fastapi-startkit-auth 0.7.0__tar.gz → 0.8.0__tar.gz

{fastapi_startkit_auth-0.7.0 → fastapi_startkit_auth-0.8.0}/CHANGELOG.md

@@ -11,6 +11,26 @@ Release notes are also published on
 
 Each item lists what changed and what to do.
 
+- **The package is async-only; every sync class is removed.** The sync
+  `Auth`, `SessionGuard`, `PassportGuard`, `TokenGuard`, `ChainGuard`,
+  `TokenService`, `ApiTokenManager`, `PasswordBroker`, `PasswordGrant`,
+  `ClientCredentialsGrant`, `AuthorizationCodeGrant`, `RefreshTokenGrant`,
+  `ModelUserProvider` and `UserProvider` are gone, and each `Async*` class now
+  carries the plain name (`AsyncAuth` is `Auth`, `AsyncTokenService` is
+  `TokenService`, and so on). `user_is_active_async`, `find_user_async`,
+  `active_user_async` and `AuthManager.owner_provider_async` lose their
+  `_async` suffix; `AuthManager.owner_provider` is now a coroutine.
+  `AsyncMisconfiguration`, `ensure_sync`, `is_async_provider`,
+  `guard_is_async`, `is_async` and `has_async_methods` are removed, and the
+  `"async_model"` provider driver is dropped in favour of `"model"`;
+  configuring it raises a `ValueError` naming the replacement. The `"model"`
+  driver accepts sync and async models: a sync model's `find`,
+  `where(...).first()` and `save()` run in the threadpool.
+  `InMemoryUserProvider` methods are coroutines. User-supplied stores,
+  listeners and `is_active` hooks may still be sync; they run in the
+  threadpool. *Migrate:* import the plain names, `await` every `Auth`, guard,
+  provider, broker, grant and token-service call, and change
+  `driver="async_model"` to `driver="model"`.
 - **Feature providers replace `Application` and `AuthServiceProvider`.**
   Register `AuthProvider` first, then the features your guards use:
   `AuthSessionProvider(SessionConfig)`, `AuthOAuth2Provider(OAuth2Config)` and
@@ -90,6 +110,18 @@ Each item lists what changed and what to do.
   `revoke_token_chain`, and `store_refresh_token` takes `family_id`.
 - Error responses carry `Cache-Control: no-store`; `invalid_client` challenges
   with `WWW-Authenticate: Basic`.
+- **Class-level `Auth.guard(name)` is a FastAPI dependency.**
+  `Auth.guard(name)` / `AsyncAuth.guard(name)` on the class now returns a
+  `GuardDependency`: `user = Depends(Auth.guard("api"))` resolves the user
+  through that guard and raises 401 otherwise, and equal names compare equal,
+  so `app.dependency_overrides[Auth.guard("api")]` works. Inside a request,
+  attribute access (`provider`, `user_from_token`, `authenticate`, ...) still
+  reaches the named guard, but the value is no longer the guard object itself,
+  so identity and `isinstance` checks fail, and outside a request attributes
+  raise `AttributeError`. On an instance (`auth.guard(name)` from
+  `Depends(Auth.scoped)`) it still returns the guard. *Migrate:* where you need
+  the guard object, use `auth.guard(name)` from `Depends(Auth.scoped)` or
+  `manager.guard(name)`.
 
 ### Migrations
 
@@ -104,6 +136,18 @@ using the ORM stores:
 
 ### Added
 
+- `ChainGuard(guards=[...])` (`{"driver": "chain"}`): authenticates through the
+  first member guard that accepts the request, e.g. a bearer token backed by
+  the browser session. A token the request presents is final for every member
+  type (oauth2 bearer, or an API token in `Authorization` or a custom header):
+  when the member that reads it rejects it, the chain fails instead of trying
+  the session. `user_from_token` skips session members.
+- `OAuth2Guard(first_party_only=True)` refuses access tokens issued to an OAuth
+  client (`client_id` set), so a first-party API accepts only the
+  application's own login and personal tokens.
+- `AuthManager.on_authenticated(listener)`: `listener(request, user, guard)`
+  runs whenever a guard dependency resolves a user, before the route handler,
+  for activity tracking or request-scoped state.
 - Refresh token families with reuse detection: replaying a rotated refresh token
   revokes the whole family, whoever presents it: the owning client, another
   authenticated client, or no client at all for unbound password-grant tokens.

{fastapi_startkit_auth-0.7.0 → fastapi_startkit_auth-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-startkit-auth
-Version: 0.7.0
+Version: 0.8.0
 Summary: Laravel-style authentication for FastAPI: OAuth2/JWT authorization server, cookie/session guard, SPA + CSRF protection, and Sanctum-style API tokens.
 Keywords: fastapi,oauth2,jwt,auth,passport,sanctum,authentication,authorization,security,tokens,session,cookie,csrf,spa,starter-kit
 Author: Bedram Tamang

{fastapi_startkit_auth-0.7.0 → fastapi_startkit_auth-0.8.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fastapi-startkit-auth"
-version = "0.7.0"
+version = "0.8.0"
 description = "Laravel-style authentication for FastAPI: OAuth2/JWT authorization server, cookie/session guard, SPA + CSRF protection, and Sanctum-style API tokens."
 readme = "README.md"
 license = "MIT"

{fastapi_startkit_auth-0.7.0 → fastapi_startkit_auth-0.8.0}/src/fastapi_startkit_auth/__init__.py

@@ -8,10 +8,9 @@ Passport while staying idiomatic FastAPI:
 from __future__ import annotations
 
 from .apitokens.facade import ApiToken
-from .apitokens.manager import ApiTokenManager, AsyncApiTokenManager, NewApiToken
+from .apitokens.manager import ApiTokenManager, NewApiToken
 from .apitokens.models import ApiTokenRecord
 from .apitokens.repository import ApiTokenRepository, InMemoryApiTokenRepository
-from .concurrency import AsyncMisconfiguration
 from .clients.models import Client
 from .clients.repository import InMemoryClientRepository
 from .config import (
@@ -25,6 +24,7 @@ from .config import (
     SessionConfig,
 )
 from .dependencies import (
+    GuardDependency,
     auth,
     current_user,
     optional_user,
@@ -61,24 +61,25 @@ from .exceptions import (
     UnsupportedResponseTypeException,
 )
 from .policy import GrantPolicy
-from .facade import AsyncAuth, Auth
-from .guards.guard import AsyncPassportGuard, PassportGuard
-from .guards.session import AsyncSessionGuard, SessionGuard
-from .guards.token import AsyncTokenGuard, TokenGuard
+from .facade import Auth
+from .guards.chain import ChainGuard
+from .guards.guard import PassportGuard
+from .guards.session import SessionGuard
+from .guards.token import TokenGuard
 from .manager import AuthManager, FeatureNotRegistered
 from .middleware.context import AuthMiddleware
 from .middleware.csrf import CsrfMiddleware
 from .middleware.session import SessionMiddleware
-from .passwords.broker import AsyncPasswordBroker, PasswordBroker
+from .passwords.broker import PasswordBroker
 from .provider import AuthApiTokenProvider, AuthOAuth2Provider, AuthProvider, AuthSessionProvider
 from .providers.memory import InMemoryUserProvider
-from .providers.model import AsyncModelUserProvider, ModelUserProvider
+from .providers.model import ModelUserProvider
 from .sessions.facade import Session
 from .sessions.models import SessionRecord
 from .sessions.store import InMemorySessionStore, SessionStore
-from .tokens.service import AsyncTokenService, TokenService
+from .tokens.service import TokenService
 
-__version__ = "0.7.0"
+__version__ = "0.8.0"
 
 __all__ = (
     "AuthConfig",
@@ -108,11 +109,11 @@ __all__ = (
     "UnsupportedGrantTypeException",
     "UnsupportedResponseTypeException",
     "current_user",
+    "GuardDependency",
     "optional_user",
     "require_scopes",
     "require_abilities",
     "AuthException",
-    "AsyncMisconfiguration",
     "InvalidGrantException",
     "InvalidClientException",
     "InvalidCredentialsException",
@@ -149,19 +150,12 @@ __all__ = (
     "ApiTokenRecord",
     "ApiTokenRepository",
     "InMemoryApiTokenRepository",
-    "AsyncAuth",
     "PassportGuard",
-    "AsyncPassportGuard",
-    "AsyncSessionGuard",
-    "AsyncTokenGuard",
-    "AsyncApiTokenManager",
+    "ChainGuard",
     "PasswordBroker",
-    "AsyncPasswordBroker",
     "InMemoryUserProvider",
     "ModelUserProvider",
-    "AsyncModelUserProvider",
     "TokenService",
-    "AsyncTokenService",
 )
 
 

{fastapi_startkit_auth-0.7.0 → fastapi_startkit_auth-0.8.0}/src/fastapi_startkit_auth/apitokens/manager.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 import secrets
-import threading
 import time
 from dataclasses import dataclass
 from typing import Any
@@ -9,7 +8,7 @@ from typing import Any
 from ..concurrency import call
 from ..exceptions import InvalidTokenException
 from .models import ApiTokenRecord
-from .repository import ApiTokenRepository, generate_token_secret, hash_token_secret
+from .repository import generate_token_secret, hash_token_secret
 
 # Every verification failure raises this exact message so responses (and their
 # timing, via the dummy compare below) never reveal whether the id exists.
@@ -69,79 +68,6 @@ class NewApiToken:
 
 
 class ApiTokenManager:
-    """Issues, verifies, revokes, and lists opaque API tokens.
-
-    Exposed as ``AuthManager.api_tokens``; apps wire their own management
-    routes around it (the package ships none, per the app-owns-routes
-    decision).
-    """
-
-    def __init__(
-        self,
-        repository: ApiTokenRepository,
-        default_ttl: float | None = None,
-        purge_interval: float = 300,
-    ) -> None:
-        self.repository = repository
-        self._default_ttl = default_ttl
-        self._purge_interval = purge_interval
-        self._purge_lock = threading.Lock()
-        self._last_purge = time.time()
-
-    def _maybe_purge(self) -> None:
-        """Drop expired records periodically so stores stay bounded without a
-        scheduler (mirrors the purge-on-issue pattern of ``TokenService``)."""
-        now = time.time()
-        with self._purge_lock:
-            if now - self._last_purge < self._purge_interval:
-                return
-            self._last_purge = now
-        self.repository.purge_expired()
-
-    def create(
-        self,
-        user_id: Any,
-        name: str | None = None,
-        abilities: list[str] | None = None,
-        expires_at: float | None = None,
-    ) -> NewApiToken:
-        """Issue a token for ``user_id``; the plaintext is returned exactly once.
-
-        ``expires_at`` overrides the configured default ttl; ``None`` with no
-        configured ttl means the token never expires. ``abilities`` default to
-        the unrestricted ``["*"]``.
-        """
-        self._maybe_purge()
-        secret = generate_token_secret()
-        record = self.repository.create(
-            **_creation_fields(user_id, secret, name, abilities, expires_at, self._default_ttl)
-        )
-        return NewApiToken(record=record, plain_text=f"{record.id}|{secret}")
-
-    def verify(self, token: str) -> ApiTokenRecord:
-        """Resolve ``"{id}|{secret}"`` to its live record or raise 401.
-
-        Lookup is by id (O(1), no scan); the secret comparison is constant-time
-        against the stored hash — or against a dummy hash when the id is
-        unknown, so the miss path costs the same as a mismatch.
-        """
-        token_id, secret = _split_token(token)
-        record = self.repository.find(token_id) if token_id else None
-        _check_secret(record, secret)
-        self.repository.touch(record.id)
-        return record
-
-    def revoke(self, token_id: str) -> bool:
-        return self.repository.revoke(token_id)
-
-    def revoke_all(self, user_id: Any) -> int:
-        return self.repository.revoke_all_for_user(user_id)
-
-    def tokens_for(self, user_id: Any) -> list[ApiTokenRecord]:
-        return self.repository.list_for_user(user_id)
-
-
-class AsyncApiTokenManager:
     def __init__(self, repository: Any, default_ttl: float | None = None, purge_interval: float = 300) -> None:
         self.repository = repository
         self._default_ttl = default_ttl

fastapi_startkit_auth-0.8.0/src/fastapi_startkit_auth/concurrency.py

@@ -0,0 +1,22 @@
+from __future__ import annotations
+
+import inspect
+from typing import Any, Callable
+
+from starlette.concurrency import run_in_threadpool
+
+
+async def resolve(value: Any) -> Any:
+    if inspect.isawaitable(value):
+        return await value
+    return value
+
+
+async def call(function: Callable[..., Any], *args: Any, **kwargs: Any) -> Any:
+    if is_coroutine_callable(function):
+        return await function(*args, **kwargs)
+    return await resolve(await run_in_threadpool(function, *args, **kwargs))
+
+
+def is_coroutine_callable(obj: Any) -> bool:
+    return inspect.iscoroutinefunction(obj) or inspect.iscoroutinefunction(getattr(obj, "__call__", None))

{fastapi_startkit_auth-0.7.0 → fastapi_startkit_auth-0.8.0}/src/fastapi_startkit_auth/config/__init__.py

@@ -4,6 +4,7 @@ from .auth import (
     ApiTokenConfig,
     ApiTokenGuard,
     AuthConfig,
+    ChainGuard,
     OAuth2Config,
     OAuth2Guard,
     OAuthClientConfig,
@@ -29,6 +30,7 @@ __all__ = (
     "SessionGuard",
     "OAuth2Guard",
     "ApiTokenGuard",
+    "ChainGuard",
     "DEFAULT_GRANT_TYPES",
     "DEPRECATED_OAUTH2_ATTRIBUTES",
     "as_config_class",

{fastapi_startkit_auth-0.7.0 → fastapi_startkit_auth-0.8.0}/src/fastapi_startkit_auth/config/auth.py

@@ -28,6 +28,7 @@ class SessionGuard:
 class OAuth2Guard:
     provider: str = "users"
     audience: str | None = None
+    first_party_only: bool = False
     driver: Literal["oauth2"] = "oauth2"
 
 
@@ -37,6 +38,14 @@ class ApiTokenGuard:
     driver: Literal["token"] = "token"
 
 
+@dataclass
+class ChainGuard:
+    """Authenticates through the first of ``guards`` (guard names) that accepts the request."""
+
+    guards: list[str] = field(default_factory=list)
+    driver: Literal["chain"] = "chain"
+
+
 @dataclass
 class SessionConfig:
     """Cookie sessions, enabled by ``AuthSessionProvider``.

{fastapi_startkit_auth-0.7.0 → fastapi_startkit_auth-0.8.0}/src/fastapi_startkit_auth/dependencies.py

@@ -85,6 +85,51 @@ async def optional_user(
         return None
 
 
+class GuardDependency:
+    """FastAPI dependency resolving the request's user through a named guard.
+
+    ``user = Depends(Auth.guard("api"))`` authenticates with whatever the
+    guard's driver reads (bearer token, session cookie, API token, a chain of
+    them) and raises 401 when it cannot, or when the credential has no user.
+    A resolved user is announced to ``AuthManager.on_authenticated`` listeners.
+    Equal names compare equal, so ``app.dependency_overrides`` can key on
+    ``Auth.guard("api")``. Inside a request, other attributes (``provider``,
+    ``user_from_token``, ``authenticate``...) are read from the named guard, so
+    code that used class-level ``Auth.guard(name)`` as the guard keeps working.
+    """
+
+    def __init__(self, name: str | None = None) -> None:
+        self.name = name
+
+    async def __call__(self, request: Request, token: str | None = Depends(_bearer)) -> Any:
+        manager = get_auth_manager(request)
+        context = await resolve_context(request, manager, self.name)
+        if context.user is None:
+            raise InvalidTokenException("This token is not associated with a user.")
+        await manager.authenticated(request, context.user, self.name)
+        return context.user
+
+    def __getattr__(self, attribute: str) -> Any:
+        if attribute.startswith("__") or attribute == "name":
+            raise AttributeError(attribute)
+        context = _auth_request.get()
+        if context is None or not context.active:
+            raise AttributeError(
+                f"{type(self).__name__} has no attribute {attribute!r} outside a request; "
+                "use the AuthManager's guard() there."
+            )
+        return getattr(context.manager.guard(self.name), attribute)
+
+    def __eq__(self, other: object) -> bool:
+        return isinstance(other, GuardDependency) and other.name == self.name
+
+    def __hash__(self) -> int:
+        return hash((GuardDependency, self.name))
+
+    def __repr__(self) -> str:
+        return f"GuardDependency({self.name!r})"
+
+
 def require_scopes(*scopes: str, mode: str = "all") -> Callable[..., AuthContext]:
     """Dependency factory enforcing token abilities (Passport-style scopes).
 

fastapi_startkit_auth-0.8.0/src/fastapi_startkit_auth/facade.py

@@ -0,0 +1,95 @@
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi import Depends, Request
+
+from .dependencies import GuardDependency, get_auth_manager, resolve_context
+from .concurrency import call
+from .exceptions import AuthException
+from .guards.session import SessionGuard
+from .manager import AuthManager
+from .providers.base import user_is_active
+from .scoped_method import ScopedMethod
+from .sessions.models import SessionRecord
+
+
+class GuardAccessor:
+    """``Auth.guard(name)`` is a FastAPI dependency; ``auth.guard(name)`` on an instance is the guard itself."""
+
+    def __get__(self, instance: Any, owner: type) -> Any:
+        if instance is None:
+            return GuardDependency
+        return instance._manager.guard
+
+
+class Auth:
+    def __init__(self, manager: AuthManager, request: Request) -> None:
+        self._manager = manager
+        self._request = request
+
+    @classmethod
+    def scoped(cls, request: Request, manager: AuthManager = Depends(get_auth_manager)) -> "Auth":
+        return cls(manager, request)
+
+    guard = GuardAccessor()
+
+    @ScopedMethod
+    async def login(self, user_or_id: Any, guard: str | None = None) -> SessionRecord:
+        session_guard = self._session_guard(guard)
+        user = await self._resolve_user(user_or_id, session_guard)
+        return await call(session_guard.login, self._request, user)
+
+    @ScopedMethod
+    async def attempt(self, credentials: dict[str, Any], guard: str | None = None) -> bool:
+        session_guard = self._session_guard(guard)
+        user = await self.validate(credentials, session_guard.name)
+        if user is None:
+            return False
+        await call(session_guard.login, self._request, user)
+        return True
+
+    @ScopedMethod
+    async def validate(self, credentials: dict[str, Any], guard: str | None = None) -> Any | None:
+        provider = self.guard(guard).provider
+        user = await call(provider.retrieve_by_credentials, credentials)
+        if user is None:
+            dummy = getattr(provider, "dummy_verify", None)
+            if dummy is not None:
+                await call(dummy)
+            return None
+        valid = await call(provider.validate_credentials, user, credentials)
+        return user if valid and await user_is_active(provider, user) else None
+
+    @ScopedMethod
+    async def logout(self, guard: str | None = None) -> None:
+        await call(self._session_guard(guard).logout, self._request)
+
+    @ScopedMethod
+    async def user(self, guard: str | None = None) -> Any | None:
+        try:
+            return (await resolve_context(self._request, self._manager, guard)).user
+        except AuthException:
+            return None
+
+    @ScopedMethod
+    async def id(self, guard: str | None = None) -> Any | None:
+        user = await self.user(guard)
+        if user is None:
+            return None
+        return self.guard(guard).provider.get_identifier(user)
+
+    @ScopedMethod
+    async def check(self, guard: str | None = None) -> bool:
+        return await self.user(guard) is not None
+
+    def _session_guard(self, name: str | None) -> SessionGuard:
+        return self._manager.session_guard(name)
+
+    async def _resolve_user(self, user_or_id: Any, session_guard: Any) -> Any:
+        if not isinstance(user_or_id, (int, str)):
+            return user_or_id
+        user = await call(session_guard.provider.retrieve_by_id, user_or_id)
+        if user is None:
+            raise ValueError(f"No user with id {user_or_id!r} in guard {session_guard.name!r}'s provider.")
+        return user

fastapi_startkit_auth-0.8.0/src/fastapi_startkit_auth/grants/__init__.py

@@ -0,0 +1,13 @@
+from .authorization_code import AuthorizationCodeGrant
+from .client_credentials import ClientCredentialsGrant
+from .password import PasswordGrant
+from .pkce import verify_pkce
+from .refresh import RefreshTokenGrant
+
+__all__ = [
+    "PasswordGrant",
+    "ClientCredentialsGrant",
+    "RefreshTokenGrant",
+    "AuthorizationCodeGrant",
+    "verify_pkce",
+]

{fastapi_startkit_auth-0.7.0 → fastapi_startkit_auth-0.8.0}/src/fastapi_startkit_auth/grants/authorization_code.py

@@ -8,10 +8,10 @@ from ..clients.models import Client
 from ..concurrency import call
 from ..exceptions import InvalidClientException, InvalidGrantException
 from ..policy import GrantPolicy, ensure_client_may, ensure_same_resource, ensure_valid_verifier
-from ..tokens.service import IssuedToken, TokenService
+from ..tokens.service import IssuedToken
 from ..tokens.models import AuthorizationCode
 from .pkce import verify_pkce
-from .refresh import OwnerProviderResolver, ensure_owner_active, ensure_owner_active_async, owner_resolver
+from .refresh import OwnerProviderResolver, ensure_owner_active, owner_resolver
 
 
 def _validate_request(
@@ -59,97 +59,6 @@ def _validate_exchange(
 
 
 class AuthorizationCodeGrant:
-    """Authorization-code grant with PKCE (RFC 6749 §4.1 + RFC 7636).
-
-    PKCE is mandatory for public (secretless) clients and for any exchange where
-    the client did not authenticate — both at code issuance (a public client
-    cannot obtain a code without a ``code_challenge``) and at exchange (the
-    verifier must match). Confidential clients that authenticate may omit PKCE,
-    but any challenge they do supply is still verified.
-
-    ``issue_code`` is called after the resource owner approves a request;
-    ``handle`` exchanges the resulting single-use code for tokens.
-    """
-
-    def __init__(
-        self,
-        token_service: TokenService,
-        code_ttl: int = 600,
-        user_provider: Any = None,
-        owner_provider: OwnerProviderResolver | None = None,
-        policy: GrantPolicy | None = None,
-    ) -> None:
-        self._tokens = token_service
-        self._code_ttl = code_ttl
-        self._policy = policy or GrantPolicy()
-        self._owner_provider = owner_resolver(user_provider, owner_provider)
-
-    def validate_request(
-        self,
-        *,
-        client: Client,
-        redirect_uri: str | None,
-        scopes: list[str],
-        code_challenge: str | None,
-        code_challenge_method: str | None,
-        resource: str | None = None,
-    ) -> None:
-        """Reject an authorization request before the user is asked to approve it."""
-        _validate_request(
-            self._policy, client, redirect_uri, scopes, code_challenge, code_challenge_method, resource
-        )
-
-    def issue_code(
-        self,
-        *,
-        client: Client,
-        user_id: Any,
-        scopes: list[str],
-        redirect_uri: str | None,
-        code_challenge: str | None,
-        code_challenge_method: str | None,
-        resource: str | None = None,
-    ) -> str:
-        _validate_request(
-            self._policy, client, redirect_uri, scopes, code_challenge, code_challenge_method, resource
-        )
-        code = secrets.token_urlsafe(40)
-        self._tokens.repository.store_auth_code(
-            code=code,
-            client_id=client.id,
-            user_id=user_id,
-            scopes=scopes,
-            redirect_uri=redirect_uri,
-            code_challenge=code_challenge,
-            code_challenge_method=code_challenge_method,
-            expires_at=time.time() + self._code_ttl,
-            resource=resource,
-        )
-        return code
-
-    def handle(
-        self,
-        *,
-        client: Client,
-        code: str,
-        redirect_uri: str | None,
-        code_verifier: str | None,
-        client_authenticated: bool = False,
-        resource: str | None = None,
-    ) -> IssuedToken:
-        record = self._tokens.repository.pull_auth_code(code)
-        _validate_exchange(record, client, redirect_uri, code_verifier, client_authenticated, resource)
-        ensure_owner_active(self._owner_provider(client.id), record.user_id)
-        return self._tokens.issue(
-            user_id=record.user_id,
-            client_id=client.id,
-            scopes=record.scopes,
-            with_refresh=True,
-            audience=record.resource,
-        )
-
-
-class AsyncAuthorizationCodeGrant:
     def __init__(
         self,
         token_service: Any,
@@ -219,7 +128,7 @@ class AsyncAuthorizationCodeGrant:
     ) -> IssuedToken:
         record = await call(self._tokens.repository.pull_auth_code, code)
         _validate_exchange(record, client, redirect_uri, code_verifier, client_authenticated, resource)
-        await ensure_owner_active_async(await call(self._owner_provider, client.id), record.user_id)
+        await ensure_owner_active(await call(self._owner_provider, client.id), record.user_id)
         return await call(
             self._tokens.issue,
             user_id=record.user_id,

{fastapi_startkit_auth-0.7.0 → fastapi_startkit_auth-0.8.0}/src/fastapi_startkit_auth/grants/client_credentials.py

@@ -6,7 +6,7 @@ from ..clients.models import Client
 from ..concurrency import call
 from ..exceptions import UnauthorizedClientException
 from ..policy import GrantPolicy, ensure_client_may
-from ..tokens.service import IssuedToken, TokenService
+from ..tokens.service import IssuedToken
 
 
 def _check(policy: GrantPolicy, client: Client, scopes: list[str], resource: str | None) -> None:
@@ -20,24 +20,6 @@ def _check(policy: GrantPolicy, client: Client, scopes: list[str], resource: str
 
 
 class ClientCredentialsGrant:
-    """Machine-to-machine grant (RFC 6749 §4.4) for confidential clients. No user, no refresh token."""
-
-    def __init__(self, token_service: TokenService, policy: GrantPolicy | None = None) -> None:
-        self._tokens = token_service
-        self._policy = policy or GrantPolicy()
-
-    def handle(self, *, client: Client, scopes: list[str], resource: str | None = None) -> IssuedToken:
-        _check(self._policy, client, scopes, resource)
-        return self._tokens.issue(
-            user_id=None,
-            client_id=client.id,
-            scopes=scopes,
-            with_refresh=False,
-            audience=resource,
-        )
-
-
-class AsyncClientCredentialsGrant:
     def __init__(self, token_service: Any, policy: GrantPolicy | None = None) -> None:
         self._tokens = token_service
         self._policy = policy or GrantPolicy()