decern 0.2.0__tar.gz → 0.3.0__tar.gz

decern-0.3.0/PKG-INFO

@@ -0,0 +1,85 @@
+Metadata-Version: 2.5
+Name: decern
+Version: 0.3.0
+Summary: Ask a decern server whether an action is allowed, and get a decision that is recorded to a tamper-evident log. Dependency-free AuthZEN 1.0 client.
+Project-URL: Homepage, https://decern.anivar.net/
+Project-URL: Source, https://github.com/anivar/decern
+Project-URL: Issues, https://github.com/anivar/decern/issues
+Project-URL: Changelog, https://github.com/anivar/decern/blob/main/CHANGELOG.md
+Author: Anivar A Aravind
+License-Expression: Apache-2.0
+Keywords: access-control,ai-agents,audit,authorization,authzen,pdp
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+
+# decern — Python client
+
+[![PyPI](https://anivar.net/badge?src=pypi&name=decern)](https://pypi.org/project/decern/)
+[![License](https://anivar.net/badge?label=license&value=Apache-2.0)](https://github.com/anivar/decern/blob/main/LICENSE)
+[![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.21848620.svg)](https://doi.org/10.5281/zenodo.21848620)
+
+[Website](https://decern.anivar.net/) · [Repository](https://github.com/anivar/decern) ·
+[Commands](https://github.com/anivar/decern/blob/main/docs/CLI.md) ·
+[Issues](https://github.com/anivar/decern/issues)
+
+Ask whether an action is allowed, and get an answer somebody can check afterwards.
+Standard library only — no `requests`, no `httpx`. Python ≥ 3.11.
+
+```sh
+uv add decern
+# and a server to ask:
+cargo install decern-server && decern-serve --trust-proxy
+```
+
+```python
+from decern import Client
+
+c = Client("http://127.0.0.1:8080")  # optionally: token="…"
+
+d = c.evaluate(
+    subject={"type": "Principal", "id": "corp"},
+    action="Read",  # or {"name": "Read"}
+    resource={"type": "Resource", "id": "claim1"},
+)
+
+d.allowed   # True / False
+d.reasons   # the policies that decided it, on allow
+d.errors    # why not, on deny
+```
+
+When `token` is set it is sent as `Authorization: Bearer` on every request, for a
+deployment that requires bearer tokens on the evaluation endpoint.
+
+Also on the client: `c.pubkey()` (the Ed25519 key id the log is signed with) and
+`c.healthy()`. A non-2xx response or transport failure raises `DecernError` with the HTTP
+status and body, so a denial is distinguishable from a misconfigured endpoint. `context` is
+advisory — the server overrides anything it derives itself (the clock, the accountable
+owner), so a caller cannot talk its way into a decision by supplying them.
+
+## What the server gives you
+
+[decern](https://github.com/anivar/decern) is an [AuthZEN
+1.0](https://openid.net/specs/authorization-api-1_0.html) authorization server whose safety
+rules are machine-checked over every input, and whose decisions land in an append-only,
+signed, hash-chained log **before** they are served — a decision that cannot be recorded is
+refused, and a third party can verify what was decided without trusting the operator:
+
+```sh
+decern verify --ledger <file> --pubkey <key>   # the chain and every signature
+decern explain --ledger <file> --seq 12        # one decision, in full
+```
+
+Obtain the public key out of band; a key handed over by the party being audited
+establishes nothing.
+
+## Test
+
+```sh
+cd sdks/python && python -m unittest discover -v
+```
+
+Apache-2.0. Published from CI by OIDC with no stored credential.

decern-0.3.0/README.md

@@ -0,0 +1,67 @@
+# decern — Python client
+
+[![PyPI](https://anivar.net/badge?src=pypi&name=decern)](https://pypi.org/project/decern/)
+[![License](https://anivar.net/badge?label=license&value=Apache-2.0)](https://github.com/anivar/decern/blob/main/LICENSE)
+[![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.21848620.svg)](https://doi.org/10.5281/zenodo.21848620)
+
+[Website](https://decern.anivar.net/) · [Repository](https://github.com/anivar/decern) ·
+[Commands](https://github.com/anivar/decern/blob/main/docs/CLI.md) ·
+[Issues](https://github.com/anivar/decern/issues)
+
+Ask whether an action is allowed, and get an answer somebody can check afterwards.
+Standard library only — no `requests`, no `httpx`. Python ≥ 3.11.
+
+```sh
+uv add decern
+# and a server to ask:
+cargo install decern-server && decern-serve --trust-proxy
+```
+
+```python
+from decern import Client
+
+c = Client("http://127.0.0.1:8080")  # optionally: token="…"
+
+d = c.evaluate(
+    subject={"type": "Principal", "id": "corp"},
+    action="Read",  # or {"name": "Read"}
+    resource={"type": "Resource", "id": "claim1"},
+)
+
+d.allowed   # True / False
+d.reasons   # the policies that decided it, on allow
+d.errors    # why not, on deny
+```
+
+When `token` is set it is sent as `Authorization: Bearer` on every request, for a
+deployment that requires bearer tokens on the evaluation endpoint.
+
+Also on the client: `c.pubkey()` (the Ed25519 key id the log is signed with) and
+`c.healthy()`. A non-2xx response or transport failure raises `DecernError` with the HTTP
+status and body, so a denial is distinguishable from a misconfigured endpoint. `context` is
+advisory — the server overrides anything it derives itself (the clock, the accountable
+owner), so a caller cannot talk its way into a decision by supplying them.
+
+## What the server gives you
+
+[decern](https://github.com/anivar/decern) is an [AuthZEN
+1.0](https://openid.net/specs/authorization-api-1_0.html) authorization server whose safety
+rules are machine-checked over every input, and whose decisions land in an append-only,
+signed, hash-chained log **before** they are served — a decision that cannot be recorded is
+refused, and a third party can verify what was decided without trusting the operator:
+
+```sh
+decern verify --ledger <file> --pubkey <key>   # the chain and every signature
+decern explain --ledger <file> --seq 12        # one decision, in full
+```
+
+Obtain the public key out of band; a key handed over by the party being audited
+establishes nothing.
+
+## Test
+
+```sh
+cd sdks/python && python -m unittest discover -v
+```
+
+Apache-2.0. Published from CI by OIDC with no stored credential.

{decern-0.2.0 → decern-0.3.0}/decern/client.py

@@ -48,15 +48,24 @@ class Decision:
 class Client:
     """Client for a decern PDP speaking AuthZEN 1.0 Access Evaluation."""
 
-    def __init__(self, base_url: str = "http://127.0.0.1:8080", timeout: float = 5.0):
+    def __init__(
+        self,
+        base_url: str = "http://127.0.0.1:8080",
+        timeout: float = 5.0,
+        *,
+        token: str | None = None,
+    ):
         self.base_url = base_url.rstrip("/")
         self.timeout = timeout
+        self.token = token
 
     # --- HTTP ---------------------------------------------------------------
 
     def _request(self, method: str, path: str, body: Optional[dict] = None) -> Any:
         data = json.dumps(body).encode() if body is not None else None
         headers = {"Content-Type": "application/json"} if data else {}
+        if self.token is not None:
+            headers["Authorization"] = f"Bearer {self.token}"
         req = urllib.request.Request(
             self.base_url + path, data=data, headers=headers, method=method
         )

decern-0.3.0/pyproject.toml

@@ -0,0 +1,30 @@
+# SPDX-License-Identifier: Apache-2.0
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "decern"
+version = "0.3.0"
+description = "Ask a decern server whether an action is allowed, and get a decision that is recorded to a tamper-evident log. Dependency-free AuthZEN 1.0 client."
+readme = "README.md"
+requires-python = ">=3.11"
+license = "Apache-2.0"
+dependencies = []
+authors = [{ name = "Anivar A Aravind" }]
+keywords = ["authorization", "authzen", "pdp", "access-control", "ai-agents", "audit"]
+classifiers = [
+    "License :: OSI Approved :: Apache Software License",
+    "Programming Language :: Python :: 3",
+    "Topic :: Security",
+    "Typing :: Typed",
+]
+
+[project.urls]
+Homepage = "https://decern.anivar.net/"
+Source = "https://github.com/anivar/decern"
+Issues = "https://github.com/anivar/decern/issues"
+Changelog = "https://github.com/anivar/decern/blob/main/CHANGELOG.md"
+
+[tool.hatch.build.targets.wheel]
+packages = ["decern"]

{decern-0.2.0 → decern-0.3.0}/tests/test_client.py

@@ -103,6 +103,25 @@ class TestPubkeyHealth(unittest.TestCase):
         self.assertFalse(c.healthy())
 
 
+class TestBearerToken(unittest.TestCase):
+    @staticmethod
+    def _sent_request(client):
+        """Run one evaluate() through urllib and return the outgoing Request."""
+        resp = mock.MagicMock()
+        resp.__enter__.return_value.read.return_value = b'{"decision": true}'
+        with mock.patch("urllib.request.urlopen", return_value=resp) as urlopen:
+            client.evaluate({"id": "a"}, "Read", {"id": "b"})
+        return urlopen.call_args[0][0]
+
+    def test_token_sent_as_bearer_header(self):
+        req = self._sent_request(Client(token="tok123"))
+        self.assertEqual(req.get_header("Authorization"), "Bearer tok123")
+
+    def test_no_token_no_authorization_header(self):
+        req = self._sent_request(Client())
+        self.assertFalse(req.has_header("Authorization"))
+
+
 class TestHttpError(unittest.TestCase):
     def test_http_error_attaches_status_and_body(self):
         import io

decern-0.2.0/PKG-INFO

@@ -1,56 +0,0 @@
-Metadata-Version: 2.4
-Name: decern
-Version: 0.2.0
-Summary: Dependency-free Python client for the decern PDP (AuthZEN 1.0 Access Evaluation).
-License-Expression: Apache-2.0
-Requires-Python: >=3.11
-Description-Content-Type: text/markdown
-
-# decern Python SDK
-
-Dependency-free Python client for the decern PDP, speaking
-[AuthZEN 1.0](https://openid.net/specs/authorization-api-1_0.html) Access Evaluation.
-Standard library only — no `requests`/`httpx`.
-
-## Install
-
-```sh
-uv pip install .
-```
-
-## Usage
-
-Start the PDP:
-
-```sh
-decern-serve
-```
-
-Then:
-
-```python
-from decern import Client
-
-c = Client("http://127.0.0.1:8080")
-
-d = c.evaluate(
-    subject={"type": "Principal", "id": "corp"},
-    action="Read",  # or {"name": "Read"}
-    resource={"type": "Resource", "id": "claim1"},
-    context={"now": 100},  # optional; PDP injects `now` if omitted
-)
-
-print(d.allowed)   # True / False
-print(d.reasons)   # e.g. ["policy0"] on allow
-print(d.errors)    # e.g. ["no_policy"] on deny
-
-c.pubkey()   # ed25519 public key id (hex)
-c.healthy()  # True if /healthz == "ok"
-```
-
-## Test
-
-```sh
-cd sdks/python
-python -m unittest discover -v
-```

decern-0.2.0/README.md

@@ -1,48 +0,0 @@
-# decern Python SDK
-
-Dependency-free Python client for the decern PDP, speaking
-[AuthZEN 1.0](https://openid.net/specs/authorization-api-1_0.html) Access Evaluation.
-Standard library only — no `requests`/`httpx`.
-
-## Install
-
-```sh
-uv pip install .
-```
-
-## Usage
-
-Start the PDP:
-
-```sh
-decern-serve
-```
-
-Then:
-
-```python
-from decern import Client
-
-c = Client("http://127.0.0.1:8080")
-
-d = c.evaluate(
-    subject={"type": "Principal", "id": "corp"},
-    action="Read",  # or {"name": "Read"}
-    resource={"type": "Resource", "id": "claim1"},
-    context={"now": 100},  # optional; PDP injects `now` if omitted
-)
-
-print(d.allowed)   # True / False
-print(d.reasons)   # e.g. ["policy0"] on allow
-print(d.errors)    # e.g. ["no_policy"] on deny
-
-c.pubkey()   # ed25519 public key id (hex)
-c.healthy()  # True if /healthz == "ok"
-```
-
-## Test
-
-```sh
-cd sdks/python
-python -m unittest discover -v
-```

decern-0.2.0/pyproject.toml

@@ -1,16 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-[build-system]
-requires = ["hatchling"]
-build-backend = "hatchling.build"
-
-[project]
-name = "decern"
-version = "0.2.0"
-description = "Dependency-free Python client for the decern PDP (AuthZEN 1.0 Access Evaluation)."
-readme = "README.md"
-requires-python = ">=3.11"
-license = "Apache-2.0"
-dependencies = []
-
-[tool.hatch.build.targets.wheel]
-packages = ["decern"]