gl-iam 0.3.9b2__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (164) hide show
  1. gl_iam-0.3.9b2/LICENSE +21 -0
  2. gl_iam-0.3.9b2/MANIFEST.in +5 -0
  3. gl_iam-0.3.9b2/PKG-INFO +381 -0
  4. gl_iam-0.3.9b2/README.md +296 -0
  5. gl_iam-0.3.9b2/gl_iam/__init__.py +350 -0
  6. gl_iam-0.3.9b2/gl_iam/cli/__init__.py +20 -0
  7. gl_iam-0.3.9b2/gl_iam/cli/main.py +1584 -0
  8. gl_iam-0.3.9b2/gl_iam/cli/secrets.py +630 -0
  9. gl_iam-0.3.9b2/gl_iam/client/__init__.py +11 -0
  10. gl_iam-0.3.9b2/gl_iam/client/dpop.py +151 -0
  11. gl_iam-0.3.9b2/gl_iam/core/__init__.py +331 -0
  12. gl_iam-0.3.9b2/gl_iam/core/audit_context.py +79 -0
  13. gl_iam-0.3.9b2/gl_iam/core/audit_handlers.py +266 -0
  14. gl_iam-0.3.9b2/gl_iam/core/config.py +220 -0
  15. gl_iam-0.3.9b2/gl_iam/core/constraint_validators.py +239 -0
  16. gl_iam-0.3.9b2/gl_iam/core/crypto_config.py +351 -0
  17. gl_iam-0.3.9b2/gl_iam/core/delegation_utils.py +460 -0
  18. gl_iam-0.3.9b2/gl_iam/core/exceptions.py +483 -0
  19. gl_iam-0.3.9b2/gl_iam/core/gateway.py +2254 -0
  20. gl_iam-0.3.9b2/gl_iam/core/protocols/__init__.py +92 -0
  21. gl_iam-0.3.9b2/gl_iam/core/protocols/agent.py +214 -0
  22. gl_iam-0.3.9b2/gl_iam/core/protocols/api_key.py +330 -0
  23. gl_iam-0.3.9b2/gl_iam/core/protocols/audit.py +53 -0
  24. gl_iam-0.3.9b2/gl_iam/core/protocols/authentication.py +313 -0
  25. gl_iam-0.3.9b2/gl_iam/core/protocols/dpop.py +106 -0
  26. gl_iam-0.3.9b2/gl_iam/core/protocols/organization.py +241 -0
  27. gl_iam-0.3.9b2/gl_iam/core/protocols/partner_registry.py +213 -0
  28. gl_iam-0.3.9b2/gl_iam/core/protocols/session.py +150 -0
  29. gl_iam-0.3.9b2/gl_iam/core/protocols/third_party.py +336 -0
  30. gl_iam-0.3.9b2/gl_iam/core/protocols/user_store.py +626 -0
  31. gl_iam-0.3.9b2/gl_iam/core/roles/__init__.py +52 -0
  32. gl_iam-0.3.9b2/gl_iam/core/roles/mappings.py +288 -0
  33. gl_iam-0.3.9b2/gl_iam/core/roles/standard.py +145 -0
  34. gl_iam-0.3.9b2/gl_iam/core/scope_utils.py +75 -0
  35. gl_iam-0.3.9b2/gl_iam/core/token_manager.py +1033 -0
  36. gl_iam-0.3.9b2/gl_iam/core/types/__init__.py +150 -0
  37. gl_iam-0.3.9b2/gl_iam/core/types/agent.py +138 -0
  38. gl_iam-0.3.9b2/gl_iam/core/types/api_key.py +464 -0
  39. gl_iam-0.3.9b2/gl_iam/core/types/audit.py +561 -0
  40. gl_iam-0.3.9b2/gl_iam/core/types/auth.py +130 -0
  41. gl_iam-0.3.9b2/gl_iam/core/types/credentials.py +43 -0
  42. gl_iam-0.3.9b2/gl_iam/core/types/delegation.py +229 -0
  43. gl_iam-0.3.9b2/gl_iam/core/types/dpop.py +149 -0
  44. gl_iam-0.3.9b2/gl_iam/core/types/inputs.py +297 -0
  45. gl_iam-0.3.9b2/gl_iam/core/types/mfa.py +72 -0
  46. gl_iam-0.3.9b2/gl_iam/core/types/organization.py +48 -0
  47. gl_iam-0.3.9b2/gl_iam/core/types/permission.py +74 -0
  48. gl_iam-0.3.9b2/gl_iam/core/types/result.py +828 -0
  49. gl_iam-0.3.9b2/gl_iam/core/types/role.py +48 -0
  50. gl_iam-0.3.9b2/gl_iam/core/types/sso.py +260 -0
  51. gl_iam-0.3.9b2/gl_iam/core/types/third_party.py +69 -0
  52. gl_iam-0.3.9b2/gl_iam/core/types/user.py +279 -0
  53. gl_iam-0.3.9b2/gl_iam/core/verification.py +198 -0
  54. gl_iam-0.3.9b2/gl_iam/django/__init__.py +204 -0
  55. gl_iam-0.3.9b2/gl_iam/django/_audit.py +93 -0
  56. gl_iam-0.3.9b2/gl_iam/django/agent_decorators.py +225 -0
  57. gl_iam-0.3.9b2/gl_iam/django/agent_middleware.py +128 -0
  58. gl_iam-0.3.9b2/gl_iam/django/apps.py +63 -0
  59. gl_iam-0.3.9b2/gl_iam/django/backends.py +272 -0
  60. gl_iam-0.3.9b2/gl_iam/django/conf.py +214 -0
  61. gl_iam-0.3.9b2/gl_iam/django/decorators.py +668 -0
  62. gl_iam-0.3.9b2/gl_iam/django/drf/__init__.py +64 -0
  63. gl_iam-0.3.9b2/gl_iam/django/drf/agent_authentication.py +145 -0
  64. gl_iam-0.3.9b2/gl_iam/django/drf/agent_permissions.py +109 -0
  65. gl_iam-0.3.9b2/gl_iam/django/drf/authentication.py +382 -0
  66. gl_iam-0.3.9b2/gl_iam/django/drf/permissions.py +592 -0
  67. gl_iam-0.3.9b2/gl_iam/django/exceptions.py +261 -0
  68. gl_iam-0.3.9b2/gl_iam/django/middleware.py +509 -0
  69. gl_iam-0.3.9b2/gl_iam/django/mixins.py +796 -0
  70. gl_iam-0.3.9b2/gl_iam/django/testing/__init__.py +21 -0
  71. gl_iam-0.3.9b2/gl_iam/django/testing/client.py +353 -0
  72. gl_iam-0.3.9b2/gl_iam/django/testing/mock_gateway.py +406 -0
  73. gl_iam-0.3.9b2/gl_iam/django/user_sync.py +539 -0
  74. gl_iam-0.3.9b2/gl_iam/django/utils.py +250 -0
  75. gl_iam-0.3.9b2/gl_iam/dpop/__init__.py +29 -0
  76. gl_iam-0.3.9b2/gl_iam/dpop/errors.py +30 -0
  77. gl_iam-0.3.9b2/gl_iam/dpop/nonce.py +102 -0
  78. gl_iam-0.3.9b2/gl_iam/dpop/proof_handler.py +82 -0
  79. gl_iam-0.3.9b2/gl_iam/dpop/replay.py +76 -0
  80. gl_iam-0.3.9b2/gl_iam/dpop/thumbprint.py +75 -0
  81. gl_iam-0.3.9b2/gl_iam/dpop/validator.py +259 -0
  82. gl_iam-0.3.9b2/gl_iam/fastapi/__init__.py +102 -0
  83. gl_iam-0.3.9b2/gl_iam/fastapi/dependencies.py +1628 -0
  84. gl_iam-0.3.9b2/gl_iam/fastapi/dpop.py +282 -0
  85. gl_iam-0.3.9b2/gl_iam/fastapi/exception_handlers.py +139 -0
  86. gl_iam-0.3.9b2/gl_iam/migration/__init__.py +22 -0
  87. gl_iam-0.3.9b2/gl_iam/migration/bosa_adapter.py +408 -0
  88. gl_iam-0.3.9b2/gl_iam/providers/__init__.py +13 -0
  89. gl_iam-0.3.9b2/gl_iam/providers/dpop/__init__.py +11 -0
  90. gl_iam-0.3.9b2/gl_iam/providers/dpop/standalone.py +192 -0
  91. gl_iam-0.3.9b2/gl_iam/providers/keycloak/__init__.py +39 -0
  92. gl_iam-0.3.9b2/gl_iam/providers/keycloak/agent_mixin.py +655 -0
  93. gl_iam-0.3.9b2/gl_iam/providers/keycloak/client.py +659 -0
  94. gl_iam-0.3.9b2/gl_iam/providers/keycloak/config.py +128 -0
  95. gl_iam-0.3.9b2/gl_iam/providers/keycloak/dpop.py +245 -0
  96. gl_iam-0.3.9b2/gl_iam/providers/keycloak/mappers.py +290 -0
  97. gl_iam-0.3.9b2/gl_iam/providers/keycloak/provider.py +1292 -0
  98. gl_iam-0.3.9b2/gl_iam/providers/keycloak/types.py +93 -0
  99. gl_iam-0.3.9b2/gl_iam/providers/native/__init__.py +160 -0
  100. gl_iam-0.3.9b2/gl_iam/providers/native/agent_provider.py +74 -0
  101. gl_iam-0.3.9b2/gl_iam/providers/native/api_key_provider.py +93 -0
  102. gl_iam-0.3.9b2/gl_iam/providers/native/audit_handler.py +73 -0
  103. gl_iam-0.3.9b2/gl_iam/providers/native/auth_provider.py +128 -0
  104. gl_iam-0.3.9b2/gl_iam/providers/native/config.py +528 -0
  105. gl_iam-0.3.9b2/gl_iam/providers/native/crypto/__init__.py +69 -0
  106. gl_iam-0.3.9b2/gl_iam/providers/native/crypto/aes_gcm_encryption.py +284 -0
  107. gl_iam-0.3.9b2/gl_iam/providers/native/crypto/api_key_hasher.py +332 -0
  108. gl_iam-0.3.9b2/gl_iam/providers/native/crypto/encryption_backend.py +127 -0
  109. gl_iam-0.3.9b2/gl_iam/providers/native/crypto/versioned_encryption.py +252 -0
  110. gl_iam-0.3.9b2/gl_iam/providers/native/mappers.py +255 -0
  111. gl_iam-0.3.9b2/gl_iam/providers/native/migrations/__init__.py +25 -0
  112. gl_iam-0.3.9b2/gl_iam/providers/native/migrations/base.py +160 -0
  113. gl_iam-0.3.9b2/gl_iam/providers/native/migrations/runner.py +451 -0
  114. gl_iam-0.3.9b2/gl_iam/providers/native/migrations/versions/__init__.py +9 -0
  115. gl_iam-0.3.9b2/gl_iam/providers/native/migrations/versions/v001_initial_schema.py +369 -0
  116. gl_iam-0.3.9b2/gl_iam/providers/native/migrations/versions/v002_api_key_encrypted_storage.py +114 -0
  117. gl_iam-0.3.9b2/gl_iam/providers/native/migrations/versions/v003_fix_algo_column.py +68 -0
  118. gl_iam-0.3.9b2/gl_iam/providers/native/migrations/versions/v004_agents_table.py +104 -0
  119. gl_iam-0.3.9b2/gl_iam/providers/native/migrations/versions/v005_username_email_unique_per_org.py +100 -0
  120. gl_iam-0.3.9b2/gl_iam/providers/native/migrations/versions/v006_organization_metadata.py +92 -0
  121. gl_iam-0.3.9b2/gl_iam/providers/native/migrations/versions/v007_sso_partners_table.py +84 -0
  122. gl_iam-0.3.9b2/gl_iam/providers/native/migrations/versions/v008_sso_partner_security_fields.py +66 -0
  123. gl_iam-0.3.9b2/gl_iam/providers/native/migrations/versions/v009_audit_events_table.py +89 -0
  124. gl_iam-0.3.9b2/gl_iam/providers/native/migrations/versions/v010_drop_sso_partner_org_fk.py +77 -0
  125. gl_iam-0.3.9b2/gl_iam/providers/native/migrations/versions/v011_api_key_pop_binding.py +61 -0
  126. gl_iam-0.3.9b2/gl_iam/providers/native/mixins/__init__.py +49 -0
  127. gl_iam-0.3.9b2/gl_iam/providers/native/mixins/agent.py +544 -0
  128. gl_iam-0.3.9b2/gl_iam/providers/native/mixins/api_key.py +1005 -0
  129. gl_iam-0.3.9b2/gl_iam/providers/native/mixins/audit.py +250 -0
  130. gl_iam-0.3.9b2/gl_iam/providers/native/mixins/auth.py +420 -0
  131. gl_iam-0.3.9b2/gl_iam/providers/native/mixins/base.py +375 -0
  132. gl_iam-0.3.9b2/gl_iam/providers/native/mixins/organization.py +541 -0
  133. gl_iam-0.3.9b2/gl_iam/providers/native/mixins/partner_registry.py +1434 -0
  134. gl_iam-0.3.9b2/gl_iam/providers/native/mixins/session.py +432 -0
  135. gl_iam-0.3.9b2/gl_iam/providers/native/mixins/third_party.py +764 -0
  136. gl_iam-0.3.9b2/gl_iam/providers/native/mixins/user_store.py +1228 -0
  137. gl_iam-0.3.9b2/gl_iam/providers/native/models.py +1186 -0
  138. gl_iam-0.3.9b2/gl_iam/providers/native/organization_provider.py +101 -0
  139. gl_iam-0.3.9b2/gl_iam/providers/native/partner_registry_provider.py +86 -0
  140. gl_iam-0.3.9b2/gl_iam/providers/native/provider.py +155 -0
  141. gl_iam-0.3.9b2/gl_iam/providers/native/third_party_provider.py +104 -0
  142. gl_iam-0.3.9b2/gl_iam/providers/native/user_store_provider.py +108 -0
  143. gl_iam-0.3.9b2/gl_iam/providers/native/utils.py +246 -0
  144. gl_iam-0.3.9b2/gl_iam/providers/postgresql/__init__.py +181 -0
  145. gl_iam-0.3.9b2/gl_iam/providers/postgresql/mixins/__init__.py +99 -0
  146. gl_iam-0.3.9b2/gl_iam/providers/stackauth/__init__.py +70 -0
  147. gl_iam-0.3.9b2/gl_iam/providers/stackauth/agent_mixin.py +146 -0
  148. gl_iam-0.3.9b2/gl_iam/providers/stackauth/agent_provider.py +245 -0
  149. gl_iam-0.3.9b2/gl_iam/providers/stackauth/client.py +627 -0
  150. gl_iam-0.3.9b2/gl_iam/providers/stackauth/config.py +167 -0
  151. gl_iam-0.3.9b2/gl_iam/providers/stackauth/mappers.py +318 -0
  152. gl_iam-0.3.9b2/gl_iam/providers/stackauth/provider.py +1291 -0
  153. gl_iam-0.3.9b2/gl_iam/providers/stackauth/types.py +30 -0
  154. gl_iam-0.3.9b2/gl_iam/py.typed +2 -0
  155. gl_iam-0.3.9b2/gl_iam/utils/__init__.py +12 -0
  156. gl_iam-0.3.9b2/gl_iam.egg-info/PKG-INFO +381 -0
  157. gl_iam-0.3.9b2/gl_iam.egg-info/SOURCES.txt +162 -0
  158. gl_iam-0.3.9b2/gl_iam.egg-info/dependency_links.txt +1 -0
  159. gl_iam-0.3.9b2/gl_iam.egg-info/entry_points.txt +2 -0
  160. gl_iam-0.3.9b2/gl_iam.egg-info/requires.txt +91 -0
  161. gl_iam-0.3.9b2/gl_iam.egg-info/top_level.txt +1 -0
  162. gl_iam-0.3.9b2/pyproject.toml +196 -0
  163. gl_iam-0.3.9b2/setup.cfg +4 -0
  164. gl_iam-0.3.9b2/setup.py +10 -0
gl_iam-0.3.9b2/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 GDP Labs
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
@@ -0,0 +1,5 @@
1
+ global-exclude *.key
2
+ global-exclude *.env
3
+ global-exclude *.aes
4
+ prune tests
5
+ prune build
@@ -0,0 +1,381 @@
1
+ Metadata-Version: 2.4
2
+ Name: gl-iam
3
+ Version: 0.3.9b2
4
+ Summary: A pluggable Identity and Access Management (IAM) SDK for GDP Labs applications.
5
+ Author-email: Sandy Dewangga <sandy.dewangga@gdplabs.id>
6
+ Requires-Python: <3.14,>=3.11
7
+ Description-Content-Type: text/markdown
8
+ License-File: LICENSE
9
+ Requires-Dist: pydantic<3.0.0,>=2.7.0
10
+ Requires-Dist: email-validator<3.0.0,>=2.0.0
11
+ Requires-Dist: python-json-logger<4.0.0,>=2.0.0
12
+ Provides-Extra: dev
13
+ Requires-Dist: coverage<8.0.0,>=7.4.4; extra == "dev"
14
+ Requires-Dist: mypy<2.0.0,>=1.15.0; extra == "dev"
15
+ Requires-Dist: pre-commit<4.0.0,>=3.7.0; extra == "dev"
16
+ Requires-Dist: pytest<10.0.0,>=9.0.3; extra == "dev"
17
+ Requires-Dist: pytest-asyncio<2.0.0,>=1.0.0; extra == "dev"
18
+ Requires-Dist: pytest-cov<8.0.0,>=7.0.0; extra == "dev"
19
+ Requires-Dist: ruff<1.0.0,>=0.6.7; extra == "dev"
20
+ Provides-Extra: fastapi
21
+ Requires-Dist: fastapi<1.0.0,>=0.115.0; extra == "fastapi"
22
+ Provides-Extra: stackauth
23
+ Requires-Dist: httpx<1.0.0,>=0.28.0; extra == "stackauth"
24
+ Provides-Extra: keycloak
25
+ Requires-Dist: httpx<1.0.0,>=0.28.0; extra == "keycloak"
26
+ Requires-Dist: pyjwt<3.0.0,>=2.13.0; extra == "keycloak"
27
+ Provides-Extra: ldap
28
+ Requires-Dist: ldap3<3.0.0,>=2.9.1; extra == "ldap"
29
+ Provides-Extra: saml
30
+ Requires-Dist: python3-saml<2.0.0,>=1.16.0; extra == "saml"
31
+ Requires-Dist: lxml<7.0.0,>=6.1.0; extra == "saml"
32
+ Provides-Extra: postgresql
33
+ Requires-Dist: asyncpg<1.0.0,>=0.30.0; extra == "postgresql"
34
+ Requires-Dist: sqlalchemy[asyncio]<3.0.0,>=2.0.0; extra == "postgresql"
35
+ Requires-Dist: passlib[bcrypt]<2.0.0,>=1.7.4; extra == "postgresql"
36
+ Requires-Dist: argon2-cffi<26.0.0,>=21.3.0; extra == "postgresql"
37
+ Requires-Dist: pyjwt<3.0.0,>=2.13.0; extra == "postgresql"
38
+ Requires-Dist: cryptography<49.0.0,>=48.0.1; extra == "postgresql"
39
+ Requires-Dist: psycopg2-binary<3.0.0,>=2.9.0; extra == "postgresql"
40
+ Requires-Dist: alembic<2.0.0,>=1.12.0; extra == "postgresql"
41
+ Provides-Extra: native
42
+ Requires-Dist: gl-iam[postgresql]; extra == "native"
43
+ Provides-Extra: cli
44
+ Requires-Dist: click<9.0.0,>=8.1.0; extra == "cli"
45
+ Provides-Extra: cli-aws
46
+ Requires-Dist: click<9.0.0,>=8.1.0; extra == "cli-aws"
47
+ Requires-Dist: boto3<2.0.0,>=1.34.0; extra == "cli-aws"
48
+ Provides-Extra: cli-vault
49
+ Requires-Dist: click<9.0.0,>=8.1.0; extra == "cli-vault"
50
+ Requires-Dist: hvac<3.0.0,>=2.1.0; extra == "cli-vault"
51
+ Provides-Extra: cli-gcp
52
+ Requires-Dist: click<9.0.0,>=8.1.0; extra == "cli-gcp"
53
+ Requires-Dist: google-cloud-secret-manager<3.0.0,>=2.18.0; extra == "cli-gcp"
54
+ Provides-Extra: otel
55
+ Requires-Dist: opentelemetry-api<3.0.0,>=1.20.0; extra == "otel"
56
+ Requires-Dist: opentelemetry-sdk<3.0.0,>=1.20.0; extra == "otel"
57
+ Provides-Extra: django
58
+ Requires-Dist: django<6.0,>=4.0; extra == "django"
59
+ Requires-Dist: asgiref<4.0.0,>=3.5.0; extra == "django"
60
+ Provides-Extra: drf
61
+ Requires-Dist: django<6.0,>=4.0; extra == "drf"
62
+ Requires-Dist: asgiref<4.0.0,>=3.5.0; extra == "drf"
63
+ Requires-Dist: djangorestframework<4.0.0,>=3.14.0; extra == "drf"
64
+ Provides-Extra: all
65
+ Requires-Dist: opentelemetry-api<3.0.0,>=1.20.0; extra == "all"
66
+ Requires-Dist: opentelemetry-sdk<3.0.0,>=1.20.0; extra == "all"
67
+ Requires-Dist: fastapi<1.0.0,>=0.115.0; extra == "all"
68
+ Requires-Dist: httpx<1.0.0,>=0.28.0; extra == "all"
69
+ Requires-Dist: ldap3<3.0.0,>=2.9.1; extra == "all"
70
+ Requires-Dist: python3-saml<2.0.0,>=1.16.0; extra == "all"
71
+ Requires-Dist: lxml<7.0.0,>=6.1.0; extra == "all"
72
+ Requires-Dist: asyncpg<1.0.0,>=0.30.0; extra == "all"
73
+ Requires-Dist: sqlalchemy[asyncio]<3.0.0,>=2.0.0; extra == "all"
74
+ Requires-Dist: passlib[bcrypt]<2.0.0,>=1.7.4; extra == "all"
75
+ Requires-Dist: argon2-cffi<26.0.0,>=21.3.0; extra == "all"
76
+ Requires-Dist: pyjwt<3.0.0,>=2.13.0; extra == "all"
77
+ Requires-Dist: cryptography<49.0.0,>=48.0.1; extra == "all"
78
+ Requires-Dist: psycopg2-binary<3.0.0,>=2.9.0; extra == "all"
79
+ Requires-Dist: alembic<2.0.0,>=1.12.0; extra == "all"
80
+ Requires-Dist: django<6.0,>=4.0; extra == "all"
81
+ Requires-Dist: asgiref<4.0.0,>=3.5.0; extra == "all"
82
+ Requires-Dist: djangorestframework<4.0.0,>=3.14.0; extra == "all"
83
+ Requires-Dist: click<9.0.0,>=8.1.0; extra == "all"
84
+ Dynamic: license-file
85
+
86
+ # GL-IAM
87
+
88
+ ## Description
89
+
90
+ A pluggable Identity and Access Management (IAM) SDK for GDP Labs applications. GL-IAM provides a unified interface for authentication, authorization, user management, and organization management following the Single Interface Multiple Implementation (SIMI) pattern.
91
+
92
+ ### Key Features
93
+
94
+ - **Pluggable Authentication**: Support for Stack Auth, Keycloak (with LDAP/SAML federation), PostgreSQL, and custom providers
95
+ - **User Store Abstraction**: Flexible user storage with JIT (Just-In-Time) provisioning
96
+ - **Role-Based Access Control (RBAC)**: Comprehensive permission and role management
97
+ - **Multi-Factor Authentication (MFA)**: TOTP and other second-factor methods
98
+ - **Organization Management**: Multi-tenancy support for enterprise applications
99
+ - **FastAPI Integration**: Ready-to-use dependencies for FastAPI applications
100
+
101
+ ---
102
+
103
+ ## Installation
104
+
105
+ ### Prerequisites
106
+
107
+ Mandatory:
108
+ 1. Python 3.11+ — [Install here](https://www.python.org/downloads/)
109
+ 2. pip — [Install here](https://pip.pypa.io/en/stable/installation/)
110
+ 3. uv — [Install here](https://docs.astral.sh/uv/getting-started/installation/)
111
+
112
+ For PostgreSQL provider:
113
+ 4. PostgreSQL 13+ — Recommended for production ([details](https://github.com/GDP-ADMIN/gl-sdk/blob/main/libs/gl-iam/gl_iam/providers/native/README.md#requirements))
114
+
115
+ Extras (required only for Artifact Registry installations):
116
+ 1. gcloud CLI (for authentication) — [Install here](https://cloud.google.com/sdk/docs/install), then log in using:
117
+ ```bash
118
+ gcloud auth login
119
+ ```
120
+
121
+ ---
122
+
123
+ ### Option 1: Install from PyPI (recommended)
124
+
125
+ This option requires no authentication.
126
+
127
+ ```bash
128
+ uv pip install gl-iam
129
+ ```
130
+
131
+ With optional dependencies:
132
+
133
+ ```bash
134
+ # With FastAPI integration
135
+ uv pip install "gl-iam[fastapi]"
136
+
137
+ # With Stack Auth provider
138
+ uv pip install "gl-iam[stackauth]"
139
+
140
+ # With LDAP provider
141
+ uv pip install "gl-iam[ldap]"
142
+
143
+ # With all providers
144
+ uv pip install "gl-iam[all]"
145
+ ```
146
+
147
+ ---
148
+
149
+ ### Option 2: Install from Artifact Registry
150
+
151
+ This option requires authentication via the `gcloud` CLI. Use it when you need a build that is not
152
+ yet released to PyPI.
153
+
154
+ ```bash
155
+ uv pip install \
156
+ --extra-index-url "https://oauth2accesstoken:$(gcloud auth print-access-token)@glsdk.gdplabs.id/gen-ai-internal/simple/" \
157
+ gl-iam
158
+ ```
159
+
160
+ ---
161
+
162
+ ## Quick Start
163
+
164
+ ### Basic Usage
165
+
166
+ ```python
167
+ from gl_iam import IAMGateway
168
+ from gl_iam.providers.stackauth import StackAuthProvider
169
+
170
+ # Initialize with Stack Auth as full-stack provider
171
+ gateway = IAMGateway.from_fullstack_provider(
172
+ provider=StackAuthProvider(
173
+ api_url="https://api.stack-auth.com",
174
+ project_id="your-project-id",
175
+ secret_key="your-secret-key",
176
+ )
177
+ )
178
+
179
+ # Authenticate a user
180
+ result = await gateway.authenticate(
181
+ credentials={"email": "user@example.com", "password": "secret"}
182
+ )
183
+
184
+ if result.is_ok:
185
+ user = result.user
186
+ print(f"Authenticated: {user.display_name}")
187
+ ```
188
+
189
+ ### Mix-and-Match Providers
190
+
191
+ ```python
192
+ from gl_iam import IAMGateway
193
+ from gl_iam.providers.ldap import LDAPAuthProvider
194
+ from gl_iam.providers.stackauth import StackAuthUserStore
195
+
196
+ # Use LDAP for authentication, Stack Auth for user storage
197
+ gateway = IAMGateway(
198
+ auth_provider=LDAPAuthProvider(
199
+ server_url="ldap://ad.company.com",
200
+ base_dn="dc=company,dc=com",
201
+ ),
202
+ user_store=StackAuthUserStore(
203
+ api_url="https://api.stack-auth.com",
204
+ project_id="your-project-id",
205
+ ),
206
+ enable_jit_provisioning=True, # Auto-create users on first login
207
+ )
208
+ ```
209
+
210
+ ### FastAPI Integration
211
+
212
+ ```python
213
+ from fastapi import FastAPI, Depends
214
+ from gl_iam.fastapi import get_current_user, require_permission, require_role
215
+ from gl_iam.types import User
216
+
217
+ app = FastAPI()
218
+
219
+ @app.get("/profile")
220
+ async def get_profile(user: User = Depends(get_current_user)):
221
+ return {"user_id": user.id, "email": user.email}
222
+
223
+ @app.delete("/admin/users/{user_id}")
224
+ async def delete_user(
225
+ user_id: str,
226
+ _: None = Depends(require_permission("users:delete")),
227
+ ):
228
+ # Only users with "users:delete" permission can access
229
+ pass
230
+
231
+ @app.get("/admin/dashboard")
232
+ async def admin_dashboard(_: None = Depends(require_role("admin"))):
233
+ # Only users with "admin" role can access
234
+ pass
235
+ ```
236
+
237
+ ---
238
+
239
+ ## Local Development Setup
240
+
241
+ ### Prerequisites
242
+
243
+ 1. Python 3.11+ — [Install here](https://www.python.org/downloads/)
244
+ 2. pip — [Install here](https://pip.pypa.io/en/stable/installation/)
245
+ 3. uv — [Install here](https://docs.astral.sh/uv/getting-started/installation/)
246
+ 4. gcloud CLI — [Install here](https://cloud.google.com/sdk/docs/install), then log in using:
247
+
248
+ ```bash
249
+ gcloud auth login
250
+ ```
251
+ 5. Git — [Install here](https://git-scm.com/downloads)
252
+ 6. Access to the [GDP Labs SDK GitHub repository](https://github.com/GDP-ADMIN/gl-sdk)
253
+
254
+ ---
255
+
256
+ ### 1. Clone Repository
257
+
258
+ ```bash
259
+ git clone git@github.com:GDP-ADMIN/gl-sdk.git
260
+ cd gl-sdk/libs/gl-iam
261
+ ```
262
+
263
+ ---
264
+
265
+ ### 2. Setup Authentication
266
+
267
+ Set the following environment variables to authenticate with internal package indexes:
268
+
269
+ ```bash
270
+ export UV_INDEX_GEN_AI_INTERNAL_USERNAME=oauth2accesstoken
271
+ export UV_INDEX_GEN_AI_INTERNAL_PASSWORD="$(gcloud auth print-access-token)"
272
+ export UV_INDEX_GEN_AI_USERNAME=oauth2accesstoken
273
+ export UV_INDEX_GEN_AI_PASSWORD="$(gcloud auth print-access-token)"
274
+ ```
275
+
276
+ ---
277
+
278
+ ### 3. Quick Setup
279
+
280
+ Run:
281
+
282
+ ```bash
283
+ make setup
284
+ ```
285
+
286
+ ---
287
+
288
+ ### 4. Activate Virtual Environment
289
+
290
+ ```bash
291
+ source .venv/bin/activate
292
+ ```
293
+
294
+ ---
295
+
296
+ ## Local Development Utilities
297
+
298
+ The following Makefile commands are available for quick operations:
299
+
300
+ ### Install uv
301
+
302
+ ```bash
303
+ make install-uv
304
+ ```
305
+
306
+ ### Install Pre-Commit
307
+
308
+ ```bash
309
+ make install-pre-commit
310
+ ```
311
+
312
+ ### Install Dependencies
313
+
314
+ ```bash
315
+ make install
316
+ ```
317
+
318
+ ### Update Dependencies
319
+
320
+ ```bash
321
+ make update
322
+ ```
323
+
324
+ ### Run Tests
325
+
326
+ ```bash
327
+ make test
328
+ ```
329
+
330
+ ---
331
+
332
+ ## Architecture
333
+
334
+ GL-IAM follows the Single Interface Multiple Implementation (SIMI) pattern:
335
+
336
+ ```
337
+ ┌─────────────────────────────────────────────────────────────┐
338
+ │ IAMGateway │
339
+ │ (Central Orchestrator - Coordinates all IAM operations) │
340
+ └─────────────────────────────────────────────────────────────┘
341
+
342
+ ┌─────────────────────┼─────────────────────┐
343
+ ▼ ▼ ▼
344
+ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐
345
+ │ Authentication│ │ User Store │ │ Session │
346
+ │ Provider │ │ Provider │ │ Provider │
347
+ └───────────────┘ └───────────────┘ └───────────────┘
348
+ │ │ │
349
+ ▼ ▼ ▼
350
+ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐
351
+ │ - Stack Auth │ │ - Stack Auth │ │ - Stack Auth │
352
+ │ - LDAP │ │ - PostgreSQL │ │ - Redis │
353
+ │ - SAML │ │ - Custom │ │ - JWT │
354
+ │ - OAuth2 │ │ │ │ │
355
+ └───────────────┘ └───────────────┘ └───────────────┘
356
+ ```
357
+
358
+ ---
359
+
360
+ ## Migration Guides
361
+
362
+ ### Migrating from BOSA Core Auth
363
+
364
+ If you're currently using BOSA Core Authentication (`bosa-core[authentication]`) and want to migrate to GL-IAM, see the comprehensive migration guide:
365
+
366
+ 📖 **[BOSA to GL-IAM Migration Guide](https://github.com/GDP-ADMIN/gl-sdk/blob/main/libs/gl-iam/docs/migration/BOSA_TO_GL_IAM_MIGRATION_GUIDE.md)**
367
+
368
+ The guide covers:
369
+ - Step-by-step migration instructions
370
+ - API mapping reference (BOSA → GL-IAM)
371
+ - Data migration scripts
372
+ - Code examples for common patterns
373
+ - Testing and rollback strategies
374
+
375
+ ---
376
+
377
+ ## Contributing
378
+
379
+ Please refer to the [Python Style Guide](https://docs.google.com/document/d/1uRggCrHnVfDPBnG641FyQBwUwLoFw0kTzNqRm92vUwM/edit?usp=sharing)
380
+ for information about code style, documentation standards, and SCA requirements.
381
+
@@ -0,0 +1,296 @@
1
+ # GL-IAM
2
+
3
+ ## Description
4
+
5
+ A pluggable Identity and Access Management (IAM) SDK for GDP Labs applications. GL-IAM provides a unified interface for authentication, authorization, user management, and organization management following the Single Interface Multiple Implementation (SIMI) pattern.
6
+
7
+ ### Key Features
8
+
9
+ - **Pluggable Authentication**: Support for Stack Auth, Keycloak (with LDAP/SAML federation), PostgreSQL, and custom providers
10
+ - **User Store Abstraction**: Flexible user storage with JIT (Just-In-Time) provisioning
11
+ - **Role-Based Access Control (RBAC)**: Comprehensive permission and role management
12
+ - **Multi-Factor Authentication (MFA)**: TOTP and other second-factor methods
13
+ - **Organization Management**: Multi-tenancy support for enterprise applications
14
+ - **FastAPI Integration**: Ready-to-use dependencies for FastAPI applications
15
+
16
+ ---
17
+
18
+ ## Installation
19
+
20
+ ### Prerequisites
21
+
22
+ Mandatory:
23
+ 1. Python 3.11+ — [Install here](https://www.python.org/downloads/)
24
+ 2. pip — [Install here](https://pip.pypa.io/en/stable/installation/)
25
+ 3. uv — [Install here](https://docs.astral.sh/uv/getting-started/installation/)
26
+
27
+ For PostgreSQL provider:
28
+ 4. PostgreSQL 13+ — Recommended for production ([details](https://github.com/GDP-ADMIN/gl-sdk/blob/main/libs/gl-iam/gl_iam/providers/native/README.md#requirements))
29
+
30
+ Extras (required only for Artifact Registry installations):
31
+ 1. gcloud CLI (for authentication) — [Install here](https://cloud.google.com/sdk/docs/install), then log in using:
32
+ ```bash
33
+ gcloud auth login
34
+ ```
35
+
36
+ ---
37
+
38
+ ### Option 1: Install from PyPI (recommended)
39
+
40
+ This option requires no authentication.
41
+
42
+ ```bash
43
+ uv pip install gl-iam
44
+ ```
45
+
46
+ With optional dependencies:
47
+
48
+ ```bash
49
+ # With FastAPI integration
50
+ uv pip install "gl-iam[fastapi]"
51
+
52
+ # With Stack Auth provider
53
+ uv pip install "gl-iam[stackauth]"
54
+
55
+ # With LDAP provider
56
+ uv pip install "gl-iam[ldap]"
57
+
58
+ # With all providers
59
+ uv pip install "gl-iam[all]"
60
+ ```
61
+
62
+ ---
63
+
64
+ ### Option 2: Install from Artifact Registry
65
+
66
+ This option requires authentication via the `gcloud` CLI. Use it when you need a build that is not
67
+ yet released to PyPI.
68
+
69
+ ```bash
70
+ uv pip install \
71
+ --extra-index-url "https://oauth2accesstoken:$(gcloud auth print-access-token)@glsdk.gdplabs.id/gen-ai-internal/simple/" \
72
+ gl-iam
73
+ ```
74
+
75
+ ---
76
+
77
+ ## Quick Start
78
+
79
+ ### Basic Usage
80
+
81
+ ```python
82
+ from gl_iam import IAMGateway
83
+ from gl_iam.providers.stackauth import StackAuthProvider
84
+
85
+ # Initialize with Stack Auth as full-stack provider
86
+ gateway = IAMGateway.from_fullstack_provider(
87
+ provider=StackAuthProvider(
88
+ api_url="https://api.stack-auth.com",
89
+ project_id="your-project-id",
90
+ secret_key="your-secret-key",
91
+ )
92
+ )
93
+
94
+ # Authenticate a user
95
+ result = await gateway.authenticate(
96
+ credentials={"email": "user@example.com", "password": "secret"}
97
+ )
98
+
99
+ if result.is_ok:
100
+ user = result.user
101
+ print(f"Authenticated: {user.display_name}")
102
+ ```
103
+
104
+ ### Mix-and-Match Providers
105
+
106
+ ```python
107
+ from gl_iam import IAMGateway
108
+ from gl_iam.providers.ldap import LDAPAuthProvider
109
+ from gl_iam.providers.stackauth import StackAuthUserStore
110
+
111
+ # Use LDAP for authentication, Stack Auth for user storage
112
+ gateway = IAMGateway(
113
+ auth_provider=LDAPAuthProvider(
114
+ server_url="ldap://ad.company.com",
115
+ base_dn="dc=company,dc=com",
116
+ ),
117
+ user_store=StackAuthUserStore(
118
+ api_url="https://api.stack-auth.com",
119
+ project_id="your-project-id",
120
+ ),
121
+ enable_jit_provisioning=True, # Auto-create users on first login
122
+ )
123
+ ```
124
+
125
+ ### FastAPI Integration
126
+
127
+ ```python
128
+ from fastapi import FastAPI, Depends
129
+ from gl_iam.fastapi import get_current_user, require_permission, require_role
130
+ from gl_iam.types import User
131
+
132
+ app = FastAPI()
133
+
134
+ @app.get("/profile")
135
+ async def get_profile(user: User = Depends(get_current_user)):
136
+ return {"user_id": user.id, "email": user.email}
137
+
138
+ @app.delete("/admin/users/{user_id}")
139
+ async def delete_user(
140
+ user_id: str,
141
+ _: None = Depends(require_permission("users:delete")),
142
+ ):
143
+ # Only users with "users:delete" permission can access
144
+ pass
145
+
146
+ @app.get("/admin/dashboard")
147
+ async def admin_dashboard(_: None = Depends(require_role("admin"))):
148
+ # Only users with "admin" role can access
149
+ pass
150
+ ```
151
+
152
+ ---
153
+
154
+ ## Local Development Setup
155
+
156
+ ### Prerequisites
157
+
158
+ 1. Python 3.11+ — [Install here](https://www.python.org/downloads/)
159
+ 2. pip — [Install here](https://pip.pypa.io/en/stable/installation/)
160
+ 3. uv — [Install here](https://docs.astral.sh/uv/getting-started/installation/)
161
+ 4. gcloud CLI — [Install here](https://cloud.google.com/sdk/docs/install), then log in using:
162
+
163
+ ```bash
164
+ gcloud auth login
165
+ ```
166
+ 5. Git — [Install here](https://git-scm.com/downloads)
167
+ 6. Access to the [GDP Labs SDK GitHub repository](https://github.com/GDP-ADMIN/gl-sdk)
168
+
169
+ ---
170
+
171
+ ### 1. Clone Repository
172
+
173
+ ```bash
174
+ git clone git@github.com:GDP-ADMIN/gl-sdk.git
175
+ cd gl-sdk/libs/gl-iam
176
+ ```
177
+
178
+ ---
179
+
180
+ ### 2. Setup Authentication
181
+
182
+ Set the following environment variables to authenticate with internal package indexes:
183
+
184
+ ```bash
185
+ export UV_INDEX_GEN_AI_INTERNAL_USERNAME=oauth2accesstoken
186
+ export UV_INDEX_GEN_AI_INTERNAL_PASSWORD="$(gcloud auth print-access-token)"
187
+ export UV_INDEX_GEN_AI_USERNAME=oauth2accesstoken
188
+ export UV_INDEX_GEN_AI_PASSWORD="$(gcloud auth print-access-token)"
189
+ ```
190
+
191
+ ---
192
+
193
+ ### 3. Quick Setup
194
+
195
+ Run:
196
+
197
+ ```bash
198
+ make setup
199
+ ```
200
+
201
+ ---
202
+
203
+ ### 4. Activate Virtual Environment
204
+
205
+ ```bash
206
+ source .venv/bin/activate
207
+ ```
208
+
209
+ ---
210
+
211
+ ## Local Development Utilities
212
+
213
+ The following Makefile commands are available for quick operations:
214
+
215
+ ### Install uv
216
+
217
+ ```bash
218
+ make install-uv
219
+ ```
220
+
221
+ ### Install Pre-Commit
222
+
223
+ ```bash
224
+ make install-pre-commit
225
+ ```
226
+
227
+ ### Install Dependencies
228
+
229
+ ```bash
230
+ make install
231
+ ```
232
+
233
+ ### Update Dependencies
234
+
235
+ ```bash
236
+ make update
237
+ ```
238
+
239
+ ### Run Tests
240
+
241
+ ```bash
242
+ make test
243
+ ```
244
+
245
+ ---
246
+
247
+ ## Architecture
248
+
249
+ GL-IAM follows the Single Interface Multiple Implementation (SIMI) pattern:
250
+
251
+ ```
252
+ ┌─────────────────────────────────────────────────────────────┐
253
+ │ IAMGateway │
254
+ │ (Central Orchestrator - Coordinates all IAM operations) │
255
+ └─────────────────────────────────────────────────────────────┘
256
+
257
+ ┌─────────────────────┼─────────────────────┐
258
+ ▼ ▼ ▼
259
+ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐
260
+ │ Authentication│ │ User Store │ │ Session │
261
+ │ Provider │ │ Provider │ │ Provider │
262
+ └───────────────┘ └───────────────┘ └───────────────┘
263
+ │ │ │
264
+ ▼ ▼ ▼
265
+ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐
266
+ │ - Stack Auth │ │ - Stack Auth │ │ - Stack Auth │
267
+ │ - LDAP │ │ - PostgreSQL │ │ - Redis │
268
+ │ - SAML │ │ - Custom │ │ - JWT │
269
+ │ - OAuth2 │ │ │ │ │
270
+ └───────────────┘ └───────────────┘ └───────────────┘
271
+ ```
272
+
273
+ ---
274
+
275
+ ## Migration Guides
276
+
277
+ ### Migrating from BOSA Core Auth
278
+
279
+ If you're currently using BOSA Core Authentication (`bosa-core[authentication]`) and want to migrate to GL-IAM, see the comprehensive migration guide:
280
+
281
+ 📖 **[BOSA to GL-IAM Migration Guide](https://github.com/GDP-ADMIN/gl-sdk/blob/main/libs/gl-iam/docs/migration/BOSA_TO_GL_IAM_MIGRATION_GUIDE.md)**
282
+
283
+ The guide covers:
284
+ - Step-by-step migration instructions
285
+ - API mapping reference (BOSA → GL-IAM)
286
+ - Data migration scripts
287
+ - Code examples for common patterns
288
+ - Testing and rollback strategies
289
+
290
+ ---
291
+
292
+ ## Contributing
293
+
294
+ Please refer to the [Python Style Guide](https://docs.google.com/document/d/1uRggCrHnVfDPBnG641FyQBwUwLoFw0kTzNqRm92vUwM/edit?usp=sharing)
295
+ for information about code style, documentation standards, and SCA requirements.
296
+