decern 0.1.1__tar.gz

decern-0.1.1/.gitignore

@@ -0,0 +1,3 @@
+__pycache__/
+*.pyc
+.ruff_cache/

decern-0.1.1/PKG-INFO

@@ -0,0 +1,58 @@
+Metadata-Version: 2.4
+Name: decern
+Version: 0.1.1
+Summary: Dependency-free Python client for the decern PDP (AuthZEN 1.0 Access Evaluation).
+License-Expression: Apache-2.0
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+
+# decern Python SDK
+
+Dependency-free Python client for the decern PDP, speaking
+[AuthZEN 1.0](https://openid.net/specs/authorization-api-1_0.html) Access Evaluation.
+Standard library only — no `requests`/`httpx`.
+
+## Install
+
+```sh
+pip install .
+# or
+uv pip install .
+```
+
+## Usage
+
+Start the PDP:
+
+```sh
+decern-serve
+```
+
+Then:
+
+```python
+from decern import Client
+
+c = Client("http://127.0.0.1:8080")
+
+d = c.evaluate(
+    subject={"type": "Principal", "id": "corp"},
+    action="Read",  # or {"name": "Read"}
+    resource={"type": "Resource", "id": "claim1"},
+    context={"now": 100},  # optional; PDP injects `now` if omitted
+)
+
+print(d.allowed)   # True / False
+print(d.reasons)   # e.g. ["policy0"] on allow
+print(d.errors)    # e.g. ["no_policy"] on deny
+
+c.pubkey()   # ed25519 public key id (hex)
+c.healthy()  # True if /healthz == "ok"
+```
+
+## Test
+
+```sh
+cd sdks/python
+python -m unittest discover -v
+```

decern-0.1.1/README.md

@@ -0,0 +1,50 @@
+# decern Python SDK
+
+Dependency-free Python client for the decern PDP, speaking
+[AuthZEN 1.0](https://openid.net/specs/authorization-api-1_0.html) Access Evaluation.
+Standard library only — no `requests`/`httpx`.
+
+## Install
+
+```sh
+pip install .
+# or
+uv pip install .
+```
+
+## Usage
+
+Start the PDP:
+
+```sh
+decern-serve
+```
+
+Then:
+
+```python
+from decern import Client
+
+c = Client("http://127.0.0.1:8080")
+
+d = c.evaluate(
+    subject={"type": "Principal", "id": "corp"},
+    action="Read",  # or {"name": "Read"}
+    resource={"type": "Resource", "id": "claim1"},
+    context={"now": 100},  # optional; PDP injects `now` if omitted
+)
+
+print(d.allowed)   # True / False
+print(d.reasons)   # e.g. ["policy0"] on allow
+print(d.errors)    # e.g. ["no_policy"] on deny
+
+c.pubkey()   # ed25519 public key id (hex)
+c.healthy()  # True if /healthz == "ok"
+```
+
+## Test
+
+```sh
+cd sdks/python
+python -m unittest discover -v
+```

decern-0.1.1/decern/__init__.py

@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: Apache-2.0
+"""Minimal, dependency-free Python client for the decern PDP (AuthZEN 1.0)."""
+
+from .client import Client, Decision, DecernError
+
+__all__ = ["Client", "Decision", "DecernError"]
+__version__ = "0.1.0"

decern-0.1.1/decern/client.py

@@ -0,0 +1,84 @@
+# SPDX-License-Identifier: Apache-2.0
+"""AuthZEN 1.0 Access Evaluation client for the decern PDP."""
+
+from __future__ import annotations
+
+import json
+import urllib.error
+import urllib.request
+from dataclasses import dataclass, field
+from typing import Any, Dict, List, Optional, Union
+
+Entity = Dict[str, Any]  # {"type": ..., "id": ...}
+Action = Union[str, Dict[str, Any]]
+
+
+class DecernError(Exception):
+    """Transport failure or non-2xx response from the PDP."""
+
+
+@dataclass
+class Decision:
+    allowed: bool
+    reasons: List[str] = field(default_factory=list)
+    errors: List[str] = field(default_factory=list)
+    context: Optional[Dict[str, Any]] = None
+
+
+class Client:
+    """Client for a decern PDP speaking AuthZEN 1.0 Access Evaluation."""
+
+    def __init__(self, base_url: str = "http://127.0.0.1:8080", timeout: float = 5.0):
+        self.base_url = base_url.rstrip("/")
+        self.timeout = timeout
+
+    # --- HTTP ---------------------------------------------------------------
+
+    def _request(self, method: str, path: str, body: Optional[dict] = None) -> Any:
+        data = json.dumps(body).encode() if body is not None else None
+        headers = {"Content-Type": "application/json"} if data else {}
+        req = urllib.request.Request(
+            self.base_url + path, data=data, headers=headers, method=method
+        )
+        try:
+            with urllib.request.urlopen(req, timeout=self.timeout) as resp:
+                raw = resp.read().decode()
+        except urllib.error.HTTPError as e:
+            raise DecernError(f"{method} {path} -> {e.code} {e.reason}") from e
+        except urllib.error.URLError as e:
+            raise DecernError(f"{method} {path} failed: {e.reason}") from e
+        return raw
+
+    # --- API ----------------------------------------------------------------
+
+    def evaluate(
+        self,
+        subject: Entity,
+        action: Action,
+        resource: Entity,
+        context: Optional[Dict[str, Any]] = None,
+    ) -> Decision:
+        act = {"name": action} if isinstance(action, str) else action
+        body: Dict[str, Any] = {"subject": subject, "action": act, "resource": resource}
+        if context is not None:
+            body["context"] = context
+        raw = self._request("POST", "/access/v1/evaluation", body)
+        resp = json.loads(raw)
+        ctx = resp.get("context") or None
+        reasons = list(ctx.get("reasons", [])) if ctx else []
+        errors = list(ctx.get("errors", [])) if ctx else []
+        return Decision(
+            allowed=bool(resp.get("decision", False)),
+            reasons=reasons,
+            errors=errors,
+            context=ctx,
+        )
+
+    def pubkey(self) -> str:
+        return json.loads(self._request("GET", "/pubkey"))["kid"]
+
+    def healthy(self) -> bool:
+        try:
+            return self._request("GET", "/healthz").strip() == "ok"
+        except DecernError:
+            return False

decern-0.1.1/pyproject.toml

@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: Apache-2.0
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "decern"
+version = "0.1.1"
+description = "Dependency-free Python client for the decern PDP (AuthZEN 1.0 Access Evaluation)."
+readme = "README.md"
+requires-python = ">=3.11"
+license = "Apache-2.0"
+dependencies = []
+
+[tool.hatch.build.targets.wheel]
+packages = ["decern"]

decern-0.1.1/tests/__init__.py

@@ -0,0 +1 @@
+# SPDX-License-Identifier: Apache-2.0

decern-0.1.1/tests/test_client.py

@@ -0,0 +1,107 @@
+# SPDX-License-Identifier: Apache-2.0
+"""Tests for the decern client. No network/server required."""
+
+import json
+import unittest
+from unittest import mock
+
+from decern import Client, Decision, DecernError
+
+
+class FakeTransport:
+    """Records requests and returns a queued raw response string."""
+
+    def __init__(self, raw="{}"):
+        self.raw = raw
+        self.calls = []
+
+    def __call__(self, method, path, body=None):
+        self.calls.append((method, path, body))
+        return self.raw
+
+
+def client_with(raw="{}"):
+    c = Client()
+    t = FakeTransport(raw)
+    c._request = t  # inject fake transport
+    return c, t
+
+
+class TestEvaluateBody(unittest.TestCase):
+    def test_builds_exact_authzen_body(self):
+        c, t = client_with('{"decision": true}')
+        c.evaluate(
+            {"type": "Principal", "id": "corp"},
+            "Read",
+            {"type": "Resource", "id": "claim1"},
+            {"now": 100},
+        )
+        method, path, body = t.calls[0]
+        self.assertEqual(method, "POST")
+        self.assertEqual(path, "/access/v1/evaluation")
+        self.assertEqual(
+            body,
+            {
+                "subject": {"type": "Principal", "id": "corp"},
+                "action": {"name": "Read"},
+                "resource": {"type": "Resource", "id": "claim1"},
+                "context": {"now": 100},
+            },
+        )
+
+    def test_action_dict_passthrough_and_context_omitted(self):
+        c, t = client_with('{"decision": false}')
+        c.evaluate(
+            {"type": "Principal", "id": "corp"},
+            {"name": "Write", "extra": 1},
+            {"type": "Resource", "id": "r"},
+        )
+        _, _, body = t.calls[0]
+        self.assertEqual(body["action"], {"name": "Write", "extra": 1})
+        self.assertNotIn("context", body)
+
+
+class TestResponseParsing(unittest.TestCase):
+    def test_allow_with_reasons(self):
+        c, _ = client_with(json.dumps({"decision": True, "context": {"reasons": ["policy0"]}}))
+        d = c.evaluate({"id": "a"}, "Read", {"id": "b"})
+        self.assertIsInstance(d, Decision)
+        self.assertTrue(d.allowed)
+        self.assertEqual(d.reasons, ["policy0"])
+        self.assertEqual(d.errors, [])
+
+    def test_deny_with_errors(self):
+        c, _ = client_with(json.dumps({"decision": False, "context": {"errors": ["no_policy"]}}))
+        d = c.evaluate({"id": "a"}, "Read", {"id": "b"})
+        self.assertFalse(d.allowed)
+        self.assertEqual(d.errors, ["no_policy"])
+        self.assertEqual(d.reasons, [])
+
+    def test_bare_decision(self):
+        c, _ = client_with('{"decision": true}')
+        d = c.evaluate({"id": "a"}, "Read", {"id": "b"})
+        self.assertTrue(d.allowed)
+        self.assertIsNone(d.context)
+
+
+class TestPubkeyHealth(unittest.TestCase):
+    def test_pubkey(self):
+        c, _ = client_with('{"kid": "deadbeef"}')
+        self.assertEqual(c.pubkey(), "deadbeef")
+
+    def test_healthy_ok(self):
+        c, _ = client_with("ok")
+        self.assertTrue(c.healthy())
+
+    def test_healthy_bad_body(self):
+        c, _ = client_with("nope")
+        self.assertFalse(c.healthy())
+
+    def test_healthy_transport_error(self):
+        c = Client()
+        c._request = mock.Mock(side_effect=DecernError("boom"))
+        self.assertFalse(c.healthy())
+
+
+if __name__ == "__main__":
+    unittest.main()