fastapi-startkit-auth 0.6.3__tar.gz → 0.8.0__tar.gz

{fastapi_startkit_auth-0.6.3 → fastapi_startkit_auth-0.8.0}/CHANGELOG.md

@@ -11,6 +11,26 @@ Release notes are also published on
 
 Each item lists what changed and what to do.
 
+- **The package is async-only; every sync class is removed.** The sync
+  `Auth`, `SessionGuard`, `PassportGuard`, `TokenGuard`, `ChainGuard`,
+  `TokenService`, `ApiTokenManager`, `PasswordBroker`, `PasswordGrant`,
+  `ClientCredentialsGrant`, `AuthorizationCodeGrant`, `RefreshTokenGrant`,
+  `ModelUserProvider` and `UserProvider` are gone, and each `Async*` class now
+  carries the plain name (`AsyncAuth` is `Auth`, `AsyncTokenService` is
+  `TokenService`, and so on). `user_is_active_async`, `find_user_async`,
+  `active_user_async` and `AuthManager.owner_provider_async` lose their
+  `_async` suffix; `AuthManager.owner_provider` is now a coroutine.
+  `AsyncMisconfiguration`, `ensure_sync`, `is_async_provider`,
+  `guard_is_async`, `is_async` and `has_async_methods` are removed, and the
+  `"async_model"` provider driver is dropped in favour of `"model"`;
+  configuring it raises a `ValueError` naming the replacement. The `"model"`
+  driver accepts sync and async models: a sync model's `find`,
+  `where(...).first()` and `save()` run in the threadpool.
+  `InMemoryUserProvider` methods are coroutines. User-supplied stores,
+  listeners and `is_active` hooks may still be sync; they run in the
+  threadpool. *Migrate:* import the plain names, `await` every `Auth`, guard,
+  provider, broker, grant and token-service call, and change
+  `driver="async_model"` to `driver="model"`.
 - **Feature providers replace `Application` and `AuthServiceProvider`.**
   Register `AuthProvider` first, then the features your guards use:
   `AuthSessionProvider(SessionConfig)`, `AuthOAuth2Provider(OAuth2Config)` and
@@ -66,7 +86,7 @@ Each item lists what changed and what to do.
   in `SessionConfig.csrf_exempt_paths`.
 - **OAuth client store defaults to `"database"`** (the ORM `oauth_clients`
   table). *Migrate:* publish and run the migrations, or set
-  `OAuth2Config(clients=OAuthClientsConfig(store="memory"))`.
+  `OAuth2Config(clients=OAuthClientConfig(store="memory"))`.
 - **The in-memory OAuth client store is async.** `InMemoryClientRepository`
   methods (`register`, `add`, `find`, `all`, `authenticate`, `revoke`,
   `delete`) are coroutines, like `OrmClientRepository`, and `store="memory"` now
@@ -74,6 +94,14 @@ Each item lists what changed and what to do.
   synchronous custom store passed with `store="instance"` keeps the sync grants.
   *Migrate:*
   `await` client-store calls and the `handle` / `issue_code` of those grants.
+- **Exception classes take an `Exception` suffix.** `AuthError` is now
+  `AuthException`, and every subclass gets the suffix (`InvalidToken` →
+  `InvalidTokenException`, `InsufficientScope` → `MissingScopeException`, and so
+  on). Wire error codes and HTTP statuses are unchanged. The old names remain as
+  deprecated aliases. *Migrate:* import the `*Exception` names.
+- **Bad password on the password grant raises `InvalidCredentialsException`**, a
+  subclass of `InvalidGrantException`. The response is unchanged (`invalid_grant`,
+  400), so existing `except InvalidGrantException` blocks still catch it.
 - **Persistent stores are named `"database"`.** `store="orm"` still works for
   sessions, API tokens, OAuth tokens and OAuth clients, but emits a
   `DeprecationWarning` and will be removed in a future release. *Migrate:*
@@ -82,6 +110,18 @@ Each item lists what changed and what to do.
   `revoke_token_chain`, and `store_refresh_token` takes `family_id`.
 - Error responses carry `Cache-Control: no-store`; `invalid_client` challenges
   with `WWW-Authenticate: Basic`.
+- **Class-level `Auth.guard(name)` is a FastAPI dependency.**
+  `Auth.guard(name)` / `AsyncAuth.guard(name)` on the class now returns a
+  `GuardDependency`: `user = Depends(Auth.guard("api"))` resolves the user
+  through that guard and raises 401 otherwise, and equal names compare equal,
+  so `app.dependency_overrides[Auth.guard("api")]` works. Inside a request,
+  attribute access (`provider`, `user_from_token`, `authenticate`, ...) still
+  reaches the named guard, but the value is no longer the guard object itself,
+  so identity and `isinstance` checks fail, and outside a request attributes
+  raise `AttributeError`. On an instance (`auth.guard(name)` from
+  `Depends(Auth.scoped)`) it still returns the guard. *Migrate:* where you need
+  the guard object, use `auth.guard(name)` from `Depends(Auth.scoped)` or
+  `manager.guard(name)`.
 
 ### Migrations
 
@@ -96,6 +136,18 @@ using the ORM stores:
 
 ### Added
 
+- `ChainGuard(guards=[...])` (`{"driver": "chain"}`): authenticates through the
+  first member guard that accepts the request, e.g. a bearer token backed by
+  the browser session. A token the request presents is final for every member
+  type (oauth2 bearer, or an API token in `Authorization` or a custom header):
+  when the member that reads it rejects it, the chain fails instead of trying
+  the session. `user_from_token` skips session members.
+- `OAuth2Guard(first_party_only=True)` refuses access tokens issued to an OAuth
+  client (`client_id` set), so a first-party API accepts only the
+  application's own login and personal tokens.
+- `AuthManager.on_authenticated(listener)`: `listener(request, user, guard)`
+  runs whenever a guard dependency resolves a user, before the route handler,
+  for activity tracking or request-scoped state.
 - Refresh token families with reuse detection: replaying a rotated refresh token
   revokes the whole family, whoever presents it: the owning client, another
   authenticated client, or no client at all for unbound password-grant tokens.

fastapi_startkit_auth-0.8.0/PKG-INFO

@@ -0,0 +1,67 @@
+Metadata-Version: 2.4
+Name: fastapi-startkit-auth
+Version: 0.8.0
+Summary: Laravel-style authentication for FastAPI: OAuth2/JWT authorization server, cookie/session guard, SPA + CSRF protection, and Sanctum-style API tokens.
+Keywords: fastapi,oauth2,jwt,auth,passport,sanctum,authentication,authorization,security,tokens,session,cookie,csrf,spa,starter-kit
+Author: Bedram Tamang
+Author-email: Bedram Tamang <tmgbedu@gmail.com>
+License-Expression: MIT
+License-File: LICENSE.md
+Classifier: Development Status :: 4 - Beta
+Classifier: Framework :: FastAPI
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Internet :: WWW/HTTP :: Session
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
+Requires-Dist: fastapi>=0.110
+Requires-Dist: pyjwt>=2.10.1
+Requires-Dist: bcrypt>=4.1
+Requires-Dist: pydantic>=2
+Requires-Dist: python-multipart>=0.0.9
+Requires-Dist: masonite-orm>=2.18 ; extra == 'masoniteorm'
+Requires-Dist: fastapi-startkit[database]>=0.60,<1.0 ; python_full_version >= '3.12' and extra == 'startkit'
+Requires-Dist: pytest>=8 ; extra == 'test'
+Requires-Dist: pytest-asyncio>=0.23 ; extra == 'test'
+Requires-Dist: httpx>=0.27 ; extra == 'test'
+Requires-Dist: aiosqlite>=0.20 ; extra == 'test'
+Requires-Dist: asyncpg>=0.29 ; extra == 'test'
+Requires-Python: >=3.10
+Project-URL: Homepage, https://github.com/fastapi-startkit/fastapi-startkit-auth
+Project-URL: Repository, https://github.com/fastapi-startkit/fastapi-startkit-auth
+Project-URL: Issues, https://github.com/fastapi-startkit/fastapi-startkit-auth/issues
+Project-URL: Changelog, https://github.com/fastapi-startkit/fastapi-startkit-auth/blob/main/CHANGELOG.md
+Provides-Extra: masoniteorm
+Provides-Extra: startkit
+Provides-Extra: test
+Description-Content-Type: text/markdown
+
+# FastAPI Startkit Auth
+
+FastAPI Startkit Auth provides authentication for FastAPI: an OAuth2/JWT authorization server, cookie/session guards, SPA + CSRF protection, and API tokens.
+
+## Official Documentation
+
+Documentation for FastAPI Startkit Auth can be found on the [FastAPI Startkit website](https://fastapi-startkit.github.io/docs/authentication).
+
+## Contributing
+
+Thank you for considering contributing to FastAPI Startkit Auth! The contribution guide can be found in the [FastAPI Startkit documentation](https://fastapi-startkit.github.io/docs/authentication).
+
+## Code of Conduct
+
+In order to ensure that the FastAPI Startkit community is welcoming to all, please review and abide by the code of conduct in the [FastAPI Startkit documentation](https://fastapi-startkit.github.io/docs/authentication).
+
+## Security Vulnerabilities
+
+If you discover a security vulnerability within FastAPI Startkit Auth, please report it privately to the maintainers rather than opening a public issue. Details can be found in the [FastAPI Startkit documentation](https://fastapi-startkit.github.io/docs/authentication).
+
+## License
+
+FastAPI Startkit Auth is open-sourced software licensed under the [MIT license](LICENSE.md).

fastapi_startkit_auth-0.8.0/README.md

@@ -0,0 +1,23 @@
+# FastAPI Startkit Auth
+
+FastAPI Startkit Auth provides authentication for FastAPI: an OAuth2/JWT authorization server, cookie/session guards, SPA + CSRF protection, and API tokens.
+
+## Official Documentation
+
+Documentation for FastAPI Startkit Auth can be found on the [FastAPI Startkit website](https://fastapi-startkit.github.io/docs/authentication).
+
+## Contributing
+
+Thank you for considering contributing to FastAPI Startkit Auth! The contribution guide can be found in the [FastAPI Startkit documentation](https://fastapi-startkit.github.io/docs/authentication).
+
+## Code of Conduct
+
+In order to ensure that the FastAPI Startkit community is welcoming to all, please review and abide by the code of conduct in the [FastAPI Startkit documentation](https://fastapi-startkit.github.io/docs/authentication).
+
+## Security Vulnerabilities
+
+If you discover a security vulnerability within FastAPI Startkit Auth, please report it privately to the maintainers rather than opening a public issue. Details can be found in the [FastAPI Startkit documentation](https://fastapi-startkit.github.io/docs/authentication).
+
+## License
+
+FastAPI Startkit Auth is open-sourced software licensed under the [MIT license](LICENSE.md).

{fastapi_startkit_auth-0.6.3 → fastapi_startkit_auth-0.8.0}/pyproject.toml

@@ -1,10 +1,10 @@
 [project]
 name = "fastapi-startkit-auth"
-version = "0.6.3"
+version = "0.8.0"
 description = "Laravel-style authentication for FastAPI: OAuth2/JWT authorization server, cookie/session guard, SPA + CSRF protection, and Sanctum-style API tokens."
 readme = "README.md"
 license = "MIT"
-license-files = ["LICENSE"]
+license-files = ["LICENSE.md"]
 keywords = [
     "fastapi",
     "oauth2",

{fastapi_startkit_auth-0.6.3 → fastapi_startkit_auth-0.8.0}/src/fastapi_startkit_auth/__init__.py

@@ -8,21 +8,23 @@ Passport while staying idiomatic FastAPI:
 from __future__ import annotations
 
 from .apitokens.facade import ApiToken
-from .apitokens.manager import ApiTokenManager, AsyncApiTokenManager, NewApiToken
+from .apitokens.manager import ApiTokenManager, NewApiToken
 from .apitokens.models import ApiTokenRecord
 from .apitokens.repository import ApiTokenRepository, InMemoryApiTokenRepository
-from .concurrency import AsyncMisconfiguration
 from .clients.models import Client
 from .clients.repository import InMemoryClientRepository
 from .config import (
     ApiTokenConfig,
     AuthConfig,
     OAuth2Config,
+    OAuthClientConfig,
     OAuthClientsConfig,
+    OAuthTokenConfig,
     OAuthTokensConfig,
     SessionConfig,
 )
 from .dependencies import (
+    GuardDependency,
     auth,
     current_user,
     optional_user,
@@ -31,44 +33,61 @@ from .dependencies import (
 )
 from .exceptions import (
     AccessDenied,
+    AccessDeniedException,
+    AuthenticationException,
     AuthError,
+    AuthException,
     CsrfTokenMismatch,
+    CsrfTokenMismatchException,
     InsufficientScope,
     InvalidClient,
+    InvalidClientException,
+    InvalidCredentialsException,
     InvalidGrant,
+    InvalidGrantException,
     InvalidScope,
+    InvalidScopeException,
     InvalidSession,
     InvalidTarget,
+    InvalidTargetException,
     InvalidToken,
+    InvalidTokenException,
+    MissingScopeException,
     UnauthorizedClient,
+    UnauthorizedClientException,
     UnsupportedGrantType,
+    UnsupportedGrantTypeException,
     UnsupportedResponseType,
+    UnsupportedResponseTypeException,
 )
 from .policy import GrantPolicy
-from .facade import AsyncAuth, Auth
-from .guards.guard import AsyncPassportGuard, PassportGuard
-from .guards.session import AsyncSessionGuard, SessionGuard
-from .guards.token import AsyncTokenGuard, TokenGuard
+from .facade import Auth
+from .guards.chain import ChainGuard
+from .guards.guard import PassportGuard
+from .guards.session import SessionGuard
+from .guards.token import TokenGuard
 from .manager import AuthManager, FeatureNotRegistered
 from .middleware.context import AuthMiddleware
 from .middleware.csrf import CsrfMiddleware
 from .middleware.session import SessionMiddleware
-from .passwords.broker import AsyncPasswordBroker, PasswordBroker
+from .passwords.broker import PasswordBroker
 from .provider import AuthApiTokenProvider, AuthOAuth2Provider, AuthProvider, AuthSessionProvider
 from .providers.memory import InMemoryUserProvider
-from .providers.model import AsyncModelUserProvider, ModelUserProvider
+from .providers.model import ModelUserProvider
 from .sessions.facade import Session
 from .sessions.models import SessionRecord
 from .sessions.store import InMemorySessionStore, SessionStore
-from .tokens.service import AsyncTokenService, TokenService
+from .tokens.service import TokenService
 
-__version__ = "0.6.3"
+__version__ = "0.8.0"
 
 __all__ = (
     "AuthConfig",
     "SessionConfig",
     "OAuth2Config",
+    "OAuthClientConfig",
     "OAuthClientsConfig",
+    "OAuthTokenConfig",
     "OAuthTokensConfig",
     "ApiTokenConfig",
     "AuthProvider",
@@ -85,23 +104,37 @@ __all__ = (
     "InMemoryClientRepository",
     "OrmClientRepository",
     "OrmSessionStore",
-    "AccessDenied",
-    "UnauthorizedClient",
-    "UnsupportedGrantType",
-    "UnsupportedResponseType",
+    "AccessDeniedException",
+    "UnauthorizedClientException",
+    "UnsupportedGrantTypeException",
+    "UnsupportedResponseTypeException",
     "current_user",
+    "GuardDependency",
     "optional_user",
     "require_scopes",
     "require_abilities",
+    "AuthException",
+    "InvalidGrantException",
+    "InvalidClientException",
+    "InvalidCredentialsException",
+    "InvalidTokenException",
+    "MissingScopeException",
+    "InvalidScopeException",
+    "InvalidTargetException",
+    "GrantPolicy",
+    "AuthenticationException",
+    "CsrfTokenMismatchException",
+    "AccessDenied",
+    "UnauthorizedClient",
+    "UnsupportedGrantType",
+    "UnsupportedResponseType",
     "AuthError",
-    "AsyncMisconfiguration",
     "InvalidGrant",
     "InvalidClient",
     "InvalidToken",
     "InsufficientScope",
     "InvalidScope",
     "InvalidTarget",
-    "GrantPolicy",
     "InvalidSession",
     "CsrfTokenMismatch",
     "Auth",
@@ -117,19 +150,12 @@ __all__ = (
     "ApiTokenRecord",
     "ApiTokenRepository",
     "InMemoryApiTokenRepository",
-    "AsyncAuth",
     "PassportGuard",
-    "AsyncPassportGuard",
-    "AsyncSessionGuard",
-    "AsyncTokenGuard",
-    "AsyncApiTokenManager",
+    "ChainGuard",
     "PasswordBroker",
-    "AsyncPasswordBroker",
     "InMemoryUserProvider",
     "ModelUserProvider",
-    "AsyncModelUserProvider",
     "TokenService",
-    "AsyncTokenService",
 )
 
 

{fastapi_startkit_auth-0.6.3 → fastapi_startkit_auth-0.8.0}/src/fastapi_startkit_auth/apitokens/manager.py

@@ -1,15 +1,14 @@
 from __future__ import annotations
 
 import secrets
-import threading
 import time
 from dataclasses import dataclass
 from typing import Any
 
 from ..concurrency import call
-from ..exceptions import InvalidToken
+from ..exceptions import InvalidTokenException
 from .models import ApiTokenRecord
-from .repository import ApiTokenRepository, generate_token_secret, hash_token_secret
+from .repository import generate_token_secret, hash_token_secret
 
 # Every verification failure raises this exact message so responses (and their
 # timing, via the dummy compare below) never reveal whether the id exists.
@@ -29,7 +28,7 @@ def _check_secret(record: ApiTokenRecord | None, secret: str) -> None:
     expected = record.token_hash if record is not None else _DUMMY_HASH
     matched = secrets.compare_digest(hash_token_secret(secret), expected)
     if record is None or not matched or record.expired:
-        raise InvalidToken(_GENERIC_FAILURE)
+        raise InvalidTokenException(_GENERIC_FAILURE)
 
 
 def _creation_fields(
@@ -69,79 +68,6 @@ class NewApiToken:
 
 
 class ApiTokenManager:
-    """Issues, verifies, revokes, and lists opaque API tokens.
-
-    Exposed as ``AuthManager.api_tokens``; apps wire their own management
-    routes around it (the package ships none, per the app-owns-routes
-    decision).
-    """
-
-    def __init__(
-        self,
-        repository: ApiTokenRepository,
-        default_ttl: float | None = None,
-        purge_interval: float = 300,
-    ) -> None:
-        self.repository = repository
-        self._default_ttl = default_ttl
-        self._purge_interval = purge_interval
-        self._purge_lock = threading.Lock()
-        self._last_purge = time.time()
-
-    def _maybe_purge(self) -> None:
-        """Drop expired records periodically so stores stay bounded without a
-        scheduler (mirrors the purge-on-issue pattern of ``TokenService``)."""
-        now = time.time()
-        with self._purge_lock:
-            if now - self._last_purge < self._purge_interval:
-                return
-            self._last_purge = now
-        self.repository.purge_expired()
-
-    def create(
-        self,
-        user_id: Any,
-        name: str | None = None,
-        abilities: list[str] | None = None,
-        expires_at: float | None = None,
-    ) -> NewApiToken:
-        """Issue a token for ``user_id``; the plaintext is returned exactly once.
-
-        ``expires_at`` overrides the configured default ttl; ``None`` with no
-        configured ttl means the token never expires. ``abilities`` default to
-        the unrestricted ``["*"]``.
-        """
-        self._maybe_purge()
-        secret = generate_token_secret()
-        record = self.repository.create(
-            **_creation_fields(user_id, secret, name, abilities, expires_at, self._default_ttl)
-        )
-        return NewApiToken(record=record, plain_text=f"{record.id}|{secret}")
-
-    def verify(self, token: str) -> ApiTokenRecord:
-        """Resolve ``"{id}|{secret}"`` to its live record or raise 401.
-
-        Lookup is by id (O(1), no scan); the secret comparison is constant-time
-        against the stored hash — or against a dummy hash when the id is
-        unknown, so the miss path costs the same as a mismatch.
-        """
-        token_id, secret = _split_token(token)
-        record = self.repository.find(token_id) if token_id else None
-        _check_secret(record, secret)
-        self.repository.touch(record.id)
-        return record
-
-    def revoke(self, token_id: str) -> bool:
-        return self.repository.revoke(token_id)
-
-    def revoke_all(self, user_id: Any) -> int:
-        return self.repository.revoke_all_for_user(user_id)
-
-    def tokens_for(self, user_id: Any) -> list[ApiTokenRecord]:
-        return self.repository.list_for_user(user_id)
-
-
-class AsyncApiTokenManager:
     def __init__(self, repository: Any, default_ttl: float | None = None, purge_interval: float = 300) -> None:
         self.repository = repository
         self._default_ttl = default_ttl

{fastapi_startkit_auth-0.6.3 → fastapi_startkit_auth-0.8.0}/src/fastapi_startkit_auth/commands/oauth2_client.py

@@ -5,7 +5,7 @@ from cleo.helpers import option
 from fastapi_startkit.console import Command
 
 from ..concurrency import call
-from ..exceptions import InvalidScope
+from ..exceptions import InvalidScopeException
 
 
 def _valid_redirect(uri: str | None) -> bool:
@@ -45,7 +45,7 @@ class OAuth2ClientCommand(Command):
             return 1
         try:
             manager.grant_policy.check_scopes(scopes)
-        except InvalidScope as error:
+        except InvalidScopeException as error:
             self.line_error(str(error))
             return 1
         client, secret = asyncio.run(

fastapi_startkit_auth-0.8.0/src/fastapi_startkit_auth/concurrency.py

@@ -0,0 +1,22 @@
+from __future__ import annotations
+
+import inspect
+from typing import Any, Callable
+
+from starlette.concurrency import run_in_threadpool
+
+
+async def resolve(value: Any) -> Any:
+    if inspect.isawaitable(value):
+        return await value
+    return value
+
+
+async def call(function: Callable[..., Any], *args: Any, **kwargs: Any) -> Any:
+    if is_coroutine_callable(function):
+        return await function(*args, **kwargs)
+    return await resolve(await run_in_threadpool(function, *args, **kwargs))
+
+
+def is_coroutine_callable(obj: Any) -> bool:
+    return inspect.iscoroutinefunction(obj) or inspect.iscoroutinefunction(getattr(obj, "__call__", None))

{fastapi_startkit_auth-0.6.3 → fastapi_startkit_auth-0.8.0}/src/fastapi_startkit_auth/config/__init__.py

@@ -4,9 +4,12 @@ from .auth import (
     ApiTokenConfig,
     ApiTokenGuard,
     AuthConfig,
+    ChainGuard,
     OAuth2Config,
     OAuth2Guard,
+    OAuthClientConfig,
     OAuthClientsConfig,
+    OAuthTokenConfig,
     OAuthTokensConfig,
     SessionConfig,
     SessionGuard,
@@ -19,12 +22,15 @@ __all__ = (
     "AuthConfig",
     "SessionConfig",
     "OAuth2Config",
+    "OAuthClientConfig",
     "OAuthClientsConfig",
+    "OAuthTokenConfig",
     "OAuthTokensConfig",
     "ApiTokenConfig",
     "SessionGuard",
     "OAuth2Guard",
     "ApiTokenGuard",
+    "ChainGuard",
     "DEFAULT_GRANT_TYPES",
     "DEPRECATED_OAUTH2_ATTRIBUTES",
     "as_config_class",

{fastapi_startkit_auth-0.6.3 → fastapi_startkit_auth-0.8.0}/src/fastapi_startkit_auth/config/auth.py

@@ -8,14 +8,14 @@ from typing import Any, Literal, TypeVar
 ConfigT = TypeVar("ConfigT")
 
 
-def _canonical_store(store: str, section: str) -> str:
-    if store == "orm":
+def _canonical_driver(driver: str, section: str) -> str:
+    if driver == "orm":
         # stacklevel 4: this helper, __post_init__, the dataclass __init__, then the caller.
         warnings.warn(
-            f'{section}(store="orm") is deprecated; use store="database".', DeprecationWarning, stacklevel=4
+            f'{section}(driver="orm") is deprecated; use driver="database".', DeprecationWarning, stacklevel=4
         )
         return "database"
-    return store
+    return driver
 
 
 @dataclass
@@ -28,6 +28,7 @@ class SessionGuard:
 class OAuth2Guard:
     provider: str = "users"
     audience: str | None = None
+    first_party_only: bool = False
     driver: Literal["oauth2"] = "oauth2"
 
 
@@ -37,15 +38,23 @@ class ApiTokenGuard:
     driver: Literal["token"] = "token"
 
 
+@dataclass
+class ChainGuard:
+    """Authenticates through the first of ``guards`` (guard names) that accepts the request."""
+
+    guards: list[str] = field(default_factory=list)
+    driver: Literal["chain"] = "chain"
+
+
 @dataclass
 class SessionConfig:
     """Cookie sessions, enabled by ``AuthSessionProvider``.
 
-    ``store`` is "memory", "database" (the ORM ``sessions`` table; "orm" is a
+    ``driver`` is "memory", "database" (the ORM ``sessions`` table; "orm" is a
     deprecated alias) or "instance" (a ready-made store under ``instance``).
     """
 
-    store: str = "memory"
+    driver: str = "memory"
     connection: str | None = None
     instance: Any = None
     cookie: str = "startkit_session"
@@ -63,7 +72,7 @@ class SessionConfig:
     csrf_exempt_paths: list[str] = field(default_factory=list)
 
     def __post_init__(self) -> None:
-        self.store = _canonical_store(self.store, "SessionConfig")
+        self.driver = _canonical_driver(self.driver, "SessionConfig")
 
 
 @dataclass
@@ -74,7 +83,7 @@ class ApiTokenConfig:
     accept the ``session_guard`` cookie session from those origins.
     """
 
-    store: str = "memory"
+    driver: str = "memory"
     connection: str | None = None
     instance: Any = None
     header: str = "Authorization"
@@ -84,7 +93,7 @@ class ApiTokenConfig:
     session_guard: str = "web"
 
     def __post_init__(self) -> None:
-        self.store = _canonical_store(self.store, "ApiTokenConfig")
+        self.driver = _canonical_driver(self.driver, "ApiTokenConfig")
 
     @property
     def stateful(self) -> bool:
@@ -92,25 +101,42 @@ class ApiTokenConfig:
 
 
 @dataclass
-class OAuthClientsConfig:
+class OAuthClientConfig:
     """Where OAuth clients live: "database" (the ORM ``oauth_clients`` table), "memory" or "instance"."""
 
-    store: str = "database"
+    driver: str = "database"
     connection: str | None = None
     instance: Any = None
 
     def __post_init__(self) -> None:
-        self.store = _canonical_store(self.store, "OAuthClientsConfig")
+        self.driver = _canonical_driver(self.driver, "OAuthClientConfig")
 
 
 @dataclass
-class OAuthTokensConfig:
-    store: str = "memory"
+class OAuthTokenConfig:
+    driver: str = "memory"
     connection: str | None = None
     instance: Any = None
 
     def __post_init__(self) -> None:
-        self.store = _canonical_store(self.store, "OAuthTokensConfig")
+        self.driver = _canonical_driver(self.driver, "OAuthTokenConfig")
+
+
+def _deprecated_alias(config_type: type[ConfigT], old_name: str) -> type[ConfigT]:
+    class Alias(config_type):
+        def __init__(self, *args: Any, **kwargs: Any) -> None:
+            warnings.warn(
+                f"{old_name} is deprecated; use {config_type.__name__}.", DeprecationWarning, stacklevel=2
+            )
+            super().__init__(*args, **kwargs)
+
+    Alias.__name__ = old_name
+    Alias.__qualname__ = old_name
+    return Alias
+
+
+OAuthClientsConfig = _deprecated_alias(OAuthClientConfig, "OAuthClientsConfig")
+OAuthTokensConfig = _deprecated_alias(OAuthTokenConfig, "OAuthTokensConfig")
 
 
 DEFAULT_GRANT_TYPES = ("authorization_code", "client_credentials", "refresh_token")
@@ -145,12 +171,12 @@ class OAuth2Config:
     require_redirect_uri: bool = True
     grant_types: list[str] = field(default_factory=lambda: list(DEFAULT_GRANT_TYPES))
     authorization_guard: str | None = None
-    tokens: OAuthTokensConfig = field(default_factory=OAuthTokensConfig)
-    clients: OAuthClientsConfig = field(default_factory=OAuthClientsConfig)
+    tokens: OAuthTokenConfig = field(default_factory=OAuthTokenConfig)
+    clients: OAuthClientConfig = field(default_factory=OAuthClientConfig)
 
     def __post_init__(self) -> None:
-        self.tokens = resolve_config(self.tokens, OAuthTokensConfig)
-        self.clients = resolve_config(self.clients, OAuthClientsConfig)
+        self.tokens = resolve_config(self.tokens, OAuthTokenConfig)
+        self.clients = resolve_config(self.clients, OAuthClientConfig)
 
 
 # v0.6 AuthConfig attributes that moved to OAuth2Config; still read, with a warning.