phlo-oauth2-proxy 0.2.0__tar.gz

phlo_oauth2_proxy-0.2.0/PKG-INFO

@@ -0,0 +1,15 @@
+Metadata-Version: 2.4
+Name: phlo-oauth2-proxy
+Version: 0.2.0
+Summary: oauth2-proxy service plugin for Phlo
+Author-email: Phlo Team <team@phlo.dev>
+License: MIT
+Requires-Python: >=3.11
+Description-Content-Type: text/plain
+Requires-Dist: phlo>=0.1.0
+Requires-Dist: pyyaml>=6.0.1
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == "dev"
+Requires-Dist: ruff>=0.1.0; extra == "dev"
+
+oauth2-proxy authentication gateway service plugin for Phlo.

phlo_oauth2_proxy-0.2.0/README.md

@@ -0,0 +1,26 @@
+# phlo-oauth2-proxy
+
+OAuth2/OIDC authentication proxy for Phlo services.
+
+Provides a forward-auth gateway using [oauth2-proxy](https://oauth2-proxy.github.io/oauth2-proxy/).
+When paired with `phlo-traefik`, protects `phlo-api` (and optionally other surfaces)
+behind SSO authentication.
+
+## Quick Start
+
+1. Configure your IdP credentials in `.phlo/.env.local`:
+
+   ```env
+   OAUTH2_PROXY_OIDC_ISSUER_URL=https://your-idp.example.com
+   OAUTH2_PROXY_CLIENT_ID=your-client-id
+   OAUTH2_PROXY_CLIENT_SECRET=your-client-secret
+   OAUTH2_PROXY_COOKIE_SECRET=$(python -c "import secrets; print(secrets.token_urlsafe(32))")
+   ```
+
+2. Start with the proxy profile:
+
+   ```bash
+   phlo services start --profile proxy
+   ```
+
+See `docs/setup/security.md` for the full operator walkthrough.

phlo_oauth2_proxy-0.2.0/pyproject.toml

@@ -0,0 +1,52 @@
+[build-system]
+build-backend = "setuptools.build_meta"
+requires = [
+    "setuptools>=45",
+    "wheel",
+]
+
+[project]
+dependencies = [
+    "phlo>=0.1.0",
+    "pyyaml>=6.0.1",
+]
+description = "oauth2-proxy service plugin for Phlo"
+name = "phlo-oauth2-proxy"
+requires-python = ">=3.11"
+version = "0.2.0"
+
+[[project.authors]]
+email = "team@phlo.dev"
+name = "Phlo Team"
+
+[project.entry-points."phlo.plugins.services"]
+oauth2-proxy = "phlo_oauth2_proxy.plugin:Oauth2ProxyServicePlugin"
+
+[project.license]
+text = "MIT"
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=7.0",
+    "ruff>=0.1.0",
+]
+
+[project.readme]
+content-type = "text/plain"
+text = "oauth2-proxy authentication gateway service plugin for Phlo."
+
+[tool.ruff]
+line-length = 100
+target-version = "py311"
+
+[tool.setuptools]
+include-package-data = true
+
+[tool.setuptools.package-data]
+phlo_oauth2_proxy = ["service.yaml"]
+
+[tool.setuptools.package-dir]
+"" = "src"
+
+[tool.setuptools.packages.find]
+where = ["src"]

phlo_oauth2_proxy-0.2.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

phlo_oauth2_proxy-0.2.0/src/phlo_oauth2_proxy/__init__.py

@@ -0,0 +1 @@
+"""oauth2-proxy authentication gateway for Phlo."""

phlo_oauth2_proxy-0.2.0/src/phlo_oauth2_proxy/plugin.py

@@ -0,0 +1,51 @@
+"""oauth2-proxy service plugin implementation."""
+
+from __future__ import annotations
+
+from phlo.plugins import PackageYamlServicePlugin, PluginMetadata
+
+
+class Oauth2ProxyServicePlugin(PackageYamlServicePlugin):
+    """Service plugin for oauth2-proxy authentication gateway.
+
+    This plugin provides integration with oauth2-proxy, an OAuth2/OIDC
+    authentication proxy that implements forward-auth with Traefik.
+    It reads service configuration from a bundled service.yaml file
+    and exposes standard Phlo plugin metadata.
+
+    Attributes:
+        None
+
+    Example:
+        >>> plugin = Oauth2ProxyServicePlugin()
+        >>> metadata = plugin.metadata
+        >>> print(metadata.name, metadata.version)
+        oauth2-proxy 0.1.0
+        >>> definition = plugin.service_definition
+
+    """
+
+    @property
+    def metadata(self) -> PluginMetadata:
+        """Return plugin metadata for the oauth2-proxy service.
+
+        Returns:
+            PluginMetadata: Plugin metadata containing name, version,
+                description, author, and tags.
+
+        Example:
+            >>> plugin = Oauth2ProxyServicePlugin()
+            >>> meta = plugin.metadata
+            >>> meta.name
+            'oauth2-proxy'
+            >>> meta.tags
+            ['auth', 'proxy', 'oidc']
+
+        """
+        return PluginMetadata(
+            name="oauth2-proxy",
+            version="0.1.0",
+            description="OAuth2/OIDC authentication proxy for Phlo services",
+            author="Phlo Team",
+            tags=["auth", "proxy", "oidc"],
+        )

phlo_oauth2_proxy-0.2.0/src/phlo_oauth2_proxy/service.yaml

@@ -0,0 +1,63 @@
+name: oauth2-proxy
+description: OAuth2/OIDC authentication proxy for forward-auth with Traefik
+category: auth
+default: false
+profile: proxy
+
+image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1
+
+compose:
+  restart: unless-stopped
+  labels:
+    phlo.metrics.enabled: "false"
+  environment:
+    OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:4180"
+    OAUTH2_PROXY_REVERSE_PROXY: "true"
+    OAUTH2_PROXY_SET_XAUTHREQUEST: "true"
+    OAUTH2_PROXY_PASS_ACCESS_TOKEN: "false"
+    OAUTH2_PROXY_PROVIDER: "${OAUTH2_PROXY_PROVIDER:-oidc}"
+    OAUTH2_PROXY_OIDC_ISSUER_URL: "${OAUTH2_PROXY_OIDC_ISSUER_URL}"
+    OAUTH2_PROXY_CLIENT_ID: "${OAUTH2_PROXY_CLIENT_ID}"
+    OAUTH2_PROXY_CLIENT_SECRET: "${OAUTH2_PROXY_CLIENT_SECRET}"
+    OAUTH2_PROXY_COOKIE_SECRET: "${OAUTH2_PROXY_COOKIE_SECRET}"
+    OAUTH2_PROXY_COOKIE_SECURE: "${OAUTH2_PROXY_COOKIE_SECURE:-false}"
+    OAUTH2_PROXY_REDIRECT_URL: "${OAUTH2_PROXY_REDIRECT_URL:-http://api.phlo.localhost/oauth2/callback}"
+    OAUTH2_PROXY_EMAIL_DOMAINS: "${OAUTH2_PROXY_EMAIL_DOMAINS:-*}"
+    OAUTH2_PROXY_UPSTREAMS: "static://202"
+    OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
+  healthcheck:
+    test:
+      [
+        "CMD",
+        "wget",
+        "--quiet",
+        "--tries=1",
+        "--spider",
+        "http://127.0.0.1:4180/ping",
+      ]
+    interval: 30s
+    timeout: 5s
+    retries: 3
+    start_period: 10s
+
+env_vars:
+  OAUTH2_PROXY_PROVIDER:
+    default: oidc
+    description: OAuth2 provider type (oidc, google, github, etc.)
+  OAUTH2_PROXY_OIDC_ISSUER_URL:
+    description: OIDC issuer URL (e.g., https://accounts.google.com)
+  OAUTH2_PROXY_CLIENT_ID:
+    description: OAuth2 client ID from your identity provider
+  OAUTH2_PROXY_CLIENT_SECRET:
+    description: OAuth2 client secret (store in .phlo/.env.local)
+  OAUTH2_PROXY_COOKIE_SECRET:
+    description: Random 32-byte base64 string for cookie encryption (generate with python -c "import secrets; print(secrets.token_urlsafe(32))")
+  OAUTH2_PROXY_COOKIE_SECURE:
+    default: "false"
+    description: Set to true when using HTTPS
+  OAUTH2_PROXY_REDIRECT_URL:
+    default: http://api.phlo.localhost/oauth2/callback
+    description: OAuth2 callback URL (must match IdP config)
+  OAUTH2_PROXY_EMAIL_DOMAINS:
+    default: "*"
+    description: Comma-separated list of allowed email domains (use * for any)

phlo_oauth2_proxy-0.2.0/src/phlo_oauth2_proxy.egg-info/PKG-INFO

@@ -0,0 +1,15 @@
+Metadata-Version: 2.4
+Name: phlo-oauth2-proxy
+Version: 0.2.0
+Summary: oauth2-proxy service plugin for Phlo
+Author-email: Phlo Team <team@phlo.dev>
+License: MIT
+Requires-Python: >=3.11
+Description-Content-Type: text/plain
+Requires-Dist: phlo>=0.1.0
+Requires-Dist: pyyaml>=6.0.1
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == "dev"
+Requires-Dist: ruff>=0.1.0; extra == "dev"
+
+oauth2-proxy authentication gateway service plugin for Phlo.

phlo_oauth2_proxy-0.2.0/src/phlo_oauth2_proxy.egg-info/SOURCES.txt

@@ -0,0 +1,12 @@
+README.md
+pyproject.toml
+src/phlo_oauth2_proxy/__init__.py
+src/phlo_oauth2_proxy/plugin.py
+src/phlo_oauth2_proxy/service.yaml
+src/phlo_oauth2_proxy.egg-info/PKG-INFO
+src/phlo_oauth2_proxy.egg-info/SOURCES.txt
+src/phlo_oauth2_proxy.egg-info/dependency_links.txt
+src/phlo_oauth2_proxy.egg-info/entry_points.txt
+src/phlo_oauth2_proxy.egg-info/requires.txt
+src/phlo_oauth2_proxy.egg-info/top_level.txt
+tests/test_oauth2_proxy_plugin.py

phlo_oauth2_proxy-0.2.0/src/phlo_oauth2_proxy.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

phlo_oauth2_proxy-0.2.0/src/phlo_oauth2_proxy.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[phlo.plugins.services]
+oauth2-proxy = phlo_oauth2_proxy.plugin:Oauth2ProxyServicePlugin

phlo_oauth2_proxy-0.2.0/src/phlo_oauth2_proxy.egg-info/requires.txt

@@ -0,0 +1,6 @@
+phlo>=0.1.0
+pyyaml>=6.0.1
+
+[dev]
+pytest>=7.0
+ruff>=0.1.0

phlo_oauth2_proxy-0.2.0/src/phlo_oauth2_proxy.egg-info/top_level.txt

@@ -0,0 +1 @@
+phlo_oauth2_proxy

phlo_oauth2_proxy-0.2.0/tests/test_oauth2_proxy_plugin.py

@@ -0,0 +1,42 @@
+"""Tests for oauth2-proxy service plugin."""
+
+from phlo_oauth2_proxy.plugin import Oauth2ProxyServicePlugin
+
+
+def test_oauth2_proxy_service_definition():
+    """Validate oauth2-proxy service metadata in compose definition."""
+    plugin = Oauth2ProxyServicePlugin()
+    defn = plugin.service_definition
+
+    assert defn["name"] == "oauth2-proxy"
+    assert defn["category"] == "auth"
+    assert defn["default"] is False
+    assert defn["profile"] == "proxy"
+
+
+def test_oauth2_proxy_plugin_metadata():
+    """Validate oauth2-proxy plugin metadata tags and name."""
+    plugin = Oauth2ProxyServicePlugin()
+    meta = plugin.metadata
+
+    assert meta.name == "oauth2-proxy"
+    assert "auth" in meta.tags
+    assert "oidc" in meta.tags
+
+
+def test_oauth2_proxy_not_publicly_routed():
+    """Verify oauth2-proxy has no traefik.enable label (internal only)."""
+    plugin = Oauth2ProxyServicePlugin()
+    defn = plugin.service_definition
+    labels = defn.get("compose", {}).get("labels", {})
+
+    assert labels.get("traefik.enable") != "true"
+
+
+def test_oauth2_proxy_image_pinned():
+    """Verify oauth2-proxy uses a pinned image version."""
+    plugin = Oauth2ProxyServicePlugin()
+    defn = plugin.service_definition
+
+    assert "oauth2-proxy" in defn["image"]
+    assert ":" in defn["image"], "Image must be version-pinned"