edge-authz 0.1.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- edge_authz-0.1.0/.gitattributes +10 -0
- edge_authz-0.1.0/.github/workflows/publish-test.yml +40 -0
- edge_authz-0.1.0/.github/workflows/publish.yml +42 -0
- edge_authz-0.1.0/.github/workflows/run-static.yml +58 -0
- edge_authz-0.1.0/.github/workflows/run-tests.yml +51 -0
- edge_authz-0.1.0/.gitignore +24 -0
- edge_authz-0.1.0/.pre-commit-config.yaml +41 -0
- edge_authz-0.1.0/CONTRIBUTING.md +124 -0
- edge_authz-0.1.0/LICENSE +21 -0
- edge_authz-0.1.0/PKG-INFO +127 -0
- edge_authz-0.1.0/README.md +116 -0
- edge_authz-0.1.0/edge_authz/__init__.py +46 -0
- edge_authz-0.1.0/edge_authz/audit.py +51 -0
- edge_authz-0.1.0/edge_authz/decision.py +50 -0
- edge_authz-0.1.0/edge_authz/policy_file.py +134 -0
- edge_authz-0.1.0/edge_authz/py.typed +0 -0
- edge_authz-0.1.0/edge_authz/tokens.py +65 -0
- edge_authz-0.1.0/pyproject.toml +89 -0
- edge_authz-0.1.0/tests/__init__.py +0 -0
- edge_authz-0.1.0/tests/test_audit_and_decision.py +39 -0
- edge_authz-0.1.0/tests/test_policy_file.py +117 -0
- edge_authz-0.1.0/tests/test_tokens.py +55 -0
- edge_authz-0.1.0/uv.lock +463 -0
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
# Store and check out text files as LF on every platform, overriding a local
|
|
2
|
+
# core.autocrlf=true that would otherwise produce phantom EOL-only diffs.
|
|
3
|
+
# text=auto leaves detected binaries untouched; eol=lf pins the *working tree*.
|
|
4
|
+
* text=auto eol=lf
|
|
5
|
+
|
|
6
|
+
# cmd.exe reads batch files by byte offset, so LF-only endings break labels
|
|
7
|
+
# and goto. Do NOT add *.ps1 here: PowerShell is cross-platform, and CRLF
|
|
8
|
+
# breaks the shebang of a .ps1 meant to run on Linux/macOS.
|
|
9
|
+
*.bat text eol=crlf
|
|
10
|
+
*.cmd text eol=crlf
|
|
@@ -0,0 +1,40 @@
|
|
|
1
|
+
name: Publish to TestPyPI
|
|
2
|
+
on:
|
|
3
|
+
workflow_dispatch:
|
|
4
|
+
|
|
5
|
+
jobs:
|
|
6
|
+
test-pypi-publish:
|
|
7
|
+
name: Upload to TestPyPI
|
|
8
|
+
runs-on: ubuntu-latest
|
|
9
|
+
permissions:
|
|
10
|
+
id-token: write # For PyPI's trusted publishing
|
|
11
|
+
steps:
|
|
12
|
+
- name: Checkout
|
|
13
|
+
uses: actions/checkout@v5
|
|
14
|
+
with:
|
|
15
|
+
fetch-depth: 0
|
|
16
|
+
fetch-tags: true
|
|
17
|
+
|
|
18
|
+
- name: Install uv
|
|
19
|
+
uses: astral-sh/setup-uv@v6
|
|
20
|
+
|
|
21
|
+
- name: Build
|
|
22
|
+
run: uv build
|
|
23
|
+
|
|
24
|
+
- name: Check version format
|
|
25
|
+
run: |
|
|
26
|
+
# Extract version from the built package
|
|
27
|
+
VERSION=$(ls dist/*.whl | head -n1 | sed -E 's/.*-([0-9].*)-.*/\1/')
|
|
28
|
+
echo "Package version: $VERSION"
|
|
29
|
+
|
|
30
|
+
# Check if version contains dev/post markers (development version)
|
|
31
|
+
if [[ "$VERSION" =~ (dev|post.*dev) ]]; then
|
|
32
|
+
echo "❌ ERROR: Cannot publish development version: $VERSION"
|
|
33
|
+
echo "Please create a proper Git tag first (e.g., 'git tag v0.1.0')"
|
|
34
|
+
exit 1
|
|
35
|
+
fi
|
|
36
|
+
|
|
37
|
+
echo "✅ Version $VERSION is valid for publishing"
|
|
38
|
+
|
|
39
|
+
- name: Publish to TestPyPI
|
|
40
|
+
run: uv publish --publish-url https://test.pypi.org/legacy/ -v dist/*
|
|
@@ -0,0 +1,42 @@
|
|
|
1
|
+
name: Publish to PyPI
|
|
2
|
+
on:
|
|
3
|
+
release:
|
|
4
|
+
types: [published]
|
|
5
|
+
workflow_dispatch:
|
|
6
|
+
|
|
7
|
+
jobs:
|
|
8
|
+
pypi-publish:
|
|
9
|
+
name: Upload to PyPI
|
|
10
|
+
runs-on: ubuntu-latest
|
|
11
|
+
permissions:
|
|
12
|
+
id-token: write # For PyPI's trusted publishing
|
|
13
|
+
steps:
|
|
14
|
+
- name: Checkout
|
|
15
|
+
uses: actions/checkout@v5
|
|
16
|
+
with:
|
|
17
|
+
fetch-depth: 0
|
|
18
|
+
fetch-tags: true
|
|
19
|
+
|
|
20
|
+
- name: Install uv
|
|
21
|
+
uses: astral-sh/setup-uv@v6
|
|
22
|
+
|
|
23
|
+
- name: Build
|
|
24
|
+
run: uv build
|
|
25
|
+
|
|
26
|
+
- name: Check version format
|
|
27
|
+
run: |
|
|
28
|
+
# Extract version from the built package
|
|
29
|
+
VERSION=$(ls dist/*.whl | head -n1 | sed -E 's/.*-([0-9].*)-.*/\1/')
|
|
30
|
+
echo "Package version: $VERSION"
|
|
31
|
+
|
|
32
|
+
# Check if version contains dev/post markers (development version)
|
|
33
|
+
if [[ "$VERSION" =~ (dev|post.*dev) ]]; then
|
|
34
|
+
echo "❌ ERROR: Cannot publish development version: $VERSION"
|
|
35
|
+
echo "Please create a proper Git tag first (e.g., 'git tag v0.1.0')"
|
|
36
|
+
exit 1
|
|
37
|
+
fi
|
|
38
|
+
|
|
39
|
+
echo "✅ Version $VERSION is valid for publishing"
|
|
40
|
+
|
|
41
|
+
- name: Publish to PyPI
|
|
42
|
+
run: uv publish -v dist/*
|
|
@@ -0,0 +1,58 @@
|
|
|
1
|
+
name: Run static analysis
|
|
2
|
+
|
|
3
|
+
env:
|
|
4
|
+
# Enable colored output
|
|
5
|
+
PY_COLORS: 1
|
|
6
|
+
|
|
7
|
+
on:
|
|
8
|
+
push:
|
|
9
|
+
branches: ["main"]
|
|
10
|
+
paths:
|
|
11
|
+
- "src/**"
|
|
12
|
+
- "tests/**"
|
|
13
|
+
- "uv.lock"
|
|
14
|
+
- "pyproject.toml"
|
|
15
|
+
- ".github/workflows/**"
|
|
16
|
+
|
|
17
|
+
# Run on all pull requests because these checks are required and will block merges otherwise
|
|
18
|
+
pull_request:
|
|
19
|
+
|
|
20
|
+
workflow_dispatch:
|
|
21
|
+
|
|
22
|
+
permissions:
|
|
23
|
+
contents: read
|
|
24
|
+
|
|
25
|
+
jobs:
|
|
26
|
+
static_analysis:
|
|
27
|
+
timeout-minutes: 2
|
|
28
|
+
|
|
29
|
+
runs-on: ubuntu-latest
|
|
30
|
+
|
|
31
|
+
steps:
|
|
32
|
+
- uses: actions/checkout@v5
|
|
33
|
+
- name: Install uv
|
|
34
|
+
uses: astral-sh/setup-uv@v6
|
|
35
|
+
with:
|
|
36
|
+
enable-cache: true
|
|
37
|
+
cache-dependency-glob: "uv.lock"
|
|
38
|
+
|
|
39
|
+
- name: Install dependencies
|
|
40
|
+
run: uv sync
|
|
41
|
+
|
|
42
|
+
- name: Check lockfile is up to date
|
|
43
|
+
run: |
|
|
44
|
+
if ! uv lock --check; then
|
|
45
|
+
echo "❌ Lockfile is out of date!"
|
|
46
|
+
echo "To update the lockfile, run 'uv lock'."
|
|
47
|
+
exit 1
|
|
48
|
+
fi
|
|
49
|
+
echo "✅ Lockfile is up to date"
|
|
50
|
+
|
|
51
|
+
- name: Lint
|
|
52
|
+
run: uv run ruff check src tests
|
|
53
|
+
|
|
54
|
+
- name: Check formatting
|
|
55
|
+
run: uv run ruff format --check src tests
|
|
56
|
+
|
|
57
|
+
- name: Type checking
|
|
58
|
+
run: uv run ty check src
|
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
name: Run tests
|
|
2
|
+
|
|
3
|
+
env:
|
|
4
|
+
# Enable colored output
|
|
5
|
+
PY_COLORS: 1
|
|
6
|
+
|
|
7
|
+
on:
|
|
8
|
+
push:
|
|
9
|
+
branches: ["main"]
|
|
10
|
+
paths:
|
|
11
|
+
- "src/**"
|
|
12
|
+
- "tests/**"
|
|
13
|
+
- "uv.lock"
|
|
14
|
+
- "pyproject.toml"
|
|
15
|
+
- ".github/workflows/**"
|
|
16
|
+
|
|
17
|
+
# Run on all pull requests because these checks are required and will block merges otherwise
|
|
18
|
+
pull_request:
|
|
19
|
+
|
|
20
|
+
workflow_dispatch:
|
|
21
|
+
|
|
22
|
+
permissions:
|
|
23
|
+
contents: read
|
|
24
|
+
|
|
25
|
+
jobs:
|
|
26
|
+
run_tests:
|
|
27
|
+
name: "Run tests: Python ${{ matrix.python-version }} on ${{ matrix.os }}"
|
|
28
|
+
runs-on: ${{ matrix.os }}
|
|
29
|
+
strategy:
|
|
30
|
+
matrix:
|
|
31
|
+
os: [ubuntu-latest, windows-latest]
|
|
32
|
+
python-version: ["3.11"]
|
|
33
|
+
fail-fast: false
|
|
34
|
+
timeout-minutes: 5
|
|
35
|
+
|
|
36
|
+
steps:
|
|
37
|
+
- uses: actions/checkout@v5
|
|
38
|
+
|
|
39
|
+
- name: Install uv
|
|
40
|
+
uses: astral-sh/setup-uv@v6
|
|
41
|
+
with:
|
|
42
|
+
enable-cache: true
|
|
43
|
+
cache-dependency-glob: "uv.lock"
|
|
44
|
+
python-version: ${{ matrix.python-version }}
|
|
45
|
+
|
|
46
|
+
- name: Install dependencies
|
|
47
|
+
# Run with frozen to use the current lockfile; static checks will determine if it needs updating
|
|
48
|
+
run: uv sync --frozen
|
|
49
|
+
|
|
50
|
+
- name: Run tests
|
|
51
|
+
run: uv run pytest
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
# Python-generated files
|
|
2
|
+
__pycache__/
|
|
3
|
+
*.py[oc]
|
|
4
|
+
build/
|
|
5
|
+
dist/
|
|
6
|
+
wheels/
|
|
7
|
+
*.egg-info
|
|
8
|
+
|
|
9
|
+
# Virtual environments
|
|
10
|
+
.venv/
|
|
11
|
+
|
|
12
|
+
# Log files
|
|
13
|
+
*.log
|
|
14
|
+
|
|
15
|
+
# Coverage reports
|
|
16
|
+
.coverage
|
|
17
|
+
htmlcov/
|
|
18
|
+
.pytest_cache/
|
|
19
|
+
|
|
20
|
+
# VSCode settings
|
|
21
|
+
.vscode/PythonImportHelper-v2-Completion.json
|
|
22
|
+
|
|
23
|
+
# Claude Code local settings (tool permissions, personal overrides — not shared)
|
|
24
|
+
.claude/settings.local.json
|
|
@@ -0,0 +1,41 @@
|
|
|
1
|
+
fail_fast: false
|
|
2
|
+
|
|
3
|
+
repos:
|
|
4
|
+
- repo: https://github.com/abravalheri/validate-pyproject
|
|
5
|
+
rev: v0.24.1
|
|
6
|
+
hooks:
|
|
7
|
+
- id: validate-pyproject
|
|
8
|
+
|
|
9
|
+
- repo: https://github.com/pre-commit/mirrors-prettier
|
|
10
|
+
rev: v3.1.0
|
|
11
|
+
hooks:
|
|
12
|
+
- id: prettier
|
|
13
|
+
types_or: [yaml, json]
|
|
14
|
+
|
|
15
|
+
- repo: https://github.com/astral-sh/ruff-pre-commit
|
|
16
|
+
# Ruff version.
|
|
17
|
+
rev: v0.15.12
|
|
18
|
+
hooks:
|
|
19
|
+
# Run the linter.
|
|
20
|
+
- id: ruff-check
|
|
21
|
+
args: [--fix, --exit-non-zero-on-fix]
|
|
22
|
+
# Run the formatter.
|
|
23
|
+
- id: ruff-format
|
|
24
|
+
|
|
25
|
+
- repo: local
|
|
26
|
+
hooks:
|
|
27
|
+
- id: ty
|
|
28
|
+
name: ty check
|
|
29
|
+
entry: uv run ty check
|
|
30
|
+
language: system
|
|
31
|
+
types: [python]
|
|
32
|
+
files: ^src/|^tests/
|
|
33
|
+
pass_filenames: false
|
|
34
|
+
require_serial: true
|
|
35
|
+
|
|
36
|
+
- repo: https://github.com/codespell-project/codespell
|
|
37
|
+
rev: v2.4.1
|
|
38
|
+
hooks:
|
|
39
|
+
- id: codespell # See pyproject.toml for args
|
|
40
|
+
additional_dependencies:
|
|
41
|
+
- tomli
|
|
@@ -0,0 +1,124 @@
|
|
|
1
|
+
# Contributing <!-- omit in toc -->
|
|
2
|
+
|
|
3
|
+
Thank you for your interest in contributing to `edge-authz`! This document
|
|
4
|
+
provides guidelines for setting up a development environment, making changes,
|
|
5
|
+
and testing them locally before pushing to GitHub.
|
|
6
|
+
|
|
7
|
+
- [Development Setup](#development-setup)
|
|
8
|
+
- [Prerequisites](#prerequisites)
|
|
9
|
+
- [Clone and install](#clone-and-install)
|
|
10
|
+
- [Code Quality](#code-quality)
|
|
11
|
+
- [Enable automatic execution on git commit](#enable-automatic-execution-on-git-commit)
|
|
12
|
+
- [Manual execution](#manual-execution)
|
|
13
|
+
- [Testing](#testing)
|
|
14
|
+
- [Release Process](#release-process)
|
|
15
|
+
- [Testing a release first](#testing-a-release-first)
|
|
16
|
+
- [Building Packages Locally](#building-packages-locally)
|
|
17
|
+
- [Dependency Management](#dependency-management)
|
|
18
|
+
|
|
19
|
+
## Development Setup
|
|
20
|
+
|
|
21
|
+
### Prerequisites
|
|
22
|
+
|
|
23
|
+
- [Python 3.11](https://www.python.org/downloads) or later
|
|
24
|
+
- [uv](https://docs.astral.sh/uv/) — fast Python package manager
|
|
25
|
+
|
|
26
|
+
### Clone and install
|
|
27
|
+
|
|
28
|
+
```bash
|
|
29
|
+
git clone https://github.com/stephaneberle9/python-edge-authz.git
|
|
30
|
+
cd python-edge-authz
|
|
31
|
+
uv sync
|
|
32
|
+
```
|
|
33
|
+
|
|
34
|
+
## Code Quality
|
|
35
|
+
|
|
36
|
+
This project uses `pre-commit` hooks for static checks to maintain high code
|
|
37
|
+
quality standards:
|
|
38
|
+
|
|
39
|
+
| Hook | Purpose |
|
|
40
|
+
| ---- | ------- |
|
|
41
|
+
| `ruff-check` | Python linting (with auto-fix) |
|
|
42
|
+
| `ruff-format` | Python code formatting |
|
|
43
|
+
|
|
44
|
+
### Enable automatic execution on git commit
|
|
45
|
+
|
|
46
|
+
```bash
|
|
47
|
+
uv run pre-commit install
|
|
48
|
+
```
|
|
49
|
+
|
|
50
|
+
### Manual execution
|
|
51
|
+
|
|
52
|
+
```bash
|
|
53
|
+
# Run all checks on all files
|
|
54
|
+
uv run pre-commit run --all-files
|
|
55
|
+
|
|
56
|
+
# Run individual tools
|
|
57
|
+
uv run ruff format src tests # Code formatting
|
|
58
|
+
uv run ruff check --fix src tests # Linting with auto-fix
|
|
59
|
+
uv run ty check src # Type checking
|
|
60
|
+
```
|
|
61
|
+
|
|
62
|
+
## Testing
|
|
63
|
+
|
|
64
|
+
```bash
|
|
65
|
+
# Run all tests with coverage
|
|
66
|
+
uv run pytest
|
|
67
|
+
|
|
68
|
+
# Run a specific test file
|
|
69
|
+
uv run pytest tests/test_chain.py
|
|
70
|
+
|
|
71
|
+
# Run with verbose output
|
|
72
|
+
uv run pytest -v
|
|
73
|
+
|
|
74
|
+
# Show only a coverage summary (skip HTML report)
|
|
75
|
+
uv run pytest --cov-report=term-missing --no-cov-on-fail
|
|
76
|
+
```
|
|
77
|
+
|
|
78
|
+
Coverage is collected from `src/edge_authz` and an HTML report is written
|
|
79
|
+
to `htmlcov/`.
|
|
80
|
+
|
|
81
|
+
## Release Process
|
|
82
|
+
|
|
83
|
+
1. Ensure all changes are committed and the `main` branch is up to date.
|
|
84
|
+
|
|
85
|
+
2. Create and push a version tag:
|
|
86
|
+
|
|
87
|
+
```bash
|
|
88
|
+
git tag v0.1.0
|
|
89
|
+
git push origin v0.1.0
|
|
90
|
+
```
|
|
91
|
+
|
|
92
|
+
3. Create a GitHub release from the tag and add release notes. The
|
|
93
|
+
`publish.yml` workflow triggers automatically and uploads the package to
|
|
94
|
+
PyPI.
|
|
95
|
+
|
|
96
|
+
The package version is derived automatically from the git tag by
|
|
97
|
+
[uv-dynamic-versioning](https://github.com/nicoddemus/uv-dynamic-versioning).
|
|
98
|
+
|
|
99
|
+
### Testing a release first
|
|
100
|
+
|
|
101
|
+
To publish to TestPyPI before a real release, trigger the `publish-test.yml`
|
|
102
|
+
workflow manually from the **Actions** tab on GitHub (select **Run workflow**).
|
|
103
|
+
|
|
104
|
+
## Building Packages Locally
|
|
105
|
+
|
|
106
|
+
```bash
|
|
107
|
+
uv build
|
|
108
|
+
ls dist/
|
|
109
|
+
```
|
|
110
|
+
|
|
111
|
+
This produces both a wheel (`.whl`) and a source distribution (`.tar.gz`).
|
|
112
|
+
|
|
113
|
+
## Dependency Management
|
|
114
|
+
|
|
115
|
+
Dependencies are pinned in `uv.lock` for reproducible installs. After adding or
|
|
116
|
+
changing dependencies in `pyproject.toml`:
|
|
117
|
+
|
|
118
|
+
```bash
|
|
119
|
+
uv lock # update the lockfile
|
|
120
|
+
uv sync # sync your environment to the new lockfile
|
|
121
|
+
```
|
|
122
|
+
|
|
123
|
+
> [!IMPORTANT]
|
|
124
|
+
> Always commit both `pyproject.toml` and `uv.lock` together.
|
edge_authz-0.1.0/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 Stephan Eberle
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
|
@@ -0,0 +1,127 @@
|
|
|
1
|
+
Metadata-Version: 2.5
|
|
2
|
+
Name: edge-authz
|
|
3
|
+
Version: 0.1.0
|
|
4
|
+
Summary: Edge authorization building blocks: client tokens, principals, decisions, a versioned and archived policy file, and a JSONL audit log. Framework-neutral.
|
|
5
|
+
Author-email: Stephan Eberle <stephaneberle9@gmail.com>
|
|
6
|
+
License-Expression: MIT
|
|
7
|
+
License-File: LICENSE
|
|
8
|
+
Requires-Python: >=3.11
|
|
9
|
+
Requires-Dist: tomlkit>=0.13
|
|
10
|
+
Description-Content-Type: text/markdown
|
|
11
|
+
|
|
12
|
+
# edge-authz <!-- omit in toc -->
|
|
13
|
+
|
|
14
|
+
Building blocks for an authorization enforcement point at the edge — a proxy
|
|
15
|
+
or gateway that decides, per request, whether a caller may do something, and
|
|
16
|
+
keeps a trace of every decision. Framework-neutral: no web framework, no
|
|
17
|
+
policy engine.
|
|
18
|
+
|
|
19
|
+
- [What it provides](#what-it-provides)
|
|
20
|
+
- [Installation](#installation)
|
|
21
|
+
- [Usage](#usage)
|
|
22
|
+
- [Client tokens](#client-tokens)
|
|
23
|
+
- [A versioned policy file](#a-versioned-policy-file)
|
|
24
|
+
- [Decisions](#decisions)
|
|
25
|
+
- [Audit log](#audit-log)
|
|
26
|
+
- [Contributing](#contributing)
|
|
27
|
+
- [License](#license)
|
|
28
|
+
|
|
29
|
+
## What it provides
|
|
30
|
+
|
|
31
|
+
| Piece | Purpose |
|
|
32
|
+
| --- | --- |
|
|
33
|
+
| `generate_token`, `hash_token`, `StaticTokenVerifier` | One random bearer token per client; only its SHA-256 is stored |
|
|
34
|
+
| `load_policy` | Reads a TOML policy file, requires a version number, and archives every version it loads |
|
|
35
|
+
| `create_client_token`, `revoke_client_token`, `edit_policy` | Change the policy file in place, keeping comments and raising its version |
|
|
36
|
+
| `Principal`, `Decision`, `PolicyBackend` | Who asks, what was decided and why, and the interface of whatever decides |
|
|
37
|
+
| `JsonlAuditSink`, `pseudonymize` | An append-only audit log flushed to disk per entry, and keyed pseudonyms for identifiers |
|
|
38
|
+
|
|
39
|
+
What a policy allows is the application's business; this package only
|
|
40
|
+
supplies the plumbing around it.
|
|
41
|
+
|
|
42
|
+
## Installation
|
|
43
|
+
|
|
44
|
+
The package is not published to PyPI. Install it from its Git repository:
|
|
45
|
+
|
|
46
|
+
```bash
|
|
47
|
+
uv add "edge-authz @ git+https://github.com/stephaneberle9/python-edge-authz.git"
|
|
48
|
+
```
|
|
49
|
+
|
|
50
|
+
Requires Python 3.11+.
|
|
51
|
+
|
|
52
|
+
## Usage
|
|
53
|
+
|
|
54
|
+
### Client tokens
|
|
55
|
+
|
|
56
|
+
```python
|
|
57
|
+
from edge_authz import StaticTokenVerifier
|
|
58
|
+
|
|
59
|
+
verifier = StaticTokenVerifier(
|
|
60
|
+
{"agent-a": "<sha256 of agent-a's token>"},
|
|
61
|
+
{"agent-a": {"may_write": True}},
|
|
62
|
+
)
|
|
63
|
+
principal = verifier.verify_authorization(request.headers.get("authorization"))
|
|
64
|
+
if principal is None:
|
|
65
|
+
... # 401
|
|
66
|
+
```
|
|
67
|
+
|
|
68
|
+
Tokens carry 256 random bits, so a plain SHA-256 is enough to store them; all
|
|
69
|
+
stored hashes are compared in constant time.
|
|
70
|
+
|
|
71
|
+
### A versioned policy file
|
|
72
|
+
|
|
73
|
+
```toml
|
|
74
|
+
[proxy]
|
|
75
|
+
version = 3
|
|
76
|
+
|
|
77
|
+
[clients.agent-a]
|
|
78
|
+
token_sha256 = "…"
|
|
79
|
+
may_write = true
|
|
80
|
+
```
|
|
81
|
+
|
|
82
|
+
```python
|
|
83
|
+
from edge_authz import create_client_token, load_policy
|
|
84
|
+
|
|
85
|
+
policy = load_policy("policy.toml", "policy-archive", version_table="proxy")
|
|
86
|
+
token = create_client_token("policy.toml", "agent-b", version_table="proxy", prefix="dcp_")
|
|
87
|
+
print(token) # shown once; only its hash is in the file
|
|
88
|
+
```
|
|
89
|
+
|
|
90
|
+
`load_policy` copies each version it loads to `<archive>/<version>-<sha256>.toml`
|
|
91
|
+
and refuses a version that was archived before with different content, so a
|
|
92
|
+
decision logged with a version and hash can always be traced back to the exact
|
|
93
|
+
policy, even when the file itself is not under version control. Editing the
|
|
94
|
+
file by hand means raising `version`; the token functions do that themselves.
|
|
95
|
+
|
|
96
|
+
### Decisions
|
|
97
|
+
|
|
98
|
+
```python
|
|
99
|
+
from edge_authz import Decision, Principal
|
|
100
|
+
|
|
101
|
+
class MyPolicy:
|
|
102
|
+
async def decide(self, principal: Principal, action: str, attributes) -> Decision:
|
|
103
|
+
if action in {"read"}:
|
|
104
|
+
return Decision.allow("reads")
|
|
105
|
+
return Decision.deny("action_not_enabled", "default")
|
|
106
|
+
```
|
|
107
|
+
|
|
108
|
+
### Audit log
|
|
109
|
+
|
|
110
|
+
```python
|
|
111
|
+
from edge_authz import JsonlAuditSink, pseudonymize
|
|
112
|
+
|
|
113
|
+
audit = JsonlAuditSink("audit/audit.jsonl")
|
|
114
|
+
audit.write({"client": principal.id, "decision": "allow", "subject": pseudonymize(key, subject_id)})
|
|
115
|
+
```
|
|
116
|
+
|
|
117
|
+
`write` raises when the entry could not be stored; refuse the request then.
|
|
118
|
+
Pseudonymize identifiers that are personal data with a secret key: plain
|
|
119
|
+
hashes of short identifiers are easy to reverse by trying values.
|
|
120
|
+
|
|
121
|
+
## Contributing
|
|
122
|
+
|
|
123
|
+
See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup and guidelines.
|
|
124
|
+
|
|
125
|
+
## License
|
|
126
|
+
|
|
127
|
+
MIT — see [LICENSE](LICENSE).
|
|
@@ -0,0 +1,116 @@
|
|
|
1
|
+
# edge-authz <!-- omit in toc -->
|
|
2
|
+
|
|
3
|
+
Building blocks for an authorization enforcement point at the edge — a proxy
|
|
4
|
+
or gateway that decides, per request, whether a caller may do something, and
|
|
5
|
+
keeps a trace of every decision. Framework-neutral: no web framework, no
|
|
6
|
+
policy engine.
|
|
7
|
+
|
|
8
|
+
- [What it provides](#what-it-provides)
|
|
9
|
+
- [Installation](#installation)
|
|
10
|
+
- [Usage](#usage)
|
|
11
|
+
- [Client tokens](#client-tokens)
|
|
12
|
+
- [A versioned policy file](#a-versioned-policy-file)
|
|
13
|
+
- [Decisions](#decisions)
|
|
14
|
+
- [Audit log](#audit-log)
|
|
15
|
+
- [Contributing](#contributing)
|
|
16
|
+
- [License](#license)
|
|
17
|
+
|
|
18
|
+
## What it provides
|
|
19
|
+
|
|
20
|
+
| Piece | Purpose |
|
|
21
|
+
| --- | --- |
|
|
22
|
+
| `generate_token`, `hash_token`, `StaticTokenVerifier` | One random bearer token per client; only its SHA-256 is stored |
|
|
23
|
+
| `load_policy` | Reads a TOML policy file, requires a version number, and archives every version it loads |
|
|
24
|
+
| `create_client_token`, `revoke_client_token`, `edit_policy` | Change the policy file in place, keeping comments and raising its version |
|
|
25
|
+
| `Principal`, `Decision`, `PolicyBackend` | Who asks, what was decided and why, and the interface of whatever decides |
|
|
26
|
+
| `JsonlAuditSink`, `pseudonymize` | An append-only audit log flushed to disk per entry, and keyed pseudonyms for identifiers |
|
|
27
|
+
|
|
28
|
+
What a policy allows is the application's business; this package only
|
|
29
|
+
supplies the plumbing around it.
|
|
30
|
+
|
|
31
|
+
## Installation
|
|
32
|
+
|
|
33
|
+
The package is not published to PyPI. Install it from its Git repository:
|
|
34
|
+
|
|
35
|
+
```bash
|
|
36
|
+
uv add "edge-authz @ git+https://github.com/stephaneberle9/python-edge-authz.git"
|
|
37
|
+
```
|
|
38
|
+
|
|
39
|
+
Requires Python 3.11+.
|
|
40
|
+
|
|
41
|
+
## Usage
|
|
42
|
+
|
|
43
|
+
### Client tokens
|
|
44
|
+
|
|
45
|
+
```python
|
|
46
|
+
from edge_authz import StaticTokenVerifier
|
|
47
|
+
|
|
48
|
+
verifier = StaticTokenVerifier(
|
|
49
|
+
{"agent-a": "<sha256 of agent-a's token>"},
|
|
50
|
+
{"agent-a": {"may_write": True}},
|
|
51
|
+
)
|
|
52
|
+
principal = verifier.verify_authorization(request.headers.get("authorization"))
|
|
53
|
+
if principal is None:
|
|
54
|
+
... # 401
|
|
55
|
+
```
|
|
56
|
+
|
|
57
|
+
Tokens carry 256 random bits, so a plain SHA-256 is enough to store them; all
|
|
58
|
+
stored hashes are compared in constant time.
|
|
59
|
+
|
|
60
|
+
### A versioned policy file
|
|
61
|
+
|
|
62
|
+
```toml
|
|
63
|
+
[proxy]
|
|
64
|
+
version = 3
|
|
65
|
+
|
|
66
|
+
[clients.agent-a]
|
|
67
|
+
token_sha256 = "…"
|
|
68
|
+
may_write = true
|
|
69
|
+
```
|
|
70
|
+
|
|
71
|
+
```python
|
|
72
|
+
from edge_authz import create_client_token, load_policy
|
|
73
|
+
|
|
74
|
+
policy = load_policy("policy.toml", "policy-archive", version_table="proxy")
|
|
75
|
+
token = create_client_token("policy.toml", "agent-b", version_table="proxy", prefix="dcp_")
|
|
76
|
+
print(token) # shown once; only its hash is in the file
|
|
77
|
+
```
|
|
78
|
+
|
|
79
|
+
`load_policy` copies each version it loads to `<archive>/<version>-<sha256>.toml`
|
|
80
|
+
and refuses a version that was archived before with different content, so a
|
|
81
|
+
decision logged with a version and hash can always be traced back to the exact
|
|
82
|
+
policy, even when the file itself is not under version control. Editing the
|
|
83
|
+
file by hand means raising `version`; the token functions do that themselves.
|
|
84
|
+
|
|
85
|
+
### Decisions
|
|
86
|
+
|
|
87
|
+
```python
|
|
88
|
+
from edge_authz import Decision, Principal
|
|
89
|
+
|
|
90
|
+
class MyPolicy:
|
|
91
|
+
async def decide(self, principal: Principal, action: str, attributes) -> Decision:
|
|
92
|
+
if action in {"read"}:
|
|
93
|
+
return Decision.allow("reads")
|
|
94
|
+
return Decision.deny("action_not_enabled", "default")
|
|
95
|
+
```
|
|
96
|
+
|
|
97
|
+
### Audit log
|
|
98
|
+
|
|
99
|
+
```python
|
|
100
|
+
from edge_authz import JsonlAuditSink, pseudonymize
|
|
101
|
+
|
|
102
|
+
audit = JsonlAuditSink("audit/audit.jsonl")
|
|
103
|
+
audit.write({"client": principal.id, "decision": "allow", "subject": pseudonymize(key, subject_id)})
|
|
104
|
+
```
|
|
105
|
+
|
|
106
|
+
`write` raises when the entry could not be stored; refuse the request then.
|
|
107
|
+
Pseudonymize identifiers that are personal data with a secret key: plain
|
|
108
|
+
hashes of short identifiers are easy to reverse by trying values.
|
|
109
|
+
|
|
110
|
+
## Contributing
|
|
111
|
+
|
|
112
|
+
See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup and guidelines.
|
|
113
|
+
|
|
114
|
+
## License
|
|
115
|
+
|
|
116
|
+
MIT — see [LICENSE](LICENSE).
|