mindyard 0.1.0__py3-none-any.whl

mindyard/__init__.py

@@ -0,0 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+"""mindyard: a personal LLM wiki served over MCP."""
+
+__version__ = "0.1.0"

mindyard/auth/__init__.py

@@ -0,0 +1,21 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+"""Pluggable authentication and access policies."""
+
+from .backends import AuthBackend, BearerAuth, GoogleAuth, NoAuth, google_identity
+from .policy import AccessPolicy, AllowAll, AllowAuthenticated, EmailAllowlist
+from .tokens import TokenStore, TokenStoreError, add_token
+
+__all__ = [
+    "AccessPolicy",
+    "AllowAll",
+    "AllowAuthenticated",
+    "AuthBackend",
+    "BearerAuth",
+    "EmailAllowlist",
+    "GoogleAuth",
+    "NoAuth",
+    "TokenStore",
+    "TokenStoreError",
+    "add_token",
+    "google_identity",
+]

mindyard/auth/backends.py

@@ -0,0 +1,169 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+"""Authentication backends: who is calling.
+
+A backend has two jobs. It supplies the FastMCP auth provider that guards the
+HTTP endpoint (or none), and it turns the verified access token into a neutral
+:class:`~mindyard.identity.Identity`. Deciding whether that identity may come in is
+the access policy's job, and which wikis it sees is the tenant resolver's.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import Any, Protocol
+
+from fastmcp.server.auth import AccessToken, AuthProvider
+from fastmcp.server.auth.providers.google import GoogleProvider
+
+from mindyard.identity import Identity
+
+from .consent import StableConsentMixin
+from .gate import CallbackGateMixin
+from .policy import AccessPolicy
+from .tokens import BEARER_ISSUER, HashedTokenVerifier, TokenStore
+
+GOOGLE_ISSUER = "https://accounts.google.com"
+GOOGLE_SCOPES = ("openid", "email", "profile")
+
+
+class AuthBackend(Protocol):
+    name: str
+
+    def provider(self) -> AuthProvider | None: ...
+
+    def identity(self, token: AccessToken | None) -> Identity | None: ...
+
+
+class NoAuth:
+    """Local development only. The server refuses to listen beyond loopback."""
+
+    name = "none"
+
+    def provider(self) -> AuthProvider | None:
+        return None
+
+    def identity(self, token: AccessToken | None) -> Identity | None:
+        return None
+
+
+class BearerAuth:
+    """Static bearer tokens, stored hashed; one named principal per token.
+
+    Suited to Claude Code, Claude Desktop (through a stdio bridge) and scripts.
+    Claude.ai custom connectors accept static headers only for some accounts,
+    so OAuth remains the route there.
+    """
+
+    name = "bearer"
+
+    def __init__(self, store: TokenStore) -> None:
+        self._verifier = HashedTokenVerifier(store)
+
+    def provider(self) -> AuthProvider | None:
+        return self._verifier
+
+    def identity(self, token: AccessToken | None) -> Identity | None:
+        if token is None:
+            return None
+        return Identity(issuer=BEARER_ISSUER, subject=token.client_id)
+
+
+def _attested(flag: Any) -> bool:
+    """True only for an explicit affirmative flag, boolean or string.
+
+    Google's tokeninfo returns ``"true"``/``"false"`` strings and userinfo a JSON
+    boolean. ``"false"`` is a truthy Python string: a plain truth test would read
+    a refusal as a proof.
+    """
+    if isinstance(flag, bool):
+        return flag
+    if isinstance(flag, str):
+        return flag.strip().lower() == "true"
+    return False
+
+
+def email_verified(claims: Mapping[str, Any]) -> bool:
+    """True only if every source present explicitly attests the email.
+
+    The flag has two homes: ``email_verified`` at the top level and
+    ``verified_email`` in the ``google_user_data`` profile, which is ``None``
+    when the userinfo fetch fails. No flag is not a verification, and any source
+    that disagrees is a refusal.
+    """
+    flags = [
+        source[key]
+        for source in (claims, claims.get("google_user_data"))
+        if isinstance(source, Mapping)
+        for key in ("email_verified", "verified_email")
+        if key in source
+    ]
+    return bool(flags) and all(_attested(flag) for flag in flags)
+
+
+def google_identity(claims: Mapping[str, Any] | None) -> Identity | None:
+    """Identity from Google claims, or ``None`` without a subject."""
+    if not claims:
+        return None
+    subject = claims.get("sub")
+    if not isinstance(subject, str) or not subject:
+        return None
+    email = claims.get("email")
+    return Identity(
+        issuer=GOOGLE_ISSUER,
+        subject=subject,
+        email=email.strip().lower() if isinstance(email, str) and email.strip() else None,
+        email_verified=email_verified(claims),
+        claims=dict(claims),
+    )
+
+
+class StableConsentGoogleProvider(StableConsentMixin, GoogleProvider):
+    """Google OAuth proxy whose consent page tolerates a second load."""
+
+
+class GatedGoogleProvider(CallbackGateMixin, StableConsentGoogleProvider):
+    """The same proxy, refusing an identity the policy denies at the callback."""
+
+
+class GoogleAuth:
+    """OAuth through Google, proxied by FastMCP so Claude.ai can connect.
+
+    The proxy persists client registrations and tokens under FastMCP's home
+    directory: losing it forces every client to sign in again. Given the access
+    policy, it also refuses a denied account at the callback, before the client
+    holds a token.
+    """
+
+    name = "google"
+
+    def __init__(
+        self,
+        client_id: str,
+        client_secret: str,
+        base_url: str,
+        redirect_path: str = "/auth/callback",
+        policy: AccessPolicy | None = None,
+    ) -> None:
+        self._client_id = client_id
+        self._client_secret = client_secret
+        self._base_url = base_url
+        self._redirect_path = redirect_path
+        self._policy = policy
+
+    def provider(self) -> AuthProvider | None:
+        options: dict[str, Any] = {
+            "client_id": self._client_id,
+            "client_secret": self._client_secret,
+            "base_url": self._base_url,
+            "redirect_path": self._redirect_path,
+            "required_scopes": list(GOOGLE_SCOPES),
+        }
+        policy = self._policy
+        if policy is None:
+            return StableConsentGoogleProvider(**options)
+        return GatedGoogleProvider(
+            admit=lambda token: policy.allows(self.identity(token)), **options
+        )
+
+    def identity(self, token: AccessToken | None) -> Identity | None:
+        return google_identity(token.claims if token is not None else None)

mindyard/auth/consent.py

@@ -0,0 +1,76 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+"""A consent page whose CSRF token survives being loaded twice.
+
+FastMCP's OAuth proxy issues a fresh CSRF token every time ``GET /consent`` is
+served, and stores it on the transaction. Any second load of the same URL thus
+invalidates the form the user is looking at. Second loads happen in practice:
+some mobile browsers hand visited URLs to a scanning service, which fetches the
+page within a second, so the user's "Approve" arrives with a stale token
+("Invalid or expired consent token").
+
+This mixin keeps the token stable for the lifetime of the transaction: when the
+transaction already holds an unexpired token, a reload is served that same
+token. The double-submit check is untouched. A third party learning the token
+gains nothing: the token is only accepted together with the browser's own
+``MCP_CONSENT_STATE`` cookie, which is ``SameSite=Lax`` and therefore never
+attached to a cross-site POST.
+
+It post-processes FastMCP's response instead of copying its private method, so
+it depends on three internals only: the transaction store and its
+``csrf_token``/``csrf_expires_at`` fields, the cookie helpers, and the token
+appearing verbatim in the rendered form. ``tests/auth/test_consent.py`` replays
+the race end to end and fails if any of them changes.
+"""
+
+from __future__ import annotations
+
+import time
+from typing import Any
+
+from starlette.requests import Request
+from starlette.responses import HTMLResponse, RedirectResponse
+
+CONSENT_COOKIE = "MCP_CONSENT_STATE"
+
+
+class StableConsentMixin:
+    """Mix into an ``OAuthProxy`` subclass, before it in the bases."""
+
+    async def _show_consent_page(self, request: Request) -> HTMLResponse | RedirectResponse:
+        proxy: Any = self
+        txn_id = request.query_params.get("txn_id")
+        previous: tuple[str, float] | None = None
+        if txn_id:
+            txn = await proxy._transaction_store.get(key=txn_id)
+            if txn is not None and txn.csrf_token and (txn.csrf_expires_at or 0) > time.time():
+                previous = (txn.csrf_token, float(txn.csrf_expires_at))
+
+        response: HTMLResponse | RedirectResponse = await super()._show_consent_page(  # type: ignore[misc]
+            request
+        )
+        if previous is None or response.status_code != 200 or not txn_id:
+            return response
+        txn = await proxy._transaction_store.get(key=txn_id)
+        fresh = txn.csrf_token if txn is not None else None
+        body = bytes(response.body)
+        if not fresh or fresh == previous[0] or fresh.encode() not in body:
+            return response
+
+        token, expires_at = previous
+        txn.csrf_token, txn.csrf_expires_at = token, expires_at
+        ttl = max(1, int(expires_at - time.time()))
+        await proxy._transaction_store.put(key=txn_id, value=txn, ttl=ttl)
+
+        response.body = body.replace(fresh.encode(), token.encode())
+        response.headers["content-length"] = str(len(response.body))
+        cookie_name = proxy._cookie_name(CONSENT_COOKIE)
+        response.raw_headers = [
+            (k, v)
+            for k, v in response.raw_headers
+            if not (k == b"set-cookie" and v.startswith(cookie_name.encode() + b"="))
+        ]
+        tokens = [t for t in proxy._decode_list_cookie(request, CONSENT_COOKIE) if t != token]
+        proxy._set_list_cookie(
+            response, CONSENT_COOKIE, proxy._encode_list_cookie([*tokens, token]), max_age=ttl
+        )
+        return response

mindyard/auth/gate.py

@@ -0,0 +1,78 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+"""Refuse an identity at the OAuth callback, not only at the first MCP request.
+
+FastMCP's OAuth proxy hands an authorization code to any account the upstream
+provider signs in. With Google that is any account on earth: the access policy
+then refuses every MCP request, but the client already holds a token. Claude.ai
+keeps such a token and the connector stays stuck until it is disconnected.
+
+This mixin checks the identity as soon as Google's tokens are in hand. A refused
+identity gets no code: its code is deleted and the client is redirected with
+``error=access_denied`` (RFC 6749, section 4.1.2.1), so it never stores a token.
+The per-request gate stays the authority; this is the early, friendly refusal.
+
+Like the consent mixin, it post-processes FastMCP's response instead of copying
+its handler. It depends on the code store, the ``idp_tokens`` of a stored code
+and the upstream token verifier; ``tests/auth/test_gate.py`` drives the whole
+callback and fails if any of them changes.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Awaitable, Callable
+from typing import Any
+from urllib.parse import parse_qs, urlencode, urlparse
+
+from fastmcp.server.auth import AccessToken
+from starlette.requests import Request
+from starlette.responses import HTMLResponse, RedirectResponse
+
+Admit = Callable[[AccessToken | None], bool]
+
+DENIED_DESCRIPTION = "This account is not allowed on this server."
+
+
+class CallbackGateMixin:
+    """Mix into an ``OAuthProxy`` subclass, before it in the bases."""
+
+    def __init__(self, *args: Any, admit: Admit, **kwargs: Any) -> None:
+        super().__init__(*args, **kwargs)
+        self._admit = admit
+
+    async def _handle_idp_callback(self, request: Request) -> HTMLResponse | RedirectResponse:
+        proxy: Any = self
+        parent: Callable[[Request], Awaitable[HTMLResponse | RedirectResponse]]
+        parent = super()._handle_idp_callback  # type: ignore[misc]
+        response = await parent(request)
+        if not isinstance(response, RedirectResponse):
+            return response
+        target = urlparse(response.headers["location"])
+        params = parse_qs(target.query)
+        code = params.get("code", [None])[0]
+        if not code:
+            return response
+        stored = await proxy._code_store.get(key=code)
+        if stored is not None and self._admit(await self._verify(stored.idp_tokens)):
+            return response
+
+        await proxy._code_store.delete(key=code)
+        denied = {"error": "access_denied", "error_description": DENIED_DESCRIPTION}
+        if "state" in params:
+            denied["state"] = params["state"][0]
+        kept = [(k, v) for k, vs in params.items() if k not in ("code", "state") for v in vs]
+        location = target._replace(query=urlencode([*kept, *denied.items()])).geturl()
+        refused = RedirectResponse(url=location, status_code=302)
+        refused.raw_headers += [(k, v) for k, v in response.raw_headers if k == b"set-cookie"]
+        return refused
+
+    async def _verify(self, idp_tokens: dict[str, Any]) -> AccessToken | None:
+        """The upstream verifier's verdict on the fresh tokens; failure denies."""
+        proxy: Any = self
+        access_token = idp_tokens.get("access_token")
+        if not isinstance(access_token, str) or not access_token:
+            return None
+        try:
+            verified: AccessToken | None = await proxy._token_validator.verify_token(access_token)
+        except Exception:
+            return None
+        return verified

mindyard/auth/policy.py

@@ -0,0 +1,46 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+"""Access policies: may this identity use the server at all.
+
+Applied to every MCP request, the handshake included: the server instructions
+and the tool list already describe the wikis, so an identity off the list must
+not even learn what is behind the door.
+"""
+
+from __future__ import annotations
+
+from typing import Protocol
+
+from mindyard.identity import Identity
+
+
+class AccessPolicy(Protocol):
+    def allows(self, identity: Identity | None) -> bool: ...
+
+
+class AllowAll:
+    """For backends whose credentials are explicit grants (bearer, no auth)."""
+
+    def allows(self, identity: Identity | None) -> bool:
+        return True
+
+
+class AllowAuthenticated:
+    """Any verified identity; the tenant map then decides what it sees."""
+
+    def allows(self, identity: Identity | None) -> bool:
+        return identity is not None
+
+
+class EmailAllowlist:
+    """A verified email on the list. An empty list denies everyone."""
+
+    def __init__(self, emails: frozenset[str]) -> None:
+        self._emails = frozenset(e.strip().lower() for e in emails if e.strip())
+
+    def allows(self, identity: Identity | None) -> bool:
+        return (
+            identity is not None
+            and identity.email_verified
+            and identity.email is not None
+            and identity.email in self._emails
+        )

mindyard/auth/tokens.py

@@ -0,0 +1,96 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+"""Static bearer tokens, stored as SHA-256 digests in ``tokens.yaml``.
+
+Tokens are 256-bit random strings, so a fast hash is enough: there is nothing
+to brute-force, and the file never holds a usable secret. Lookup is by digest,
+so comparing a guess costs the same whatever it matches.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import re
+import secrets
+from dataclasses import dataclass
+from pathlib import Path
+
+import yaml
+from fastmcp.server.auth import AccessToken, TokenVerifier
+from pydantic import BaseModel, ConfigDict, Field, ValidationError
+
+BEARER_ISSUER = "mindyard:bearer"
+TOKEN_PREFIX = "myd_"
+_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9_.-]{0,62}$")
+
+
+class TokenStoreError(ValueError):
+    pass
+
+
+def digest(token: str) -> str:
+    return hashlib.sha256(token.encode("utf-8")).hexdigest()
+
+
+def new_token() -> str:
+    return TOKEN_PREFIX + secrets.token_urlsafe(32)
+
+
+class _Entry(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+    name: str
+    sha256: str = Field(pattern=r"^[0-9a-f]{64}$")
+
+
+class _File(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+    tokens: list[_Entry] = []
+
+
+@dataclass(frozen=True)
+class TokenStore:
+    """Token digest to principal name. Loaded once, at startup."""
+
+    by_digest: dict[str, str]
+
+    @classmethod
+    def load(cls, path: Path) -> TokenStore:
+        if not path.is_file():
+            return cls({})
+        try:
+            parsed = _File.model_validate(yaml.safe_load(path.read_text(encoding="utf-8")) or {})
+        except (yaml.YAMLError, ValidationError) as exc:
+            raise TokenStoreError(f"{path}: invalid ({exc})") from exc
+        by_digest: dict[str, str] = {}
+        for entry in parsed.tokens:
+            if entry.sha256 in by_digest:
+                raise TokenStoreError(f"{path}: duplicate token digest")
+            by_digest[entry.sha256] = entry.name
+        return cls(by_digest)
+
+
+def add_token(path: Path, name: str) -> str:
+    """Mint a token for ``name``, store its digest, return the clear token once."""
+    if not _NAME_RE.match(name):
+        raise TokenStoreError(f"invalid token name {name!r}")
+    data = yaml.safe_load(path.read_text(encoding="utf-8")) if path.is_file() else None
+    entries = list((data or {}).get("tokens", []))
+    if any(e.get("name") == name for e in entries):
+        raise TokenStoreError(f"a token named {name!r} already exists")
+    token = new_token()
+    entries.append({"name": name, "sha256": digest(token)})
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(yaml.safe_dump({"tokens": entries}, sort_keys=False), encoding="utf-8")
+    path.chmod(0o600)
+    return token
+
+
+class HashedTokenVerifier(TokenVerifier):
+    def __init__(self, store: TokenStore) -> None:
+        super().__init__()
+        self._store = store
+
+    async def verify_token(self, token: str) -> AccessToken | None:
+        name = self._store.by_digest.get(digest(token))
+        if name is None:
+            return None
+        return AccessToken(token=token, client_id=name, scopes=[], claims={"sub": name})

mindyard/cli.py

@@ -0,0 +1,132 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+"""The ``mindyard`` command line: init, serve, lint, token."""
+
+from __future__ import annotations
+
+import argparse
+import os
+import sys
+from collections.abc import Sequence
+from pathlib import Path
+
+from mindyard import __version__
+
+
+def _cmd_init(args: argparse.Namespace) -> int:
+    from mindyard.init import InitError, init_vault
+
+    target = Path(args.directory)
+    label = args.label or target.name.replace("-", " ").capitalize()
+    try:
+        init_vault(target, label, "demo" if args.demo else "blank")
+    except InitError as exc:
+        print(f"mindyard init: {exc}", file=sys.stderr)
+        return 2
+    print(f"Vault created in {target}. Edit wiki.yaml and schema.md to make it yours.")
+    return 0
+
+
+def _cmd_serve(args: argparse.Namespace) -> int:
+    from mindyard.mcp import run
+    from mindyard.settings import Settings, SettingsError
+    from mindyard.tenancy import TenantConfigError
+
+    env = dict(os.environ)
+    for flag, name in (
+        ("data_root", "MINDYARD_DATA_ROOT"),
+        ("host", "MINDYARD_HOST"),
+        ("port", "MINDYARD_PORT"),
+    ):
+        value = getattr(args, flag)
+        if value is not None:
+            env[name] = str(value)
+    try:
+        run(Settings.from_env(env))
+    except (SettingsError, TenantConfigError) as exc:
+        print(f"mindyard serve: {exc}", file=sys.stderr)
+        return 2
+    return 0
+
+
+def _cmd_lint(args: argparse.Namespace) -> int:
+    from mindyard.core.config import CONFIG_FILE
+    from mindyard.lint import fix_table_pipes, lint_wiki, write_report
+    from mindyard.schema import ManifestError, Wiki, load_manifest
+
+    root = Path(args.vault).resolve()
+    if not (root / CONFIG_FILE).is_file():
+        print(f"mindyard lint: no {CONFIG_FILE} in {root}", file=sys.stderr)
+        return 2
+    try:
+        manifest = load_manifest(root)
+    except ManifestError as exc:
+        print(f"mindyard lint: {exc}", file=sys.stderr)
+        return 2
+    wiki = Wiki(manifest.to_config(root.name, root), manifest)
+    if args.fix:
+        for page, count in fix_table_pipes(wiki):
+            print(f"fixed {count} table pipe(s) in {page}")
+    findings = lint_wiki(wiki)
+    report = write_report(wiki, findings)
+    print(f"{findings.total} issue(s), {len(findings.items) - findings.total} notice(s): {report}")
+    return 1 if findings.total else 0
+
+
+def _cmd_token(args: argparse.Namespace) -> int:
+    from mindyard.auth import TokenStoreError, add_token
+
+    data_root = args.data_root or os.environ.get("MINDYARD_DATA_ROOT")
+    if not data_root:
+        print("mindyard token: set MINDYARD_DATA_ROOT or pass --data-root", file=sys.stderr)
+        return 2
+    try:
+        token = add_token(Path(data_root) / "tokens.yaml", args.name)
+    except TokenStoreError as exc:
+        print(f"mindyard token: {exc}", file=sys.stderr)
+        return 2
+    print(token)
+    print(
+        "Shown once: only its digest is stored. Restart the server to load it.",
+        file=sys.stderr,
+    )
+    return 0
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="mindyard", description=__doc__)
+    parser.add_argument("--version", action="version", version=f"mindyard {__version__}")
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    p = sub.add_parser("init", help="create a vault")
+    p.add_argument("directory")
+    p.add_argument("--label", help="display name (default: from the directory name)")
+    p.add_argument("--demo", action="store_true", help="start from the demo garden vault")
+    p.set_defaults(func=_cmd_init)
+
+    p = sub.add_parser("serve", help="run the MCP server (configured by MINDYARD_* variables)")
+    p.add_argument("--data-root")
+    p.add_argument("--host")
+    p.add_argument("--port", type=int)
+    p.set_defaults(func=_cmd_serve)
+
+    p = sub.add_parser("lint", help="lint one vault and write its LINT_REPORT.md")
+    p.add_argument("vault")
+    p.add_argument("--fix", action="store_true", help="escape table-cell wikilink pipes first")
+    p.set_defaults(func=_cmd_lint)
+
+    p = sub.add_parser("token", help="mint a bearer token")
+    p.add_argument("action", choices=["new"])
+    p.add_argument("name", help="principal name, e.g. laptop")
+    p.add_argument("--data-root")
+    p.set_defaults(func=_cmd_token)
+    return parser
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    code: int = args.func(args)
+    return code
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

mindyard/core/config.py

@@ -0,0 +1,66 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+"""Resolved, immutable configuration of one wiki, as the core sees it.
+
+The core never parses configuration files: ``mindyard.schema`` turns a vault's
+``wiki.yaml`` into a :class:`WikiConfig`, and the tenancy layer hands the core a
+:class:`WikiSet` already scoped to the caller. Nothing in ``mindyard.core`` knows
+where a wiki came from or whom it belongs to.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterator, Mapping
+from dataclasses import dataclass
+from pathlib import Path
+
+from .errors import UnknownWikiError
+
+CONFIG_FILE = "wiki.yaml"
+
+
+@dataclass(frozen=True)
+class WikiConfig:
+    """Layout of a single wiki vault.
+
+    ``index_file``, ``log_file`` and ``schema_file`` are the only root files the
+    write path may touch. ``config_file`` (``wiki.yaml``) is deliberately not one
+    of them: the model must not be able to rewrite the rules that bind it.
+    """
+
+    id: str
+    root: Path
+    label: str
+    description: str = ""
+    wiki_dir: str = "wiki"
+    raw_dir: str = "raw"
+    index_file: str = "index.md"
+    log_file: str = "log.md"
+    schema_file: str = "schema.md"
+    lint_report_file: str = "LINT_REPORT.md"
+    log_sentinel: str = "<!-- log-end -->"
+
+
+class WikiSet(Mapping[str, WikiConfig]):
+    """The wikis visible to one caller, keyed by id.
+
+    :meth:`get_wiki` is the single validation gate for a ``wiki`` argument. The
+    error lists only the ids of this set, so it never reveals another tenant's.
+    """
+
+    def __init__(self, wikis: Mapping[str, WikiConfig]) -> None:
+        self._wikis = dict(wikis)
+
+    def __getitem__(self, key: str) -> WikiConfig:
+        return self._wikis[key]
+
+    def __iter__(self) -> Iterator[str]:
+        return iter(self._wikis)
+
+    def __len__(self) -> int:
+        return len(self._wikis)
+
+    def get_wiki(self, wiki_id: str) -> WikiConfig:
+        try:
+            return self._wikis[wiki_id]
+        except KeyError:
+            raise UnknownWikiError(wiki_id, list(self._wikis)) from None