fastapi-multiauth 0.6.0__tar.gz → 0.8.0__tar.gz

{fastapi_multiauth-0.6.0 → fastapi_multiauth-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-multiauth
-Version: 0.6.0
+Version: 0.8.0
 Summary: Composable authentication sources for FastAPI: bring your own validator, combine multiple schemes, correct OpenAPI by construction
 Keywords: fastapi,authentication,security,oauth,api-key,bearer,cookie
 Author: d3vyce
@@ -13,11 +13,11 @@ Classifier: Framework :: FastAPI
 Classifier: Intended Audience :: Developers
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3 :: Only
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Classifier: Topic :: Internet :: WWW/HTTP :: Session
 Classifier: Topic :: Security
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
@@ -25,12 +25,12 @@ Classifier: Topic :: Software Development :: Libraries
 Classifier: Typing :: Typed
 Requires-Dist: anyio>=3.7
 Requires-Dist: async-lru>=2.0
-Requires-Dist: fastapi>=0.123.0
+Requires-Dist: fastapi>=0.123.0,!=0.137.0,!=0.137.1
 Requires-Dist: httpx>=0.25.0
 Requires-Dist: itsdangerous>=2.1
 Requires-Dist: pyjwt[crypto]>=2.13.0 ; extra == 'jwt'
 Requires-Dist: httpx-oauth>=0.16 ; extra == 'oauth'
-Requires-Python: >=3.10
+Requires-Python: >=3.11
 Project-URL: Homepage, https://github.com/d3vyce/fastapi-multiauth
 Project-URL: Documentation, https://fastapi-multiauth.d3vyce.fr/
 Project-URL: Repository, https://github.com/d3vyce/fastapi-multiauth
@@ -49,7 +49,7 @@ Composable authentication sources for FastAPI: bring your own validator, combine
 [![ty](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ty/main/assets/badge/v0.json)](https://github.com/astral-sh/ty)
 [![uv](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/uv/main/assets/badge/v0.json)](https://github.com/astral-sh/uv)
 [![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
-[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
+[![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 
 ---
@@ -123,11 +123,14 @@ async def me(user=Security(auth)):
     - **`APIKeyHeaderAuth`**: `X-API-Key`-style schemes, with **`APIKeyQueryAuth`** for legacy clients that can only pass a query parameter.
     - **`HTTPBasicAuth`**: `validator(username, password)` with `WWW-Authenticate` realm support.
     - **`OAuth2AuthorizationCodeBearerAuth`**, **`OAuth2PasswordBearerAuth`**, **`OpenIdConnectAuth`**: validate tokens an OAuth 2.0 / OIDC provider issued, and publish the scope catalogue so `/docs` offers a real Authorize dialog.
-- **Token hashing helpers**: `hash_token`/`verify_token_hash` package the "store the hash, never the token" pattern with constant-time comparison.
+- **Token hashing helpers**: `hash_token`/`verify_token_hash` package the "store the hash, never the token" pattern with constant-time comparison, and `checksum_token_generator`/`verify_token_checksum` add a GitHub-style CRC32 suffix that refuses typos before the lookup.
 - **JWT validation** (`fastapi-multiauth[jwt]` extra): `JWTValidator` for `HTTPBearerAuth`: HS256 or provider JWKS (Keycloak/Auth0/Entra/Authentik) with TTL caching and rotation-aware `kid` refresh, `aud`/`iss`/`exp` checks, configurable scope claims, and a `claims_to_identity` hook.
 - **Security scopes**: `Security(auth, scopes=[...])` forwards the declared scopes to validators that accept a `scopes` parameter.
+- **WebSocket routes**: every source and `MultiAuth` guard `@app.websocket` routes too, refusing the handshake with the same 401/403.
+- **Freshness / step-up auth**: `source.fresh(max_age=...)` refuses a credential proven too long ago on the endpoints that can take over an account, with the [RFC 9470](https://datatracker.ietf.org/doc/html/rfc9470) challenge that tells a client to re-authenticate. Signed cookies date themselves; anything else reads the instant off your identity. `source.stepped_up(acr_values=[...], acr=...)` asks for a stronger level instead, and composes with `fresh()` into one challenge; `AuthenticationMethodReference` names the [RFC 8176](https://datatracker.ietf.org/doc/html/rfc8176) `amr` values.
 - **Correct HTTP semantics**: 401 with `WWW-Authenticate` challenges ([RFC 7235](https://datatracker.ietf.org/doc/html/rfc7235)) and 403 via `ForbiddenError`.
-- **OAuth 2.0 / OIDC helpers** (`fastapi-multiauth[oauth]` extra): async discovery with TTL caching, HTTPS enforcement, CSRF-protected `state` encoding, PKCE (S256), and code exchange delegated to [httpx-oauth](https://github.com/frankie567/httpx-oauth).
+- **Security-event logging**: every refusal is a `WARNING` under `fastapi_multiauth.*` with a reason code (`invalid_signature`, `expired`, `stale`, …) in `extra`, never the credential or the identity; silent until your app configures logging.
+- **OAuth 2.0 / OIDC helpers** (`fastapi-multiauth[oauth]` extra): async discovery with TTL caching, HTTPS enforcement, CSRF-protected `state` encoding, PKCE (S256), code exchange delegated to [httpx-oauth](https://github.com/frankie567/httpx-oauth), and OpenID Connect ID token validation with `nonce` and `at_hash` (plus the `jwt` extra).
 
 ## Comparison
 

{fastapi_multiauth-0.6.0 → fastapi_multiauth-0.8.0}/README.md

@@ -8,7 +8,7 @@ Composable authentication sources for FastAPI: bring your own validator, combine
 [![ty](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ty/main/assets/badge/v0.json)](https://github.com/astral-sh/ty)
 [![uv](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/uv/main/assets/badge/v0.json)](https://github.com/astral-sh/uv)
 [![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
-[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
+[![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 
 ---
@@ -82,11 +82,14 @@ async def me(user=Security(auth)):
     - **`APIKeyHeaderAuth`**: `X-API-Key`-style schemes, with **`APIKeyQueryAuth`** for legacy clients that can only pass a query parameter.
     - **`HTTPBasicAuth`**: `validator(username, password)` with `WWW-Authenticate` realm support.
     - **`OAuth2AuthorizationCodeBearerAuth`**, **`OAuth2PasswordBearerAuth`**, **`OpenIdConnectAuth`**: validate tokens an OAuth 2.0 / OIDC provider issued, and publish the scope catalogue so `/docs` offers a real Authorize dialog.
-- **Token hashing helpers**: `hash_token`/`verify_token_hash` package the "store the hash, never the token" pattern with constant-time comparison.
+- **Token hashing helpers**: `hash_token`/`verify_token_hash` package the "store the hash, never the token" pattern with constant-time comparison, and `checksum_token_generator`/`verify_token_checksum` add a GitHub-style CRC32 suffix that refuses typos before the lookup.
 - **JWT validation** (`fastapi-multiauth[jwt]` extra): `JWTValidator` for `HTTPBearerAuth`: HS256 or provider JWKS (Keycloak/Auth0/Entra/Authentik) with TTL caching and rotation-aware `kid` refresh, `aud`/`iss`/`exp` checks, configurable scope claims, and a `claims_to_identity` hook.
 - **Security scopes**: `Security(auth, scopes=[...])` forwards the declared scopes to validators that accept a `scopes` parameter.
+- **WebSocket routes**: every source and `MultiAuth` guard `@app.websocket` routes too, refusing the handshake with the same 401/403.
+- **Freshness / step-up auth**: `source.fresh(max_age=...)` refuses a credential proven too long ago on the endpoints that can take over an account, with the [RFC 9470](https://datatracker.ietf.org/doc/html/rfc9470) challenge that tells a client to re-authenticate. Signed cookies date themselves; anything else reads the instant off your identity. `source.stepped_up(acr_values=[...], acr=...)` asks for a stronger level instead, and composes with `fresh()` into one challenge; `AuthenticationMethodReference` names the [RFC 8176](https://datatracker.ietf.org/doc/html/rfc8176) `amr` values.
 - **Correct HTTP semantics**: 401 with `WWW-Authenticate` challenges ([RFC 7235](https://datatracker.ietf.org/doc/html/rfc7235)) and 403 via `ForbiddenError`.
-- **OAuth 2.0 / OIDC helpers** (`fastapi-multiauth[oauth]` extra): async discovery with TTL caching, HTTPS enforcement, CSRF-protected `state` encoding, PKCE (S256), and code exchange delegated to [httpx-oauth](https://github.com/frankie567/httpx-oauth).
+- **Security-event logging**: every refusal is a `WARNING` under `fastapi_multiauth.*` with a reason code (`invalid_signature`, `expired`, `stale`, …) in `extra`, never the credential or the identity; silent until your app configures logging.
+- **OAuth 2.0 / OIDC helpers** (`fastapi-multiauth[oauth]` extra): async discovery with TTL caching, HTTPS enforcement, CSRF-protected `state` encoding, PKCE (S256), code exchange delegated to [httpx-oauth](https://github.com/frankie567/httpx-oauth), and OpenID Connect ID token validation with `nonce` and `at_hash` (plus the `jwt` extra).
 
 ## Comparison
 

{fastapi_multiauth-0.6.0 → fastapi_multiauth-0.8.0}/pyproject.toml

@@ -1,11 +1,11 @@
 [project]
 name = "fastapi-multiauth"
-version = "0.6.0"
+version = "0.8.0"
 description = "Composable authentication sources for FastAPI: bring your own validator, combine multiple schemes, correct OpenAPI by construction"
 readme = "README.md"
 license = "MIT"
 license-files = ["LICENSE"]
-requires-python = ">=3.10"
+requires-python = ">=3.11"
 keywords = [
     "fastapi",
     "authentication",
@@ -22,11 +22,11 @@ classifiers = [
     "Intended Audience :: Developers",
     "Operating System :: OS Independent",
     "Programming Language :: Python :: 3 :: Only",
-    "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
     "Programming Language :: Python :: 3.14",
+    "Programming Language :: Python :: 3.15",
     "Topic :: Internet :: WWW/HTTP :: Session",
     "Topic :: Security",
     "Topic :: Software Development :: Libraries :: Python Modules",
@@ -36,7 +36,7 @@ classifiers = [
 dependencies = [
     "anyio>=3.7",
     "async-lru>=2.0",
-    "fastapi>=0.123.0",
+    "fastapi>=0.123.0,!=0.137.0,!=0.137.1",
     "httpx>=0.25.0",
     "itsdangerous>=2.1",
 ]
@@ -78,11 +78,14 @@ docs = [
 ]
 
 [build-system]
-requires = ["uv_build>=0.11.21,<0.13.0"]
+requires = ["uv_build>=0.11.21,<0.14.0"]
 build-backend = "uv_build"
 
 [tool.ruff.lint]
-extend-select = ["S"]
+extend-select = [
+    "S",
+    "UP",
+]
 
 [tool.ruff.lint.per-file-ignores]
 "tests/**" = [

{fastapi_multiauth-0.6.0 → fastapi_multiauth-0.8.0}/pyproject.toml.orig

@@ -1,11 +1,11 @@
 [project]
 name = "fastapi-multiauth"
-version = "0.6.0"
+version = "0.8.0"
 description = "Composable authentication sources for FastAPI: bring your own validator, combine multiple schemes, correct OpenAPI by construction"
 readme = "README.md"
 license = "MIT"
 license-files = ["LICENSE"]
-requires-python = ">=3.10"
+requires-python = ">=3.11"
 authors = [
     { name = "d3vyce", email = "contact@d3vyce.fr" }
 ]
@@ -17,11 +17,11 @@ classifiers = [
     "Intended Audience :: Developers",
     "Operating System :: OS Independent",
     "Programming Language :: Python :: 3 :: Only",
-    "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
     "Programming Language :: Python :: 3.14",
+    "Programming Language :: Python :: 3.15",
     "Topic :: Internet :: WWW/HTTP :: Session",
     "Topic :: Security",
     "Topic :: Software Development :: Libraries :: Python Modules",
@@ -31,7 +31,7 @@ classifiers = [
 dependencies = [
     "anyio>=3.7",
     "async-lru>=2.0",
-    "fastapi>=0.123.0",
+    "fastapi>=0.123.0,!=0.137.0,!=0.137.1",
     "httpx>=0.25.0",
     "itsdangerous>=2.1",
 ]
@@ -73,12 +73,12 @@ docs = [
 ]
 
 [build-system]
-requires = ["uv_build>=0.11.21,<0.13.0"]
+requires = ["uv_build>=0.11.21,<0.14.0"]
 build-backend = "uv_build"
 
 [tool.ruff.lint]
 # "S" = flake8-bandit security rules, scoped to the library source.
-extend-select = ["S"]
+extend-select = ["S", "UP"]
 
 [tool.ruff.lint.per-file-ignores]
 "tests/**" = ["S", "B008"]

{fastapi_multiauth-0.6.0 → fastapi_multiauth-0.8.0}/src/fastapi_multiauth/__init__.py

@@ -9,9 +9,17 @@ exported here, and require the ``oauth`` extra. Import them explicitly::
     redirect = oauth.oauth_build_authorization_redirect(...)
 """
 
+import logging
+
 from . import oauth
 from .abc import AuthSource
-from .exceptions import ForbiddenError, UnauthorizedError
+from .amr import AuthenticationMethodReference
+from .exceptions import (
+    ForbiddenError,
+    InsufficientAuthenticationError,
+    StaleCredentialError,
+    UnauthorizedError,
+)
 from .jwt import JWTValidator
 from .sources import (
     APIKeyCookieAuth,
@@ -25,18 +33,27 @@ from .sources import (
     OpenIdConnectAuth,
 )
 from .surface import RouteAuth, SchemeRequirement, auth_surface
-from .utils import hash_token, verify_token_hash
+from .utils import (
+    checksum_token_generator,
+    hash_token,
+    verify_token_checksum,
+    verify_token_hash,
+)
+
+__version__ = "0.8.0"
 
-__version__ = "0.6.0"
+logging.getLogger(__name__).addHandler(logging.NullHandler())
 
 __all__ = [
     "APIKeyCookieAuth",
     "APIKeyHeaderAuth",
     "APIKeyQueryAuth",
     "AuthSource",
+    "AuthenticationMethodReference",
     "ForbiddenError",
     "HTTPBasicAuth",
     "HTTPBearerAuth",
+    "InsufficientAuthenticationError",
     "JWTValidator",
     "MultiAuth",
     "OAuth2AuthorizationCodeBearerAuth",
@@ -44,9 +61,12 @@ __all__ = [
     "OpenIdConnectAuth",
     "RouteAuth",
     "SchemeRequirement",
+    "StaleCredentialError",
     "UnauthorizedError",
     "auth_surface",
+    "checksum_token_generator",
     "hash_token",
     "oauth",
+    "verify_token_checksum",
     "verify_token_hash",
 ]