conduit-admin-client 0.1.0__tar.gz

conduit_admin_client-0.1.0/.gitignore

@@ -0,0 +1,15 @@
+__pycache__/
+*.pyc
+.env
+.vscode/settings.json
+Resources/BCP/*.xlsx
+scratchpad/*.sql
+.env.*
+.vscode/settings.json
+
+# Dependencies and build output
+node_modules/
+dist/
+
+.claude/settings.local.json
+shared/keys.txt

conduit_admin_client-0.1.0/PKG-INFO

@@ -0,0 +1,11 @@
+Metadata-Version: 2.4
+Name: conduit-admin-client
+Version: 0.1.0
+Summary: Shared client for the Conduit Admin authorization service
+Requires-Python: >=3.11
+Requires-Dist: cachetools>=5.3
+Requires-Dist: httpx>=0.25
+Provides-Extra: dev
+Requires-Dist: httpx>=0.25; extra == 'dev'
+Requires-Dist: pytest>=7.0; extra == 'dev'
+Requires-Dist: respx>=0.20; extra == 'dev'

conduit_admin_client-0.1.0/pyproject.toml

@@ -0,0 +1,26 @@
+[project]
+name = "conduit-admin-client"
+version = "0.1.0"
+description = "Shared client for the Conduit Admin authorization service"
+requires-python = ">=3.11"
+dependencies = [
+    "httpx>=0.25",
+    "cachetools>=5.3",
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=7.0",
+    "respx>=0.20",
+    "httpx>=0.25",
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/conduit_admin_client"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

conduit_admin_client-0.1.0/src/conduit_admin_client/__init__.py

@@ -0,0 +1,25 @@
+"""Shared client for the Conduit Admin authorization service.
+
+Usage:
+    from conduit_admin_client import AdminClient
+
+    client = AdminClient(
+        base_url="http://admin-api:8000",
+        app_code="extractor",
+        service_token="shared-secret",
+    )
+
+    # In a request handler, forward the user's JWT
+    client.set_auth_token(jwt_token)
+
+    # Get authz context (cached 60s per user)
+    ctx = client.get_user_context(object_id)
+
+    # JIT provision if user not found
+    if not ctx:
+        ctx = client.jit_provision(object_id, email, display_name, tenant_id)
+"""
+
+from conduit_admin_client.client import AdminClient
+
+__all__ = ["AdminClient"]

conduit_admin_client-0.1.0/src/conduit_admin_client/client.py

@@ -0,0 +1,126 @@
+"""HTTP client for the Conduit Admin authorization service.
+
+Provides authz resolution and JIT user provisioning with per-user TTL caching.
+Each consumer app creates an instance with its own app_code (e.g. "extractor",
+"mapper", "scripter") so the Admin API resolves app-scoped roles correctly.
+"""
+
+import logging
+import threading
+
+import httpx
+from cachetools import TTLCache
+
+logger = logging.getLogger(__name__)
+
+
+class AdminClient:
+    """Client for the Conduit Admin authz API.
+
+    Args:
+        base_url: Admin API base URL (e.g. "http://admin-api:8000").
+        app_code: This app's code for role resolution (e.g. "extractor").
+        service_token: Shared secret for service-to-service auth (optional).
+        cache_ttl: Seconds to cache authz responses per user. Default 60.
+        cache_maxsize: Max cached users. Default 500.
+        timeout: HTTP request timeout in seconds. Default 5.
+    """
+
+    def __init__(
+        self,
+        base_url: str,
+        app_code: str,
+        service_token: str | None = None,
+        cache_ttl: int = 60,
+        cache_maxsize: int = 500,
+        timeout: float = 5.0,
+    ):
+        self._base_url = base_url.rstrip("/")
+        self._app_code = app_code
+        self._service_token = service_token
+        self._timeout = timeout
+        self._cache: TTLCache = TTLCache(maxsize=cache_maxsize, ttl=cache_ttl)
+        self._local = threading.local()
+
+    def set_auth_token(self, token: str | None):
+        """Store the current request's JWT token for forwarding to Admin API."""
+        self._local.token = token
+
+    def _headers(self) -> dict:
+        """Build headers -- forwards JWT token + service token."""
+        h: dict[str, str] = {"Content-Type": "application/json"}
+        if self._service_token:
+            h["X-Conduit-Service-Token"] = self._service_token
+        token = getattr(self._local, "token", None)
+        if token:
+            h["Authorization"] = f"Bearer {token}"
+        return h
+
+    def get_user_context(self, object_id: str) -> dict | None:
+        """Get authorization context for a user from Admin.
+
+        Returns the full authz response dict, or None if user not found.
+        Cached for ``cache_ttl`` seconds per object_id.
+        """
+        cache_key = f"authz:{object_id}"
+        cached = self._cache.get(cache_key)
+        if cached is not None:
+            return cached
+
+        try:
+            resp = httpx.get(
+                f"{self._base_url}/api/authz/{object_id}",
+                params={"app": self._app_code},
+                headers=self._headers(),
+                timeout=self._timeout,
+            )
+            if resp.status_code == 200:
+                data = resp.json()
+                self._cache[cache_key] = data
+                return data
+            elif resp.status_code == 404:
+                return None
+            else:
+                logger.error("Admin authz returned %s: %s", resp.status_code, resp.text)
+                return None
+        except Exception as e:
+            logger.error("Failed to call Admin authz API: %s", e)
+            return None
+
+    def jit_provision(
+        self,
+        object_id: str,
+        email: str,
+        display_name: str,
+        tenant_id: str | None = None,
+    ) -> dict | None:
+        """JIT-provision a user via Admin and return authz context."""
+        try:
+            resp = httpx.post(
+                f"{self._base_url}/api/authz/jit",
+                json={
+                    "object_id": object_id,
+                    "email": email,
+                    "display_name": display_name,
+                    "tenant_id": tenant_id,
+                },
+                headers=self._headers(),
+                timeout=self._timeout,
+            )
+            if resp.status_code == 200:
+                data = resp.json()
+                self._cache[f"authz:{object_id}"] = data
+                return data
+            else:
+                logger.error("Admin JIT returned %s: %s", resp.status_code, resp.text)
+                return None
+        except Exception as e:
+            logger.error("Failed to call Admin JIT API: %s", e)
+            return None
+
+    def invalidate_cache(self, object_id: str | None = None):
+        """Clear cached authz data for one user or all users."""
+        if object_id:
+            self._cache.pop(f"authz:{object_id}", None)
+        else:
+            self._cache.clear()