pkg-auth 3.1.0__tar.gz → 3.2.0__tar.gz

{pkg_auth-3.1.0 → pkg_auth-3.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pkg-auth
-Version: 3.1.0
+Version: 3.2.0
 Summary: Clean-architecture auth core for multiple Python frameworks
 Author-email: Fritill <info@fritill.ae>
 License: MIT
@@ -19,7 +19,7 @@ Requires-Dist: types-requests<3.0.0.0,>=2.32.0.0; extra == "dev"
 Requires-Dist: types-PyJWT<2.0.0,>=1.7.0; extra == "dev"
 Requires-Dist: testcontainers[postgres,redis]>=4.0; extra == "dev"
 Provides-Extra: acl-sqlalchemy
-Requires-Dist: sqlalchemy<3.0,>=2.0; extra == "acl-sqlalchemy"
+Requires-Dist: sqlalchemy[asyncio]<3.0,>=2.0; extra == "acl-sqlalchemy"
 Requires-Dist: asyncpg>=0.29; extra == "acl-sqlalchemy"
 Requires-Dist: alembic>=1.13; extra == "acl-sqlalchemy"
 Provides-Extra: acl-django
@@ -41,7 +41,7 @@ Requires-Dist: starlette>=0.37; extra == "all"
 Requires-Dist: django>=4.2; extra == "all"
 Requires-Dist: psycopg[binary]>=3.1; extra == "all"
 Requires-Dist: strawberry-graphql>=0.255; extra == "all"
-Requires-Dist: sqlalchemy<3.0,>=2.0; extra == "all"
+Requires-Dist: sqlalchemy[asyncio]<3.0,>=2.0; extra == "all"
 Requires-Dist: asyncpg>=0.29; extra == "all"
 Requires-Dist: alembic>=1.13; extra == "all"
 Requires-Dist: redis>=5.0; extra == "all"

{pkg_auth-3.1.0 → pkg_auth-3.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pkg-auth"
-version = "3.1.0"
+version = "3.2.0"
 description = "Clean-architecture auth core for multiple Python frameworks"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -33,7 +33,7 @@ dev = [
 
 # ACL storage backends (v1.0)
 acl-sqlalchemy = [
-    "sqlalchemy>=2.0,<3.0",
+    "sqlalchemy[asyncio]>=2.0,<3.0",
     "asyncpg>=0.29",
     "alembic>=1.13",
 ]
@@ -67,7 +67,7 @@ all = [
     "django>=4.2",
     "psycopg[binary]>=3.1",
     "strawberry-graphql>=0.255",
-    "sqlalchemy>=2.0,<3.0",
+    "sqlalchemy[asyncio]>=2.0,<3.0",
     "asyncpg>=0.29",
     "alembic>=1.13",
     "redis>=5.0",

{pkg_auth-3.1.0 → pkg_auth-3.2.0}/src/pkg_auth/__init__.py

@@ -10,6 +10,6 @@ Authorization (ACL) and framework integrations (FastAPI, Django,
 Strawberry) are available via sub-packages.
 """
 
-__version__ = "2.1.0"
+__version__ = "3.2.0"
 
 __all__ = ["__version__"]

{pkg_auth-3.1.0 → pkg_auth-3.2.0}/src/pkg_auth/authorization/__init__.py

@@ -8,7 +8,7 @@ Public API:
                      MembershipRepository, PermissionCatalogRepository
     Exceptions:      AuthorizationError, NotAMember, MissingPermission,
                      UnknownOrganization, UnknownUser, UnknownRole,
-                     UserNotProvisioned
+                     UserNotProvisioned, DelegationRefused, DelegationRefusal
 
 The application layer (use cases) is added in M3; SQLAlchemy / Django ORM
 adapters in M4 / M6; cache layer in M5; framework integrations in M7-M9.
@@ -34,6 +34,8 @@ from .domain.entities import (
 from .platform import is_platform_context
 from .domain.exceptions import (
     AuthorizationError,
+    DelegationRefusal,
+    DelegationRefused,
     MissingPermission,
     NotAMember,
     PermissionVisibilityConflict,
@@ -118,4 +120,6 @@ __all__ = [
     "ServiceNotEnabled",
     "PermissionVisibilityConflict",
     "UserNotProvisioned",
+    "DelegationRefused",
+    "DelegationRefusal",
 ]

pkg_auth-3.2.0/src/pkg_auth/authorization/application/use_cases/resolve_delegated_auth_context.py

@@ -0,0 +1,169 @@
+"""Resolve a delegated (on-behalf-of) :class:`AuthContext` (``auth:AD-1``)."""
+from __future__ import annotations
+
+from collections.abc import Iterable, Mapping, Sequence
+from dataclasses import dataclass, field, replace
+from types import MappingProxyType
+from typing import Any
+from uuid import UUID
+
+from ...domain.entities import AuthContext, Organization, User
+from ...domain.exceptions import (
+    DelegationRefusal,
+    DelegationRefused,
+    NotAMember,
+)
+from ...domain.ports import OrganizationRepository, UserRepository
+from ...domain.value_objects import OrgId
+from .resolve_auth_context import ResolveAuthContextUseCase
+
+Delegators = Mapping[str, frozenset[OrgId]]
+
+ON_BEHALF_OF_HEADER = "X-On-Behalf-Of"
+
+
+async def find_organization(
+    repo: OrganizationRepository, raw: str
+) -> Organization | None:
+    """Look up an org from a raw ``X-Organization-Id`` value.
+
+    Tries ``raw`` as a UUID first and falls back to a slug lookup. The one
+    lookup rule shared by the FastAPI dependency and the delegated use case,
+    so the two cannot drift.
+    """
+    try:
+        org_id = OrgId(UUID(raw))
+    except ValueError:
+        return await repo.get_by_slug(raw)
+    return await repo.get(org_id)
+
+
+def _to_org_id(raw: Any, sub: str) -> OrgId:
+    if isinstance(raw, OrgId):
+        return raw
+    if isinstance(raw, UUID):
+        return OrgId(raw)
+    if isinstance(raw, str):
+        try:
+            return OrgId(UUID(raw))
+        except ValueError:
+            pass
+    raise ValueError(
+        f"delegators[{sub!r}]: organization {raw!r} is not a UUID"
+    )
+
+
+def normalize_delegators(
+    raw: Mapping[str, Iterable[Any]] | None,
+) -> MappingProxyType[str, frozenset[OrgId]]:
+    """Normalize a ``delegators`` config into an immutable allowlist.
+
+    Keys are Keycloak service-account ``sub`` strings, kept exactly as
+    given. Values are iterables of org ids (``OrgId``, ``UUID`` or UUID
+    strings). ``None`` or an empty mapping yields an empty map, so nobody
+    delegates (fail closed); a ``sub`` with no orgs is dropped, so it is
+    refused as not a delegator before any lookup.
+
+    Raises :class:`ValueError` when ``raw`` is a bare ``str`` or not a
+    mapping, a ``sub`` is not a non-blank, unpadded ``str``, a value is a bare
+    ``str`` or not iterable, or an org is not a UUID.
+    """
+    if raw is None:
+        return MappingProxyType({})
+    if isinstance(raw, (str, bytes)) or not isinstance(raw, Mapping):
+        raise ValueError(
+            f"delegators must be a mapping of sub -> org ids, got {type(raw).__name__}"
+        )
+    normalized: dict[str, frozenset[OrgId]] = {}
+    for sub, orgs in raw.items():
+        if not isinstance(sub, str) or not sub.strip() or sub != sub.strip():
+            raise ValueError(f"delegators: blank, padded or non-string sub {sub!r}")
+        if isinstance(orgs, (str, bytes)):
+            raise ValueError(
+                f"delegators[{sub!r}] must be a collection of org ids, not a bare string"
+            )
+        try:
+            items = list(orgs)
+        except TypeError as exc:
+            raise ValueError(
+                f"delegators[{sub!r}] must be a collection of org ids"
+            ) from exc
+        org_ids = frozenset(_to_org_id(o, sub) for o in items)
+        if org_ids:  # an agent with no orgs is not a delegator at all
+            normalized[sub] = org_ids
+    return MappingProxyType(normalized)
+
+
+@dataclass(slots=True)
+class ResolveDelegatedAuthContextUseCase:
+    """Decide a delegated request and return the target's :class:`AuthContext`.
+
+    The single framework-free place that holds ``delegators`` (``auth:AD-1``
+    Placement). Integrations pass the raw ``X-On-Behalf-Of`` values and the
+    raw ``X-Organization-Id`` value; they never see the allowlist.
+
+    Checks run in ``auth:AD-1``'s order (rows 3–9), first match wins, and
+    every refusal is a :class:`DelegationRefused`. The target is looked up
+    read-only through ``UserRepository.get_by_keycloak_sub`` — delegation
+    never creates a user. On success the result is the target's own
+    context from ``resolve_use_case`` (same service guard, same cache
+    entry) with ``acted_by`` attached afterwards; the caller's perms are
+    never used.
+    """
+
+    resolve_use_case: ResolveAuthContextUseCase
+    user_repo: UserRepository
+    organization_repo: OrganizationRepository
+    delegators: Delegators | None = field(default=None)
+
+    def __post_init__(self) -> None:
+        self.delegators = normalize_delegators(self.delegators)
+
+    async def execute(
+        self,
+        *,
+        caller: User,
+        on_behalf_of: Sequence[str],
+        organization: str,
+    ) -> AuthContext:
+        if isinstance(on_behalf_of, (str, bytes)):
+            raise TypeError("on_behalf_of must be the header's list of values")
+        if len(on_behalf_of) == 0:
+            raise ValueError("on_behalf_of is empty; only call when the header is present")
+
+        # Row 3: repeated header.
+        if len(on_behalf_of) > 1:
+            raise DelegationRefused(DelegationRefusal.REPEATED)
+
+        # Row 4: caller not a delegator — before any lookup.
+        assert self.delegators is not None
+        allowed_orgs = self.delegators.get(caller.keycloak_sub)
+        if allowed_orgs is None:
+            raise DelegationRefused(DelegationRefusal.NOT_A_DELEGATOR)
+
+        # Row 5: empty value.
+        target_sub = on_behalf_of[0]
+        if not target_sub.strip():
+            raise DelegationRefused(DelegationRefusal.EMPTY_TARGET)
+
+        # Row 6: unknown org (UUID first, then slug).
+        org = await find_organization(self.organization_repo, organization)
+        if org is None:
+            raise DelegationRefused(DelegationRefusal.UNKNOWN_ORGANIZATION)
+
+        # Row 7: org not on this agent's list (no platform-org bypass).
+        if org.id not in allowed_orgs:
+            raise DelegationRefused(DelegationRefusal.ORGANIZATION_NOT_ALLOWED)
+
+        # Row 8: target not provisioned — read-only lookup, never upsert.
+        target = await self.user_repo.get_by_keycloak_sub(target_sub)
+        if target is None:
+            raise DelegationRefused(DelegationRefusal.TARGET_NOT_PROVISIONED)
+
+        # Row 9: target not a member.
+        try:
+            ctx = await self.resolve_use_case.execute(target.id, org.id)
+        except NotAMember as exc:
+            raise DelegationRefused(DelegationRefusal.TARGET_NOT_A_MEMBER) from exc
+
+        return replace(ctx, acted_by=caller.id)

{pkg_auth-3.1.0 → pkg_auth-3.2.0}/src/pkg_auth/authorization/domain/entities.py

@@ -163,12 +163,19 @@ class AuthContext:
     services cache their platform org's id at startup and call
     :func:`pkg_auth.authorization.is_platform_context` to compare against
     ``self.organization_id``. See the package docs for the pattern.
+
+    ``acted_by`` is **attribution only**. On a delegated (on-behalf-of)
+    request ``user_id`` is the target user — the acting principal for
+    authorization and ownership — and ``acted_by`` is the caller's ACL id;
+    it is ``None`` otherwise. It never grants or removes a permission, and
+    the cache serializer deliberately excludes it (``auth:AD-1``).
     """
 
     user_id: UserId
     organization_id: OrgId
     role_names: frozenset[str]
     perms: frozenset[str]
+    acted_by: UserId | None = None
 
     def has(self, perm: str) -> bool:
         """Return ``True`` if any of the user's roles grant ``perm``."""

{pkg_auth-3.1.0 → pkg_auth-3.2.0}/src/pkg_auth/authorization/domain/exceptions.py

@@ -7,6 +7,8 @@ each to the right HTTP status.
 """
 from __future__ import annotations
 
+from enum import Enum
+
 
 class AuthorizationError(Exception):
     """Base for all authorization (ACL) failures."""
@@ -66,3 +68,37 @@ class ServiceNotSaaSAvailable(AuthorizationError):
 
 class ServiceNotEnabled(AuthorizationError):
     """The organization does not have the required service enabled."""
+
+
+class DelegationRefusal(str, Enum):
+    """Why a delegated (on-behalf-of) request was refused.
+
+    One member per row 3–9 of ``auth:AD-1``'s order of checks. Integration
+    layers map ``REPEATED`` and ``EMPTY_TARGET`` to 400,
+    ``UNKNOWN_ORGANIZATION`` to 404, and every other reason to 403.
+    """
+
+    REPEATED = "repeated"
+    NOT_A_DELEGATOR = "not_a_delegator"
+    EMPTY_TARGET = "empty_target"
+    UNKNOWN_ORGANIZATION = "unknown_organization"
+    ORGANIZATION_NOT_ALLOWED = "organization_not_allowed"
+    TARGET_NOT_PROVISIONED = "target_not_provisioned"
+    TARGET_NOT_A_MEMBER = "target_not_a_member"
+
+    def __str__(self) -> str:
+        return self.value
+
+
+class DelegationRefused(AuthorizationError):
+    """A delegated request was refused; ``reason`` says which check failed.
+
+    The only error :class:`ResolveDelegatedAuthContextUseCase` raises for a
+    refusal — never :class:`NotAMember` or :class:`UserNotProvisioned`, so
+    no integration can mistake a refused delegation for the caller's own
+    failure and fall back to the caller's context.
+    """
+
+    def __init__(self, reason: DelegationRefusal, detail: str | None = None) -> None:
+        self.reason = reason
+        super().__init__(detail or f"delegation refused: {reason.value}")

{pkg_auth-3.1.0 → pkg_auth-3.2.0}/src/pkg_auth/integrations/django/auth_context_middleware.py

@@ -13,6 +13,9 @@ from ...authorization import (
     UnknownOrganization,
     UserNotProvisioned,
 )
+from ...authorization.application.use_cases.resolve_delegated_auth_context import (
+    ON_BEHALF_OF_HEADER,
+)
 from ...authorization.domain.entities import User
 from .install import get_registry
 
@@ -23,6 +26,9 @@ class AuthContextMiddleware:
     Requires ``IdentityMiddleware`` to run first so ``request.identity``
     is populated. Behavior:
 
+        - ``X-On-Behalf-Of`` present (any value, with or without the org
+          header or an identity) → 403; this middleware cannot delegate
+          (``auth:AD-1``)
         - no header → ``request.auth_context = None`` (route decides)
         - identity is None and header present → 401
         - org not found → 404
@@ -53,8 +59,14 @@ class AuthContextMiddleware:
             )
 
     async def __call__(self, request: HttpRequest) -> HttpResponse:
-        registry = get_registry()
         request.auth_context = None  # type: ignore[attr-defined]
+        if request.headers.get(ON_BEHALF_OF_HEADER) is not None:
+            return JsonResponse(
+                {"detail": f"{ON_BEHALF_OF_HEADER} is not accepted here"},
+                status=403,
+            )
+
+        registry = get_registry()
 
         raw = request.headers.get(registry.header_name)
         if raw is None:

{pkg_auth-3.1.0 → pkg_auth-3.2.0}/src/pkg_auth/integrations/fastapi/__init__.py

@@ -10,7 +10,8 @@ except ImportError as exc:  # pragma: no cover
     ) from exc
 
 from .auth_factory import Authentication, create_authentication
-from .auth_context_dep import make_get_auth_context
+from .auth_context_dep import ON_BEHALF_OF_HEADER, make_get_auth_context
+from .current_user_dep import make_get_current_user
 from .decorators import require_permission
 from .errors import install_exception_handlers
 from .identity_dep import bearer_scheme, extract_token_from_request
@@ -19,6 +20,8 @@ __all__ = [
     "Authentication",
     "create_authentication",
     "make_get_auth_context",
+    "make_get_current_user",
+    "ON_BEHALF_OF_HEADER",
     "require_permission",
     "install_exception_handlers",
     "bearer_scheme",

{pkg_auth-3.1.0 → pkg_auth-3.2.0}/src/pkg_auth/integrations/fastapi/auth_context_dep.py

@@ -31,21 +31,26 @@ pattern.
 from __future__ import annotations
 
 from typing import Awaitable, Callable
-from uuid import UUID
 
 from fastapi import Depends, HTTPException, Request, status
 
 from ...authentication import IdentityContext
 from ...authorization import (
     AuthContext,
+    DelegationRefusal,
+    DelegationRefused,
     NotAMember,
-    OrgId,
     UnknownOrganization,
     UserNotProvisioned,
 )
 from ...authorization.application.use_cases.resolve_auth_context import (
     ResolveAuthContextUseCase,
 )
+from ...authorization.application.use_cases.resolve_delegated_auth_context import (
+    ON_BEHALF_OF_HEADER,
+    ResolveDelegatedAuthContextUseCase,
+    find_organization,
+)
 from ...authorization.application.use_cases.resolve_user_from_jwt import (
     ResolveUserFromJwtUseCase,
 )
@@ -57,6 +62,13 @@ from ...authorization.domain.ports import OrganizationRepository
 
 DEFAULT_HEADER_NAME = "X-Organization-Id"
 
+# Unlisted reasons fall through to 403, so a new reason fails closed.
+_REFUSAL_STATUS: dict[DelegationRefusal, int] = {
+    DelegationRefusal.REPEATED: status.HTTP_400_BAD_REQUEST,
+    DelegationRefusal.EMPTY_TARGET: status.HTTP_400_BAD_REQUEST,
+    DelegationRefusal.UNKNOWN_ORGANIZATION: status.HTTP_404_NOT_FOUND,
+}
+
 
 def make_get_auth_context(
     *,
@@ -66,6 +78,7 @@ def make_get_auth_context(
     sync_user_use_case: SyncUserFromJwtUseCase | None = None,
     resolve_user_use_case: ResolveUserFromJwtUseCase | None = None,
     header_name: str = DEFAULT_HEADER_NAME,
+    delegation: ResolveDelegatedAuthContextUseCase | None = None,
 ) -> Callable[..., Awaitable[tuple[IdentityContext, AuthContext]]]:
     """Build a FastAPI dependency returning ``(IdentityContext, AuthContext)``.
 
@@ -80,11 +93,21 @@ def make_get_auth_context(
            UUID first, falling back to a slug lookup.
         4. Resolves the user's auth context for that organization.
 
+    If the request carries ``X-On-Behalf-Of`` (checked only after steps 1
+    and 2, ``auth:AD-1``), steps 3–4 are replaced by ``delegation``: the
+    result is ``(caller's IdentityContext, target's AuthContext)`` with
+    ``acted_by`` set to the caller's ACL id. Without ``delegation`` the
+    header is refused with 403. A refusal never falls back to the
+    caller's own context.
+
     Errors map to:
         - missing header                → 400
         - unknown organization          → 404
         - user not a member             → 403
         - user not provisioned (Mode B) → 403
+        - ``X-On-Behalf-Of`` without ``delegation`` → 403
+        - delegation refused: repeated header or empty value → 400,
+          unknown organization → 404, any other reason → 403
     """
     if (sync_user_use_case is None) == (resolve_user_use_case is None):
         raise ValueError(
@@ -122,10 +145,27 @@ def make_get_auth_context(
                 detail=str(exc),
             ) from exc
 
-        try:
-            org = await organization_repo.get(OrgId(UUID(raw)))
-        except (ValueError, AttributeError):
-            org = await organization_repo.get_by_slug(raw)
+        on_behalf_of = request.headers.getlist(ON_BEHALF_OF_HEADER)
+        if on_behalf_of:
+            if delegation is None:
+                raise HTTPException(
+                    status_code=status.HTTP_403_FORBIDDEN,
+                    detail=f"{ON_BEHALF_OF_HEADER} is not accepted here",
+                )
+            try:
+                auth_ctx = await delegation.execute(
+                    caller=user, on_behalf_of=on_behalf_of, organization=raw
+                )
+            except DelegationRefused as exc:
+                raise HTTPException(
+                    status_code=_REFUSAL_STATUS.get(
+                        exc.reason, status.HTTP_403_FORBIDDEN
+                    ),
+                    detail=str(exc),
+                ) from exc
+            return identity, auth_ctx
+
+        org = await find_organization(organization_repo, raw)
         if org is None:
             raise HTTPException(
                 status_code=status.HTTP_404_NOT_FOUND,

pkg_auth-3.2.0/src/pkg_auth/integrations/fastapi/current_user_dep.py

@@ -0,0 +1,78 @@
+"""``make_get_current_user`` factory — the org-less ACL user dependency.
+
+Resolves the caller's ACL :class:`User` from the token alone, with no
+``X-Organization-Id``. It cannot delegate, so it refuses ``X-On-Behalf-Of``
+with 403 before any user work (``auth:AD-1`` Coverage).
+"""
+from __future__ import annotations
+
+from typing import Awaitable, Callable
+
+from fastapi import Depends, HTTPException, Request, status
+
+from ...authentication import IdentityContext
+from ...authorization import UserNotProvisioned
+from ...authorization.application.use_cases.resolve_delegated_auth_context import (
+    ON_BEHALF_OF_HEADER,
+)
+from ...authorization.application.use_cases.resolve_user_from_jwt import (
+    ResolveUserFromJwtUseCase,
+)
+from ...authorization.application.use_cases.sync_user_from_jwt import (
+    SyncUserFromJwtUseCase,
+)
+from ...authorization.domain.entities import User
+
+
+async def _refuse_on_behalf_of(request: Request) -> None:
+    # Declared before ``get_identity`` so FastAPI resolves it first: the
+    # header is refused even without a valid token.
+    if request.headers.getlist(ON_BEHALF_OF_HEADER):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=f"{ON_BEHALF_OF_HEADER} is not accepted here",
+        )
+
+
+def make_get_current_user(
+    *,
+    get_identity: Callable[..., Awaitable[IdentityContext]],
+    sync_user_use_case: SyncUserFromJwtUseCase | None = None,
+    resolve_user_use_case: ResolveUserFromJwtUseCase | None = None,
+) -> Callable[..., Awaitable[User]]:
+    """Build a FastAPI dependency returning the caller's ACL ``User``.
+
+    Exactly one of ``sync_user_use_case`` (Mode A — upserts the caller)
+    or ``resolve_user_use_case`` (Mode B — read-through) must be supplied.
+
+    Errors map to:
+        - ``X-On-Behalf-Of`` present (any value, any token) → 403
+        - no or invalid token                    → 401 (from ``get_identity``)
+        - user not provisioned (Mode B)          → 403
+    """
+    if (sync_user_use_case is None) == (resolve_user_use_case is None):
+        raise ValueError(
+            "make_get_current_user: pass exactly one of "
+            "sync_user_use_case (Mode A) or resolve_user_use_case (Mode B)."
+        )
+
+    async def dependency(
+        _: None = Depends(_refuse_on_behalf_of),
+        identity: IdentityContext = Depends(get_identity),
+    ) -> User:
+        try:
+            if sync_user_use_case is not None:
+                return await sync_user_use_case.execute(
+                    sub=identity.subject_str,
+                    email=identity.email_str or "",
+                    full_name=identity.full_name,
+                )
+            assert resolve_user_use_case is not None
+            return await resolve_user_use_case.execute(sub=identity.subject_str)
+        except UserNotProvisioned as exc:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail=str(exc),
+            ) from exc
+
+    return dependency

{pkg_auth-3.1.0 → pkg_auth-3.2.0}/src/pkg_auth/integrations/strawberry/auth.py

@@ -5,6 +5,7 @@ from dataclasses import dataclass, field
 from typing import Awaitable, Callable
 from uuid import UUID
 
+from starlette.exceptions import HTTPException
 from starlette.requests import Request
 
 from ...authentication import (
@@ -23,6 +24,9 @@ from ...authorization import (
 from ...authorization.application.use_cases.resolve_auth_context import (
     ResolveAuthContextUseCase,
 )
+from ...authorization.application.use_cases.resolve_delegated_auth_context import (
+    ON_BEHALF_OF_HEADER,
+)
 from ...authorization.application.use_cases.resolve_user_from_jwt import (
     ResolveUserFromJwtUseCase,
 )
@@ -80,6 +84,10 @@ def make_context_getter(
     rather than raising. Permission classes (``IsAuthenticated``,
     ``RequirePermission``) are responsible for rejecting under-privileged
     queries.
+
+    The one non-permissive case is ``X-On-Behalf-Of``: this integration
+    cannot delegate, so a request carrying it (any value, any token
+    state) is refused with HTTP 403 before any user work (``auth:AD-1``).
     """
     if (sync_user_use_case is None) == (resolve_user_use_case is None):
         raise ValueError(
@@ -88,6 +96,12 @@ def make_context_getter(
         )
 
     async def _context_getter(request: Request) -> StrawberryContext:
+        if request.headers.getlist(ON_BEHALF_OF_HEADER):
+            raise HTTPException(
+                status_code=403,
+                detail=f"{ON_BEHALF_OF_HEADER} is not accepted here",
+            )
+
         ctx = StrawberryContext(request=request)
 
         token = _extract_token(request, cookie_name)

{pkg_auth-3.1.0 → pkg_auth-3.2.0}/src/pkg_auth.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pkg-auth
-Version: 3.1.0
+Version: 3.2.0
 Summary: Clean-architecture auth core for multiple Python frameworks
 Author-email: Fritill <info@fritill.ae>
 License: MIT
@@ -19,7 +19,7 @@ Requires-Dist: types-requests<3.0.0.0,>=2.32.0.0; extra == "dev"
 Requires-Dist: types-PyJWT<2.0.0,>=1.7.0; extra == "dev"
 Requires-Dist: testcontainers[postgres,redis]>=4.0; extra == "dev"
 Provides-Extra: acl-sqlalchemy
-Requires-Dist: sqlalchemy<3.0,>=2.0; extra == "acl-sqlalchemy"
+Requires-Dist: sqlalchemy[asyncio]<3.0,>=2.0; extra == "acl-sqlalchemy"
 Requires-Dist: asyncpg>=0.29; extra == "acl-sqlalchemy"
 Requires-Dist: alembic>=1.13; extra == "acl-sqlalchemy"
 Provides-Extra: acl-django
@@ -41,7 +41,7 @@ Requires-Dist: starlette>=0.37; extra == "all"
 Requires-Dist: django>=4.2; extra == "all"
 Requires-Dist: psycopg[binary]>=3.1; extra == "all"
 Requires-Dist: strawberry-graphql>=0.255; extra == "all"
-Requires-Dist: sqlalchemy<3.0,>=2.0; extra == "all"
+Requires-Dist: sqlalchemy[asyncio]<3.0,>=2.0; extra == "all"
 Requires-Dist: asyncpg>=0.29; extra == "all"
 Requires-Dist: alembic>=1.13; extra == "all"
 Requires-Dist: redis>=5.0; extra == "all"

{pkg_auth-3.1.0 → pkg_auth-3.2.0}/src/pkg_auth.egg-info/SOURCES.txt

@@ -79,6 +79,7 @@ src/pkg_auth/authorization/application/use_cases/list_user_organizations.py
 src/pkg_auth/authorization/application/use_cases/provision_default_services.py
 src/pkg_auth/authorization/application/use_cases/register_permission_catalog.py
 src/pkg_auth/authorization/application/use_cases/resolve_auth_context.py
+src/pkg_auth/authorization/application/use_cases/resolve_delegated_auth_context.py
 src/pkg_auth/authorization/application/use_cases/resolve_user_from_jwt.py
 src/pkg_auth/authorization/application/use_cases/set_organization_service.py
 src/pkg_auth/authorization/application/use_cases/sync_permission_catalog.py
@@ -105,6 +106,7 @@ src/pkg_auth/integrations/django/middleware.py
 src/pkg_auth/integrations/fastapi/__init__.py
 src/pkg_auth/integrations/fastapi/auth_context_dep.py
 src/pkg_auth/integrations/fastapi/auth_factory.py
+src/pkg_auth/integrations/fastapi/current_user_dep.py
 src/pkg_auth/integrations/fastapi/decorators.py
 src/pkg_auth/integrations/fastapi/errors.py
 src/pkg_auth/integrations/fastapi/identity_dep.py

{pkg_auth-3.1.0 → pkg_auth-3.2.0}/src/pkg_auth.egg-info/requires.txt

@@ -7,7 +7,7 @@ django>=4.2
 psycopg[binary]>=3.1
 
 [acl-sqlalchemy]
-sqlalchemy<3.0,>=2.0
+sqlalchemy[asyncio]<3.0,>=2.0
 asyncpg>=0.29
 alembic>=1.13
 
@@ -18,7 +18,7 @@ starlette>=0.37
 django>=4.2
 psycopg[binary]>=3.1
 strawberry-graphql>=0.255
-sqlalchemy<3.0,>=2.0
+sqlalchemy[asyncio]<3.0,>=2.0
 asyncpg>=0.29
 alembic>=1.13
 redis>=5.0