pyapiauth 0.1.0__py3-none-any.whl

pyapiauth/__init__.py

@@ -0,0 +1,44 @@
+"""Verify an OIDC provider's RFC 9068 access tokens inside a Python web API.
+
+The Python sibling of goapiauth. A CLI logs in with the device grant, and a
+service with the client-credentials grant, and each sends the provider's access
+token as a bearer. `Verifier` checks it against the issuer's published keys and
+returns the `Caller` it establishes: a person, or a service client limited to
+its scopes.
+
+    from pyapiauth import LazyVerifier, person_prefix, service_prefix
+
+    verifier = LazyVerifier('https://auth.example.com', person_prefix('acme'), service_prefix=service_prefix('acme'))
+    caller = verifier.verify(token)  # Rejected, or IssuerUnreachable
+
+The FastAPI dependencies live in `pyapiauth.fastapi_dependencies`, installed
+with the `fastapi` extra.
+"""
+
+from pyapiauth.errors import AuthError
+from pyapiauth.errors import IssuerUnreachable
+from pyapiauth.errors import Rejected
+from pyapiauth.verifier import USER_AGENT
+from pyapiauth.verifier import Caller
+from pyapiauth.verifier import HeldKeys
+from pyapiauth.verifier import LazyVerifier
+from pyapiauth.verifier import Verifier
+from pyapiauth.verifier import bearer_token
+from pyapiauth.verifier import discover_jwks_uri
+from pyapiauth.verifier import person_prefix
+from pyapiauth.verifier import service_prefix
+
+__all__ = [
+    'USER_AGENT',
+    'AuthError',
+    'Caller',
+    'HeldKeys',
+    'IssuerUnreachable',
+    'LazyVerifier',
+    'Rejected',
+    'Verifier',
+    'bearer_token',
+    'discover_jwks_uri',
+    'person_prefix',
+    'service_prefix',
+]

pyapiauth/errors.py

@@ -0,0 +1,20 @@
+"""Exceptions raised by pyapiauth.
+
+Both are one level under `AuthError`. They need opposite answers: a rejected
+token is the caller's to fix by logging in again, and an unreachable issuer is
+nobody's to fix by logging in.
+"""
+
+from __future__ import annotations
+
+
+class AuthError(Exception):
+    """Base class for every error this package raises."""
+
+
+class Rejected(AuthError):
+    """A token failed a check. The message is for the API's log, never for the caller."""
+
+
+class IssuerUnreachable(AuthError):
+    """The issuer could not be asked, or published no usable keys, so the token was never judged."""

pyapiauth/fastapi_dependencies.py

@@ -0,0 +1,92 @@
+"""FastAPI dependencies that admit a request by its bearer token, installed with the `fastapi` extra.
+
+goapiauth's `RequireBearer` and `LimitServices`, as dependency factories:
+
+    from fastapi import APIRouter, Depends
+    from pyapiauth import LazyVerifier, person_prefix, service_prefix
+    from pyapiauth.fastapi_dependencies import person_dependency
+
+    verifier = LazyVerifier('https://auth.example.com', person_prefix('acme'), service_prefix=service_prefix('acme'))
+    router = APIRouter(dependencies=[Depends(person_dependency(verifier))])
+
+Each puts the verified `Caller` on `request.state.caller` and returns it. A
+refusal is an `HTTPException`, so FastAPI answers it as `{"detail": ...}`:
+
+- **401** with a `WWW-Authenticate` challenge for a missing or rejected token.
+  The detail is one opaque sentence, so a caller probing with forged tokens
+  learns nothing about which check failed. The reason goes to the log.
+- **503** where the issuer cannot be reached, because a login cannot fix that.
+- **403** where a service client reaches a route it holds no scope for.
+
+The bearer is the only credential read. A header a proxy might set, such as
+`Remote-User`, is whatever the caller typed unless the proxy strips it.
+"""
+
+from __future__ import annotations
+
+import logging
+
+from fastapi import HTTPException
+from fastapi import Request
+
+from .errors import IssuerUnreachable
+from .errors import Rejected
+from .verifier import Caller
+from .verifier import bearer_token
+
+log = logging.getLogger(__name__)
+
+UNAUTHORIZED_DETAIL = 'Invalid credentials'
+ISSUER_UNAVAILABLE_DETAIL = 'Identity provider unavailable'
+PERSON_ONLY_DETAIL = 'This route answers a person, not a service client'
+SCOPE_REFUSED_DETAIL = 'This service client holds no scope this route answers'
+
+
+def caller_dependency(verifier):
+    """A dependency admitting any caller whose token `verifier` accepts."""
+
+    def require_caller(request: Request) -> Caller:
+        token = bearer_token(request.headers.get('Authorization', ''))
+        if not token:
+            log.info('bearer_missing', extra={'path': request.url.path})
+            raise HTTPException(401, UNAUTHORIZED_DETAIL, {'WWW-Authenticate': 'Bearer'})
+        try:
+            caller = verifier.verify(token)
+        except IssuerUnreachable as error:
+            log.error('issuer_unreachable', extra={'path': request.url.path, 'error': str(error)})
+            raise HTTPException(503, ISSUER_UNAVAILABLE_DETAIL) from None
+        except Rejected as error:
+            log.warning('bearer_rejected', extra={'path': request.url.path, 'error': str(error)})
+            raise HTTPException(401, UNAUTHORIZED_DETAIL, {'WWW-Authenticate': 'Bearer error="invalid_token"'}) from None
+        request.state.caller = caller
+        return caller
+
+    return require_caller
+
+
+def person_dependency(verifier):
+    """As `caller_dependency`, refusing a service principal with 403."""
+    require_caller = caller_dependency(verifier)
+
+    def require_person(request: Request) -> Caller:
+        caller = require_caller(request)
+        if caller.service:
+            log.info('service_refused', extra={'path': request.url.path, 'client_id': caller.client_id})
+            raise HTTPException(403, PERSON_ONLY_DETAIL)
+        return caller
+
+    return require_person
+
+
+def person_or_scoped_service_dependency(verifier, scope):
+    """As `caller_dependency`, admitting a person, or a service principal holding `scope`."""
+    require_caller = caller_dependency(verifier)
+
+    def require_person_or_scope(request: Request) -> Caller:
+        caller = require_caller(request)
+        if caller.service and scope not in caller.scopes:
+            log.info('service_refused', extra={'path': request.url.path, 'client_id': caller.client_id, 'scope': scope})
+            raise HTTPException(403, SCOPE_REFUSED_DETAIL)
+        return caller
+
+    return require_person_or_scope

pyapiauth/verifier.py

@@ -0,0 +1,295 @@
+"""Verifying the RFC 9068 access tokens an OIDC provider issues to a product's CLIs and service clients.
+
+A CLI logs in with the device authorization grant and sends its access token as
+a bearer. A service logs in with the client-credentials grant and does the same.
+The token is a signed JWT, so the API verifies it against the issuer's published
+keys and asks nothing of the edge. The checks run in this order:
+
+1. the header's `typ` is `at+jwt`
+2. the signature verifies against a key from the issuer's JWKS
+3. `iss` is the issuer this API trusts
+4. `client_id` carries one of this product's two prefixes
+5. `exp` is in the future
+6. a person's token, `<product>-cli-*`, carries a `sub`; a service's token,
+   `<product>-svc-*`, carries a non-empty `scp`
+
+The prefix decides which kind a token is, never the absence of `sub`. A provider
+can omit `sub` from a client-credentials token, and a release can put it back.
+The audience claim is not checked, because some providers leave it empty on a
+device grant's token. The prefix is what keeps a token issued to another
+product's CLI out.
+
+The type check comes first because an id_token from the same issuer is signed by
+the same key. Without the check it would pass every later step, and an id_token
+is handed to the client where an access token is not.
+
+## The keys outlive an outage of the issuer
+
+`HeldKeys` reads the key set once and holds it. A token whose `kid` no held key
+carries makes it read again, which finds a key the provider has just rotated in.
+Those reads are at least `KEY_REREAD_GAP_SECONDS` apart, so a stream of forged
+tokens costs the provider one read per gap. Keys older than
+`KEY_SET_LIFESPAN_SECONDS` are read again too, which bounds how long a key the
+provider stopped publishing still verifies. A read that fails keeps the held
+keys, because a provider that cannot be read has not rotated its keys out.
+"""
+
+from __future__ import annotations
+
+import threading
+import time
+from dataclasses import dataclass
+
+import httpx2
+import jwt
+
+from .errors import IssuerUnreachable
+from .errors import Rejected
+
+ACCESS_TOKEN_TYPE = 'at+jwt'
+SIGNING_ALGORITHMS = ['RS256']
+DISCOVERY_PATH = '/.well-known/openid-configuration'
+DISCOVERY_TIMEOUT_SECONDS = 10.0
+KEY_READ_TIMEOUT_SECONDS = 10
+KEY_SET_LIFESPAN_SECONDS = 300.0
+KEY_REREAD_GAP_SECONDS = 30.0
+
+# A CDN in front of an issuer can refuse a client that names none. urllib's
+# default agent, which PyJWKClient sends unless told otherwise, is one such.
+USER_AGENT = 'pyapiauth (+https://github.com/datapointchris/pyapiauth)'
+
+
+def person_prefix(product):
+    """The client id prefix of every person's CLI for `product`: `acme-cli-`."""
+    return f'{product}-cli-'
+
+
+def service_prefix(product):
+    """The client id prefix of every service client for `product`: `acme-svc-`."""
+    return f'{product}-svc-'
+
+
+@dataclass(frozen=True)
+class Caller:
+    """What a verified token establishes about who is asking.
+
+    `subject` is empty for a service principal, which acts as no user. A
+    provider's subject can be an opaque id, so `name` carries the token's
+    `preferred_username` where the provider copies it into the access token.
+    """
+
+    subject: str
+    client_id: str
+    scopes: frozenset[str] = frozenset()
+    service: bool = False
+    name: str = ''
+
+    @property
+    def who(self):
+        """The caller as a record shows it: the username, else the subject, else the service client."""
+        return self.name or self.subject or self.client_id
+
+
+def bearer_token(authorization):
+    """The credential in an Authorization header, or '' where there is no bearer."""
+    scheme, _, credential = authorization.partition(' ')
+    if scheme.lower() != 'bearer':
+        return ''
+    return credential.strip()
+
+
+def discover_jwks_uri(issuer, client=None, user_agent=USER_AGENT):
+    """The issuer's JWKS endpoint, from its discovery document.
+
+    The document must name the issuer it was asked about. One that names another
+    is a misrouted request or a misconfigured proxy, and its keys would verify
+    tokens this API was never told to trust.
+    """
+    client = client or httpx2.Client(timeout=DISCOVERY_TIMEOUT_SECONDS)
+    try:
+        response = client.get(issuer.rstrip('/') + DISCOVERY_PATH, headers={'User-Agent': user_agent}, timeout=DISCOVERY_TIMEOUT_SECONDS)
+        response.raise_for_status()
+        document = response.json()
+    except (httpx2.HTTPError, ValueError) as error:
+        raise IssuerUnreachable(f'discovery at {issuer} failed: {error}') from error
+    if document.get('issuer') != issuer:
+        raise IssuerUnreachable(f'{issuer} advertises itself as {document.get("issuer")!r}')
+    jwks_uri = document.get('jwks_uri')
+    if not jwks_uri:
+        raise IssuerUnreachable(f'{issuer} advertises no jwks_uri')
+    return jwks_uri
+
+
+class HeldKeys:
+    """The issuer's signing keys, read once and held through an outage of the issuer.
+
+    `read_key_set` returns a `jwt.PyJWKSet`, and raises a `jwt.PyJWTError` where
+    the issuer cannot be read. `clock` is a parameter so the lifespan and the
+    gap can be driven from a test.
+    """
+
+    def __init__(self, read_key_set, clock=time.monotonic):
+        self.read_key_set = read_key_set
+        self.clock = clock
+        self.keys = {}
+        self.read_at = None
+        self.tried_at = None
+        self.mutex = threading.Lock()
+
+    @classmethod
+    def from_jwks_uri(cls, jwks_uri, user_agent=USER_AGENT):
+        reader = jwt.PyJWKClient(
+            jwks_uri, cache_jwk_set=False, cache_keys=False, headers={'User-Agent': user_agent}, timeout=KEY_READ_TIMEOUT_SECONDS
+        )
+        return cls(lambda: reader.get_jwk_set(refresh=True))
+
+    def get_signing_key_from_jwt(self, token):
+        """The held key the token's `kid` names, read again first where it is unknown or the keys are old.
+
+        `jwt.PyJWKClientConnectionError` means no key has ever been read.
+        """
+        kid = jwt.get_unverified_header(token).get('kid')
+        with self.mutex:
+            if kid not in self.keys or self.clock() - self.read_at >= KEY_SET_LIFESPAN_SECONDS:
+                self.read()
+            key = self.keys.get(kid)
+        if key is None:
+            raise jwt.PyJWKClientError(f'the issuer publishes no signing key {kid!r}')
+        return key
+
+    def read(self):
+        now = self.clock()
+        if self.keys and self.tried_at is not None and now - self.tried_at < KEY_REREAD_GAP_SECONDS:
+            return
+        self.tried_at = now
+        try:
+            key_set = self.read_key_set()
+        except jwt.PyJWTError as error:
+            if self.keys:
+                return
+            raise jwt.PyJWKClientConnectionError(f'the issuer published no usable key: {error}') from error
+        self.keys = {key.key_id: key for key in key_set.keys if key.key_id and key.public_key_use in ('sig', None)}
+        self.read_at = now
+
+
+class Verifier:
+    """Judges a bearer token against one issuer and this product's two client prefixes.
+
+    `person_prefix` starts every person's CLI client id, such as `acme-cli-`.
+    `service_prefix` starts every service client's, such as `acme-svc-`, and
+    empty refuses every service token. `keys` answers
+    `get_signing_key_from_jwt`, as `HeldKeys` and `jwt.PyJWKClient` both do.
+    """
+
+    def __init__(self, issuer, person_prefix, keys, clock=time.time, service_prefix=''):
+        check_prefixes(person_prefix, service_prefix)
+        self.issuer = issuer
+        self.person_prefix = person_prefix
+        self.service_prefix = service_prefix
+        self.keys = keys
+        self.clock = clock
+
+    @classmethod
+    def from_discovery(cls, issuer, person_prefix, client=None, service_prefix='', user_agent=USER_AGENT):
+        jwks_uri = discover_jwks_uri(issuer, client=client, user_agent=user_agent)
+        return cls(issuer, person_prefix, HeldKeys.from_jwks_uri(jwks_uri, user_agent), service_prefix=service_prefix)
+
+    def kind_of(self, client_id):
+        """'person' or 'service' by the client's prefix, or '' for a client this API does not know."""
+        if not isinstance(client_id, str):
+            return ''
+        if client_id.startswith(self.person_prefix):
+            return 'person'
+        if self.service_prefix and client_id.startswith(self.service_prefix):
+            return 'service'
+        return ''
+
+    def verify(self, token):
+        """The caller a token establishes, or `Rejected` naming the check it failed."""
+        try:
+            header = jwt.get_unverified_header(token)
+        except jwt.PyJWTError as error:
+            raise Rejected(f'header unreadable: {error}') from error
+        token_type = str(header.get('typ', ''))
+        if token_type.lower() != ACCESS_TOKEN_TYPE:
+            raise Rejected(f'type {token_type!r} is not {ACCESS_TOKEN_TYPE}')
+
+        try:
+            key = self.keys.get_signing_key_from_jwt(token)
+        except jwt.PyJWKClientConnectionError as error:
+            raise IssuerUnreachable(f'JWKS fetch failed: {error}') from error
+        except jwt.PyJWTError as error:
+            raise Rejected(f'no signing key: {error}') from error
+
+        # PyJWT's own claim checks are switched off so each runs below in the
+        # order above. Its order would report an expired id_token as expired
+        # rather than as the wrong kind of token.
+        try:
+            claims = jwt.decode(
+                token,
+                key.key,
+                algorithms=SIGNING_ALGORITHMS,
+                options={'verify_exp': False, 'verify_iss': False, 'verify_aud': False, 'verify_iat': False, 'verify_nbf': False},
+            )
+        except jwt.PyJWTError as error:
+            raise Rejected(f'signature: {error}') from error
+
+        if claims.get('iss') != self.issuer:
+            raise Rejected(f'issuer {claims.get("iss")!r} is not {self.issuer!r}')
+        client_id = claims.get('client_id')
+        kind = self.kind_of(client_id)
+        if not kind:
+            known = ' or '.join(f'{prefix}*' for prefix in (self.person_prefix, self.service_prefix) if prefix)
+            raise Rejected(f'client {client_id!r} is not a {known} client')
+        expires = claims.get('exp')
+        if not isinstance(expires, int | float) or expires <= self.clock():
+            raise Rejected(f'expired or no expiry: exp={expires!r}')
+        granted = claims.get('scp')
+        scopes = frozenset(scope for scope in granted if isinstance(scope, str)) if isinstance(granted, list) else frozenset()
+        if kind == 'service':
+            if not scopes:
+                raise Rejected(f'service client {client_id} holds no scope')
+            return Caller(subject='', client_id=client_id, scopes=scopes, service=True)
+        subject = claims.get('sub')
+        if not isinstance(subject, str) or not subject:
+            raise Rejected('no subject')
+        name = claims.get('preferred_username')
+        return Caller(subject=subject, client_id=client_id, scopes=scopes, name=name if isinstance(name, str) else '')
+
+
+def check_prefixes(person, service):
+    """Refuse a prefix `person_prefix` or `service_prefix` could not have built, or two that overlap.
+
+    A bare product name would admit every client id it starts: `acme` admits
+    `acmecorp-cli-desk`.
+    """
+    if not person.endswith('-cli-') or person == '-cli-':
+        raise ValueError(f'person prefix {person!r} is not person_prefix(product) for any product')
+    if service and (not service.endswith('-svc-') or service == '-svc-'):
+        raise ValueError(f'service prefix {service!r} is not service_prefix(product) for any product')
+    if service and (person.startswith(service) or service.startswith(person)):
+        raise ValueError(f'client prefixes {person!r} and {service!r} overlap')
+
+
+class LazyVerifier:
+    """A `Verifier` built on first use, and rebuilt after a failed build. goapiauth's `Connecting`.
+
+    Discovery needs the issuer up. Building at startup would make an issuer
+    outage stop the API from starting, and its health route would go with it. A
+    failed build is not remembered, so the request after the issuer returns
+    succeeds.
+    """
+
+    def __init__(self, issuer, person_prefix, build=Verifier.from_discovery, service_prefix='', user_agent=USER_AGENT):
+        check_prefixes(person_prefix, service_prefix)
+        self.issuer = issuer
+        self.person_prefix = person_prefix
+        self.service_prefix = service_prefix
+        self.user_agent = user_agent
+        self.build = build
+        self.verifier = None
+
+    def verify(self, token):
+        if self.verifier is None:
+            self.verifier = self.build(self.issuer, self.person_prefix, service_prefix=self.service_prefix, user_agent=self.user_agent)
+        return self.verifier.verify(token)

pyapiauth-0.1.0.dist-info/METADATA

@@ -0,0 +1,117 @@
+Metadata-Version: 2.5
+Name: pyapiauth
+Version: 0.1.0
+Summary: Verify an OIDC provider's RFC 9068 access tokens inside a Python web API, with FastAPI dependencies
+Project-URL: Repository, https://github.com/datapointchris/pyapiauth
+Project-URL: Issues, https://github.com/datapointchris/pyapiauth/issues
+Project-URL: Changelog, https://github.com/datapointchris/pyapiauth/releases
+Author-email: Chris Birch <datapointchris@gmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: bearer,fastapi,jwt,oauth2,oidc,rfc9068
+Classifier: Development Status :: 4 - Beta
+Classifier: Framework :: FastAPI
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: httpx2>=2.9.1
+Requires-Dist: pyjwt[crypto]>=2.10
+Provides-Extra: fastapi
+Requires-Dist: fastapi>=0.120; extra == 'fastapi'
+Description-Content-Type: text/markdown
+
+# pyapiauth
+
+Verify an OIDC provider's RFC 9068 access tokens inside a Python web API. A CLI
+logs in with the device grant, a service with the client-credentials grant, and
+each sends the provider's access token as a bearer. pyapiauth checks it against
+the issuer's published keys and says who is asking: a person, or a service
+client limited to its scopes.
+
+It is the Python sibling of
+[goapiauth](https://github.com/datapointchris/goapiauth). Its client-side
+counterpart is [pyclilogin](https://github.com/datapointchris/pyclilogin),
+which obtains the tokens this package verifies.
+
+## Install
+
+```bash
+uv add pyapiauth              # the verifier
+uv add "pyapiauth[fastapi]"   # plus the FastAPI dependencies
+```
+
+## Starting from scratch
+
+An API for a product called `acme` trusts one issuer and two client prefixes:
+`acme-cli-` for each person's machine, and `acme-svc-` for each service.
+
+```python
+from fastapi import APIRouter, Depends
+from pyapiauth import LazyVerifier, person_prefix, service_prefix
+from pyapiauth.fastapi_dependencies import person_dependency, person_or_scoped_service_dependency
+
+verifier = LazyVerifier('https://auth.example.com', person_prefix('acme'), service_prefix=service_prefix('acme'))
+
+people = APIRouter(dependencies=[Depends(person_dependency(verifier))])
+readers = APIRouter(dependencies=[Depends(person_or_scoped_service_dependency(verifier, 'acme.read'))])
+```
+
+Each dependency puts the verified `Caller` on `request.state.caller`. Without
+FastAPI, `verifier.verify(token)` returns the `Caller` or raises.
+
+`LazyVerifier` reads the issuer's discovery document on the first request,
+rather than at startup. An issuer that is down then cannot stop the API from
+starting, and a failed read is tried again on the next request.
+
+## A token passes six checks, in this order
+
+1. The header's `typ` is `at+jwt`.
+2. The signature verifies against a key from the issuer's JWKS.
+3. `iss` is the issuer the API trusts.
+4. `client_id` starts with the person prefix or the service prefix.
+5. `exp` is in the future.
+6. A person's token carries a `sub`. A service's token carries a non-empty
+   `scp`.
+
+The type check comes first because an id_token from the same issuer is signed
+by the same key, and would otherwise pass every later step. The prefix decides
+whether a token is a person's or a service's, never the absence of `sub`. The
+audience claim is not checked, because some providers leave it empty on a
+device grant's token. The client prefix keeps another product's tokens out.
+
+A prefix no product name builds is refused when the verifier is built. A bare
+`acme` would admit `acmecorp-cli-desk`. An empty service prefix refuses every
+service token.
+
+## A refusal tells the caller nothing, and an outage is not a refusal
+
+| Outcome | Exception | FastAPI answer |
+| --- | --- | --- |
+| No bearer, or one that fails a check | `Rejected` | 401 `Invalid credentials`, with a `WWW-Authenticate` challenge |
+| The issuer cannot be read | `IssuerUnreachable` | 503 `Identity provider unavailable` |
+| A service on a route no scope of its admits | — | 403 |
+
+A caller probing with forged tokens learns nothing about which check failed.
+The reason goes to the `pyapiauth.fastapi_dependencies` logger, as
+`bearer_rejected` at WARNING, `issuer_unreachable` at ERROR, and
+`bearer_missing` and `service_refused` at INFO. A 503 never sends anyone to log
+in again, because a login cannot fix a network fault.
+
+## The keys outlive an outage of the issuer
+
+`HeldKeys` reads the key set once and holds it. A token naming a `kid` no held
+key carries reads it again, which finds a key the provider has just rotated in.
+Those reads are at least 30 seconds apart, so a stream of forged tokens costs
+the provider one read per gap. Keys older than five minutes are read again too,
+which bounds how long a key the provider stopped publishing still verifies. A
+read that fails keeps the held keys, so an outage of the issuer is not an
+outage of the API.
+
+## What it deliberately does not do
+
+It does not issue, refresh or store tokens; pyclilogin does that on the client.
+It verifies RS256 alone, and does not introspect opaque tokens.

pyapiauth-0.1.0.dist-info/RECORD

@@ -0,0 +1,9 @@
+pyapiauth/__init__.py,sha256=iiY1ZwPp7KRlP9YMRVwpQoza8XUbsvs4nPo2pjxuyLU,1530
+pyapiauth/errors.py,sha256=tJWA81OWU8zYEcqKS-QGgjHhd936VQk3mhJlc_zCh3E,609
+pyapiauth/fastapi_dependencies.py,sha256=8YTPpwr0mFK5mUqn17iALP8xlkGtAsiw4IKaC0ezQ-c,3898
+pyapiauth/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+pyapiauth/verifier.py,sha256=z_0IVjii24aU0HqYENZ-bK2eOJlJ9BHjSyahD7yxuCs,12743
+pyapiauth-0.1.0.dist-info/METADATA,sha256=peYNOiqRoDXnouZdvwIAjR5fZPzX8SUpbqg4Qx2XZgY,5212
+pyapiauth-0.1.0.dist-info/WHEEL,sha256=2iZrJkDIkeDh0k9SikKMqFuRP-ua6mb4Ir1AsER4BEw,87
+pyapiauth-0.1.0.dist-info/licenses/LICENSE,sha256=GAtoA41_GNRzmpuNDCm36J0OQXWmAEkUJXwqla22KLo,1068
+pyapiauth-0.1.0.dist-info/RECORD,,

pyapiauth-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.33.0
+Root-Is-Purelib: true
+Tag: py3-none-any

pyapiauth-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Chris Birch
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.