buntu 0.1.0__tar.gz

buntu-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ibrahima Touré
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

buntu-0.1.0/PKG-INFO

@@ -0,0 +1,141 @@
+Metadata-Version: 2.4
+Name: buntu
+Version: 0.1.0
+Summary: OAuth 2.1 and OpenID Connect provider
+Author: Ibrahima Touré
+License-Expression: MIT
+Project-URL: Source, https://github.com/buntubi/buntu
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: flask>=3.1
+Requires-Dist: authlib<1.9,>=1.8
+Requires-Dist: sqlalchemy>=2.0.36
+Requires-Dist: alembic>=1.14
+Requires-Dist: psycopg[binary]>=3.2
+Requires-Dist: pydantic-settings>=2.6
+Requires-Dist: flask-limiter>=3.8
+Requires-Dist: requests>=2.32
+Requires-Dist: segno>=1.6
+Requires-Dist: email-validator>=2.2
+Requires-Dist: webauthn<4,>=3.0
+Requires-Dist: cryptography>=44
+Requires-Dist: joserfc<2,>=1.7
+Requires-Dist: gunicorn>=23
+Provides-Extra: dev
+Requires-Dist: pytest>=8.3; extra == "dev"
+Requires-Dist: ruff>=0.8; extra == "dev"
+Requires-Dist: mypy>=1.13; extra == "dev"
+Requires-Dist: openapi-spec-validator>=0.7; extra == "dev"
+Requires-Dist: jsonschema>=4.23; extra == "dev"
+Dynamic: license-file
+
+# The provider
+
+The OAuth 2.1 and OpenID Connect server, in Flask. It owns every account, every session and
+every token on the platform, and every rule about who may do what. The console, the portal and
+the sign-in pages hold no rules of their own: they call this server and show what it answers.
+
+Setup, deployment and the platform's concepts (accounts, organizations, apps, the catalogue) are
+in the [repository README](../README.md). Plugins are in [docs/plugins.md](../docs/plugins.md).
+
+## What it serves
+
+| Prefix | Who calls it | What |
+|---|---|---|
+| `/.well-known/openid-configuration`, `/.well-known/jwks.json` | Any client | Discovery and the signing keys |
+| `/.well-known/brand.json` | The console and the portal | The platform's name, colour and links |
+| `/oauth/*` | OAuth clients | `authorize`, `token`, `revoke`, `introspect`, `device_authorization`, `userinfo`, `logout`, `check-session` |
+| `/signin`, `/signup`, `/mfa`, `/consent`, `/accounts`, `/account/*`, ... | People, in a browser | The pages built from `frontend/`, rendered into `templates/shell.html` |
+| `/api/*` | Those pages | Sign-in steps, the account area, passkeys. Same-site, with a CSRF token |
+| `/developer/api/*` | The portal | Organizations, members, apps, secrets, test users, API keys. Bearer token with the `developer` scope |
+| `/admin/api/*` | The console | Users, organizations, reviews, the catalogue, the platform's apps. Bearer token with the `admin` scope and a two-step sign-in |
+| `/api/plugins/<id>/*` | Plugin pages in the console and portal | Each plugin's own API |
+| `/openapi.json` | Developers, Postman | The OAuth endpoints, the developer API and the admin API |
+
+Grants: authorization code with PKCE, refresh token (rotated, with reuse detection), client
+credentials, and the device code. Tokens are JWTs signed with the newest key in
+`IDP_SIGNING_KEYS_DIR`; every key in the directory still verifies.
+
+Sessions end everywhere they reached: a sign-out, a device signed out from the account area,
+or a deleted account sends an OpenID back-channel logout token to every app with a
+`backchannel_logout_uri` that took part in that session.
+
+## Layout
+
+```
+src/idp/
+  app.py          create_app: settings, extensions, blueprints, plugins
+  config.py       every setting, read from IDP_* variables and .env
+  cli.py          the flask commands
+  models/         SQLAlchemy models
+  db/             the session and utcnow
+  oauth/          Authlib server, grants, claims, JWT helpers
+  security/       passwords, TOTP, CSRF, signing keys, encryption at rest
+  services/       the rules: accounts, sessions, MFA, passkeys, platform, profile, ...
+  web/            the blueprints: pages, api, developer, admin, oidc, openapi
+  plugins/        the plugin interface and the catalogue sync
+  templates/      the page shell
+  static/idp/     the built sign-in pages (from frontend/, not edited here)
+migrations/       Alembic revisions
+tests/            pytest, against a real PostgreSQL database
+platform.example.toml   the platform's apps, copied to platform.toml per deployment
+```
+
+The rule of thumb when changing something: a view in `web/` parses the request and shapes the
+answer; the decision lives in `services/`. A rule that two endpoints share is one function in a
+service, never two copies in two views.
+
+## Commands
+
+Run from `idp/` as `../.venv/bin/flask --app idp.app:create_app <command>`.
+
+| Command | Does |
+|---|---|
+| `keys generate` | Adds a signing key; the newest signs from then on |
+| `admin create`, `admin check` | Creates the superadmin; checks one exists |
+| `users admins`, `users promote`, `users demote` | Lists admins; gives or takes the admin role |
+| `users delete <pattern> --yes` | Deletes accounts by email (a `*` pattern works), as deleting from the account page does: apps are signed out, plugins told, the audit trail kept without who it was |
+| `prune` | Deletes expired codes and tokens, sign-ins ended more than `IDP_SESSION_RETENTION_DAYS` ago and audit rows older than `IDP_AUDIT_RETENTION_DAYS`; schedule it daily |
+| `platform setup [--file] [--rotate-secrets]` | The platform organization, the apps `platform.toml` lists, and the plugins' catalogue |
+| `clients create`, `clients homepage <client_id> [url]` | A client by hand; set or clear the address it lives at |
+| `plugins list`, `plugins sync` | The plugins running; bring the catalogue in line with them |
+
+Migrations: `../.venv/bin/alembic upgrade head`, with `IDP_DATABASE_URL` set. A new revision
+goes in `migrations/versions/` and names its `down_revision`; there is one head.
+
+## Settings
+
+All of them are in `src/idp/config.py`, each with a comment, and read from the environment with
+the `IDP_` prefix or from `idp/.env` (see `.env.example`). The ones every deployment sets:
+
+| Setting | Meaning |
+|---|---|
+| `IDP_ISSUER` | The public origin, exactly as clients see it, no trailing slash |
+| `IDP_DATABASE_URL` | PostgreSQL |
+| `IDP_SECRET_KEY` | Signs the session cookie and CSRF tokens; 32 characters or more |
+| `IDP_SIGNING_KEYS_DIR` | The token signing keys |
+| `IDP_EMAIL_TEST_MODE`, `IDP_RESEND_API_KEY`, `IDP_EMAIL_FROM` | Email: logged in test mode (development only), sent through Resend otherwise |
+| `IDP_TRUSTED_PROXIES` | How many proxies in front set `X-Forwarded-For` and `X-Forwarded-Proto`; 0 when none |
+| `IDP_RATE_LIMIT_STORAGE` | Where rate limits are counted: `redis://...` shared by every process, or `memory://` for one |
+| `IDP_BRAND_*` | The platform's name, colour, logo and links |
+| `IDP_CORS_ORIGINS` | Browser origins allowed on the token, revocation and userinfo endpoints |
+| `IDP_PLUGINS`, `IDP_PLUGINS_SYNC_ON_START` | The plugins, as a JSON list (`["acme"]`); whether to sync the catalogue at start |
+
+With an issuer that is not on this machine, the provider refuses to start when the issuer is
+not https, email test mode is on, cookies are not Secure, or `IDP_RATE_LIMIT_STORAGE` is not
+set. It then also sends `Strict-Transport-Security`.
+
+Lifetimes (`IDP_ACCESS_TOKEN_TTL`, `IDP_REFRESH_TOKEN_TTL`, `IDP_SESSION_TTL`, ...) are in
+seconds. What `prune` keeps is in days: `IDP_SESSION_RETENTION_DAYS` (30) for ended sign-ins,
+`IDP_AUDIT_RETENTION_DAYS` (365) for the audit trail.
+
+## Checks
+
+```bash
+../.venv/bin/python -m pytest      # needs the idp_test database on localhost
+../.venv/bin/ruff check src tests
+../.venv/bin/mypy src
+```
+
+Every change to a rule comes with a test in `tests/` that fails without it.

buntu-0.1.0/README.md

@@ -0,0 +1,109 @@
+# The provider
+
+The OAuth 2.1 and OpenID Connect server, in Flask. It owns every account, every session and
+every token on the platform, and every rule about who may do what. The console, the portal and
+the sign-in pages hold no rules of their own: they call this server and show what it answers.
+
+Setup, deployment and the platform's concepts (accounts, organizations, apps, the catalogue) are
+in the [repository README](../README.md). Plugins are in [docs/plugins.md](../docs/plugins.md).
+
+## What it serves
+
+| Prefix | Who calls it | What |
+|---|---|---|
+| `/.well-known/openid-configuration`, `/.well-known/jwks.json` | Any client | Discovery and the signing keys |
+| `/.well-known/brand.json` | The console and the portal | The platform's name, colour and links |
+| `/oauth/*` | OAuth clients | `authorize`, `token`, `revoke`, `introspect`, `device_authorization`, `userinfo`, `logout`, `check-session` |
+| `/signin`, `/signup`, `/mfa`, `/consent`, `/accounts`, `/account/*`, ... | People, in a browser | The pages built from `frontend/`, rendered into `templates/shell.html` |
+| `/api/*` | Those pages | Sign-in steps, the account area, passkeys. Same-site, with a CSRF token |
+| `/developer/api/*` | The portal | Organizations, members, apps, secrets, test users, API keys. Bearer token with the `developer` scope |
+| `/admin/api/*` | The console | Users, organizations, reviews, the catalogue, the platform's apps. Bearer token with the `admin` scope and a two-step sign-in |
+| `/api/plugins/<id>/*` | Plugin pages in the console and portal | Each plugin's own API |
+| `/openapi.json` | Developers, Postman | The OAuth endpoints, the developer API and the admin API |
+
+Grants: authorization code with PKCE, refresh token (rotated, with reuse detection), client
+credentials, and the device code. Tokens are JWTs signed with the newest key in
+`IDP_SIGNING_KEYS_DIR`; every key in the directory still verifies.
+
+Sessions end everywhere they reached: a sign-out, a device signed out from the account area,
+or a deleted account sends an OpenID back-channel logout token to every app with a
+`backchannel_logout_uri` that took part in that session.
+
+## Layout
+
+```
+src/idp/
+  app.py          create_app: settings, extensions, blueprints, plugins
+  config.py       every setting, read from IDP_* variables and .env
+  cli.py          the flask commands
+  models/         SQLAlchemy models
+  db/             the session and utcnow
+  oauth/          Authlib server, grants, claims, JWT helpers
+  security/       passwords, TOTP, CSRF, signing keys, encryption at rest
+  services/       the rules: accounts, sessions, MFA, passkeys, platform, profile, ...
+  web/            the blueprints: pages, api, developer, admin, oidc, openapi
+  plugins/        the plugin interface and the catalogue sync
+  templates/      the page shell
+  static/idp/     the built sign-in pages (from frontend/, not edited here)
+migrations/       Alembic revisions
+tests/            pytest, against a real PostgreSQL database
+platform.example.toml   the platform's apps, copied to platform.toml per deployment
+```
+
+The rule of thumb when changing something: a view in `web/` parses the request and shapes the
+answer; the decision lives in `services/`. A rule that two endpoints share is one function in a
+service, never two copies in two views.
+
+## Commands
+
+Run from `idp/` as `../.venv/bin/flask --app idp.app:create_app <command>`.
+
+| Command | Does |
+|---|---|
+| `keys generate` | Adds a signing key; the newest signs from then on |
+| `admin create`, `admin check` | Creates the superadmin; checks one exists |
+| `users admins`, `users promote`, `users demote` | Lists admins; gives or takes the admin role |
+| `users delete <pattern> --yes` | Deletes accounts by email (a `*` pattern works), as deleting from the account page does: apps are signed out, plugins told, the audit trail kept without who it was |
+| `prune` | Deletes expired codes and tokens, sign-ins ended more than `IDP_SESSION_RETENTION_DAYS` ago and audit rows older than `IDP_AUDIT_RETENTION_DAYS`; schedule it daily |
+| `platform setup [--file] [--rotate-secrets]` | The platform organization, the apps `platform.toml` lists, and the plugins' catalogue |
+| `clients create`, `clients homepage <client_id> [url]` | A client by hand; set or clear the address it lives at |
+| `plugins list`, `plugins sync` | The plugins running; bring the catalogue in line with them |
+
+Migrations: `../.venv/bin/alembic upgrade head`, with `IDP_DATABASE_URL` set. A new revision
+goes in `migrations/versions/` and names its `down_revision`; there is one head.
+
+## Settings
+
+All of them are in `src/idp/config.py`, each with a comment, and read from the environment with
+the `IDP_` prefix or from `idp/.env` (see `.env.example`). The ones every deployment sets:
+
+| Setting | Meaning |
+|---|---|
+| `IDP_ISSUER` | The public origin, exactly as clients see it, no trailing slash |
+| `IDP_DATABASE_URL` | PostgreSQL |
+| `IDP_SECRET_KEY` | Signs the session cookie and CSRF tokens; 32 characters or more |
+| `IDP_SIGNING_KEYS_DIR` | The token signing keys |
+| `IDP_EMAIL_TEST_MODE`, `IDP_RESEND_API_KEY`, `IDP_EMAIL_FROM` | Email: logged in test mode (development only), sent through Resend otherwise |
+| `IDP_TRUSTED_PROXIES` | How many proxies in front set `X-Forwarded-For` and `X-Forwarded-Proto`; 0 when none |
+| `IDP_RATE_LIMIT_STORAGE` | Where rate limits are counted: `redis://...` shared by every process, or `memory://` for one |
+| `IDP_BRAND_*` | The platform's name, colour, logo and links |
+| `IDP_CORS_ORIGINS` | Browser origins allowed on the token, revocation and userinfo endpoints |
+| `IDP_PLUGINS`, `IDP_PLUGINS_SYNC_ON_START` | The plugins, as a JSON list (`["acme"]`); whether to sync the catalogue at start |
+
+With an issuer that is not on this machine, the provider refuses to start when the issuer is
+not https, email test mode is on, cookies are not Secure, or `IDP_RATE_LIMIT_STORAGE` is not
+set. It then also sends `Strict-Transport-Security`.
+
+Lifetimes (`IDP_ACCESS_TOKEN_TTL`, `IDP_REFRESH_TOKEN_TTL`, `IDP_SESSION_TTL`, ...) are in
+seconds. What `prune` keeps is in days: `IDP_SESSION_RETENTION_DAYS` (30) for ended sign-ins,
+`IDP_AUDIT_RETENTION_DAYS` (365) for the audit trail.
+
+## Checks
+
+```bash
+../.venv/bin/python -m pytest      # needs the idp_test database on localhost
+../.venv/bin/ruff check src tests
+../.venv/bin/mypy src
+```
+
+Every change to a rule comes with a test in `tests/` that fails without it.

buntu-0.1.0/pyproject.toml

@@ -0,0 +1,80 @@
+[project]
+name = "buntu"
+version = "0.1.0"
+description = "OAuth 2.1 and OpenID Connect provider"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "Ibrahima Touré" }]
+requires-python = ">=3.11"
+dependencies = [
+  "flask>=3.1",
+  # Pinned to a minor: 1.8 moved the ID token hooks, and a silent change there drops `kid`.
+  "authlib>=1.8,<1.9",
+  "sqlalchemy>=2.0.36",
+  "alembic>=1.14",
+  "psycopg[binary]>=3.2",
+  "pydantic-settings>=2.6",
+  "flask-limiter>=3.8",
+  "requests>=2.32",
+  "segno>=1.6",
+  "email-validator>=2.2",
+  "webauthn>=3.0,<4",
+  # Imported directly (keys, token checks), not only through authlib and webauthn.
+  "cryptography>=44",
+  "joserfc>=1.7,<2",
+  # The production server (the images run it).
+  "gunicorn>=23",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=8.3", "ruff>=0.8", "mypy>=1.13", "openapi-spec-validator>=0.7", "jsonschema>=4.23"]
+
+[project.urls]
+Source = "https://github.com/buntubi/buntu"
+
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+idp = ["templates/*.html", "static/**/*", "security/data/*.gz"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-q"
+
+[tool.ruff]
+line-length = 110
+target-version = "py311"
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "B", "UP", "S", "SIM"]
+ignore = ["S101"]
+
+[tool.ruff.lint.isort]
+known-local-folder = ["conftest"]
+
+[tool.ruff.lint.per-file-ignores]
+# Test accounts have passwords.
+"tests/*" = ["S105", "S106"]
+
+[tool.mypy]
+python_version = "3.11"
+strict = true
+packages = ["idp"]
+mypy_path = "src"
+
+# Authlib and flask-limiter ship no type information.
+[[tool.mypy.overrides]]
+module = ["authlib.*", "flask_limiter.*"]
+ignore_missing_imports = true
+
+# The modules built on Authlib's classes and decorators get Any back from them.
+[[tool.mypy.overrides]]
+module = ["idp.models.*", "idp.oauth.*", "idp.web.*"]
+warn_return_any = false
+disallow_untyped_decorators = false

buntu-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

buntu-0.1.0/src/buntu.egg-info/PKG-INFO

@@ -0,0 +1,141 @@
+Metadata-Version: 2.4
+Name: buntu
+Version: 0.1.0
+Summary: OAuth 2.1 and OpenID Connect provider
+Author: Ibrahima Touré
+License-Expression: MIT
+Project-URL: Source, https://github.com/buntubi/buntu
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: flask>=3.1
+Requires-Dist: authlib<1.9,>=1.8
+Requires-Dist: sqlalchemy>=2.0.36
+Requires-Dist: alembic>=1.14
+Requires-Dist: psycopg[binary]>=3.2
+Requires-Dist: pydantic-settings>=2.6
+Requires-Dist: flask-limiter>=3.8
+Requires-Dist: requests>=2.32
+Requires-Dist: segno>=1.6
+Requires-Dist: email-validator>=2.2
+Requires-Dist: webauthn<4,>=3.0
+Requires-Dist: cryptography>=44
+Requires-Dist: joserfc<2,>=1.7
+Requires-Dist: gunicorn>=23
+Provides-Extra: dev
+Requires-Dist: pytest>=8.3; extra == "dev"
+Requires-Dist: ruff>=0.8; extra == "dev"
+Requires-Dist: mypy>=1.13; extra == "dev"
+Requires-Dist: openapi-spec-validator>=0.7; extra == "dev"
+Requires-Dist: jsonschema>=4.23; extra == "dev"
+Dynamic: license-file
+
+# The provider
+
+The OAuth 2.1 and OpenID Connect server, in Flask. It owns every account, every session and
+every token on the platform, and every rule about who may do what. The console, the portal and
+the sign-in pages hold no rules of their own: they call this server and show what it answers.
+
+Setup, deployment and the platform's concepts (accounts, organizations, apps, the catalogue) are
+in the [repository README](../README.md). Plugins are in [docs/plugins.md](../docs/plugins.md).
+
+## What it serves
+
+| Prefix | Who calls it | What |
+|---|---|---|
+| `/.well-known/openid-configuration`, `/.well-known/jwks.json` | Any client | Discovery and the signing keys |
+| `/.well-known/brand.json` | The console and the portal | The platform's name, colour and links |
+| `/oauth/*` | OAuth clients | `authorize`, `token`, `revoke`, `introspect`, `device_authorization`, `userinfo`, `logout`, `check-session` |
+| `/signin`, `/signup`, `/mfa`, `/consent`, `/accounts`, `/account/*`, ... | People, in a browser | The pages built from `frontend/`, rendered into `templates/shell.html` |
+| `/api/*` | Those pages | Sign-in steps, the account area, passkeys. Same-site, with a CSRF token |
+| `/developer/api/*` | The portal | Organizations, members, apps, secrets, test users, API keys. Bearer token with the `developer` scope |
+| `/admin/api/*` | The console | Users, organizations, reviews, the catalogue, the platform's apps. Bearer token with the `admin` scope and a two-step sign-in |
+| `/api/plugins/<id>/*` | Plugin pages in the console and portal | Each plugin's own API |
+| `/openapi.json` | Developers, Postman | The OAuth endpoints, the developer API and the admin API |
+
+Grants: authorization code with PKCE, refresh token (rotated, with reuse detection), client
+credentials, and the device code. Tokens are JWTs signed with the newest key in
+`IDP_SIGNING_KEYS_DIR`; every key in the directory still verifies.
+
+Sessions end everywhere they reached: a sign-out, a device signed out from the account area,
+or a deleted account sends an OpenID back-channel logout token to every app with a
+`backchannel_logout_uri` that took part in that session.
+
+## Layout
+
+```
+src/idp/
+  app.py          create_app: settings, extensions, blueprints, plugins
+  config.py       every setting, read from IDP_* variables and .env
+  cli.py          the flask commands
+  models/         SQLAlchemy models
+  db/             the session and utcnow
+  oauth/          Authlib server, grants, claims, JWT helpers
+  security/       passwords, TOTP, CSRF, signing keys, encryption at rest
+  services/       the rules: accounts, sessions, MFA, passkeys, platform, profile, ...
+  web/            the blueprints: pages, api, developer, admin, oidc, openapi
+  plugins/        the plugin interface and the catalogue sync
+  templates/      the page shell
+  static/idp/     the built sign-in pages (from frontend/, not edited here)
+migrations/       Alembic revisions
+tests/            pytest, against a real PostgreSQL database
+platform.example.toml   the platform's apps, copied to platform.toml per deployment
+```
+
+The rule of thumb when changing something: a view in `web/` parses the request and shapes the
+answer; the decision lives in `services/`. A rule that two endpoints share is one function in a
+service, never two copies in two views.
+
+## Commands
+
+Run from `idp/` as `../.venv/bin/flask --app idp.app:create_app <command>`.
+
+| Command | Does |
+|---|---|
+| `keys generate` | Adds a signing key; the newest signs from then on |
+| `admin create`, `admin check` | Creates the superadmin; checks one exists |
+| `users admins`, `users promote`, `users demote` | Lists admins; gives or takes the admin role |
+| `users delete <pattern> --yes` | Deletes accounts by email (a `*` pattern works), as deleting from the account page does: apps are signed out, plugins told, the audit trail kept without who it was |
+| `prune` | Deletes expired codes and tokens, sign-ins ended more than `IDP_SESSION_RETENTION_DAYS` ago and audit rows older than `IDP_AUDIT_RETENTION_DAYS`; schedule it daily |
+| `platform setup [--file] [--rotate-secrets]` | The platform organization, the apps `platform.toml` lists, and the plugins' catalogue |
+| `clients create`, `clients homepage <client_id> [url]` | A client by hand; set or clear the address it lives at |
+| `plugins list`, `plugins sync` | The plugins running; bring the catalogue in line with them |
+
+Migrations: `../.venv/bin/alembic upgrade head`, with `IDP_DATABASE_URL` set. A new revision
+goes in `migrations/versions/` and names its `down_revision`; there is one head.
+
+## Settings
+
+All of them are in `src/idp/config.py`, each with a comment, and read from the environment with
+the `IDP_` prefix or from `idp/.env` (see `.env.example`). The ones every deployment sets:
+
+| Setting | Meaning |
+|---|---|
+| `IDP_ISSUER` | The public origin, exactly as clients see it, no trailing slash |
+| `IDP_DATABASE_URL` | PostgreSQL |
+| `IDP_SECRET_KEY` | Signs the session cookie and CSRF tokens; 32 characters or more |
+| `IDP_SIGNING_KEYS_DIR` | The token signing keys |
+| `IDP_EMAIL_TEST_MODE`, `IDP_RESEND_API_KEY`, `IDP_EMAIL_FROM` | Email: logged in test mode (development only), sent through Resend otherwise |
+| `IDP_TRUSTED_PROXIES` | How many proxies in front set `X-Forwarded-For` and `X-Forwarded-Proto`; 0 when none |
+| `IDP_RATE_LIMIT_STORAGE` | Where rate limits are counted: `redis://...` shared by every process, or `memory://` for one |
+| `IDP_BRAND_*` | The platform's name, colour, logo and links |
+| `IDP_CORS_ORIGINS` | Browser origins allowed on the token, revocation and userinfo endpoints |
+| `IDP_PLUGINS`, `IDP_PLUGINS_SYNC_ON_START` | The plugins, as a JSON list (`["acme"]`); whether to sync the catalogue at start |
+
+With an issuer that is not on this machine, the provider refuses to start when the issuer is
+not https, email test mode is on, cookies are not Secure, or `IDP_RATE_LIMIT_STORAGE` is not
+set. It then also sends `Strict-Transport-Security`.
+
+Lifetimes (`IDP_ACCESS_TOKEN_TTL`, `IDP_REFRESH_TOKEN_TTL`, `IDP_SESSION_TTL`, ...) are in
+seconds. What `prune` keeps is in days: `IDP_SESSION_RETENTION_DAYS` (30) for ended sign-ins,
+`IDP_AUDIT_RETENTION_DAYS` (365) for the audit trail.
+
+## Checks
+
+```bash
+../.venv/bin/python -m pytest      # needs the idp_test database on localhost
+../.venv/bin/ruff check src tests
+../.venv/bin/mypy src
+```
+
+Every change to a rule comes with a test in `tests/` that fails without it.

buntu-0.1.0/src/buntu.egg-info/SOURCES.txt

@@ -0,0 +1,134 @@
+LICENSE
+README.md
+pyproject.toml
+src/buntu.egg-info/PKG-INFO
+src/buntu.egg-info/SOURCES.txt
+src/buntu.egg-info/dependency_links.txt
+src/buntu.egg-info/requires.txt
+src/buntu.egg-info/top_level.txt
+src/idp/__init__.py
+src/idp/app.py
+src/idp/cli.py
+src/idp/config.py
+src/idp/extensions.py
+src/idp/db/__init__.py
+src/idp/models/__init__.py
+src/idp/models/account.py
+src/idp/models/clients.py
+src/idp/models/grants.py
+src/idp/models/platform.py
+src/idp/models/users.py
+src/idp/oauth/__init__.py
+src/idp/oauth/claims.py
+src/idp/oauth/grants.py
+src/idp/oauth/jwt.py
+src/idp/oauth/server.py
+src/idp/plugins/__init__.py
+src/idp/plugins/sync.py
+src/idp/security/__init__.py
+src/idp/security/crypto.py
+src/idp/security/csrf.py
+src/idp/security/keys.py
+src/idp/security/passwords.py
+src/idp/security/tokens.py
+src/idp/security/totp.py
+src/idp/security/data/breached.txt.gz
+src/idp/services/__init__.py
+src/idp/services/accounts.py
+src/idp/services/activity.py
+src/idp/services/audit.py
+src/idp/services/backchannel.py
+src/idp/services/closing.py
+src/idp/services/connected.py
+src/idp/services/consent.py
+src/idp/services/credentials.py
+src/idp/services/devices.py
+src/idp/services/mail.py
+src/idp/services/mfa.py
+src/idp/services/own_apps.py
+src/idp/services/passkeys.py
+src/idp/services/platform.py
+src/idp/services/profile.py
+src/idp/services/retention.py
+src/idp/services/security_prompt.py
+src/idp/services/session_check.py
+src/idp/services/sessions.py
+src/idp/services/setup.py
+src/idp/static/idp/idp.css
+src/idp/static/idp/idp.js
+src/idp/static/idp/assets/account-D-MHfC1z.js
+src/idp/static/idp/assets/account-DN_Addf0.js
+src/idp/static/idp/assets/app-CzfYFveQ.js
+src/idp/static/idp/assets/di-D0iZ5SU4.js
+src/idp/static/idp/assets/di-dx_XE3Av.js
+src/idp/static/idp/assets/geist-cyrillic-ext-wght-normal-DjL33-gN.woff2
+src/idp/static/idp/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2
+src/idp/static/idp/assets/geist-latin-ext-wght-normal-DC-KSUi6.woff2
+src/idp/static/idp/assets/geist-latin-wght-normal-BgDaEnEv.woff2
+src/idp/static/idp/assets/geist-mono-cyrillic-ext-wght-normal-X_5orZeX.woff2
+src/idp/static/idp/assets/geist-mono-cyrillic-wght-normal-DiZS0aHC.woff2
+src/idp/static/idp/assets/geist-mono-latin-ext-wght-normal-Bwz-egvJ.woff2
+src/idp/static/idp/assets/geist-mono-latin-wght-normal-XN7g48iV.woff2
+src/idp/static/idp/assets/geist-mono-symbols2-wght-normal-CO5SzqOn.woff2
+src/idp/static/idp/assets/geist-mono-vietnamese-wght-normal-DadHysG0.woff2
+src/idp/static/idp/assets/geist-vietnamese-wght-normal-6IgcOCM7.woff2
+src/idp/static/idp/assets/i18n-BZyjOlbu.js
+src/idp/static/idp/assets/i18n-Dog5o8z6.js
+src/idp/static/idp/assets/roboto-latin-variable-ccAYIvAh.woff2
+src/idp/static/idp/assets/schemas-Bl_iabpv.js
+src/idp/static/idp/assets/secure-account-Dl1pS_Wo.js
+src/idp/static/idp/assets/service-BhG4-X2O.js
+src/idp/static/idp/assets/service-vCuiuvPs.js
+src/idp/static/idp/assets/theme-toggle-C07m3YIv.js
+src/idp/static/idp/assets/two-step-section-DMQmuG2q.js
+src/idp/static/idp/assets/webauthn-BQas4tAd.js
+src/idp/templates/shell.html
+src/idp/web/__init__.py
+src/idp/web/admin.py
+src/idp/web/api.py
+src/idp/web/developer.py
+src/idp/web/oidc.py
+src/idp/web/openapi.py
+src/idp/web/pages.py
+src/idp/web/validation.py
+tests/test_account_area.py
+tests/test_account_attacks.py
+tests/test_account_closing.py
+tests/test_account_connected.py
+tests/test_account_profile.py
+tests/test_account_security.py
+tests/test_app_overview.py
+tests/test_authorization_code.py
+tests/test_authorization_code_attacks.py
+tests/test_backchannel_logout.py
+tests/test_boundary_attacks.py
+tests/test_brand.py
+tests/test_cli.py
+tests/test_console_api.py
+tests/test_console_users.py
+tests/test_credentials.py
+tests/test_data_retention.py
+tests/test_deployment.py
+tests/test_developer_api.py
+tests/test_flows.py
+tests/test_grant_attacks.py
+tests/test_invitations.py
+tests/test_members.py
+tests/test_mfa.py
+tests/test_offline_access.py
+tests/test_openapi.py
+tests/test_own_apps.py
+tests/test_passkeys.py
+tests/test_platform_gates.py
+tests/test_platform_organization.py
+tests/test_plugin_attacks.py
+tests/test_plugins.py
+tests/test_review_rules.py
+tests/test_reviews.py
+tests/test_role_matrix.py
+tests/test_scope_rules.py
+tests/test_security_prompt.py
+tests/test_session_attacks.py
+tests/test_session_check.py
+tests/test_setup.py
+tests/test_token_attacks.py

buntu-0.1.0/src/buntu.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

buntu-0.1.0/src/buntu.egg-info/requires.txt

@@ -0,0 +1,21 @@
+flask>=3.1
+authlib<1.9,>=1.8
+sqlalchemy>=2.0.36
+alembic>=1.14
+psycopg[binary]>=3.2
+pydantic-settings>=2.6
+flask-limiter>=3.8
+requests>=2.32
+segno>=1.6
+email-validator>=2.2
+webauthn<4,>=3.0
+cryptography>=44
+joserfc<2,>=1.7
+gunicorn>=23
+
+[dev]
+pytest>=8.3
+ruff>=0.8
+mypy>=1.13
+openapi-spec-validator>=0.7
+jsonschema>=4.23

buntu-0.1.0/src/buntu.egg-info/top_level.txt

@@ -0,0 +1 @@
+idp