imbi-plugin-oidc 1.0.1__tar.gz

imbi_plugin_oidc-1.0.1/.github/workflows/publish.yml

@@ -0,0 +1,45 @@
+name: Publish to PyPI
+on:
+  release:
+    types: [published]
+
+permissions:
+  id-token: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Set up Python
+        run: uv python install 3.14
+
+      - name: Build
+        run: uv build
+
+      - name: Upload dist
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    steps:
+      - name: Download dist
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish package
+        uses: pypa/gh-action-pypi-publish@release/v1

imbi_plugin_oidc-1.0.1/.github/workflows/test.yml

@@ -0,0 +1,54 @@
+name: Testing
+on:
+  pull_request:
+  push:
+    branches: [ "main" ]
+    paths-ignore:
+      - 'docs/**'
+      - '*.md'
+    tags-ignore: [ "*" ]
+
+jobs:
+  lint:
+    name: "Static Analysis"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+      - name: Install just
+        uses: extractions/setup-just@v2
+        with:
+          just-version: '1.47.1'
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - name: Run linters
+        run: just lint
+
+  test:
+    name: "Automated Tests"
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: [ "3.14" ]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+      - name: Install just
+        uses: extractions/setup-just@v2
+        with:
+          just-version: '1.47.1'
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          python-version: "${{ matrix.python }}"
+          enable-cache: true
+      - name: Test with python ${{ matrix.python }}
+        run: just test
+      - name: Upload Coverage
+        uses: codecov/codecov-action@v5
+        with:
+          files: ./build/coverage.xml
+          flags: unittests

imbi_plugin_oidc-1.0.1/.gitignore

@@ -0,0 +1,10 @@
+__pycache__/
+*.py[cod]
+.venv/
+.pytest_cache/
+.coverage
+htmlcov/
+dist/
+build/
+*.egg-info/
+.ruff_cache/

imbi_plugin_oidc-1.0.1/.pre-commit-config.yaml

@@ -0,0 +1,36 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-added-large-files
+      - id: check-merge-conflict
+      - id: check-toml
+      - id: debug-statements
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.14.6
+    hooks:
+      - id: ruff-check
+        args: [--fix]
+      - id: ruff-format
+
+  - repo: https://github.com/tombi-toml/tombi-pre-commit
+    rev: v0.7.25
+    hooks:
+      - id: tombi-format
+
+  - repo: local
+    hooks:
+      - id: basedpyright
+        name: basedpyright
+        language: system
+        types: [python]
+        pass_filenames: false
+        entry: uv
+        args:
+          - run
+          - basedpyright
+          - src

imbi_plugin_oidc-1.0.1/LICENSE

@@ -0,0 +1,29 @@
+BSD 3-Clause License
+
+Copyright (c) 2026, AWeber Communications, Inc.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

imbi_plugin_oidc-1.0.1/PKG-INFO

@@ -0,0 +1,49 @@
+Metadata-Version: 2.4
+Name: imbi-plugin-oidc
+Version: 1.0.1
+Summary: Generic OIDC identity plugin for Imbi
+Author-email: "Gavin M. Roy" <gavinr@aweber.com>
+License: BSD-3-Clause
+License-File: LICENSE
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Natural Language :: English
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: >=3.14
+Requires-Dist: httpx>=0.27
+Requires-Dist: imbi-common>=0.1.0a1
+Requires-Dist: pydantic>=2
+Description-Content-Type: text/markdown
+
+# imbi-plugin-oidc
+
+Generic OIDC identity plugin for Imbi. Implements the OIDC authorization
+code + PKCE flow against any provider that publishes a
+`.well-known/openid-configuration` discovery document.
+
+## Manifest options
+
+| Option                   | Required | Description                                                            |
+| ------------------------ | -------- | ---------------------------------------------------------------------- |
+| `issuer_url`             | yes      | OIDC issuer URL (no trailing slash).                                   |
+| `authorization_endpoint` | no       | Override the discovered authorization endpoint.                        |
+| `token_endpoint`         | no       | Override the discovered token endpoint.                                |
+| `userinfo_endpoint`      | no       | Override the discovered userinfo endpoint.                             |
+| `jwks_uri`               | no       | Override the discovered JWKS URI.                                      |
+| `revocation_endpoint`    | no       | Override the discovered revocation endpoint (optional in OIDC).        |
+| `audience`               | no       | Audience parameter sent on `/authorize`.                               |
+| `pkce_required`          | no       | Force PKCE for public clients (default: `true`).                       |
+| `default_scopes`         | no       | Comma-separated default scopes (default: `openid profile email`).      |
+
+## Credentials
+
+| Field            | Required                       |
+| ---------------- | ------------------------------ |
+| `client_id`      | yes                            |
+| `client_secret`  | only when `pkce_required=false` |
+
+## License
+
+BSD-3-Clause.

imbi_plugin_oidc-1.0.1/README.md

@@ -0,0 +1,30 @@
+# imbi-plugin-oidc
+
+Generic OIDC identity plugin for Imbi. Implements the OIDC authorization
+code + PKCE flow against any provider that publishes a
+`.well-known/openid-configuration` discovery document.
+
+## Manifest options
+
+| Option                   | Required | Description                                                            |
+| ------------------------ | -------- | ---------------------------------------------------------------------- |
+| `issuer_url`             | yes      | OIDC issuer URL (no trailing slash).                                   |
+| `authorization_endpoint` | no       | Override the discovered authorization endpoint.                        |
+| `token_endpoint`         | no       | Override the discovered token endpoint.                                |
+| `userinfo_endpoint`      | no       | Override the discovered userinfo endpoint.                             |
+| `jwks_uri`               | no       | Override the discovered JWKS URI.                                      |
+| `revocation_endpoint`    | no       | Override the discovered revocation endpoint (optional in OIDC).        |
+| `audience`               | no       | Audience parameter sent on `/authorize`.                               |
+| `pkce_required`          | no       | Force PKCE for public clients (default: `true`).                       |
+| `default_scopes`         | no       | Comma-separated default scopes (default: `openid profile email`).      |
+
+## Credentials
+
+| Field            | Required                       |
+| ---------------- | ------------------------------ |
+| `client_id`      | yes                            |
+| `client_secret`  | only when `pkce_required=false` |
+
+## License
+
+BSD-3-Clause.

imbi_plugin_oidc-1.0.1/justfile

@@ -0,0 +1,59 @@
+[default]
+[private]
+@help:
+    just --list
+
+[private]
+ci: lint test
+
+[doc("Set up your development environment")]
+[group("Environment")]
+setup:
+    uv sync --all-groups --all-extras --frozen
+    uv run pre-commit install --install-hooks --overwrite
+
+[doc("Run tests")]
+[group("Testing")]
+test *FILES: setup
+    #!/usr/bin/env sh
+    set -e
+    env_args=""
+    if [ -f .env ]; then
+      env_args="--env-file .env"
+    fi
+    if [ -z "{{ FILES }}" ]; then
+      uv run $env_args coverage run -m pytest tests
+      uv run coverage report
+      uv run coverage xml -o build/coverage.xml
+    else
+      uv run $env_args pytest {{ FILES }}
+    fi
+
+[doc("Run linters")]
+[group("Testing")]
+lint: setup
+    uv run pre-commit run --all-files
+
+[doc("Reformat code (optionally pass specific files)")]
+[group("Development")]
+format *FILES: setup
+    #!/usr/bin/env sh
+    if [ "{{ FILES }}" = '' ]; then
+        args='--all-files'
+    else
+        args='--files {{ FILES }}'
+    fi
+    uv run pre-commit run ruff-format $args
+    uv run pre-commit run tombi-format $args
+
+[doc("Remove runtime development artifacts")]
+[group("Environment")]
+clean:
+    rm -f .coverage .env
+    rm -fR build
+
+[confirm]
+[doc("Remove caches, virtual env, and output files")]
+[group("Environment")]
+real-clean: clean
+    rm -fR .venv .*_cache dist

imbi_plugin_oidc-1.0.1/pyproject.toml

@@ -0,0 +1,119 @@
+[project]
+name = "imbi-plugin-oidc"
+version = "1.0.1"
+description = "Generic OIDC identity plugin for Imbi"
+readme = "README.md"
+requires-python = ">=3.14"
+license = { text = "BSD-3-Clause" }
+authors = [{ name = "Gavin M. Roy", email = "gavinr@aweber.com" }]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Intended Audience :: Developers",
+  "Natural Language :: English",
+  "Operating System :: OS Independent",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.14",
+]
+dependencies = [
+  "httpx>=0.27",
+  "imbi-common>=0.1.0a1",
+  "pydantic>=2",
+]
+
+[project.entry-points."imbi.plugins"]
+oidc = "imbi_plugin_oidc.plugin:OIDCPlugin"
+
+[dependency-groups]
+dev = [
+  "basedpyright",
+  "coverage[toml]",
+  "imbi-common[server,databases]",
+  "pre-commit",
+  "pytest",
+  "pytest-asyncio",
+  "respx",
+  "ruff~=0.14.6",
+]
+dist = ["build", "twine", "wheel"]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/imbi_plugin_oidc"]
+
+[tool.coverage.report]
+exclude_also = ["typing.TYPE_CHECKING"]
+fail_under = 90
+show_missing = true
+
+[tool.coverage.run]
+branch = true
+source = ["src/imbi_plugin_oidc"]
+
+[tool.pytest.ini_options]
+asyncio_mode = "auto"
+asyncio_default_fixture_loop_scope = "function"
+
+[tool.pyright]
+executionEnvironments = [
+  { root = "src" },
+  { root = "tests", reportPrivateUsage = false },
+]
+deprecateTypingAliases = true
+reportMissingSuperCall = "hint"
+reportMissingTypeStubs = false
+typeCheckingMode = "strict"
+
+[tool.ruff]
+line-length = 79
+target-version = "py314"
+
+[tool.ruff.format]
+quote-style = "single"
+
+[tool.ruff.lint]
+select = [
+  "BLE",
+  "C4",
+  "C90",
+  "E",
+  "W",
+  "F",
+  "G",
+  "I",
+  "N",
+  "Q",
+  "S",
+  "ASYNC",
+  "B",
+  "DTZ",
+  "FURB",
+  "RUF",
+  "T20",
+  "UP",
+]
+ignore = [
+  "ASYNC109",
+  "N818",
+  "RSE",
+  "S105",
+  "TRY003",
+  "TRY400",
+  "UP047",
+]
+flake8-quotes = { inline-quotes = "single" }
+
+[tool.ruff.lint.mccabe]
+max-complexity = 15
+
+[tool.ruff.lint.per-file-ignores]
+"tests/**/*.py" = ["S"]
+
+[tool.uv]
+default-groups = ["dev"]
+
+[[tool.uv.index]]
+url = "https://pypi.org/simple"
+default = true

imbi_plugin_oidc-1.0.1/src/imbi_plugin_oidc/__init__.py

@@ -0,0 +1,5 @@
+"""Imbi OIDC identity plugin."""
+
+from imbi_plugin_oidc.plugin import OIDCPlugin
+
+__all__ = ['OIDCPlugin']