service-BhG4-X2O.js,sha256=PoHAfvw57_DnpP5_RytoB_Mk9uFVemNRjecZoQFdGAg,55
+idp/static/idp/assets/service-vCuiuvPs.js,sha256=MZgvMN7xMF2DJu7lT4yW8ALTRzwoHt3NrxaT8BXUOWg,2140
+idp/static/idp/assets/theme-toggle-C07m3YIv.js,sha256=YsNcs25XbcgBJ1dkxEL60ntVS4oVKRLXZmmND3Qs6lI,42495
+idp/static/idp/assets/two-step-section-DMQmuG2q.js,sha256=eE-VtR4B8yMs0z3GAAgeYmxj84xx7EgLxCiBy_aMC7o,13404
+idp/static/idp/assets/webauthn-BQas4tAd.js,sha256=dNBLDbM5QRyWuMvbfIcNG774ovX37fGc6mCp6byKQBU,2036
+idp/templates/shell.html,sha256=bpsGx60ROA-1KXOpABIGqtqbB37ujE89visBUwLrSnQ,839
+idp/web/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+idp/web/admin.py,sha256=hjUAsbVC67xTjjWx3gJjRJwP5KQ3_GuEP_MDs5ZEm30,34579
+idp/web/api.py,sha256=CvRXtTf0m-TyLnnwCkg6BzKW6rWwm1EtXQK_SDAOwag,25094
+idp/web/developer.py,sha256=SpfZdKaqVNtQW06uA2spLoeuvctFV-JVGYxAnWo_7YE,24589
+idp/web/oidc.py,sha256=g8Xlbvd1g7ZGOX9xZBXkqKhReXyXGLfdHeztCj7DPwU,15107
+idp/web/openapi.py,sha256=49Kz3SCJVC0Fm3uebqvVG_wtpd1bm4AMFSm6dRmEayQ,41127
+idp/web/pages.py,sha256=VrQTLAL2womm8VqXJi2ChnhTut4v0po9tWROQO5i9Xw,7900
+idp/web/validation.py,sha256=5Ky2kZo2d41RbtFgnqsK1ptvZ7zwvrOpYJ_AF7CbFYM,1873
+buntu-0.1.0.dist-info/METADATA,sha256=DUEUW7k-Ltyh4mHhzkaAmXlGW10KVajzZCKVaZMODQk,7473
+buntu-0.1.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+buntu-0.1.0.dist-info/top_level.txt,sha256=JJAnI16L4ryMUzpMjs3enjf_HDoDpuKsOBu4PHxbSng,4
+buntu-0.1.0.dist-info/RECORD,,

buntu-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

buntu-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ibrahima Touré
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

buntu-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+idp

idp/app.py

@@ -0,0 +1,114 @@
+"""The application factory."""
+
+import os
+from datetime import timedelta
+
+from flask import Flask, Response, jsonify, request
+from werkzeug.middleware.proxy_fix import ProxyFix
+
+from idp import cli, plugins
+from idp.config import Settings, get_settings
+from idp.db import db, init_db
+from idp.extensions import limiter
+from idp.oauth.server import init_oauth
+from idp.services import backchannel, session_check
+from idp.services.platform import PlatformError
+from idp.web import admin, api, developer, oidc, openapi, pages
+
+# Endpoints a browser application (SPA) calls cross-origin.
+_CORS_PATHS = ("/oauth/token", "/oauth/revoke", "/oauth/userinfo")
+
+
+def create_app(settings: Settings | None = None) -> Flask:
+    settings = settings or get_settings()
+    problems = settings.production_problems()
+    if problems:
+        raise RuntimeError("refusing to start:\n- " + "\n- ".join(problems))
+    # Authlib refuses plain HTTP; allowed only for an issuer on this machine (development, tests).
+    if settings.local:
+        os.environ["AUTHLIB_INSECURE_TRANSPORT"] = "1"
+    app = Flask(__name__)
+    if settings.trusted_proxies:
+        # The client's address and scheme as the proxies saw them, trusting only that many hops.
+        n = settings.trusted_proxies
+        app.wsgi_app = ProxyFix(app.wsgi_app, x_for=n, x_proto=n)  # type: ignore[method-assign]
+    app.config.update(
+        SECRET_KEY=settings.secret_key.get_secret_value(),
+        SESSION_COOKIE_NAME="idp_session",
+        SESSION_COOKIE_HTTPONLY=True,
+        SESSION_COOKIE_SAMESITE="Lax",
+        SESSION_COOKIE_SECURE=settings.secure_cookies,
+        PERMANENT_SESSION_LIFETIME=timedelta(seconds=settings.session_ttl),
+        RATELIMIT_STORAGE_URI=settings.rate_limit_storage,
+        RATELIMIT_ENABLED=settings.rate_limit_enabled,
+    )
+    app.json.sort_keys = False  # type: ignore[attr-defined]
+    init_db(app, settings.database_url)
+    init_oauth(app)
+    limiter.init_app(app)
+
+    app.register_blueprint(oidc.bp)
+    app.register_blueprint(api.bp)
+    app.register_blueprint(pages.bp)
+    app.register_blueprint(admin.bp)
+    app.register_blueprint(developer.bp)
+    app.register_blueprint(openapi.bp)
+    _init_plugins(app, settings)
+
+    # A plugin's routes refuse through the same helpers as the developer and admin APIs
+    # (require_developer, member_of): answered as those APIs answer, not as a server fault.
+    @app.errorhandler(PlatformError)
+    def _platform_refusal(error: PlatformError) -> tuple[Response, int]:
+        db().rollback()
+        return jsonify(error=error.code, **error.details), error.status
+
+    cli.register(app)
+
+    # Logout tokens for the sessions this request ended, once it is answered.
+    app.after_request(backchannel.flush)
+
+    @app.after_request
+    def _headers(response: Response) -> Response:
+        headers = response.headers
+        headers.setdefault(
+            "Content-Security-Policy",
+            "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; "
+            "img-src 'self' data: https:; connect-src 'self'; frame-ancestors 'none'; "
+            "base-uri 'none'; form-action 'self'",
+        )
+        # The session check page is meant to be framed by apps; nothing else is.
+        if request.path != "/oauth/check-session":
+            headers.setdefault("X-Frame-Options", "DENY")
+        session_check.sync_cookie(response)
+        headers.setdefault("X-Content-Type-Options", "nosniff")
+        headers.setdefault("Referrer-Policy", "no-referrer")
+        if settings.issuer.startswith("https://"):
+            # Not includeSubDomains: other services of the deployment's domain decide for themselves.
+            headers.setdefault("Strict-Transport-Security", "max-age=31536000")
+        # Avatars are public and their address changes with them: cached like static files.
+        if not request.path.startswith(("/static/", "/.well-known/", "/oauth/check-session.js", "/avatars/")):
+            headers["Cache-Control"] = "no-store"
+        origin = request.headers.get("Origin")
+        if origin and origin in settings.cors_origins and request.path in _CORS_PATHS:
+            headers["Access-Control-Allow-Origin"] = origin
+            headers["Access-Control-Allow-Headers"] = "Authorization, Content-Type"
+            headers["Access-Control-Allow-Methods"] = "GET, POST"
+            headers["Vary"] = "Origin"
+        return response
+
+    return app
+
+
+def _init_plugins(app: Flask, settings: Settings) -> None:
+    """Load the deployment's plugins, mount their APIs, and sync their catalogue if asked."""
+    loaded = plugins.load(settings.plugins)
+    plugins.use(loaded)
+    for plugin in loaded:
+        blueprint = plugin.blueprint()
+        if blueprint is not None:
+            app.register_blueprint(blueprint, url_prefix=f"/api/plugins/{plugin.id}")
+    if loaded and settings.plugins_sync_on_start:
+        from idp.plugins.sync import sync
+
+        with app.app_context():
+            sync(loaded)