fastapi-multiauth 1.0.0rc2__tar.gz → 1.2.0__tar.gz

{fastapi_multiauth-1.0.0rc2 → fastapi_multiauth-1.2.0}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: fastapi-multiauth
-Version: 1.0.0rc2
+Version: 1.2.0
 Summary: Composable authentication sources for FastAPI: bring your own validator, combine multiple schemes, correct OpenAPI by construction
 Keywords: fastapi,authentication,security,oauth,api-key,bearer,cookie
 Author: d3vyce
 Author-email: d3vyce <contact@d3vyce.fr>
 License-Expression: MIT
 License-File: LICENSE
-Classifier: Development Status :: 4 - Beta
+Classifier: Development Status :: 5 - Production/Stable
 Classifier: Framework :: AsyncIO
 Classifier: Framework :: FastAPI
 Classifier: Intended Audience :: Developers
@@ -18,13 +18,13 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: Python :: 3.15
+Classifier: Programming Language :: Python :: Free Threading :: 3 - Stable
 Classifier: Topic :: Internet :: WWW/HTTP :: Session
 Classifier: Topic :: Security
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Software Development :: Libraries
 Classifier: Typing :: Typed
 Requires-Dist: anyio>=3.7
-Requires-Dist: async-lru>=2.0
 Requires-Dist: fastapi>=0.123.0,!=0.137.0,!=0.137.1
 Requires-Dist: httpx>=0.25.0
 Requires-Dist: itsdangerous>=2.1
@@ -123,13 +123,13 @@ Set `SECRET_KEY` to at least 32 random bytes, for example the output of `python
 
 - **Every standard scheme**: bearer tokens with Stripe-style prefixes, signed cookie sessions, API keys, HTTP Basic, OAuth 2.0 and OpenID Connect.
 - **`MultiAuth`**: several schemes on one route, all documented in OpenAPI, plus `optional()` for routes that also serve anonymous callers.
-- **Stateless sessions**: HMAC-signed cookies with expiry, key rotation, opt-in revocable session ids, and `csrf=True` to refuse cross-origin requests.
-- **Tokens done right**: secure generation, hash-only storage, checksums, `JWTValidator` for provider JWTs (JWKS, rotation, `aud`/`iss`), `IntrospectionValidator` for opaque ones, and `HTTPDPoPAuth` for tokens bound to the client's key.
+- **Stateless sessions**: HMAC-signed cookies with expiry, key rotation, opt-in revocable session ids, and cross-origin requests refused by default.
+- **Tokens done right**: secure generation, hash-only storage, checksums, `JWTValidator` for provider JWTs (JWKS, rotation, `aud`/`iss`/`typ`), `IntrospectionValidator` for opaque ones, and `HTTPDPoPAuth` for tokens bound to the client's key.
 - **Signed webhooks**: `HMACSignatureAuth` checks the sender's signature over the raw body, with timestamp tolerance and secret rotation.
 - **Scopes and step-up**: fail-closed scope checks, and `fresh()` / `stepped_up()` with RFC 9470 challenges for sensitive routes.
 - **Second factor**: TOTP helpers that refuse a replayed code, and the login level signed into the session cookie.
 - **OAuth login helpers**: discovery, CSRF `state`, PKCE, code exchange and ID token validation.
-- **Observable**: reason-coded security logs and `auth_surface(app)` to audit what guards every route.
+- **Observable**: reason-coded security logs and `auth_surface(app)` to audit what guards every route, `dependency_overrides` included.
 
 See the [comparison](https://fastapi-multiauth.d3vyce.fr/guide/comparison/) for how it sits next to `fastapi.security`, fastapi-users, AuthX and Authlib, and the [security model](https://fastapi-multiauth.d3vyce.fr/security-model/) for what it guarantees.
 

{fastapi_multiauth-1.0.0rc2 → fastapi_multiauth-1.2.0}/README.md

@@ -82,13 +82,13 @@ Set `SECRET_KEY` to at least 32 random bytes, for example the output of `python
 
 - **Every standard scheme**: bearer tokens with Stripe-style prefixes, signed cookie sessions, API keys, HTTP Basic, OAuth 2.0 and OpenID Connect.
 - **`MultiAuth`**: several schemes on one route, all documented in OpenAPI, plus `optional()` for routes that also serve anonymous callers.
-- **Stateless sessions**: HMAC-signed cookies with expiry, key rotation, opt-in revocable session ids, and `csrf=True` to refuse cross-origin requests.
-- **Tokens done right**: secure generation, hash-only storage, checksums, `JWTValidator` for provider JWTs (JWKS, rotation, `aud`/`iss`), `IntrospectionValidator` for opaque ones, and `HTTPDPoPAuth` for tokens bound to the client's key.
+- **Stateless sessions**: HMAC-signed cookies with expiry, key rotation, opt-in revocable session ids, and cross-origin requests refused by default.
+- **Tokens done right**: secure generation, hash-only storage, checksums, `JWTValidator` for provider JWTs (JWKS, rotation, `aud`/`iss`/`typ`), `IntrospectionValidator` for opaque ones, and `HTTPDPoPAuth` for tokens bound to the client's key.
 - **Signed webhooks**: `HMACSignatureAuth` checks the sender's signature over the raw body, with timestamp tolerance and secret rotation.
 - **Scopes and step-up**: fail-closed scope checks, and `fresh()` / `stepped_up()` with RFC 9470 challenges for sensitive routes.
 - **Second factor**: TOTP helpers that refuse a replayed code, and the login level signed into the session cookie.
 - **OAuth login helpers**: discovery, CSRF `state`, PKCE, code exchange and ID token validation.
-- **Observable**: reason-coded security logs and `auth_surface(app)` to audit what guards every route.
+- **Observable**: reason-coded security logs and `auth_surface(app)` to audit what guards every route, `dependency_overrides` included.
 
 See the [comparison](https://fastapi-multiauth.d3vyce.fr/guide/comparison/) for how it sits next to `fastapi.security`, fastapi-users, AuthX and Authlib, and the [security model](https://fastapi-multiauth.d3vyce.fr/security-model/) for what it guarantees.
 

{fastapi_multiauth-1.0.0rc2 → fastapi_multiauth-1.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fastapi-multiauth"
-version = "1.0.0rc2"
+version = "1.2.0"
 description = "Composable authentication sources for FastAPI: bring your own validator, combine multiple schemes, correct OpenAPI by construction"
 readme = "README.md"
 license = "MIT"
@@ -16,7 +16,7 @@ keywords = [
     "cookie",
 ]
 classifiers = [
-    "Development Status :: 4 - Beta",
+    "Development Status :: 5 - Production/Stable",
     "Framework :: AsyncIO",
     "Framework :: FastAPI",
     "Intended Audience :: Developers",
@@ -27,6 +27,7 @@ classifiers = [
     "Programming Language :: Python :: 3.13",
     "Programming Language :: Python :: 3.14",
     "Programming Language :: Python :: 3.15",
+    "Programming Language :: Python :: Free Threading :: 3 - Stable",
     "Topic :: Internet :: WWW/HTTP :: Session",
     "Topic :: Security",
     "Topic :: Software Development :: Libraries :: Python Modules",
@@ -35,7 +36,6 @@ classifiers = [
 ]
 dependencies = [
     "anyio>=3.7",
-    "async-lru>=2.0",
     "fastapi>=0.123.0,!=0.137.0,!=0.137.1",
     "httpx>=0.25.0",
     "itsdangerous>=2.1",
@@ -66,6 +66,7 @@ dev = [
 ]
 tests = [
     "coverage>=7.0.0",
+    "httpx2>=2.16",
     "pyotp>=2.10.0",
     "pytest-anyio>=0.0.0",
     "pytest-codspeed>=5.0",
@@ -120,7 +121,6 @@ convention = "google"
 testpaths = ["tests"]
 pythonpath = ["."]
 anyio_mode = "auto"
-filterwarnings = ["ignore::DeprecationWarning"]
 
 [tool.coverage.run]
 source = ["src/fastapi_multiauth"]

{fastapi_multiauth-1.0.0rc2 → fastapi_multiauth-1.2.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "fastapi-multiauth"
-version = "1.0.0rc2"
+version = "1.2.0"
 description = "Composable authentication sources for FastAPI: bring your own validator, combine multiple schemes, correct OpenAPI by construction"
 readme = "README.md"
 license = "MIT"
@@ -11,7 +11,7 @@ authors = [
 ]
 keywords = ["fastapi", "authentication", "security", "oauth", "api-key", "bearer", "cookie"]
 classifiers = [
-    "Development Status :: 4 - Beta",
+    "Development Status :: 5 - Production/Stable",
     "Framework :: AsyncIO",
     "Framework :: FastAPI",
     "Intended Audience :: Developers",
@@ -22,6 +22,7 @@ classifiers = [
     "Programming Language :: Python :: 3.13",
     "Programming Language :: Python :: 3.14",
     "Programming Language :: Python :: 3.15",
+    "Programming Language :: Python :: Free Threading :: 3 - Stable",
     "Topic :: Internet :: WWW/HTTP :: Session",
     "Topic :: Security",
     "Topic :: Software Development :: Libraries :: Python Modules",
@@ -30,7 +31,6 @@ classifiers = [
 ]
 dependencies = [
     "anyio>=3.7",
-    "async-lru>=2.0",
     "fastapi>=0.123.0,!=0.137.0,!=0.137.1",
     "httpx>=0.25.0",
     "itsdangerous>=2.1",
@@ -61,6 +61,7 @@ dev = [
 ]
 tests = [
     "coverage>=7.0.0",
+    "httpx2>=2.16",
     "pyotp>=2.10.0",
     "pytest-anyio>=0.0.0",
     "pytest-codspeed>=5.0",
@@ -97,9 +98,6 @@ convention = "google"
 testpaths = ["tests"]
 pythonpath = ["."]
 anyio_mode = "auto"
-filterwarnings = [
-    "ignore::DeprecationWarning",
-]
 
 [tool.coverage.run]
 source = ["src/fastapi_multiauth"]

{fastapi_multiauth-1.0.0rc2 → fastapi_multiauth-1.2.0}/src/fastapi_multiauth/__init__.py

@@ -43,7 +43,7 @@ from .utils import (
     verify_token_hash,
 )
 
-__version__ = "1.0.0rc2"
+__version__ = "1.2.0"
 
 logging.getLogger(__name__).addHandler(logging.NullHandler())
 

{fastapi_multiauth-1.0.0rc2 → fastapi_multiauth-1.2.0}/src/fastapi_multiauth/_http.py

@@ -1,7 +1,6 @@
 """Shared HTTP transport hygiene for the OAuth and JWT modules."""
 
 import contextlib
-import json
 from typing import Any
 from urllib.parse import urlsplit
 
@@ -13,14 +12,22 @@ DEFAULT_TIMEOUT = 10.0
 """Default timeout (seconds) applied to every HTTP call made by this library."""
 
 
-def _require_https(url: str, description: str) -> str:
-    """Reject a URL that is not a string, or would send credentials over HTTP."""
+def _require_https(url: str, description: str, *, allow_loopback: bool = True) -> str:
+    """Reject a URL that is not a string, or would send credentials over HTTP.
+
+    Plain HTTP passes for a loopback host, for local development, unless
+    `allow_loopback` is off.
+    """
     if not isinstance(url, str):
         raise ValueError(f"{description} must be a string URL (got {url!r})")  # noqa: TRY004
     parsed = urlsplit(url)
-    if parsed.scheme == "https":
+    if parsed.scheme == "https" and parsed.hostname:
         return url
-    if parsed.scheme == "http" and parsed.hostname in _LOOPBACK_HOSTS:
+    if (
+        allow_loopback
+        and parsed.scheme == "http"
+        and parsed.hostname in _LOOPBACK_HOSTS
+    ):
         return url
     raise ValueError(f"{description} must use https:// (got {url!r})")
 
@@ -35,8 +42,8 @@ async def _request_json(
     headers: dict[str, str] | None = None,
     data: dict[str, str] | None = None,
     client: httpx.AsyncClient | None = None,
-) -> Any:
-    """Send a request and decode the JSON body, mapping failures to `error_cls`."""
+) -> dict[str, Any]:
+    """Send a request and decode the JSON object body, mapping failures to `error_cls`."""
     async with (
         contextlib.nullcontext(client)
         if client is not None
@@ -45,11 +52,14 @@ async def _request_json(
         try:
             resp = await http.request(method, url, headers=headers, data=data)
             resp.raise_for_status()
-            return resp.json()
+            body = resp.json()
         except httpx.HTTPError as exc:
             raise error_cls(f"failed to fetch {description}: {exc}") from exc
-        except json.JSONDecodeError as exc:
+        except (ValueError, RecursionError) as exc:
             raise error_cls(f"{description} is not valid JSON") from exc
+    if not isinstance(body, dict):
+        raise error_cls(f"{description} is not a JSON object")
+    return body
 
 
 async def _get_json(
@@ -60,8 +70,8 @@ async def _get_json(
     description: str,
     headers: dict[str, str] | None = None,
     client: httpx.AsyncClient | None = None,
-) -> Any:
-    """GET `url` and decode the JSON body, mapping failures to `error_cls`."""
+) -> dict[str, Any]:
+    """GET `url` and decode the JSON object body, mapping failures to `error_cls`."""
     return await _request_json(
         "GET",
         url,