fastapi-multiauth 0.1.0__tar.gz → 0.3.0__tar.gz

{fastapi_multiauth-0.1.0 → fastapi_multiauth-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-multiauth
-Version: 0.1.0
+Version: 0.3.0
 Summary: Composable authentication sources for FastAPI: bring your own validator, combine multiple schemes, correct OpenAPI by construction
 Keywords: fastapi,authentication,security,oauth,api-key,bearer,cookie
 Author: d3vyce
@@ -28,7 +28,7 @@ Requires-Dist: async-lru>=2.0
 Requires-Dist: fastapi>=0.100.0
 Requires-Dist: httpx>=0.25.0
 Requires-Dist: itsdangerous>=2.1
-Requires-Dist: pyjwt[crypto]>=2.8 ; extra == 'jwt'
+Requires-Dist: pyjwt[crypto]>=2.13.0 ; extra == 'jwt'
 Requires-Dist: httpx-oauth>=0.16 ; extra == 'oauth'
 Requires-Python: >=3.10
 Project-URL: Homepage, https://github.com/d3vyce/fastapi-multiauth
@@ -79,7 +79,13 @@ uv add "fastapi-multiauth[jwt,oauth]"
 
 ```python
 from fastapi import FastAPI, Security
-from fastapi_multiauth import HTTPBearerAuth, APIKeyCookieAuth, MultiAuth, UnauthorizedError
+from fastapi_multiauth import (
+    HTTPBearerAuth,
+    APIKeyCookieAuth,
+    MultiAuth,
+    UnauthorizedError,
+)
+
 
 async def validate_token(token: str) -> dict:
     user = await lookup_user_by_token(token)
@@ -87,9 +93,11 @@ async def validate_token(token: str) -> dict:
         raise UnauthorizedError()
     return user
 
+
 async def validate_session(value: str) -> dict:
     return await lookup_user_by_session(value)
 
+
 bearer = HTTPBearerAuth(validate_token, prefix="user_")
 session = APIKeyCookieAuth("session", validate_session, secret_key="...")
 
@@ -98,6 +106,7 @@ auth = MultiAuth(bearer, session)
 
 app = FastAPI()
 
+
 @app.get("/me")
 async def me(user=Security(auth)):
     return user

{fastapi_multiauth-0.1.0 → fastapi_multiauth-0.3.0}/README.md

@@ -38,7 +38,13 @@ uv add "fastapi-multiauth[jwt,oauth]"
 
 ```python
 from fastapi import FastAPI, Security
-from fastapi_multiauth import HTTPBearerAuth, APIKeyCookieAuth, MultiAuth, UnauthorizedError
+from fastapi_multiauth import (
+    HTTPBearerAuth,
+    APIKeyCookieAuth,
+    MultiAuth,
+    UnauthorizedError,
+)
+
 
 async def validate_token(token: str) -> dict:
     user = await lookup_user_by_token(token)
@@ -46,9 +52,11 @@ async def validate_token(token: str) -> dict:
         raise UnauthorizedError()
     return user
 
+
 async def validate_session(value: str) -> dict:
     return await lookup_user_by_session(value)
 
+
 bearer = HTTPBearerAuth(validate_token, prefix="user_")
 session = APIKeyCookieAuth("session", validate_session, secret_key="...")
 
@@ -57,6 +65,7 @@ auth = MultiAuth(bearer, session)
 
 app = FastAPI()
 
+
 @app.get("/me")
 async def me(user=Security(auth)):
     return user

fastapi_multiauth-0.3.0/pyproject.toml

@@ -0,0 +1,106 @@
+[project]
+name = "fastapi-multiauth"
+version = "0.3.0"
+description = "Composable authentication sources for FastAPI: bring your own validator, combine multiple schemes, correct OpenAPI by construction"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.10"
+keywords = [
+    "fastapi",
+    "authentication",
+    "security",
+    "oauth",
+    "api-key",
+    "bearer",
+    "cookie",
+]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Framework :: AsyncIO",
+    "Framework :: FastAPI",
+    "Intended Audience :: Developers",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Topic :: Internet :: WWW/HTTP :: Session",
+    "Topic :: Security",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+    "Topic :: Software Development :: Libraries",
+    "Typing :: Typed",
+]
+dependencies = [
+    "anyio>=3.7",
+    "async-lru>=2.0",
+    "fastapi>=0.100.0",
+    "httpx>=0.25.0",
+    "itsdangerous>=2.1",
+]
+
+[[project.authors]]
+name = "d3vyce"
+email = "contact@d3vyce.fr"
+
+[project.urls]
+Homepage = "https://github.com/d3vyce/fastapi-multiauth"
+Documentation = "https://fastapi-multiauth.d3vyce.fr/"
+Repository = "https://github.com/d3vyce/fastapi-multiauth"
+Issues = "https://github.com/d3vyce/fastapi-multiauth/issues"
+
+[project.optional-dependencies]
+jwt = ["pyjwt[crypto]>=2.13.0"]
+oauth = ["httpx-oauth>=0.16"]
+
+[dependency-groups]
+dev = [
+    { include-group = "tests" },
+    { include-group = "docs" },
+    "fastapi_multiauth[jwt,oauth]",
+    "prek>=0.3.8",
+    "ruff>=0.1.0",
+    "ty>=0.0.34",
+]
+tests = [
+    "coverage>=7.0.0",
+    "pytest-anyio>=0.0.0",
+    "pytest-cov>=4.0.0",
+    "pytest>=8.0.0",
+    "respx>=0.22",
+]
+docs = [
+    "mkdocstrings-python>=2.0.2",
+    "zensical>=0.0.30",
+]
+
+[build-system]
+requires = ["uv_build>=0.11.21,<0.13.0"]
+build-backend = "uv_build"
+
+[tool.ruff.lint]
+extend-select = ["S"]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/**" = [
+    "S",
+    "B008",
+]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+anyio_mode = "auto"
+filterwarnings = ["ignore::DeprecationWarning"]
+
+[tool.coverage.run]
+source = ["src/fastapi_multiauth"]
+branch = true
+
+[tool.coverage.report]
+exclude_lines = [
+    "pragma: no cover",
+    "if TYPE_CHECKING:",
+    "raise NotImplementedError",
+]

fastapi_multiauth-0.1.0/pyproject.toml → fastapi_multiauth-0.3.0/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "fastapi-multiauth"
-version = "0.1.0"
+version = "0.3.0"
 description = "Composable authentication sources for FastAPI: bring your own validator, combine multiple schemes, correct OpenAPI by construction"
 readme = "README.md"
 license = "MIT"
@@ -44,7 +44,7 @@ Issues = "https://github.com/d3vyce/fastapi-multiauth/issues"
 
 [project.optional-dependencies]
 jwt = [
-    "pyjwt[crypto]>=2.8",
+    "pyjwt[crypto]>=2.13.0",
 ]
 oauth = [
     "httpx-oauth>=0.16",
@@ -72,7 +72,7 @@ docs = [
 ]
 
 [build-system]
-requires = ["uv_build>=0.11.8,<0.12.0"]
+requires = ["uv_build>=0.11.21,<0.13.0"]
 build-backend = "uv_build"
 
 [tool.ruff.lint]
@@ -80,7 +80,7 @@ build-backend = "uv_build"
 extend-select = ["S"]
 
 [tool.ruff.lint.per-file-ignores]
-"tests/**" = ["S"]
+"tests/**" = ["S", "B008"]
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]

{fastapi_multiauth-0.1.0 → fastapi_multiauth-0.3.0}/src/fastapi_multiauth/__init__.py

@@ -23,7 +23,7 @@ from .sources import (
 )
 from .utils import hash_token, verify_token_hash
 
-__version__ = "0.1.0"
+__version__ = "0.3.0"
 
 __all__ = [
     "APIKeyCookieAuth",

{fastapi_multiauth-0.1.0 → fastapi_multiauth-0.3.0}/src/fastapi_multiauth/_http.py

@@ -1,5 +1,6 @@
 """Shared HTTP transport hygiene for the OAuth and JWT modules."""
 
+import contextlib
 import json
 from typing import Any
 from urllib.parse import urlsplit
@@ -15,7 +16,7 @@ DEFAULT_TIMEOUT = 10.0
 def _require_https(url: str, description: str) -> str:
     """Reject non-string URLs and URLs that would send credentials over plaintext HTTP."""
     if not isinstance(url, str):
-        raise ValueError(f"{description} must be a string URL (got {url!r})")
+        raise ValueError(f"{description} must be a string URL (got {url!r})")  # noqa: TRY004
     parsed = urlsplit(url)
     if parsed.scheme == "https":
         return url
@@ -31,11 +32,16 @@ async def _get_json(
     error_cls: type[Exception],
     description: str,
     headers: dict[str, str] | None = None,
+    client: httpx.AsyncClient | None = None,
 ) -> Any:
     """GET *url* and decode the JSON body, mapping failures to *error_cls*."""
-    async with httpx.AsyncClient(timeout=timeout) as client:
+    async with (
+        contextlib.nullcontext(client)
+        if client is not None
+        else httpx.AsyncClient(timeout=timeout)
+    ) as http:
         try:
-            resp = await client.get(url, headers=headers)
+            resp = await http.get(url, headers=headers)
             resp.raise_for_status()
             return resp.json()
         except httpx.HTTPError as exc:

{fastapi_multiauth-0.1.0 → fastapi_multiauth-0.3.0}/src/fastapi_multiauth/abc.py

@@ -3,7 +3,8 @@
 import copy
 import inspect
 from abc import ABC, abstractmethod
-from typing import Annotated, Any, Callable, TypeVar
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Annotated, Any
 
 from fastapi import Depends, HTTPException, Request
 from fastapi.security import SecurityScopes
@@ -12,7 +13,8 @@ from fastapi.security.base import SecurityBase
 from fastapi_multiauth.exceptions import UnauthorizedError
 from fastapi_multiauth.utils import add_challenge, challenge_headers, ensure_async
 
-_V = TypeVar("_V", bound="ValidatedAuthSource")
+if TYPE_CHECKING:
+    from typing_extensions import Self
 
 
 def _reject_scopes_kwarg(kwargs: dict[str, Any]) -> None:
@@ -71,7 +73,7 @@ class _DocOnlyScheme(SecurityBase):
         self.model = scheme.model
         self.scheme_name = scheme.scheme_name
 
-    async def __call__(self, request: Request) -> None:  # noqa: ARG002
+    async def __call__(self, request: Request) -> None:
         return None
 
 
@@ -212,7 +214,7 @@ class ValidatedAuthSource(AuthSource):
         """Validate a credential, forwarding route-declared scopes to the validator."""
         return await self._call_validator(credential, scopes=scopes)
 
-    def require(self: _V, **kwargs: Any) -> _V:
+    def require(self, **kwargs: Any) -> "Self":
         """Return a copy of this source with additional (or overriding) validator kwargs."""
         _reject_scopes_kwarg(kwargs)
         clone = copy.copy(self)

{fastapi_multiauth-0.1.0 → fastapi_multiauth-0.3.0}/src/fastapi_multiauth/jwt.py

@@ -2,8 +2,8 @@
 
 import logging
 import time
-from collections.abc import Sequence
-from typing import Any, Callable
+from collections.abc import Callable, Sequence
+from typing import Any
 
 import anyio
 from fastapi import HTTPException, status
@@ -149,7 +149,7 @@ class JWTValidator:
                 leeway=self._leeway,
                 options=self._decode_options,
             )
-        except self._jwt.InvalidTokenError:
+        except (self._jwt.exceptions.PyJWTError, TypeError, ValueError):
             raise UnauthorizedError() from None
         if scopes:
             missing = set(scopes) - self._granted_scopes(claims)

{fastapi_multiauth-0.1.0 → fastapi_multiauth-0.3.0}/src/fastapi_multiauth/oauth/client.py

@@ -1,5 +1,6 @@
 """OAuth 2.0 / OIDC network operations: discovery, code exchange, userinfo."""
 
+import contextlib
 import functools
 from typing import Any, Literal, NamedTuple
 
@@ -74,6 +75,7 @@ def _oauth2_client_class() -> type:
             access_token_endpoint: str,
             timeout: float,
             token_endpoint_auth_method: TokenEndpointAuthMethod,
+            client: httpx.AsyncClient | None,
         ) -> None:
             super().__init__(
                 client_id,
@@ -85,8 +87,13 @@ def _oauth2_client_class() -> type:
                 token_endpoint_auth_method=token_endpoint_auth_method,
             )
             self._timeout = timeout
+            self._client = client
 
-        def get_httpx_client(self) -> httpx.AsyncClient:
+        def get_httpx_client(self) -> Any:
+            # httpx-oauth only uses the return value as an async context
+            # manager, so a borrowed client is wrapped to survive the exit.
+            if self._client is not None:
+                return contextlib.nullcontext(self._client)
             return httpx.AsyncClient(timeout=self._timeout)
 
     return _TimeoutOAuth2
@@ -159,6 +166,7 @@ async def oauth_exchange_code(
     code_verifier: str | None = None,
     token_endpoint_auth_method: TokenEndpointAuthMethod = "client_secret_post",  # noqa: S107 — method name, not a secret
     timeout: float = DEFAULT_TIMEOUT,
+    client: httpx.AsyncClient | None = None,
 ) -> dict[str, Any]:
     """Exchange an authorization code for tokens and return the token response.
 
@@ -176,7 +184,11 @@ async def oauth_exchange_code(
             (from :func:`~fastapi_multiauth.oauth.oauth_generate_pkce_pair`).
         token_endpoint_auth_method: How credentials are sent — in the POST body
             (``client_secret_post``, default) or as a Basic header.
-        timeout: Timeout in seconds for the token request.
+        timeout: Timeout in seconds for the token request. Ignored when
+            *client* is provided.
+        client: Optional ``httpx.AsyncClient`` to reuse (connection pooling
+            across the login flow). Borrowed, not closed; its own configuration
+            (timeouts included) governs the request.
 
     Returns:
         The full token response as a ``dict`` (``access_token`` plus whatever
@@ -190,7 +202,7 @@ async def oauth_exchange_code(
     _require_https(token_url, "OAuth token_url")
 
     oauth_client = _oauth2_client_class()(
-        client_id, client_secret, token_url, timeout, token_endpoint_auth_method
+        client_id, client_secret, token_url, timeout, token_endpoint_auth_method, client
     )
     try:
         token_data = await oauth_client.get_access_token(
@@ -221,13 +233,18 @@ async def oauth_fetch_userinfo(
     userinfo_url: str,
     access_token: str,
     timeout: float = DEFAULT_TIMEOUT,
+    client: httpx.AsyncClient | None = None,
 ) -> dict[str, Any]:
     """Fetch the userinfo payload with a bearer access token.
 
     Args:
         userinfo_url: Provider's userinfo endpoint.
         access_token: Access token from :func:`oauth_exchange_code`.
-        timeout: Timeout in seconds for the userinfo request.
+        timeout: Timeout in seconds for the userinfo request. Ignored when
+            *client* is provided.
+        client: Optional ``httpx.AsyncClient`` to reuse (connection pooling
+            across the login flow). Borrowed, not closed; its own configuration
+            (timeouts included) governs the request.
 
     Returns:
         The JSON payload returned by the userinfo endpoint as a plain ``dict``.
@@ -243,4 +260,5 @@ async def oauth_fetch_userinfo(
         error_cls=OAuthUserinfoError,
         description="userinfo",
         headers={"Authorization": f"Bearer {access_token}"},
+        client=client,
     )

{fastapi_multiauth-0.1.0 → fastapi_multiauth-0.3.0}/src/fastapi_multiauth/oauth/utils.py

@@ -98,9 +98,10 @@ def oauth_encode_state(url: str, state_token: str) -> str:
 
 def _destination_allowed(destination: str, allowed_hosts: Sequence[str]) -> bool:
     """Check a decoded destination against the open-redirect allowlist."""
-    # Browsers normalize backslashes to slashes, turning "/\evil.com" into a
-    # scheme-relative redirect — reject them outright.
-    if "\\" in destination:
+    # Browsers normalize backslashes to slashes ("/\evil.com" becomes a
+    # scheme-relative redirect) and strip tabs/newlines before parsing
+    # ("/\t/evil.com" becomes "//evil.com") — reject control chars outright.
+    if "\\" in destination or any(ch <= " " for ch in destination):
         return False
     parsed = urlsplit(destination)
     if not parsed.scheme and not parsed.netloc:
@@ -125,7 +126,8 @@ def oauth_decode_state(
     Args:
         state: Raw ``state`` query parameter from the callback.
         expected_state_token: Token stored before the authorization redirect;
-            a mismatch returns ``fallback``.
+            a mismatch — or an empty token (e.g. a session miss) — returns
+            ``fallback``.
         fallback: URL returned when ``state`` is absent, malformed, or fails
             verification.
         allowed_hosts: Open-redirect guard — the decoded destination must be a
@@ -135,6 +137,10 @@ def oauth_decode_state(
     Returns:
         The destination URL embedded in ``state``, or ``fallback``.
     """
+    # An empty expected token (e.g. session.get(..., "") on a session miss)
+    # must never match — compare_digest("", "") is True.
+    if not expected_state_token:
+        return fallback
     if not state or state == "null":  # "null" guards against JS JSON.stringify(null)
         return fallback
     try:

{fastapi_multiauth-0.1.0 → fastapi_multiauth-0.3.0}/src/fastapi_multiauth/sources/basic.py

@@ -1,7 +1,8 @@
 """HTTP Basic authentication source."""
 
 import base64
-from typing import Any, Callable
+from collections.abc import Callable
+from typing import Any
 
 from fastapi import Request
 from fastapi.security import HTTPBasic

{fastapi_multiauth-0.1.0 → fastapi_multiauth-0.3.0}/src/fastapi_multiauth/sources/bearer.py

@@ -1,7 +1,8 @@
 """Bearer token authentication source."""
 
 import secrets
-from typing import Any, Callable
+from collections.abc import Callable
+from typing import Any
 
 from fastapi import Request
 from fastapi.security import HTTPBearer

{fastapi_multiauth-0.1.0 → fastapi_multiauth-0.3.0}/src/fastapi_multiauth/sources/cookie.py

@@ -1,8 +1,8 @@
 """Cookie-based authentication source."""
 
 import hashlib
-from collections.abc import Sequence
-from typing import Any, Callable, Literal
+from collections.abc import Callable, Sequence
+from typing import Any, Literal
 
 from fastapi import Request, Response
 from fastapi.security import APIKeyCookie

{fastapi_multiauth-0.1.0 → fastapi_multiauth-0.3.0}/src/fastapi_multiauth/sources/header.py

@@ -1,6 +1,7 @@
 """API key header authentication source."""
 
-from typing import Any, Callable
+from collections.abc import Callable
+from typing import Any
 
 from fastapi import Request
 from fastapi.security import APIKeyHeader

{fastapi_multiauth-0.1.0 → fastapi_multiauth-0.3.0}/src/fastapi_multiauth/sources/query.py

@@ -1,6 +1,7 @@
 """API key query-string authentication source."""
 
-from typing import Any, Callable
+from collections.abc import Callable
+from typing import Any
 
 from fastapi import Request
 from fastapi.security import APIKeyQuery

{fastapi_multiauth-0.1.0 → fastapi_multiauth-0.3.0}/src/fastapi_multiauth/utils.py

@@ -4,8 +4,10 @@ import functools
 import hashlib
 import hmac
 import inspect
-from typing import Any, Callable
+from collections.abc import Callable
+from typing import Any
 
+import anyio.to_thread
 from fastapi import HTTPException, Request
 
 
@@ -43,7 +45,7 @@ def ensure_async(fn: Callable[..., Any]) -> Callable[..., Any]:
 
     @functools.wraps(fn)
     async def wrapper(*args: Any, **kwargs: Any) -> Any:
-        result = fn(*args, **kwargs)
+        result = await anyio.to_thread.run_sync(functools.partial(fn, *args, **kwargs))
         if inspect.isawaitable(result):
             return await result
         return result