intflow-auth-sdk 0.1.0__py3-none-any.whl

intflow_auth_sdk/__init__.py

@@ -0,0 +1,71 @@
+"""Public import surface for the Intflow Auth relying application SDK."""
+
+from intflow_auth_sdk.claims import (
+    extract_user_identity,
+    get_app_roles,
+    has_app_role,
+    require_app_role,
+)
+from intflow_auth_sdk.errors import (
+    IntflowAuthError,
+    IntflowDiscoveryError,
+    IntflowJwksError,
+    IntflowMissingAppRoleError,
+    IntflowMissingClaimError,
+    IntflowTokenVerificationError,
+)
+from intflow_auth_sdk.models import (
+    OidcDiscoveryMetadata,
+    PkcePair,
+    UserIdentity,
+    VerifiedIntflowToken,
+)
+from intflow_auth_sdk.pkce import create_authorization_url, generate_pkce_pair
+from intflow_auth_sdk.verifier import (
+    DEFAULT_CACHE_TTL_SECONDS,
+    DEFAULT_CLOCK_TOLERANCE_SECONDS,
+    DEFAULT_ISSUER,
+    AsyncIntflowTokenVerifier,
+    IntflowTokenVerifier,
+    create_async_token_verifier,
+    create_token_verifier,
+    fetch_discovery,
+    fetch_discovery_async,
+    verify_access_token,
+    verify_access_token_async,
+)
+
+SDK_NAME = "intflow-auth-sdk"
+__version__ = "0.1.0"
+
+__all__ = [
+    "DEFAULT_CACHE_TTL_SECONDS",
+    "DEFAULT_CLOCK_TOLERANCE_SECONDS",
+    "DEFAULT_ISSUER",
+    "SDK_NAME",
+    "AsyncIntflowTokenVerifier",
+    "IntflowAuthError",
+    "IntflowDiscoveryError",
+    "IntflowJwksError",
+    "IntflowMissingAppRoleError",
+    "IntflowMissingClaimError",
+    "IntflowTokenVerificationError",
+    "IntflowTokenVerifier",
+    "OidcDiscoveryMetadata",
+    "PkcePair",
+    "UserIdentity",
+    "VerifiedIntflowToken",
+    "__version__",
+    "create_async_token_verifier",
+    "create_authorization_url",
+    "create_token_verifier",
+    "extract_user_identity",
+    "fetch_discovery",
+    "fetch_discovery_async",
+    "generate_pkce_pair",
+    "get_app_roles",
+    "has_app_role",
+    "require_app_role",
+    "verify_access_token",
+    "verify_access_token_async",
+]

intflow_auth_sdk/claims.py

@@ -0,0 +1,50 @@
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import Any
+
+from intflow_auth_sdk.errors import IntflowMissingAppRoleError
+from intflow_auth_sdk.models import UserIdentity
+
+
+def get_app_roles(claims: Mapping[str, Any]) -> tuple[str, ...]:
+    value = claims.get("app_roles")
+    if not isinstance(value, list):
+        return ()
+    return tuple(role for role in value if isinstance(role, str))
+
+
+def has_app_role(claims: Mapping[str, Any], role: str = "admin") -> bool:
+    return role in get_app_roles(claims)
+
+
+def require_app_role(claims: Mapping[str, Any], role: str = "admin") -> None:
+    if not has_app_role(claims, role):
+        raise IntflowMissingAppRoleError(
+            "missing_app_role",
+            f"Required app role was not present: {role}",
+        )
+
+
+def extract_user_identity(claims: Mapping[str, Any]) -> UserIdentity:
+    subject = claims.get("sub")
+    if not isinstance(subject, str) or subject == "":
+        subject = ""
+
+    return UserIdentity(
+        user_id=subject,
+        email=_optional_string(claims.get("email")),
+        display_name=_optional_string(claims.get("name")),
+        roles=_string_tuple(claims.get("roles")),
+        app_roles=get_app_roles(claims),
+    )
+
+
+def _optional_string(value: Any) -> str | None:
+    return value if isinstance(value, str) else None
+
+
+def _string_tuple(value: Any) -> tuple[str, ...]:
+    if not isinstance(value, list):
+        return ()
+    return tuple(item for item in value if isinstance(item, str))

intflow_auth_sdk/errors.py

@@ -0,0 +1,27 @@
+from __future__ import annotations
+
+
+class IntflowAuthError(Exception):
+    def __init__(self, code: str, message: str) -> None:
+        super().__init__(message)
+        self.code = code
+
+
+class IntflowDiscoveryError(IntflowAuthError):
+    pass
+
+
+class IntflowJwksError(IntflowAuthError):
+    pass
+
+
+class IntflowTokenVerificationError(IntflowAuthError):
+    pass
+
+
+class IntflowMissingClaimError(IntflowTokenVerificationError):
+    pass
+
+
+class IntflowMissingAppRoleError(IntflowAuthError):
+    pass

intflow_auth_sdk/models.py

@@ -0,0 +1,39 @@
+from __future__ import annotations
+
+from collections.abc import Mapping
+from dataclasses import dataclass
+from typing import Any
+
+type JsonMapping = Mapping[str, Any]
+
+
+@dataclass(frozen=True, slots=True)
+class OidcDiscoveryMetadata:
+    issuer: str
+    authorization_endpoint: str
+    token_endpoint: str
+    jwks_uri: str
+    raw: JsonMapping
+
+
+@dataclass(frozen=True, slots=True)
+class PkcePair:
+    code_verifier: str
+    code_challenge: str
+    code_challenge_method: str = "S256"
+
+
+@dataclass(frozen=True, slots=True)
+class VerifiedIntflowToken:
+    payload: JsonMapping
+    header: JsonMapping
+    token: str
+
+
+@dataclass(frozen=True, slots=True)
+class UserIdentity:
+    user_id: str
+    email: str | None
+    display_name: str | None
+    roles: tuple[str, ...]
+    app_roles: tuple[str, ...]

intflow_auth_sdk/pkce.py

@@ -0,0 +1,69 @@
+from __future__ import annotations
+
+import base64
+import hashlib
+import secrets
+from collections.abc import Mapping, Sequence
+from urllib.parse import urlencode, urlsplit, urlunsplit
+
+from intflow_auth_sdk.models import PkcePair
+
+DEFAULT_ISSUER = "https://id.intflow.dev"
+
+
+def generate_pkce_pair() -> PkcePair:
+    code_verifier = secrets.token_urlsafe(32)
+    digest = hashlib.sha256(code_verifier.encode("ascii")).digest()
+    code_challenge = _base64_urlencode(digest)
+    return PkcePair(
+        code_verifier=code_verifier,
+        code_challenge=code_challenge,
+        code_challenge_method="S256",
+    )
+
+
+def create_authorization_url(
+    *,
+    client_id: str,
+    redirect_uri: str,
+    state: str,
+    code_challenge: str,
+    scope: str | Sequence[str] | None = None,
+    issuer: str = DEFAULT_ISSUER,
+    authorization_endpoint: str | None = None,
+    code_challenge_method: str = "S256",
+    extra_params: Mapping[str, str | int | bool | None] | None = None,
+) -> str:
+    endpoint = authorization_endpoint or f"{_normalize_issuer(issuer)}/oauth/authorize"
+    params: dict[str, str] = {
+        "response_type": "code",
+        "client_id": client_id,
+        "redirect_uri": redirect_uri,
+        "scope": _normalize_scope(scope),
+        "state": state,
+        "code_challenge": code_challenge,
+        "code_challenge_method": code_challenge_method,
+    }
+    for key, value in (extra_params or {}).items():
+        if value is not None:
+            params[key] = str(value)
+
+    parts = urlsplit(endpoint)
+    query = urlencode(params)
+    return urlunsplit((parts.scheme, parts.netloc, parts.path, query, parts.fragment))
+
+
+def _normalize_scope(scope: str | Sequence[str] | None) -> str:
+    if scope is None:
+        return "openid"
+    if isinstance(scope, str):
+        return scope
+    return " ".join(scope)
+
+
+def _normalize_issuer(issuer: str) -> str:
+    return issuer.rstrip("/")
+
+
+def _base64_urlencode(value: bytes) -> str:
+    return base64.urlsafe_b64encode(value).rstrip(b"=").decode("ascii")

intflow_auth_sdk/py.typed

@@ -0,0 +1 @@
+

intflow_auth_sdk/verifier.py

@@ -0,0 +1,479 @@
+from __future__ import annotations
+
+import time
+from collections.abc import Mapping, Sequence
+from dataclasses import dataclass
+from typing import Any
+
+import httpx
+import jwt
+from jwt import PyJWK
+from jwt.exceptions import (
+    ExpiredSignatureError,
+    ImmatureSignatureError,
+    InvalidAlgorithmError,
+    InvalidAudienceError,
+    InvalidIssuerError,
+    InvalidSignatureError,
+    InvalidTokenError,
+    MissingRequiredClaimError,
+)
+
+from intflow_auth_sdk.errors import (
+    IntflowAuthError,
+    IntflowDiscoveryError,
+    IntflowJwksError,
+    IntflowMissingClaimError,
+    IntflowTokenVerificationError,
+)
+from intflow_auth_sdk.models import OidcDiscoveryMetadata, VerifiedIntflowToken
+
+DEFAULT_ISSUER = "https://id.intflow.dev"
+DEFAULT_CLOCK_TOLERANCE_SECONDS = 60
+DEFAULT_CACHE_TTL_SECONDS = 300
+
+
+@dataclass(frozen=True, slots=True)
+class _CachedValue:
+    value: Mapping[str, Any] | OidcDiscoveryMetadata
+    expires_at: float
+
+
+class IntflowTokenVerifier:
+    def __init__(
+        self,
+        *,
+        audience: str | Sequence[str],
+        issuer: str = DEFAULT_ISSUER,
+        algorithms: Sequence[str] | None = None,
+        cache_ttl_seconds: int = DEFAULT_CACHE_TTL_SECONDS,
+        clock_tolerance_seconds: int = DEFAULT_CLOCK_TOLERANCE_SECONDS,
+        timeout: float = 5.0,
+        client: httpx.Client | None = None,
+        transport: httpx.BaseTransport | None = None,
+    ) -> None:
+        self.audience = audience
+        self.issuer = _normalize_issuer(issuer)
+        self.algorithms = tuple(algorithms or ("RS256",))
+        self.cache_ttl_seconds = cache_ttl_seconds
+        self.clock_tolerance_seconds = clock_tolerance_seconds
+        self.timeout = timeout
+        self._client = client
+        self._transport = transport
+        self._discovery: _CachedValue | None = None
+        self._jwks: _CachedValue | None = None
+
+    def get_discovery(self, *, force_refresh: bool = False) -> OidcDiscoveryMetadata:
+        cached = self._get_cached_discovery(force_refresh=force_refresh)
+        if cached is not None:
+            return cached
+
+        url = f"{self.issuer}/.well-known/openid-configuration"
+        data = self._fetch_json(url, target="discovery")
+        discovery = _parse_discovery(data, expected_issuer=self.issuer)
+        self._discovery = _CachedValue(discovery, time.monotonic() + self.cache_ttl_seconds)
+        return discovery
+
+    def verify_access_token(self, token: str) -> VerifiedIntflowToken:
+        try:
+            return self._verify_with_jwks(token, self._get_jwks())
+        except IntflowTokenVerificationError as exc:
+            if exc.code != "unknown_key_id":
+                raise
+
+        return self._verify_with_jwks(token, self._get_jwks(force_refresh=True))
+
+    def _get_cached_discovery(self, *, force_refresh: bool) -> OidcDiscoveryMetadata | None:
+        if (
+            force_refresh
+            or self._discovery is None
+            or self._discovery.expires_at <= time.monotonic()
+        ):
+            return None
+        if not isinstance(self._discovery.value, OidcDiscoveryMetadata):
+            return None
+        return self._discovery.value
+
+    def _get_jwks(self, *, force_refresh: bool = False) -> Mapping[str, Any]:
+        if (
+            not force_refresh
+            and self._jwks is not None
+            and self._jwks.expires_at > time.monotonic()
+            and isinstance(self._jwks.value, Mapping)
+        ):
+            return self._jwks.value
+
+        discovery = self.get_discovery(force_refresh=force_refresh)
+        jwks = self._fetch_json(discovery.jwks_uri, target="jwks")
+        _assert_jwks(jwks)
+        self._jwks = _CachedValue(jwks, time.monotonic() + self.cache_ttl_seconds)
+        return jwks
+
+    def _fetch_json(self, url: str, *, target: str) -> Mapping[str, Any]:
+        try:
+            if self._client is not None:
+                response = self._client.get(url, headers={"accept": "application/json"})
+            else:
+                with httpx.Client(timeout=self.timeout, transport=self._transport) as client:
+                    response = client.get(url, headers={"accept": "application/json"})
+        except httpx.HTTPError as exc:
+            raise _fetch_error(target) from exc
+
+        return _response_json(response, target=target)
+
+    def _verify_with_jwks(self, token: str, jwks: Mapping[str, Any]) -> VerifiedIntflowToken:
+        header = _unverified_header(token)
+        key = _find_key(jwks, header, allowed_algorithms=self.algorithms)
+        try:
+            payload = jwt.decode(
+                token,
+                key=key,
+                algorithms=list(self.algorithms),
+                audience=self.audience,
+                issuer=self.issuer,
+                leeway=self.clock_tolerance_seconds,
+                options={"require": ["iss", "sub", "aud", "exp", "nbf"]},
+            )
+        except MissingRequiredClaimError as exc:
+            raise _missing_claim_error(exc.claim) from exc
+        except ExpiredSignatureError as exc:
+            raise IntflowTokenVerificationError("token_expired", "Token is expired.") from exc
+        except ImmatureSignatureError as exc:
+            raise IntflowTokenVerificationError(
+                "token_not_yet_valid",
+                "Token is not valid yet.",
+            ) from exc
+        except InvalidIssuerError as exc:
+            raise IntflowTokenVerificationError(
+                "invalid_issuer",
+                "Token issuer was invalid.",
+            ) from exc
+        except InvalidAudienceError as exc:
+            raise IntflowTokenVerificationError(
+                "invalid_audience",
+                "Token audience was invalid.",
+            ) from exc
+        except InvalidSignatureError as exc:
+            raise IntflowTokenVerificationError(
+                "invalid_signature",
+                "Token signature was invalid.",
+            ) from exc
+        except InvalidAlgorithmError as exc:
+            raise IntflowTokenVerificationError(
+                "invalid_algorithm",
+                "Token algorithm was not allowed.",
+            ) from exc
+        except InvalidTokenError as exc:
+            raise IntflowTokenVerificationError(
+                "invalid_token",
+                "Token verification failed.",
+            ) from exc
+
+        _assert_intflow_claims(payload)
+        return VerifiedIntflowToken(payload=payload, header=header, token=token)
+
+
+class AsyncIntflowTokenVerifier:
+    def __init__(
+        self,
+        *,
+        audience: str | Sequence[str],
+        issuer: str = DEFAULT_ISSUER,
+        algorithms: Sequence[str] | None = None,
+        cache_ttl_seconds: int = DEFAULT_CACHE_TTL_SECONDS,
+        clock_tolerance_seconds: int = DEFAULT_CLOCK_TOLERANCE_SECONDS,
+        timeout: float = 5.0,
+        client: httpx.AsyncClient | None = None,
+        transport: httpx.AsyncBaseTransport | None = None,
+    ) -> None:
+        self.audience = audience
+        self.issuer = _normalize_issuer(issuer)
+        self.algorithms = tuple(algorithms or ("RS256",))
+        self.cache_ttl_seconds = cache_ttl_seconds
+        self.clock_tolerance_seconds = clock_tolerance_seconds
+        self.timeout = timeout
+        self._client = client
+        self._transport = transport
+        self._discovery: _CachedValue | None = None
+        self._jwks: _CachedValue | None = None
+
+    async def get_discovery(self, *, force_refresh: bool = False) -> OidcDiscoveryMetadata:
+        cached = self._get_cached_discovery(force_refresh=force_refresh)
+        if cached is not None:
+            return cached
+
+        url = f"{self.issuer}/.well-known/openid-configuration"
+        data = await self._fetch_json(url, target="discovery")
+        discovery = _parse_discovery(data, expected_issuer=self.issuer)
+        self._discovery = _CachedValue(discovery, time.monotonic() + self.cache_ttl_seconds)
+        return discovery
+
+    async def verify_access_token(self, token: str) -> VerifiedIntflowToken:
+        try:
+            return self._verify_with_jwks(token, await self._get_jwks())
+        except IntflowTokenVerificationError as exc:
+            if exc.code != "unknown_key_id":
+                raise
+
+        return self._verify_with_jwks(token, await self._get_jwks(force_refresh=True))
+
+    def _get_cached_discovery(self, *, force_refresh: bool) -> OidcDiscoveryMetadata | None:
+        if (
+            force_refresh
+            or self._discovery is None
+            or self._discovery.expires_at <= time.monotonic()
+        ):
+            return None
+        if not isinstance(self._discovery.value, OidcDiscoveryMetadata):
+            return None
+        return self._discovery.value
+
+    async def _get_jwks(self, *, force_refresh: bool = False) -> Mapping[str, Any]:
+        if (
+            not force_refresh
+            and self._jwks is not None
+            and self._jwks.expires_at > time.monotonic()
+            and isinstance(self._jwks.value, Mapping)
+        ):
+            return self._jwks.value
+
+        discovery = await self.get_discovery(force_refresh=force_refresh)
+        jwks = await self._fetch_json(discovery.jwks_uri, target="jwks")
+        _assert_jwks(jwks)
+        self._jwks = _CachedValue(jwks, time.monotonic() + self.cache_ttl_seconds)
+        return jwks
+
+    async def _fetch_json(self, url: str, *, target: str) -> Mapping[str, Any]:
+        try:
+            if self._client is not None:
+                response = await self._client.get(url, headers={"accept": "application/json"})
+            else:
+                async with httpx.AsyncClient(
+                    timeout=self.timeout,
+                    transport=self._transport,
+                ) as client:
+                    response = await client.get(url, headers={"accept": "application/json"})
+        except httpx.HTTPError as exc:
+            raise _fetch_error(target) from exc
+
+        return _response_json(response, target=target)
+
+    def _verify_with_jwks(self, token: str, jwks: Mapping[str, Any]) -> VerifiedIntflowToken:
+        verifier = IntflowTokenVerifier(
+            audience=self.audience,
+            issuer=self.issuer,
+            algorithms=self.algorithms,
+            cache_ttl_seconds=self.cache_ttl_seconds,
+            clock_tolerance_seconds=self.clock_tolerance_seconds,
+        )
+        return verifier._verify_with_jwks(token, jwks)
+
+
+def create_token_verifier(**options: Any) -> IntflowTokenVerifier:
+    return IntflowTokenVerifier(**options)
+
+
+def create_async_token_verifier(**options: Any) -> AsyncIntflowTokenVerifier:
+    return AsyncIntflowTokenVerifier(**options)
+
+
+def verify_access_token(token: str, **options: Any) -> VerifiedIntflowToken:
+    return create_token_verifier(**options).verify_access_token(token)
+
+
+async def verify_access_token_async(token: str, **options: Any) -> VerifiedIntflowToken:
+    return await create_async_token_verifier(**options).verify_access_token(token)
+
+
+def fetch_discovery(
+    *,
+    issuer: str = DEFAULT_ISSUER,
+    client: httpx.Client | None = None,
+    transport: httpx.BaseTransport | None = None,
+    timeout: float = 5.0,
+) -> OidcDiscoveryMetadata:
+    verifier = IntflowTokenVerifier(
+        audience="discovery-only",
+        issuer=issuer,
+        client=client,
+        transport=transport,
+        timeout=timeout,
+    )
+    return verifier.get_discovery()
+
+
+async def fetch_discovery_async(
+    *,
+    issuer: str = DEFAULT_ISSUER,
+    client: httpx.AsyncClient | None = None,
+    transport: httpx.AsyncBaseTransport | None = None,
+    timeout: float = 5.0,
+) -> OidcDiscoveryMetadata:
+    verifier = AsyncIntflowTokenVerifier(
+        audience="discovery-only",
+        issuer=issuer,
+        client=client,
+        transport=transport,
+        timeout=timeout,
+    )
+    return await verifier.get_discovery()
+
+
+def _normalize_issuer(issuer: str) -> str:
+    return issuer.rstrip("/")
+
+
+def _fetch_error(target: str) -> IntflowAuthError:
+    if target == "discovery":
+        return IntflowDiscoveryError("discovery_fetch_failed", "OIDC discovery failed.")
+    return IntflowJwksError("jwks_fetch_failed", "JWKS fetch failed.")
+
+
+def _response_json(response: httpx.Response, *, target: str) -> Mapping[str, Any]:
+    if response.status_code < 200 or response.status_code >= 300:
+        if target == "discovery":
+            raise IntflowDiscoveryError(
+                "discovery_http_error",
+                f"OIDC discovery returned HTTP {response.status_code}.",
+            )
+        raise IntflowJwksError(
+            "jwks_http_error",
+            f"JWKS endpoint returned HTTP {response.status_code}.",
+        )
+
+    try:
+        data = response.json()
+    except ValueError as exc:
+        if target == "discovery":
+            raise IntflowDiscoveryError(
+                "discovery_invalid_json",
+                "OIDC discovery was not JSON.",
+            ) from exc
+        raise IntflowJwksError("jwks_invalid_json", "JWKS response was not JSON.") from exc
+
+    if not isinstance(data, Mapping):
+        if target == "discovery":
+            raise IntflowDiscoveryError(
+                "discovery_invalid_shape",
+                "OIDC discovery was invalid.",
+            )
+        raise IntflowJwksError("jwks_invalid_shape", "JWKS response was invalid.")
+    return data
+
+
+def _parse_discovery(data: Mapping[str, Any], *, expected_issuer: str) -> OidcDiscoveryMetadata:
+    if data.get("issuer") != expected_issuer:
+        raise IntflowDiscoveryError(
+            "discovery_issuer_mismatch",
+            "OIDC discovery issuer did not match the configured issuer.",
+        )
+
+    issuer = _required_string(data, "issuer", "discovery_missing_issuer", IntflowDiscoveryError)
+    authorization_endpoint = _required_string(
+        data,
+        "authorization_endpoint",
+        "discovery_missing_authorization_endpoint",
+        IntflowDiscoveryError,
+    )
+    token_endpoint = _required_string(
+        data,
+        "token_endpoint",
+        "discovery_missing_token_endpoint",
+        IntflowDiscoveryError,
+    )
+    jwks_uri = _required_string(
+        data,
+        "jwks_uri",
+        "discovery_missing_jwks_uri",
+        IntflowDiscoveryError,
+    )
+    return OidcDiscoveryMetadata(
+        issuer=issuer,
+        authorization_endpoint=authorization_endpoint,
+        token_endpoint=token_endpoint,
+        jwks_uri=jwks_uri,
+        raw=data,
+    )
+
+
+def _assert_jwks(data: Mapping[str, Any]) -> None:
+    if not isinstance(data.get("keys"), list):
+        raise IntflowJwksError("jwks_invalid_shape", "JWKS response was invalid.")
+
+
+def _unverified_header(token: str) -> Mapping[str, Any]:
+    try:
+        header = jwt.get_unverified_header(token)
+    except InvalidTokenError as exc:
+        raise IntflowTokenVerificationError("invalid_token", "Token header was invalid.") from exc
+    if not isinstance(header, Mapping):
+        raise IntflowTokenVerificationError("invalid_token", "Token header was invalid.")
+    return header
+
+
+def _find_key(
+    jwks: Mapping[str, Any],
+    header: Mapping[str, Any],
+    *,
+    allowed_algorithms: Sequence[str],
+) -> Any:
+    algorithm = header.get("alg")
+    if not isinstance(algorithm, str):
+        raise IntflowTokenVerificationError("missing_algorithm", "Token is missing alg.")
+    if algorithm not in allowed_algorithms:
+        raise IntflowTokenVerificationError("invalid_algorithm", "Token algorithm was not allowed.")
+
+    key_id = header.get("kid")
+    if not isinstance(key_id, str) or key_id == "":
+        raise IntflowTokenVerificationError("missing_key_id", "Token is missing kid.")
+
+    keys = jwks.get("keys")
+    if not isinstance(keys, list):
+        raise IntflowJwksError("jwks_invalid_shape", "JWKS response was invalid.")
+
+    for key_data in keys:
+        if isinstance(key_data, Mapping) and key_data.get("kid") == key_id:
+            return PyJWK.from_dict(dict(key_data), algorithm=algorithm).key
+
+    raise IntflowTokenVerificationError("unknown_key_id", "Token key id was not found in JWKS.")
+
+
+def _assert_intflow_claims(payload: Mapping[str, Any]) -> None:
+    subject = payload.get("sub")
+    if not isinstance(subject, str) or subject == "":
+        raise IntflowMissingClaimError("missing_subject", "Token is missing sub.")
+    if not isinstance(payload.get("iss"), str):
+        raise IntflowMissingClaimError("missing_issuer", "Token is missing iss.")
+    audience = payload.get("aud")
+    if not isinstance(audience, str) and not isinstance(audience, list):
+        raise IntflowMissingClaimError("missing_audience", "Token is missing aud.")
+    if not isinstance(payload.get("exp"), int):
+        raise IntflowMissingClaimError("missing_expiration", "Token is missing exp.")
+    if not isinstance(payload.get("nbf"), int):
+        raise IntflowMissingClaimError("missing_not_before", "Token is missing nbf.")
+
+
+def _missing_claim_error(claim: str) -> IntflowMissingClaimError:
+    code_by_claim = {
+        "iss": "missing_issuer",
+        "sub": "missing_subject",
+        "aud": "missing_audience",
+        "exp": "missing_expiration",
+        "nbf": "missing_not_before",
+    }
+    return IntflowMissingClaimError(
+        code_by_claim.get(claim, "missing_claim"),
+        f"Token is missing {claim}.",
+    )
+
+
+def _required_string(
+    data: Mapping[str, Any],
+    key: str,
+    code: str,
+    error_type: type[IntflowDiscoveryError],
+) -> str:
+    value = data.get(key)
+    if not isinstance(value, str):
+        raise error_type(code, f"OIDC discovery did not include {key}.")
+    return value

intflow_auth_sdk-0.1.0.dist-info/METADATA

@@ -0,0 +1,48 @@
+Metadata-Version: 2.4
+Name: intflow-auth-sdk
+Version: 0.1.0
+Summary: Intflow Auth relying application SDK.
+Author: Intflow
+License: Proprietary
+Requires-Python: >=3.12
+Requires-Dist: httpx<1,>=0.28
+Requires-Dist: pyjwt[crypto]<3,>=2.10
+Provides-Extra: dev
+Requires-Dist: build<2,>=1.2; extra == 'dev'
+Requires-Dist: mypy<2,>=1.13; extra == 'dev'
+Requires-Dist: pytest-asyncio<1,>=0.25; extra == 'dev'
+Requires-Dist: pytest<9,>=8; extra == 'dev'
+Requires-Dist: twine<7,>=6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# Intflow Auth SDK
+
+Python SDK for relying applications that integrate with Intflow Auth.
+
+This package is for application backends that need to validate Intflow-issued
+tokens and enforce application roles. It does not provide operator credential
+storage, service runtime components, or Admin API automation.
+
+## Install
+
+```powershell
+python -m pip install intflow-auth-sdk
+```
+
+## Current Status
+
+This package provides PKCE helpers, authorization URL construction, OIDC
+discovery/JWKS caching, Intflow access-token verification, and application-role
+checks.
+
+```python
+from intflow_auth_sdk import create_token_verifier, require_app_role
+
+verifier = create_token_verifier(audience="your-oauth-client-id")
+verified = verifier.verify_access_token(access_token)
+require_app_role(verified.payload, "admin")
+
+print(verified.payload["sub"])
+```
+
+For local fake-token examples, see `examples/python-sdk-consumer`.

intflow_auth_sdk-0.1.0.dist-info/RECORD

@@ -0,0 +1,10 @@
+intflow_auth_sdk/__init__.py,sha256=JAO48ws56qig8elWz85WhLiFbWH-6n8HYuBMZST3ReY,1823
+intflow_auth_sdk/claims.py,sha256=RjVkjxAUHQQ3i0kSMaDiM5Np2c-Q-ipP2IDCLzyWV1g,1523
+intflow_auth_sdk/errors.py,sha256=4dCq6BjCbwMHrYhLOoW2-u3rnNcVqGjyAgjtfHGFCnA,502
+intflow_auth_sdk/models.py,sha256=Vfa5qwLOswA5vEkJL6G9iJwp2xylorTmYDBxU107bUg,800
+intflow_auth_sdk/pkce.py,sha256=-2qZWXnlMUzabHtrY6WFxvLlER7SDdNzqoqgqsciR8o,2030
+intflow_auth_sdk/py.typed,sha256=AbpHGcgLb-kRsJGnwFEktk7uzpZOCcBY74-YBdrKVGs,1
+intflow_auth_sdk/verifier.py,sha256=9AyFB6GEYSkqUkAynDQs3vGP63BalMzZPRfIE0T1NLY,17520
+intflow_auth_sdk-0.1.0.dist-info/METADATA,sha256=zow8KeObR96DV4Bit2LG7VHre6otrUPqwyPRGeQ9NIw,1438
+intflow_auth_sdk-0.1.0.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
+intflow_auth_sdk-0.1.0.dist-info/RECORD,,

intflow_auth_sdk-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.31.0
+Root-Is-Purelib: true
+Tag: py3-none-any