ccproxy-api 0.1.7__py3-none-any.whl → 0.2.0__py3-none-any.whl

ccproxy/auth/dependencies.py

@@ -1,229 +1,195 @@
-"""FastAPI dependency injection for authentication."""
+"""FastAPI dependency injection utilities for authentication."""
+
+from __future__ import annotations
 
 from typing import TYPE_CHECKING, Annotated
 
-from fastapi import Depends, HTTPException, status
+from fastapi import Depends, HTTPException, Request, status
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 
-
-if TYPE_CHECKING:
-    from ccproxy.config.settings import Settings
-
 from ccproxy.auth.bearer import BearerTokenAuthManager
-from ccproxy.auth.credentials_adapter import CredentialsAuthManager
 from ccproxy.auth.exceptions import AuthenticationError, AuthenticationRequiredError
 from ccproxy.auth.manager import AuthManager
+from ccproxy.config.settings import Settings
 
 
-# FastAPI security scheme for bearer tokens
-bearer_scheme = HTTPBearer(auto_error=False)
-
-
-async def get_credentials_auth_manager() -> AuthManager:
-    """Get credentials-based authentication manager.
-
-    Returns:
-        CredentialsAuthManager instance
-    """
-    return CredentialsAuthManager()
+if TYPE_CHECKING:  # pragma: no cover - import cycle guard for type checking only
+    pass
 
 
-async def get_bearer_auth_manager(
-    credentials: Annotated[HTTPAuthorizationCredentials | None, Depends(bearer_scheme)],
-) -> AuthManager:
-    """Get bearer token authentication manager.
+# FastAPI security scheme for bearer tokens
+bearer_scheme = HTTPBearer(auto_error=False)
 
-    Args:
-        credentials: HTTP authorization credentials
 
-    Returns:
-        BearerTokenAuthManager instance
+def get_settings() -> Settings:
+    """Get settings instance directly (without service container)."""
+    return Settings()
 
-    Raises:
-        HTTPException: If no valid bearer token provided
-    """
-    if not credentials or not credentials.credentials:
-        raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Bearer token required",
-            headers={"WWW-Authenticate": "Bearer"},
-        )
 
-    return BearerTokenAuthManager(credentials.credentials)
+SettingsDep = Annotated[Settings, Depends(get_settings)]
 
 
-async def _get_auth_manager_with_settings(
-    credentials: HTTPAuthorizationCredentials | None,
-    settings: "Settings",
-) -> AuthManager:
-    """Internal function to get auth manager with specific settings.
+def _resolve_runtime_settings(request: Request) -> Settings | None:
+    """Best-effort retrieval of settings without importing API dependencies."""
 
-    Args:
-        credentials: HTTP authorization credentials
-        settings: Application settings
+    container = getattr(request.app.state, "service_container", None)
+    if container is None:
+        try:
+            from ccproxy.services.container import ServiceContainer
 
-    Returns:
-        AuthManager instance
+            container = ServiceContainer.get_current(strict=False)
+        except (ImportError, RuntimeError):
+            container = None
 
-    Raises:
-        HTTPException: If no valid authentication available
-    """
-    # Try bearer token first if provided
-    if credentials and credentials.credentials:
+    if container is not None:
         try:
-            # If API has configured auth_token, validate against it
-            if settings.security.auth_token:
-                if credentials.credentials == settings.security.auth_token:
-                    bearer_auth = BearerTokenAuthManager(credentials.credentials)
-                    if await bearer_auth.is_authenticated():
-                        return bearer_auth
-                else:
-                    # Token doesn't match configured auth_token
-                    raise HTTPException(
-                        status_code=status.HTTP_401_UNAUTHORIZED,
-                        detail="Invalid bearer token",
-                        headers={"WWW-Authenticate": "Bearer"},
-                    )
-            else:
-                # No auth_token configured, accept any bearer token
-                bearer_auth = BearerTokenAuthManager(credentials.credentials)
-                if await bearer_auth.is_authenticated():
-                    return bearer_auth
-        except (AuthenticationError, ValueError):
+            return container.get_service(Settings)
+        except ValueError:
+            # Service not registered yet; fall through to default settings.
             pass
 
-    # Fall back to credentials only if no auth_token is configured
-    if not settings.security.auth_token:
-        try:
-            credentials_auth = CredentialsAuthManager()
-            if await credentials_auth.is_authenticated():
-                return credentials_auth
-        except AuthenticationError:
-            pass
+    try:
+        return Settings()
+    except Exception:
+        # Settings construction can fail in minimal test contexts.
+        return None
 
-    raise HTTPException(
-        status_code=status.HTTP_401_UNAUTHORIZED,
-        detail="Authentication required",
-        headers={"WWW-Authenticate": "Bearer"},
-    )
 
+def _expected_token(settings: Settings | None) -> str | None:
+    """Extract configured auth token from settings if present."""
 
-async def get_auth_manager(
-    credentials: Annotated[
-        HTTPAuthorizationCredentials | None, Depends(bearer_scheme)
-    ] = None,
-) -> AuthManager:
-    """Get authentication manager with fallback strategy.
+    if settings and settings.security.auth_token:
+        return settings.security.auth_token.get_secret_value()
+    return None
 
-    Try bearer token first, then fall back to credentials.
 
-    Args:
-        credentials: HTTP authorization credentials
+async def _build_bearer_auth_manager(
+    credentials: HTTPAuthorizationCredentials | None,
+    expected_token: str | None,
+    *,
+    require_credentials: bool,
+) -> AuthManager | None:
+    """Create a bearer auth manager when credentials satisfy expectations."""
+
+    token = credentials.credentials if credentials and credentials.credentials else None
+
+    if token is None:
+        if require_credentials:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Authentication required",
+                headers={"WWW-Authenticate": "Bearer"},
+            )
+        return None
+
+    if expected_token is not None and token != expected_token:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid authentication credentials",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
 
-    Returns:
-        AuthManager instance
+    try:
+        bearer_auth = BearerTokenAuthManager(token)
+    except ValueError as exc:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=str(exc),
+            headers={"WWW-Authenticate": "Bearer"},
+        ) from exc
 
-    Raises:
-        HTTPException: If no valid authentication available
-    """
-    # Import here to avoid circular imports
-    from ccproxy.config.settings import get_settings
+    try:
+        if await bearer_auth.is_authenticated():
+            return bearer_auth
+    except AuthenticationError as exc:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=str(exc),
+            headers={"WWW-Authenticate": "Bearer"},
+        ) from exc
 
-    settings = get_settings()
-    return await _get_auth_manager_with_settings(credentials, settings)
+    if require_credentials:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Authentication failed",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    return None
 
 
-async def get_auth_manager_with_injected_settings(
-    credentials: Annotated[
-        HTTPAuthorizationCredentials | None, Depends(bearer_scheme)
-    ] = None,
+async def get_auth_manager(
+    credentials: Annotated[HTTPAuthorizationCredentials | None, Depends(bearer_scheme)],
+    settings: SettingsDep,
 ) -> AuthManager:
-    """Get authentication manager with dependency-injected settings.
-
-    This version uses FastAPI's dependency injection for settings,
-    which allows test overrides to work properly.
-
-    Args:
-        credentials: HTTP authorization credentials
-        settings: Application settings (injected by FastAPI)
+    """Return an authentication manager when credentials are required."""
 
-    Returns:
-        AuthManager instance
-
-    Raises:
-        HTTPException: If no valid authentication available
-    """
-    # Import here to avoid circular imports
-    from ccproxy.config.settings import get_settings
-
-    settings = get_settings()
-    return await _get_auth_manager_with_settings(credentials, settings)
+    auth_manager = await _build_bearer_auth_manager(
+        credentials,
+        _expected_token(settings),
+        require_credentials=True,
+    )
+    # require_credentials ensures auth_manager is never None here.
+    assert auth_manager is not None
+    return auth_manager
 
 
 async def require_auth(
     auth_manager: Annotated[AuthManager, Depends(get_auth_manager)],
 ) -> AuthManager:
-    """Require authentication for endpoint.
-
-    Args:
-        auth_manager: Authentication manager
+    """Enforce authentication, translating failures into HTTP errors."""
 
-    Returns:
-        AuthManager instance
-
-    Raises:
-        HTTPException: If authentication fails
-    """
     try:
         if not await auth_manager.is_authenticated():
             raise AuthenticationRequiredError("Authentication required")
         return auth_manager
-    except AuthenticationError as e:
+    except AuthenticationError as exc:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
-            detail=str(e),
+            detail=str(exc),
             headers={"WWW-Authenticate": "Bearer"},
-        ) from e
+        ) from exc
 
 
 async def get_access_token(
     auth_manager: Annotated[AuthManager, Depends(require_auth)],
 ) -> str:
-    """Get access token from authenticated manager.
-
-    Args:
-        auth_manager: Authentication manager
+    """Retrieve an access token from an authenticated manager."""
 
-    Returns:
-        Access token string
-
-    Raises:
-        HTTPException: If token retrieval fails
-    """
     try:
         return await auth_manager.get_access_token()
-    except AuthenticationError as e:
+    except AuthenticationError as exc:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
-            detail=str(e),
+            detail=str(exc),
             headers={"WWW-Authenticate": "Bearer"},
-        ) from e
+        ) from exc
 
 
-async def get_auth_manager_dependency(
+async def get_conditional_auth_manager(
+    request: Request,
     credentials: Annotated[
         HTTPAuthorizationCredentials | None, Depends(bearer_scheme)
     ] = None,
-) -> AuthManager:
-    """Dependency wrapper for getting auth manager with settings injection."""
-    # Import here to avoid circular imports
-    from ccproxy.config.settings import get_settings
+) -> AuthManager | None:
+    """Return an auth manager only when the configuration requires it."""
 
-    settings = get_settings()
-    return await _get_auth_manager_with_settings(credentials, settings)
+    settings = _resolve_runtime_settings(request)
+    expected_token = _expected_token(settings)
+
+    if expected_token is None:
+        return None
+
+    return await _build_bearer_auth_manager(
+        credentials,
+        expected_token,
+        require_credentials=True,
+    )
 
 
 # Type aliases for common dependencies
 AuthManagerDep = Annotated[AuthManager, Depends(get_auth_manager)]
 RequiredAuthDep = Annotated[AuthManager, Depends(require_auth)]
 AccessTokenDep = Annotated[str, Depends(get_access_token)]
+ConditionalAuthDep = Annotated[
+    AuthManager | None, Depends(get_conditional_auth_manager)
+]

ccproxy/auth/exceptions.py

@@ -61,19 +61,7 @@ class OAuthError(AuthenticationError):
     pass
 
 
-class OAuthLoginError(OAuthError):
-    """OAuth login failed."""
-
-    pass
-
-
 class OAuthTokenRefreshError(OAuthError):
     """OAuth token refresh failed."""
 
     pass
-
-
-class OAuthCallbackError(OAuthError):
-    """OAuth callback failed."""
-
-    pass

ccproxy/auth/manager.py

@@ -1,13 +1,21 @@
-"""Authentication manager interfaces for centralized auth handling."""
+"""Unified authentication manager interface for all providers."""
 
-from abc import ABC, abstractmethod
-from typing import Any, Protocol
+from typing import Any, Protocol, runtime_checkable
 
-from ccproxy.auth.models import ClaudeCredentials, UserProfile
+from ccproxy.auth.models.credentials import BaseCredentials
+from ccproxy.auth.oauth.protocol import StandardProfileFields
 
 
+@runtime_checkable
 class AuthManager(Protocol):
-    """Protocol for authentication managers."""
+    """Unified authentication manager protocol for all providers.
+
+    This protocol defines the complete interface that all authentication managers
+    must implement, supporting both provider-specific methods (like Claude credentials)
+    and generic methods (like auth headers) for maximum flexibility.
+    """
+
+    # ==================== Core Authentication Methods ====================
 
     async def get_access_token(self) -> str:
         """Get valid access token.
@@ -20,14 +28,17 @@ class AuthManager(Protocol):
         """
         ...
 
-    async def get_credentials(self) -> ClaudeCredentials:
+    async def get_credentials(self) -> BaseCredentials:
         """Get valid credentials.
 
+        Note: For non-Claude providers, this may return minimal/dummy credentials
+        or raise AuthenticationError if not supported.
+
         Returns:
             Valid credentials
 
         Raises:
-            AuthenticationError: If authentication fails
+            AuthenticationError: If authentication fails or not supported
         """
         ...
 
@@ -39,64 +50,39 @@ class AuthManager(Protocol):
         """
         ...
 
-    async def get_user_profile(self) -> UserProfile | None:
-        """Get user profile information.
+    async def get_user_profile(self) -> StandardProfileFields | None:
+        """Get standardized user profile information.
 
         Returns:
-            UserProfile if available, None otherwise
+            Standardized profile details when available, otherwise ``None``
+            for providers that do not expose profile metadata.
         """
         ...
 
+    # ==================== Provider-Generic Methods ====================
 
-class BaseAuthManager(ABC):
-    """Base class for authentication managers."""
-
-    @abstractmethod
-    async def get_access_token(self) -> str:
-        """Get valid access token.
-
-        Returns:
-            Access token string
-
-        Raises:
-            AuthenticationError: If authentication fails
-        """
-        pass
-
-    @abstractmethod
-    async def get_credentials(self) -> ClaudeCredentials:
-        """Get valid credentials.
+    async def validate_credentials(self) -> bool:
+        """Validate that credentials are available and valid.
 
         Returns:
-            Valid credentials
-
-        Raises:
-            AuthenticationError: If authentication fails
+            True if credentials are valid, False otherwise
         """
-        pass
+        ...
 
-    @abstractmethod
-    async def is_authenticated(self) -> bool:
-        """Check if current authentication is valid.
+    def get_provider_name(self) -> str:
+        """Get the provider name for logging.
 
         Returns:
-            True if authenticated, False otherwise
+            Provider name string (e.g., "anthropic-claude", "openai-codex")
         """
-        pass
+        ...
 
-    async def get_user_profile(self) -> UserProfile | None:
-        """Get user profile information.
+    # ==================== Context Manager Support ====================
 
-        Returns:
-            UserProfile if available, None otherwise
-        """
-        return None
-
-    async def __aenter__(self) -> "BaseAuthManager":
+    async def __aenter__(self) -> "AuthManager":
         """Async context manager entry."""
-        return self
+        ...
 
-    @abstractmethod
     async def __aexit__(self, exc_type: Any, exc_val: Any, exc_tb: Any) -> None:
         """Async context manager exit."""
-        pass
+        ...

ccproxy/auth/managers/__init__.py

@@ -0,0 +1,10 @@
+"""Token managers for different authentication providers."""
+
+from ccproxy.auth.managers.base import BaseTokenManager
+from ccproxy.auth.managers.token_snapshot import TokenSnapshot
+
+
+__all__ = [
+    "BaseTokenManager",
+    "TokenSnapshot",
+]