fastmcp-edge-authz 0.0.1__tar.gz

fastmcp_edge_authz-0.0.1/.gitattributes

@@ -0,0 +1,10 @@
+# Store and check out text files as LF on every platform, overriding a local
+# core.autocrlf=true that would otherwise produce phantom EOL-only diffs.
+# text=auto leaves detected binaries untouched; eol=lf pins the *working tree*.
+* text=auto eol=lf
+
+# cmd.exe reads batch files by byte offset, so LF-only endings break labels
+# and goto. Do NOT add *.ps1 here: PowerShell is cross-platform, and CRLF
+# breaks the shebang of a .ps1 meant to run on Linux/macOS.
+*.bat text eol=crlf
+*.cmd text eol=crlf

fastmcp_edge_authz-0.0.1/.github/workflows/publish.yml

@@ -0,0 +1,42 @@
+name: Publish to PyPI
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+jobs:
+  pypi-publish:
+    name: Upload to PyPI
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write # For PyPI's trusted publishing
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+
+      - name: Build
+        run: uv build
+
+      - name: Check version format
+        run: |
+          # Extract version from the built package
+          VERSION=$(ls dist/*.whl | head -n1 | sed -E 's/.*-([0-9].*)-.*/\1/')
+          echo "Package version: $VERSION"
+
+          # Check if version contains dev/post markers (development version)
+          if [[ "$VERSION" =~ (dev|post.*dev) ]]; then
+            echo "❌ ERROR: Cannot publish development version: $VERSION"
+            echo "Please create a proper Git tag first (e.g., 'git tag v0.1.0')"
+            exit 1
+          fi
+
+          echo "✅ Version $VERSION is valid for publishing"
+
+      - name: Publish to PyPI
+        run: uv publish -v dist/*

fastmcp_edge_authz-0.0.1/.gitignore

@@ -0,0 +1,24 @@
+# Python-generated files
+__pycache__/
+*.py[oc]
+build/
+dist/
+wheels/
+*.egg-info
+
+# Virtual environments
+.venv/
+
+# Log files
+*.log
+
+# Coverage reports
+.coverage
+htmlcov/
+.pytest_cache/
+
+# VSCode settings
+.vscode/PythonImportHelper-v2-Completion.json
+
+# Claude Code local settings (tool permissions, personal overrides — not shared)
+.claude/settings.local.json

fastmcp_edge_authz-0.0.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Stephan Eberle
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

fastmcp_edge_authz-0.0.1/PKG-INFO

@@ -0,0 +1,41 @@
+Metadata-Version: 2.5
+Name: fastmcp-edge-authz
+Version: 0.0.1
+Summary: Edge policy enforcement point for FastMCP servers: verifies end-user tokens and applies an allow/deny policy before calling upstreams with a service credential (planned; this release only reserves the name).
+Project-URL: Homepage, https://github.com/stephaneberle9/fastmcp-edge-authz
+Project-URL: Repository, https://github.com/stephaneberle9/fastmcp-edge-authz
+Author-email: Stephan Eberle <stephaneberle9@gmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 1 - Planning
+Classifier: Programming Language :: Python :: 3
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+
+# fastmcp-edge-authz
+
+> [!NOTE]
+> Planned, not implemented. The releases published so far only reserve the
+> package name on PyPI and contain no code.
+
+`fastmcp-edge-authz` is meant to become the policy enforcement point for
+[FastMCP](https://gofastmcp.com) servers that front an upstream API through one
+shared service credential, so the upstream cannot tell end users apart. On
+every request it will:
+
+1. verify the end user's token from an external identity provider;
+2. decide with a configurable allow/deny policy, either a local TOML allowlist
+   or a remote policy decision point;
+3. write an audit entry naming the user and the decision;
+4. drop the end-user identity and call the upstream with the service
+   credential.
+
+The framework-neutral parts (principals, decisions, the versioned policy file
+and the audit log) come from
+[python-edge-authz](https://github.com/stephaneberle9/python-edge-authz). For a
+server where each user brings their own upstream credential, see
+[fastmcp-edge-byok](https://github.com/stephaneberle9/fastmcp-edge-byok).
+
+## License
+
+MIT

fastmcp_edge_authz-0.0.1/README.md

@@ -0,0 +1,27 @@
+# fastmcp-edge-authz
+
+> [!NOTE]
+> Planned, not implemented. The releases published so far only reserve the
+> package name on PyPI and contain no code.
+
+`fastmcp-edge-authz` is meant to become the policy enforcement point for
+[FastMCP](https://gofastmcp.com) servers that front an upstream API through one
+shared service credential, so the upstream cannot tell end users apart. On
+every request it will:
+
+1. verify the end user's token from an external identity provider;
+2. decide with a configurable allow/deny policy, either a local TOML allowlist
+   or a remote policy decision point;
+3. write an audit entry naming the user and the decision;
+4. drop the end-user identity and call the upstream with the service
+   credential.
+
+The framework-neutral parts (principals, decisions, the versioned policy file
+and the audit log) come from
+[python-edge-authz](https://github.com/stephaneberle9/python-edge-authz). For a
+server where each user brings their own upstream credential, see
+[fastmcp-edge-byok](https://github.com/stephaneberle9/fastmcp-edge-byok).
+
+## License
+
+MIT

fastmcp_edge_authz-0.0.1/fastmcp_edge_authz/__init__.py

@@ -0,0 +1,4 @@
+"""fastmcp-edge-authz: an edge policy enforcement point for FastMCP servers.
+
+Planned, not implemented. This release only reserves the package name.
+"""

fastmcp_edge_authz-0.0.1/pyproject.toml

@@ -0,0 +1,37 @@
+[project]
+name = "fastmcp-edge-authz"
+dynamic = ["version"]
+description = "Edge policy enforcement point for FastMCP servers: verifies end-user tokens and applies an allow/deny policy before calling upstreams with a service credential (planned; this release only reserves the name)."
+readme = "README.md"
+authors = [
+    { name = "Stephan Eberle", email = "stephaneberle9@gmail.com" }
+]
+license = "MIT"
+requires-python = ">=3.10"
+dependencies = []
+classifiers = [
+    "Development Status :: 1 - Planning",
+    "Programming Language :: Python :: 3",
+]
+
+[project.urls]
+Homepage = "https://github.com/stephaneberle9/fastmcp-edge-authz"
+Repository = "https://github.com/stephaneberle9/fastmcp-edge-authz"
+
+[build-system]
+requires = ["hatchling", "uv-dynamic-versioning"]
+build-backend = "hatchling.build"
+
+[tool.uv-dynamic-versioning]
+enable = true
+vcs = "git"
+style = "pep440"
+
+[tool.hatch.version]
+source = "uv-dynamic-versioning"
+
+[tool.hatch.build.targets.wheel]
+sources = ["src"]
+
+[tool.hatch.build.targets.sdist]
+sources = ["src"]