fastapi-multiauth 0.1.0__py3-none-any.whl

fastapi_multiauth/sources/cookie.py

@@ -0,0 +1,153 @@
+"""Cookie-based authentication source."""
+
+import hashlib
+from collections.abc import Sequence
+from typing import Any, Callable, Literal
+
+from fastapi import Request, Response
+from fastapi.security import APIKeyCookie
+from itsdangerous import BadSignature, TimestampSigner
+
+from fastapi_multiauth.exceptions import UnauthorizedError
+
+from ..abc import ValidatedAuthSource
+
+_MIN_SECRET_KEY_BYTES = 32
+_SALT_PREFIX = "fastapi-multiauth.cookie."
+
+SameSite = Literal["lax", "strict", "none"]
+
+
+def _normalize_secret_keys(secret_key: str | Sequence[str] | None) -> list[str]:
+    """Validate and normalize ``secret_key`` into a list of keys."""
+    if secret_key is None:
+        return []
+    keys = [secret_key] if isinstance(secret_key, str) else list(secret_key)
+    if not keys:
+        raise ValueError("secret_key must contain at least one key")
+    for key in keys:
+        if len(key.encode()) < _MIN_SECRET_KEY_BYTES:
+            raise ValueError(
+                f"each secret_key must be at least {_MIN_SECRET_KEY_BYTES} "
+                "bytes of high-entropy material (e.g. secrets.token_urlsafe(32)); "
+                "an empty or short key would weaken cookie signing"
+            )
+    return keys
+
+
+class APIKeyCookieAuth(ValidatedAuthSource):
+    """Cookie-based authentication source (wraps ``APIKeyCookie`` for OpenAPI).
+
+    When ``secret_key`` is set, the cookie is signed (HMAC-SHA256 with an
+    embedded timestamp, salted by the cookie name) for stateless, tamper-proof
+    sessions; otherwise the raw cookie value is passed through.
+
+    Args:
+        name: Cookie name.
+        validator: Sync or async callable receiving the cookie value (plain,
+            after signature verification when signed) and returning the identity.
+        secret_key: One key or a sequence to rotate (first signs, all verify);
+            each at least 32 bytes. When ``None``, the cookie is not signed.
+        ttl: Cookie lifetime in seconds (default 24 h); also enforced
+            server-side when the cookie is signed.
+        secure: Set the ``Secure`` flag (default ``True``); disable only in local dev.
+        samesite: ``SameSite`` cookie attribute (default ``"lax"``).
+        domain: Optional ``Domain`` cookie attribute.
+        path: ``Path`` cookie attribute (default ``"/"``).
+        scheme_name: OpenAPI security scheme name (default ``APIKeyCookie_{name}``).
+        **kwargs: Extra keyword arguments forwarded to the validator on every call.
+    """
+
+    def __init__(
+        self,
+        name: str,
+        validator: Callable[..., Any],
+        *,
+        secret_key: str | Sequence[str] | None = None,
+        ttl: int = 86400,
+        secure: bool = True,
+        samesite: SameSite = "lax",
+        domain: str | None = None,
+        path: str = "/",
+        scheme_name: str | None = None,
+        **kwargs: Any,
+    ) -> None:
+        if ttl <= 0:
+            raise ValueError("ttl must be a positive number of seconds")
+        self._name = name
+        self._secret_keys = _normalize_secret_keys(secret_key)
+        # itsdangerous verifies against every key in the list but signs with
+        # the last one — reverse so the first configured key is the signer.
+        self._signer = (
+            TimestampSigner(
+                list(reversed(self._secret_keys)),
+                salt=f"{_SALT_PREFIX}{name}",
+                digest_method=hashlib.sha256,
+            )
+            if self._secret_keys
+            else None
+        )
+        self._ttl = ttl
+        self._secure = secure
+        self._samesite: SameSite = samesite
+        self._domain = domain
+        self._path = path
+        super().__init__(
+            validator,
+            APIKeyCookie(
+                name=name,
+                auto_error=False,
+                scheme_name=scheme_name or f"APIKeyCookie_{name}",
+            ),
+            **kwargs,
+        )
+
+    def _sign(self, value: str) -> str:
+        if self._signer is None:
+            raise RuntimeError("_sign called without secret_key configured")
+        return self._signer.sign(value.encode()).decode()
+
+    def _verify(self, cookie_value: str) -> str:
+        """Return the plain value, verifying signature + expiry when signed."""
+        if self._signer is None:
+            return cookie_value
+        try:
+            return self._signer.unsign(
+                cookie_value.encode(), max_age=self._ttl
+            ).decode()
+        except BadSignature:
+            raise UnauthorizedError() from None
+
+    async def extract(self, request: Request) -> str | None:
+        """Return the raw cookie value, or ``None`` when absent or empty."""
+        return request.cookies.get(self._name) or None
+
+    async def authenticate_scoped(self, credential: str, scopes: list[str]) -> Any:
+        """Verify the cookie, forwarding route-declared scopes to the validator."""
+        plain = self._verify(credential)
+        return await self._call_validator(plain, scopes=scopes)
+
+    def set_cookie(self, response: Response, value: str) -> None:
+        """Attach the cookie to *response*, signing it when ``secret_key`` is set."""
+        cookie_value = self._sign(value) if self._signer else value
+        response.set_cookie(
+            self._name,
+            cookie_value,
+            httponly=True,
+            samesite=self._samesite,
+            secure=self._secure,
+            max_age=self._ttl,
+            domain=self._domain,
+            path=self._path,
+        )
+
+    def delete_cookie(self, response: Response) -> None:
+        """Clear the session cookie (logout) from this client only."""
+        response.delete_cookie(
+            self._name,
+            httponly=True,
+            samesite=self._samesite,
+            secure=self._secure,
+            domain=self._domain,
+            path=self._path,
+        )

fastapi_multiauth/sources/header.py

@@ -0,0 +1,45 @@
+"""API key header authentication source."""
+
+from typing import Any, Callable
+
+from fastapi import Request
+from fastapi.security import APIKeyHeader
+
+from ..abc import ValidatedAuthSource
+
+
+class APIKeyHeaderAuth(ValidatedAuthSource):
+    """API key header authentication source (wraps ``APIKeyHeader`` for OpenAPI).
+
+    The validator is called as ``await validator(api_key, **kwargs)``.
+
+    Args:
+        name: HTTP header name that carries the API key (e.g. ``"X-API-Key"``).
+        validator: Sync or async callable returning the identity; raises
+            :class:`~fastapi_multiauth.exceptions.UnauthorizedError` on failure.
+        scheme_name: OpenAPI security scheme name (default ``APIKeyHeader_{name}``).
+        **kwargs: Extra keyword arguments forwarded to the validator on every call.
+    """
+
+    def __init__(
+        self,
+        name: str,
+        validator: Callable[..., Any],
+        *,
+        scheme_name: str | None = None,
+        **kwargs: Any,
+    ) -> None:
+        self._name = name
+        super().__init__(
+            validator,
+            APIKeyHeader(
+                name=name,
+                auto_error=False,
+                scheme_name=scheme_name or f"APIKeyHeader_{name}",
+            ),
+            **kwargs,
+        )
+
+    async def extract(self, request: Request) -> str | None:
+        """Return the API key from the configured header, or ``None`` when absent or empty."""
+        return request.headers.get(self._name) or None

fastapi_multiauth/sources/multi.py

@@ -0,0 +1,97 @@
+"""MultiAuth: combine multiple authentication sources into a single callable."""
+
+import inspect
+from typing import Any, cast
+
+from fastapi import Request
+from fastapi.security import SecurityScopes
+
+from fastapi_multiauth.exceptions import UnauthorizedError
+
+from ..abc import AuthSource
+from ..utils import challenge_headers
+
+
+class MultiAuth:
+    """Combine multiple authentication sources into a single callable.
+
+    Sources are tried in declaration order through the same ``extract()``/
+    ``authenticate()`` pair used by direct ``Security(source)`` access.
+
+    Args:
+        *sources: Auth source instances to try in order.
+
+    Raises:
+        TypeError: If a source is not an :class:`AuthSource` instance.
+    """
+
+    def __init__(self, *sources: AuthSource) -> None:
+        for source in sources:
+            if not isinstance(source, AuthSource):
+                hint = (
+                    " (MultiAuth cannot be nested)"
+                    if isinstance(source, MultiAuth)
+                    else ""
+                )
+                raise TypeError(
+                    "MultiAuth sources must be AuthSource instances, "
+                    f"got {type(source).__name__}{hint}"
+                )
+        self._sources = sources
+
+        # Build a merged signature that includes the security-scheme Depends()
+        # parameters from every source so FastAPI registers them in OpenAPI
+        # docs. Parameters are renamed `_s{i}_{name}` — unique per source
+        # index — so two sources of the same type both keep their scheme.
+        merged: list[inspect.Parameter] = [
+            inspect.Parameter(
+                "request",
+                inspect.Parameter.POSITIONAL_OR_KEYWORD,
+                annotation=Request,
+            ),
+            inspect.Parameter(
+                "security_scopes",
+                inspect.Parameter.POSITIONAL_OR_KEYWORD,
+                annotation=SecurityScopes,
+            ),
+        ]
+        for i, source in enumerate(sources):
+            for name, param in inspect.signature(source).parameters.items():
+                if name in ("request", "security_scopes"):
+                    continue
+                merged.append(param.replace(name=f"_s{i}_{name}"))
+        self.__signature__ = inspect.Signature(merged, return_annotation=Any)
+
+        # The combined challenge is fixed once the sources are known; build it
+        # once here instead of rebuilding it on every unauthenticated request.
+        challenges: list[str] = []
+        for source in sources:
+            challenge = source.www_authenticate()
+            if challenge and challenge not in challenges:
+                challenges.append(challenge)
+        self._www_authenticate = ", ".join(challenges) or None
+
+    def www_authenticate(self) -> str | None:
+        """Combined challenge of all sources (RFC 9110 §11.6.1), or ``None``."""
+        return self._www_authenticate
+
+    async def dispatch(self, request: Request, scopes: list[str]) -> Any:
+        """Authenticate with the first source whose credential is present."""
+        for source in self._sources:
+            credential = await source.extract(request)
+            if credential is not None:
+                return await source._authenticate_with_challenge(credential, scopes)
+        raise UnauthorizedError(headers=challenge_headers(self.www_authenticate()))
+
+    async def __call__(self, **kwargs: Any) -> Any:
+        return await self.dispatch(kwargs["request"], kwargs["security_scopes"].scopes)
+
+    def require(self, **kwargs: Any) -> "MultiAuth":
+        """Return a new :class:`MultiAuth` with kwargs forwarded to each source."""
+        new_sources = tuple(
+            cast(Any, source).require(**kwargs)
+            if hasattr(source, "require")
+            else source
+            for source in self._sources
+        )
+        return MultiAuth(*new_sources)

fastapi_multiauth/sources/query.py

@@ -0,0 +1,50 @@
+"""API key query-string authentication source."""
+
+from typing import Any, Callable
+
+from fastapi import Request
+from fastapi.security import APIKeyQuery
+
+from ..abc import ValidatedAuthSource
+
+
+class APIKeyQueryAuth(ValidatedAuthSource):
+    """API key query-string authentication source (wraps ``APIKeyQuery`` for OpenAPI).
+
+    The validator is called as ``await validator(api_key, **kwargs)``.
+
+    .. warning::
+        Credentials in the query string leak into access logs, browser history,
+        and ``Referer`` headers. Prefer a header or cookie when you can; use this
+        only for clients that cannot set headers.
+
+    Args:
+        name: Query parameter name that carries the API key (e.g. ``"api_key"``).
+        validator: Sync or async callable returning the identity; raises
+            :class:`~fastapi_multiauth.exceptions.UnauthorizedError` on failure.
+        scheme_name: OpenAPI security scheme name (default ``APIKeyQuery_{name}``).
+        **kwargs: Extra keyword arguments forwarded to the validator on every call.
+    """
+
+    def __init__(
+        self,
+        name: str,
+        validator: Callable[..., Any],
+        *,
+        scheme_name: str | None = None,
+        **kwargs: Any,
+    ) -> None:
+        self._name = name
+        super().__init__(
+            validator,
+            APIKeyQuery(
+                name=name,
+                auto_error=False,
+                scheme_name=scheme_name or f"APIKeyQuery_{name}",
+            ),
+            **kwargs,
+        )
+
+    async def extract(self, request: Request) -> str | None:
+        """Return the API key from the configured query parameter, or ``None`` when absent or empty."""
+        return request.query_params.get(self._name) or None

fastapi_multiauth/utils.py

@@ -0,0 +1,83 @@
+"""Standalone helpers: public token utilities plus internal source helpers."""
+
+import functools
+import hashlib
+import hmac
+import inspect
+from typing import Any, Callable
+
+from fastapi import HTTPException, Request
+
+
+def hash_token(token: str) -> str:
+    """Return the SHA-256 hex digest of an opaque token.
+
+    Args:
+        token: The opaque token, including any prefix.
+
+    Returns:
+        A 64-character lowercase hex digest.
+    """
+    return hashlib.sha256(token.encode()).hexdigest()
+
+
+def verify_token_hash(token: str, stored_hash: str) -> bool:
+    """Compare a presented token against a stored hash in constant time.
+
+    Args:
+        token: The opaque token presented by the client.
+        stored_hash: The hex digest previously stored via :func:`hash_token`.
+
+    Returns:
+        ``True`` if the token matches the stored hash.
+    """
+    return hmac.compare_digest(hash_token(token), stored_hash)
+
+
+def ensure_async(fn: Callable[..., Any]) -> Callable[..., Any]:
+    """Wrap *fn* so it can always be awaited, regardless of sync or async."""
+    if inspect.iscoroutinefunction(fn) or inspect.iscoroutinefunction(
+        getattr(fn, "__call__", None)  # noqa: B004 — detecting async __call__, not callability
+    ):
+        return fn
+
+    @functools.wraps(fn)
+    async def wrapper(*args: Any, **kwargs: Any) -> Any:
+        result = fn(*args, **kwargs)
+        if inspect.isawaitable(result):
+            return await result
+        return result
+
+    return wrapper
+
+
+def challenge_headers(challenge: str | None) -> dict[str, str] | None:
+    """Build the ``WWW-Authenticate`` header dict for a 401 (RFC 7235 §4.1)."""
+    if not challenge:
+        return None
+    return {"WWW-Authenticate": challenge}
+
+
+def add_challenge(exc: HTTPException, challenge: str | None) -> None:
+    """Attach a ``WWW-Authenticate`` challenge to a 401 that lacks one."""
+    if exc.status_code != 401 or not challenge:
+        return
+    headers = dict(exc.headers or {})
+    if "WWW-Authenticate" not in headers:
+        headers["WWW-Authenticate"] = challenge
+        exc.headers = headers
+
+
+def authorization_credential(request: Request, scheme: str) -> str | None:
+    """Extract the value of an ``Authorization: <scheme> <value>`` header.
+
+    The scheme is matched case-insensitively (RFC 7235 §2.1). Returns ``None``
+    when the header is absent, carries a different scheme, or has an empty value.
+    """
+    authorization = request.headers.get("Authorization")
+    if authorization is None:
+        return None
+    header_scheme, sep, value = authorization.partition(" ")
+    if not sep or header_scheme.lower() != scheme:
+        return None
+    return value.strip() or None

fastapi_multiauth-0.1.0.dist-info/METADATA

@@ -0,0 +1,161 @@
+Metadata-Version: 2.4
+Name: fastapi-multiauth
+Version: 0.1.0
+Summary: Composable authentication sources for FastAPI: bring your own validator, combine multiple schemes, correct OpenAPI by construction
+Keywords: fastapi,authentication,security,oauth,api-key,bearer,cookie
+Author: d3vyce
+Author-email: d3vyce <contact@d3vyce.fr>
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 4 - Beta
+Classifier: Framework :: AsyncIO
+Classifier: Framework :: FastAPI
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Internet :: WWW/HTTP :: Session
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Topic :: Software Development :: Libraries
+Classifier: Typing :: Typed
+Requires-Dist: anyio>=3.7
+Requires-Dist: async-lru>=2.0
+Requires-Dist: fastapi>=0.100.0
+Requires-Dist: httpx>=0.25.0
+Requires-Dist: itsdangerous>=2.1
+Requires-Dist: pyjwt[crypto]>=2.8 ; extra == 'jwt'
+Requires-Dist: httpx-oauth>=0.16 ; extra == 'oauth'
+Requires-Python: >=3.10
+Project-URL: Homepage, https://github.com/d3vyce/fastapi-multiauth
+Project-URL: Documentation, https://fastapi-multiauth.d3vyce.fr/
+Project-URL: Repository, https://github.com/d3vyce/fastapi-multiauth
+Project-URL: Issues, https://github.com/d3vyce/fastapi-multiauth/issues
+Provides-Extra: jwt
+Provides-Extra: oauth
+Description-Content-Type: text/markdown
+
+# FastAPI MultiAuth
+
+Composable authentication sources for FastAPI: bring your own validator, combine multiple schemes with `MultiAuth`, and get correct OpenAPI documentation by construction.
+
+[![CI](https://github.com/d3vyce/fastapi-multiauth/actions/workflows/ci.yml/badge.svg)](https://github.com/d3vyce/fastapi-multiauth/actions/workflows/ci.yml)
+[![codecov](https://codecov.io/gh/d3vyce/fastapi-multiauth/graph/badge.svg)](https://codecov.io/gh/d3vyce/fastapi-multiauth)
+[![ty](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ty/main/assets/badge/v0.json)](https://github.com/astral-sh/ty)
+[![uv](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/uv/main/assets/badge/v0.json)](https://github.com/astral-sh/uv)
+[![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
+[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+
+---
+
+**Documentation**: [https://fastapi-multiauth.d3vyce.fr](https://fastapi-multiauth.d3vyce.fr)
+
+**Source Code**: [https://github.com/d3vyce/fastapi-multiauth](https://github.com/d3vyce/fastapi-multiauth)
+
+---
+
+`fastapi-multiauth` is the composable layer between the raw primitives of `fastapi.security` and opinionated frameworks like fastapi-users or AuthX. You provide the validator; the library handles extraction, scheme combination, and OpenAPI declaration. No database coupling, no user model, no ready-made login routes.
+
+## Installation
+
+```bash
+uv add fastapi-multiauth
+```
+
+Optional extras pull in their dependencies on demand:
+
+```bash
+uv add "fastapi-multiauth[jwt]"     # JWTValidator (PyJWT)
+uv add "fastapi-multiauth[oauth]"   # OAuth 2.0 / OIDC helpers (httpx-oauth)
+uv add "fastapi-multiauth[jwt,oauth]"
+```
+
+## Quick Start
+
+```python
+from fastapi import FastAPI, Security
+from fastapi_multiauth import HTTPBearerAuth, APIKeyCookieAuth, MultiAuth, UnauthorizedError
+
+async def validate_token(token: str) -> dict:
+    user = await lookup_user_by_token(token)
+    if user is None:
+        raise UnauthorizedError()
+    return user
+
+async def validate_session(value: str) -> dict:
+    return await lookup_user_by_session(value)
+
+bearer = HTTPBearerAuth(validate_token, prefix="user_")
+session = APIKeyCookieAuth("session", validate_session, secret_key="...")
+
+# Accept either an API token or a web session on the same route.
+auth = MultiAuth(bearer, session)
+
+app = FastAPI()
+
+@app.get("/me")
+async def me(user=Security(auth)):
+    return user
+```
+
+## Features
+
+- **BYO validator**: every source wraps a sync or async callable you provide; the library never touches your user model or database.
+- **`MultiAuth`**: try several sources in order on a single route (e.g. web session cookie + API bearer token), with all schemes documented in OpenAPI.
+- **Built-in sources**: covering the standard `fastapi.security` schemes:
+    - **`HTTPBearerAuth`**: bearer tokens with optional Stripe-style `user_`/`org_` prefixes to route different token types to different validators, plus `generate_token()` for secure token creation.
+    - **`APIKeyCookieAuth`**: cookie sessions with optional HMAC-SHA256 signing (via [itsdangerous](https://itsdangerous.palletsprojects.com/)), embedded expiry, and key rotation.
+    - **`APIKeyHeaderAuth`**: `X-API-Key`-style schemes, with **`APIKeyQueryAuth`** for legacy clients that can only pass a query parameter.
+    - **`HTTPBasicAuth`**: `validator(username, password)` with `WWW-Authenticate` realm support.
+- **Token hashing helpers**: `hash_token`/`verify_token_hash` package the "store the hash, never the token" pattern with constant-time comparison.
+- **JWT validation** (`fastapi-multiauth[jwt]` extra): `JWTValidator` for `HTTPBearerAuth`: HS256 or provider JWKS (Keycloak/Auth0/Entra/Authentik) with TTL caching and rotation-aware `kid` refresh, `aud`/`iss`/`exp` checks, configurable scope claims, and a `claims_to_identity` hook.
+- **Security scopes**: `Security(auth, scopes=[...])` forwards the declared scopes to validators that accept a `scopes` parameter.
+- **Correct HTTP semantics**: 401 with `WWW-Authenticate` challenges ([RFC 7235](https://datatracker.ietf.org/doc/html/rfc7235)) and 403 via `ForbiddenError`.
+- **OAuth 2.0 / OIDC helpers** (`fastapi-multiauth[oauth]` extra): async discovery with TTL caching, HTTPS enforcement, CSRF-protected `state` encoding, PKCE (S256), and code exchange delegated to [httpx-oauth](https://github.com/frankie567/httpx-oauth).
+
+## Comparison
+
+An honest map of where `fastapi-multiauth` sits. It is the composable layer between the raw primitives of `fastapi.security` and opinionated user frameworks. If you want ready-made `/register`/`/login` routes and a user model, you want a different tool.
+
+|  | `fastapi.security` (native) | **fastapi-multiauth** | [fastapi-users](https://github.com/fastapi-users/fastapi-users) | [AuthX](https://github.com/yezz123/authx) | [Authlib](https://authlib.org/) |
+|---|---|---|---|---|---|
+| Credential extraction + OpenAPI | ✅ | ✅ | ✅ | ✅ | ➖ |
+| Bring-your-own validator | manual | ✅ | ❌ (own user model) | partial | manual |
+| Multiple schemes on one route | manual | ✅ `MultiAuth` | ❌ | ❌ | ❌ |
+| Signed cookie sessions (rotation, name-binding) | ❌ | ✅ | ✅ (own format) | ✅ (JWT in cookie) | ❌ |
+| Opaque API tokens (prefixes, hash helpers) | ❌ | ✅ | ✅ (DB-backed) | ❌ | ❌ |
+| JWT validation (HS + JWKS) | ❌ | ✅ `JWTValidator` | ✅ | ✅ | ✅ |
+| JWT **issuance** / refresh | ❌ | ❌ | ✅ | ✅ | ✅ |
+| Scope enforcement (fail-closed) | manual | ✅ | partial | ✅ | manual |
+| OAuth login client helpers (PKCE, state) | ❌ | ✅ | ✅ (per-provider) | ❌ | ✅ (full client) |
+| OAuth2/OIDC **server** | ❌ | ❌ | ❌ | ❌ | ✅ |
+| User model, register/login/reset routes | ❌ | ❌ | ✅ | ❌ | ❌ |
+| Database coupling | none | none | SQLAlchemy/Beanie | none | none |
+| Maintenance status | active | active | maintenance mode | active | active |
+
+When to pick what:
+
+- **`fastapi.security` alone**: one scheme, simple validator, no sessions. The primitives are fine, this library just saves you the boilerplate around them.
+- **fastapi-multiauth**: you own the user store and just need request-time auth: bring your own validator, combine several schemes on one route with `MultiAuth`, validate opaque tokens or JWTs, and get correct OpenAPI for free. No user model, no issued tokens, no database coupling.
+- **fastapi-users**: you want batteries included (user table, password reset, verified-email flow) and accept its user model. Note it is in maintenance mode.
+- **AuthX**: your session model is "login issues a JWT pair, refresh endpoint rotates it". This library validates JWTs but will never issue them.
+- **Authlib**: you are building an OAuth2/OIDC *server*, or need a full-featured OAuth client beyond the login flow.
+
+## FAQ
+
+### Can I use it with sync validators?
+
+Yes, every source accepts sync or async callables (including callable class instances) and awaits them correctly.
+
+### Why don't my route scopes show in Swagger UI?
+
+The OpenAPI specification only allows scope lists on `oauth2`/`openIdConnect` schemes; for `http`/`apiKey` schemes the array must be empty. Enforcement happens at runtime regardless; see [Usage → Security scopes](https://fastapi-multiauth.d3vyce.fr/usage/#security-scopes).
+
+## License
+
+This project is licensed under the [MIT License](LICENSE).

fastapi_multiauth-0.1.0.dist-info/RECORD

@@ -0,0 +1,22 @@
+fastapi_multiauth/__init__.py,sha256=9-eT91gStv08_lbm067HDs1UhpJDI236fR5QlxDLfdw,1048
+fastapi_multiauth/_http.py,sha256=7F9g2-jlFASna7ZPYNNemmc8rr4vS634z3vlf5-ngIg,1502
+fastapi_multiauth/_imports.py,sha256=-DhUaPwk3ip5Vlk8kktg78C_Gzu1ZbtagEFtXGAytug,313
+fastapi_multiauth/abc.py,sha256=q_qNLAVht29zidRHijBckk2iL7LR_2K7Z7BA-9TUmVc,8447
+fastapi_multiauth/exceptions.py,sha256=Yov3UXuNTFDJzPrpRebjujZz9GjDzoG3wuK4FKiusAk,1923
+fastapi_multiauth/jwt.py,sha256=VQEVCXpLFVYA_EQLZKaedRYfYzOafQyiqDi5uxmKASo,10528
+fastapi_multiauth/oauth/__init__.py,sha256=dLf_gg2hjy_N0ufkWwl87bU4FkS188H0Cu_0ZHrL7DI,1177
+fastapi_multiauth/oauth/client.py,sha256=b_n66iU3-uIrItrCGEl2I2NkjKOPBaQxVRNMktL1iMU,8834
+fastapi_multiauth/oauth/utils.py,sha256=7cNg_y4rPUossvMgws_QedCWWHsa2-pcs8zpLUgys6A,5850
+fastapi_multiauth/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+fastapi_multiauth/sources/__init__.py,sha256=P0hvJtodjnlQCBbiuCD-Fqs8o4NpxwRjgNrQZ55y0Mo,407
+fastapi_multiauth/sources/basic.py,sha256=bFlNaWjfXTLJTYB-wt9vyUQ8VdpfHJt-GrJUiDKO-Mk,2598
+fastapi_multiauth/sources/bearer.py,sha256=DoQmm-4_H4Itu-t8v-Y9cITerCoBuSsyjc8ikHtEuYU,2916
+fastapi_multiauth/sources/cookie.py,sha256=5HAd3pCwnY9UxKo8IbKTk1neFX-wGC0IWQu6uKIem6w,5817
+fastapi_multiauth/sources/header.py,sha256=7_o3z7mYpuPj4sMsC2dmkYWA9Mp7xWq75Ia-DlGIpT8,1479
+fastapi_multiauth/sources/multi.py,sha256=LgIHKRQaG30-TRNpUfXDcUceOSUrh2AFEpjVktKPnS8,3885
+fastapi_multiauth/sources/query.py,sha256=IdjUvdXqVwIn_PCfEAk_mmXzEGVeNzZRbXxMIbniHZA,1731
+fastapi_multiauth/utils.py,sha256=YRhWvpMT6cG2AaU4sjMaGuL_eX60_4nOjAKLbib42wA,2693
+fastapi_multiauth-0.1.0.dist-info/licenses/LICENSE,sha256=V2jCjI-VPB-veGY2Ktb0sU4vT_TldRciZ9lCE98bMoE,1063
+fastapi_multiauth-0.1.0.dist-info/WHEEL,sha256=0ksFqNncQTsCUyOQQNfyYN3tci86LvOLl92eMRFTR70,81
+fastapi_multiauth-0.1.0.dist-info/METADATA,sha256=h8ZQVzVakJTOsBUwEXkZl1e2li_zXAslzLbte6wOn5Q,9412
+fastapi_multiauth-0.1.0.dist-info/RECORD,,

fastapi_multiauth-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: uv 0.11.22
+Root-Is-Purelib: true
+Tag: py3-none-any

fastapi_multiauth-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 d3vyce
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.