fastapi-betterauth 0.1.0__py3-none-any.whl

fastapi_betterauth/__init__.py

@@ -0,0 +1,50 @@
+from ssl import SSLContext
+from typing import Any, TypedDict, Unpack
+
+import jwt
+from jwt import PyJWKClient
+
+CLIENT: PyJWKClient | None = None
+BASE_URL: str | None = None
+
+
+class PyJWKClientKwargs(TypedDict, total=False):
+    cache_keys: bool
+    max_cached_keys: int
+    cache_jwk_set: bool
+    lifespan: int
+    headers: dict[str, Any] | None
+    timeout: int
+    ssl_context: SSLContext | None
+
+
+def init_client(
+    base_url: str,
+    auth_path: str = "/api/auth/jwks",
+    **kwargs: Unpack[PyJWKClientKwargs],
+):
+    full_url = f"{base_url}{auth_path}"
+    global BASE_URL, CLIENT
+    BASE_URL = base_url
+    base_url = base_url
+    CLIENT = PyJWKClient(
+        **kwargs,
+        uri=full_url,
+    )
+
+
+def _assert_client() -> PyJWKClient:
+    if CLIENT is None:
+        raise RuntimeError("Client is not initialized call init_client first")
+    return CLIENT
+
+def validate_token(token: str):
+    client = _assert_client()
+    signing_key = client.get_signing_key_from_jwt(token)
+    return jwt.decode(
+        token,
+        signing_key.key,
+        algorithms=["EdDSA"],
+        issuer=BASE_URL,
+        audience=BASE_URL,
+    )

fastapi_betterauth/py.typed

@@ -0,0 +1 @@
+

fastapi_betterauth-0.1.0.dist-info/METADATA

@@ -0,0 +1,118 @@
+Metadata-Version: 2.4
+Name: fastapi-betterauth
+Version: 0.1.0
+Summary: FastAPI helpers for Better Auth JWT verification
+Project-URL: Homepage, https://github.com/lukonik/fastapi-betterauth
+Project-URL: Repository, https://github.com/lukonik/fastapi-betterauth
+Project-URL: Issues, https://github.com/lukonik/fastapi-betterauth/issues
+Author: Luka Onikadze
+License-Expression: MIT
+License-File: LICENSE
+Keywords: auth,better-auth,fastapi,jwks,jwt
+Classifier: Development Status :: 3 - Alpha
+Classifier: Framework :: FastAPI
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: pyjwt[crypto]>=2.12.1
+Provides-Extra: dev
+Requires-Dist: fastapi>=0.100; extra == 'dev'
+Requires-Dist: pytest>=7.4; extra == 'dev'
+Provides-Extra: fastapi
+Requires-Dist: fastapi>=0.100; extra == 'fastapi'
+Description-Content-Type: text/markdown
+
+# fastapi-betterauth
+
+FastAPI helpers for Better Auth JWT verification.
+
+The package verifies Better Auth JWTs with PyJWT and JWKS, then exposes the
+verified claims either through a plain Python verifier or a FastAPI dependency.
+
+## Installation
+
+```bash
+pip install fastapi-betterauth
+```
+
+For FastAPI dependency helpers:
+
+```bash
+pip install "fastapi-betterauth[fastapi]"
+```
+
+## Usage
+
+```python
+from fastapi_betterauth import BetterAuthVerifier
+
+verifier = BetterAuthVerifier("https://your-app.example.com")
+
+claims = verifier.validate_token(token)
+```
+
+By default, the verifier:
+
+- reads keys from `/api/auth/jwks`
+- verifies the `EdDSA` algorithm
+- expects `iss` to match `base_url`
+- expects `aud` to match `base_url`
+
+## FastAPI
+
+```python
+from typing import Annotated
+
+from fastapi import Depends, FastAPI
+from fastapi_betterauth import BetterAuthVerifier
+
+app = FastAPI()
+verifier = BetterAuthVerifier("https://your-app.example.com")
+current_user = verifier.fastapi_dependency()
+
+
+@app.get("/me")
+def me(claims: Annotated[dict, Depends(current_user)]):
+    return claims
+```
+
+Invalid tokens are converted to `401 Unauthorized` responses.
+
+## Configuration
+
+```python
+from fastapi_betterauth import BetterAuthVerifier
+
+verifier = BetterAuthVerifier(
+    "https://your-app.example.com",
+    jwks_path="/api/auth/jwks",
+    issuer="https://your-app.example.com",
+    audience="https://your-app.example.com",
+    algorithms=("EdDSA",),
+    cache_jwk_set=True,
+    lifespan=300,
+)
+```
+
+Set `issuer=None` or `audience=None` to disable that specific validation.
+
+## Compatibility API
+
+The older module-level style is still available:
+
+```python
+from fastapi_betterauth import init_client, validate_token
+
+init_client("https://your-app.example.com")
+claims = validate_token(token)
+```
+
+Prefer `BetterAuthVerifier` for new code because it avoids global state and
+works better for tests, multiple apps, and multi-tenant services.

fastapi_betterauth-0.1.0.dist-info/RECORD

@@ -0,0 +1,6 @@
+fastapi_betterauth/__init__.py,sha256=s40hmNJ0ClI5yWL3lkacxtnnBsmH3KZ69eEsZ8iuwxE,1137
+fastapi_betterauth/py.typed,sha256=AbpHGcgLb-kRsJGnwFEktk7uzpZOCcBY74-YBdrKVGs,1
+fastapi_betterauth-0.1.0.dist-info/METADATA,sha256=INkW2TnTgItqkEQ4_v8-zp6jFcdYc3h4YUqlQIbpBxQ,3134
+fastapi_betterauth-0.1.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+fastapi_betterauth-0.1.0.dist-info/licenses/LICENSE,sha256=PhBYCG7HSJxZL3-AxevMDyRbnmwsNJn9EqnUUyTYhDY,1070
+fastapi_betterauth-0.1.0.dist-info/RECORD,,

fastapi_betterauth-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.29.0
+Root-Is-Purelib: true
+Tag: py3-none-any

fastapi_betterauth-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Luka Onikadze
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.