pywire-auth 0.1.1__tar.gz

pywire_auth-0.1.1/.gitignore

@@ -0,0 +1,81 @@
+# ─────────────────────── Python ──────────────────────
+.venv/
+venv/
+env/
+ENV/
+__pycache__/
+*.pyc
+*.py[cod]
+*$py.class
+*.egg-info/
+dist/
+build/
+.coverage
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.tox/
+**/_version.py
+
+# ─────────────────────── Rust ────────────────────────
+target/
+
+# ─────────────────────── Node ────────────────────────
+node_modules/
+coverage/
+*.log
+.astro/
+
+# ─────────────────────── IDE ─────────────────────────
+.vscode/
+.idea/
+*.swp
+*.swo
+
+# ─────────────────────── OS ──────────────────────────
+.DS_Store
+Thumbs.db
+
+# ─────────────────────── Env ─────────────────────────
+.env
+.env.*
+!.env.example
+
+# ─────────────────────── pywire package ──────────────
+.pywire/
+scratch/
+packages/pywire/src/pywire/*.so
+packages/pywire/src/pywire/*.pyd
+packages/pywire/src/pywire/client/dist/
+# Un-ignore static dir — maturin must include it in WASM wheels
+!packages/pywire/src/pywire/static/
+!packages/pywire/src/pywire/static/**
+# Re-ignore built JS bundles (generated by pnpm build)
+packages/pywire/src/pywire/static/pywire.*.min.js
+packages/pywire/emsdk/
+emsdk/
+packages/pywire/.pyodide-*
+
+# ─────────────────────── vscode-pywire ───────────────
+packages/vscode-pywire/out/
+packages/vscode-pywire/bundled/
+*.vsix
+
+# ─────────────────────── tree-sitter-pywire ──────────
+packages/tree-sitter-pywire/Cargo.lock
+packages/tree-sitter-pywire/*.wasm
+
+# ─────────────────────── Docs ────────────────────────
+docs/public/sw.js
+docs/public/pywire-worker.js
+
+# ─────────────────────── Certs ───────────────────────
+localhost.pem
+localhost-key.pem
+
+# ─────────────────────── Other ───────────────────────
+chatbot.db
+.gemini/
+.claude/worktrees/
+gha-creds-*.json
+.agent/settings.local.json

pywire_auth-0.1.1/CHANGELOG.md

@@ -0,0 +1,35 @@
+# Changelog
+
+## [0.1.1](https://github.com/pywire/pywire/compare/pywire-auth-v0.1.0...pywire-auth-v0.1.1) (2026-04-20)
+
+
+### Bug Fixes
+
+* **pywire-auth:** public-API docstring + add PyPI publish job ([620aa66](https://github.com/pywire/pywire/commit/620aa66523c9429e20948df94729fcba693fbcbc))
+
+## [0.1.0](https://github.com/pywire/pywire/compare/pywire-auth-v0.1.0...pywire-auth-v0.1.0) (2026-04-20)
+
+
+### Features
+
+* **pywire-auth:** initial release — OIDC + LocalIdP + policies ([6a5af64](https://github.com/pywire/pywire/commit/6a5af6412a992dcfcaa062e6d26356bf0f087ce1))
+
+
+### Bug Fixes
+
+* **prettier-plugin-pywire:** bump for consistency ([33fc161](https://github.com/pywire/pywire/commit/33fc1613c5a70dfc4e8b00d1da3d99f2dc849925))
+* **pywire-language-server:** bump for release ([88aa449](https://github.com/pywire/pywire/commit/88aa449a1a55ece6145f1f21bc7b1ca807e394ca))
+* **pywire-language-server:** fix PyPI publish by using explicit build output dir ([8dec973](https://github.com/pywire/pywire/commit/8dec97382276ce0f139cc5abd89b0bd54806bc7d))
+* **pywire-language-server:** trigger release PR update ([77491d0](https://github.com/pywire/pywire/commit/77491d02b5f51957b83b1ae3a320cbab53fb56a8))
+* **tree-sitter-pywire:** bump for consistency ([42b40bd](https://github.com/pywire/pywire/commit/42b40bd3ec2711445865c772573b52774857bbc0))
+* **vscode-pywire:** fix CI publish with --no-dependencies flag ([1ef1d72](https://github.com/pywire/pywire/commit/1ef1d72018f4c02bf29a923dd33e4f96bdf813ac))
+
+## Changelog
+
+All notable changes to `pywire-auth` are documented here. This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html) and uses [release-please](https://github.com/googleapis/release-please) for automated releases.
+
+Initial release: batteries-included authentication — OAuth2/OIDC providers (Google, GitHub, Microsoft, Facebook, Auth0, generic OIDC), a local identity provider with Argon2 password hashing, a `SQLAlchemyAuthStore` for cross-restart persistence, policy engine with claim-based guards, `AuthActions` bundling store/session/channel mutations into one call, and a live auth channel that pushes claim changes to logged-in tabs without reload.
+
+## Unreleased
+
+_Release PR tracked by release-please._

pywire_auth-0.1.1/PKG-INFO

@@ -0,0 +1,27 @@
+Metadata-Version: 2.4
+Name: pywire-auth
+Version: 0.1.1
+Summary: Authentication providers and identity store adapters for PyWire
+Author-email: Reece Holmdahl <reece@pywire.dev>
+License-Expression: MIT
+Requires-Python: >=3.11
+Requires-Dist: argon2-cffi>=23.1
+Requires-Dist: authlib>=1.3
+Requires-Dist: httpx>=0.25
+Requires-Dist: pywire
+Requires-Dist: starlette>=0.31
+Provides-Extra: apple
+Provides-Extra: auth0
+Provides-Extra: dev
+Requires-Dist: httpx>=0.25; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.21; extra == 'dev'
+Requires-Dist: pytest>=7.4; extra == 'dev'
+Provides-Extra: facebook
+Provides-Extra: github
+Provides-Extra: google
+Provides-Extra: microsoft
+Provides-Extra: redis
+Requires-Dist: redis>=5; extra == 'redis'
+Provides-Extra: sqlalchemy
+Requires-Dist: aiosqlite>=0.19; extra == 'sqlalchemy'
+Requires-Dist: sqlalchemy[asyncio]>=2.0; extra == 'sqlalchemy'

pywire_auth-0.1.1/README.md

@@ -0,0 +1,144 @@
+# pywire-auth
+
+Authentication for [PyWire](https://pywire.dev). OAuth2 / OIDC providers, a local identity provider with Argon2 password hashing, session-backed principals, policies, and a live-update channel so logged-in tabs react to claim changes without a reload.
+
+## Install
+
+```sh
+pip install pywire-auth
+```
+
+Optional extras:
+
+- `pywire-auth[sqlalchemy]` — persistent `SQLAlchemyAuthStore` for the local IdP (SQLite / Postgres / MySQL / any async SQLA driver; ships `aiosqlite` for the default SQLite URL)
+- `pywire-auth[redis]` — cross-worker `RedisAuthChannel` (coming)
+
+Providers ship as config-only extras; the HTTP layer is `httpx` + `authlib` which are always installed:
+
+- `pywire-auth[google]` `pywire-auth[github]` `pywire-auth[microsoft]` `pywire-auth[facebook]` `pywire-auth[auth0]` — declarative today, provider-specific deps land here later without a compat break
+
+## Quick start
+
+```python
+# src/main.py
+import os
+from pathlib import Path
+from pywire import PyWire
+from pywire_auth import (
+    GoogleProvider,
+    GitHubProvider,
+    LocalIdP,
+    SQLAlchemyAuthStore,
+    connect_auth,
+)
+
+app = PyWire(pages_dir=str(Path(__file__).parent / "pages"))
+
+# Local password auth, persisted to SQLite by default. Override via
+# LOCAL_AUTH_DB env var for Postgres / etc.
+store = SQLAlchemyAuthStore(
+    os.environ.get("LOCAL_AUTH_DB", "sqlite+aiosqlite:///./local-auth.db")
+)
+
+providers = []
+if os.environ.get("GOOGLE_CLIENT_ID"):
+    providers.append(GoogleProvider(
+        client_id=os.environ["GOOGLE_CLIENT_ID"],
+        client_secret=os.environ["GOOGLE_CLIENT_SECRET"],
+    ))
+if os.environ.get("GITHUB_CLIENT_ID"):
+    providers.append(GitHubProvider(
+        client_id=os.environ["GITHUB_CLIENT_ID"],
+        client_secret=os.environ["GITHUB_CLIENT_SECRET"],
+    ))
+
+engine = connect_auth(
+    app,
+    providers=providers,
+    local_idp=LocalIdP(store=store),  # reads LOCAL_IDP_SECRET from env
+)
+engine.add_policy("AdminOnly", requires_claim=("role", "admin"))
+```
+
+`connect_auth` mounts:
+
+- `GET /auth/{provider}/login` + `GET /auth/{provider}/callback` — one pair per OIDC provider in the list
+- `POST /auth/local/{register,login,token,verify-token,revoke}` — only when `local_idp=...` is passed
+- `GET /auth/logout` — clears session + fires an `AuthChannel.revoke`
+
+and exposes the `AuthActions` helper at `app.state.auth` for one-call claim mutations.
+
+## Protecting pages
+
+Page-level (hard redirect):
+
+```wire
+!auth {"policy": "AdminOnly"}
+
+<h1>Admin dashboard</h1>
+```
+
+Region-level (renders an "allowed" or "denied" branch in place):
+
+```wire
+{$auth policy="AdminOnly"}
+    <p>Admin-only content</p>
+{$else}
+    <p>Contact an administrator.</p>
+{/auth}
+```
+
+Both check the principal against the named policy or the inline `claims=[...]` list. Policies fail closed — unknown policies, missing engine, and user-code exceptions all deny.
+
+## LocalIdP persistence
+
+In-memory default is fine for unit tests. For any real dev loop, wire a SQLite file:
+
+```python
+from pywire_auth import LocalIdP, SQLAlchemyAuthStore
+
+store = SQLAlchemyAuthStore("sqlite+aiosqlite:///./local-auth.db")
+idp = LocalIdP(store=store)  # secret from LOCAL_IDP_SECRET env
+```
+
+Schema (three tables — `pywire_auth_users`, `pywire_auth_credentials`, `pywire_auth_provider_links`) auto-initializes on first query. For Postgres, `postgresql+asyncpg://user:pw@host/db`; for MySQL, `mysql+aiomysql://...`. The `metadata` object is importable for Alembic:
+
+```python
+from pywire_auth.stores.sqlalchemy import metadata
+```
+
+See the [Local IdP setup guide](https://pywire.dev/guides/authentication/local-idp/) for first-time setup + production tips.
+
+## Live auth
+
+`AuthActions` writes claim changes to all three layers in one call:
+
+```python
+# In a page handler
+await app.state.auth.grant(self.user, self.request, "role", "admin")
+await app.state.auth.revoke_claim(self.user, self.request, "role")
+await app.state.auth.revoke_session(self.user, self.request)
+```
+
+Store → session → `AuthChannel` in that order: the change persists across logins, survives a hard reload, and re-renders every connected tab for that user without a page refresh.
+
+## Providers
+
+| Provider | Shape | Notes |
+|---|---|---|
+| `GoogleProvider` | OIDC | Fixed endpoints; returns `sub`, `email`, `email_verified`, `name`, `picture`, optional `hd` |
+| `GitHubProvider` | OAuth2 | No id_token; `sub` derived from `id`, `login` returned |
+| `MicrosoftProvider` | OIDC | `tenant="common"` default; per-tenant via GUID/domain |
+| `FacebookProvider` | OAuth2 | v18.0 endpoints; unwraps nested `picture.data.url` |
+| `Auth0Provider` | OIDC | Pass `domain=<tenant>.auth0.com`; extends `GenericOIDCProvider` |
+| `GenericOIDCProvider` | OIDC | Any `/.well-known/openid-configuration`; works for Keycloak / Okta / Cognito / Zitadel / Logto |
+
+All providers accept `client_id` + `client_secret` and expose `authorize_url` / `exchange_code` / `refresh` / `map_claims`.
+
+## API reference
+
+Full reference at [pywire.dev/reference/auth-api](https://pywire.dev/reference/auth-api/).
+
+## License
+
+MIT

pywire_auth-0.1.1/pyproject.toml

@@ -0,0 +1,54 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "pywire-auth"
+version = "0.1.1"
+description = "Authentication providers and identity store adapters for PyWire"
+authors = [
+    { name = "Reece Holmdahl", email = "reece@pywire.dev" },
+]
+requires-python = ">=3.11"
+license = "MIT"
+dependencies = [
+    "pywire",
+    "starlette>=0.31",
+    "authlib>=1.3",
+    "httpx>=0.25",
+    "argon2-cffi>=23.1",
+]
+
+[project.optional-dependencies]
+# Each OIDC provider is a config-only extra today — the network layer
+# is authlib + httpx (already required). Extras exist so users can
+# declare intent and so providers can pick up provider-specific deps
+# in the future without a compat break.
+google = []
+github = []
+microsoft = []
+facebook = []
+apple = []
+auth0 = []
+
+# Persistent user store — pulls SQLAlchemy when an app needs account
+# linking or the local IdP. aiosqlite covers dev / single-worker apps;
+# Postgres / MySQL users swap in their own async driver.
+sqlalchemy = [
+    "sqlalchemy[asyncio]>=2.0",
+    "aiosqlite>=0.19",
+]
+
+# Cross-worker realtime updates.
+redis = [
+    "redis>=5",
+]
+
+dev = [
+    "pytest>=7.4",
+    "pytest-asyncio>=0.21",
+    "httpx>=0.25",
+]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/pywire_auth"]

pywire_auth-0.1.1/src/pywire_auth/__init__.py

@@ -0,0 +1,58 @@
+"""pywire-auth — OAuth2 / OIDC providers and identity store adapters.
+
+Public API:
+
+- :func:`connect_auth` — single integration entry point
+- :class:`AuthActions` — one-call claim/session mutations (`app.state.auth`)
+- :class:`AuthMiddleware` — ASGI middleware that populates scope['user']
+- :class:`LocalIdP` + :class:`TokenIssuer` — database-backed local provider
+- OIDC providers: :class:`GoogleProvider`, :class:`GitHubProvider`,
+  :class:`MicrosoftProvider`, :class:`FacebookProvider`,
+  :class:`Auth0Provider`, :class:`GenericOIDCProvider`
+- Store adapters: :class:`MemoryAuthStore`, :class:`SQLAlchemyAuthStore`
+  (requires ``pip install pywire-auth[sqlalchemy]``)
+- Structural interfaces: :class:`AuthStore`, :class:`OIDCProvider`,
+  :class:`BaseOAuth2Provider`, :class:`BaseOIDCProvider`
+"""
+
+from pywire_auth._protocols import AuthStore, OIDCProvider
+from pywire_auth.actions import AuthActions
+from pywire_auth.integration import connect_auth
+from pywire_auth.middleware import AuthMiddleware
+from pywire_auth.local import LocalIdP, TokenIssuer
+from pywire_auth.providers import (
+    Auth0Provider,
+    BaseOAuth2Provider,
+    BaseOIDCProvider,
+    FacebookProvider,
+    GenericOIDCProvider,
+    GitHubProvider,
+    GoogleProvider,
+    MicrosoftProvider,
+)
+from pywire_auth.stores import MemoryAuthStore
+
+try:
+    from pywire_auth.stores.sqlalchemy import SQLAlchemyAuthStore
+except ImportError:
+    SQLAlchemyAuthStore = None  # type: ignore[assignment,misc]
+
+__all__ = [
+    "Auth0Provider",
+    "AuthActions",
+    "AuthMiddleware",
+    "AuthStore",
+    "BaseOAuth2Provider",
+    "BaseOIDCProvider",
+    "FacebookProvider",
+    "GenericOIDCProvider",
+    "GitHubProvider",
+    "GoogleProvider",
+    "LocalIdP",
+    "MemoryAuthStore",
+    "MicrosoftProvider",
+    "SQLAlchemyAuthStore",
+    "OIDCProvider",
+    "TokenIssuer",
+    "connect_auth",
+]

pywire_auth-0.1.1/src/pywire_auth/_protocols.py

@@ -0,0 +1,67 @@
+"""Structural interfaces for auth providers and stores."""
+
+from __future__ import annotations
+
+from typing import (
+    Any,
+    Dict,
+    List,
+    Optional,
+    Protocol,
+    Tuple,
+    runtime_checkable,
+)
+
+from pywire.auth import Claim, ClaimsPrincipal
+
+
+@runtime_checkable
+class AuthStore(Protocol):
+    """Persistent user + identity store.
+
+    Used by the local IdP and by account-linking flows. Apps using only
+    external OIDC providers don't need a store.
+    """
+
+    async def get_user(self, user_id: str) -> Optional[Dict[str, Any]]: ...
+
+    async def find_by_provider(
+        self, provider: str, subject: str
+    ) -> Optional[Dict[str, Any]]: ...
+
+    async def create_user(self, **fields: Any) -> str: ...
+
+    async def update_user(self, user_id: str, **fields: Any) -> None: ...
+
+    async def link_provider(
+        self,
+        user_id: str,
+        provider: str,
+        subject: str,
+        claims: Optional[Dict[str, Any]] = None,
+    ) -> None: ...
+
+    async def get_password_hash(self, user_id: str) -> Optional[str]: ...
+
+    async def set_password_hash(self, user_id: str, hash: str) -> None: ...
+
+
+class OIDCProvider(Protocol):
+    """Structural shape for OAuth2/OIDC login providers."""
+
+    name: str
+    scopes: List[str]
+
+    async def authorize_url(
+        self, *, redirect_uri: str, state: str, nonce: str
+    ) -> str: ...
+
+    async def exchange_code(
+        self, *, code: str, redirect_uri: str, state: str, nonce: str
+    ) -> Tuple[ClaimsPrincipal, Dict[str, Any]]: ...
+
+    async def refresh(
+        self, refresh_token: str
+    ) -> Optional[Tuple[ClaimsPrincipal, Dict[str, Any]]]: ...
+
+    def map_claims(self, raw: Dict[str, Any]) -> List[Claim]: ...

pywire_auth-0.1.1/src/pywire_auth/actions.py

@@ -0,0 +1,163 @@
+"""AuthActions — one-call claim/session mutations for live auth.
+
+Writing a new claim to a logged-in user touches three storage layers:
+
+1. The ``AuthStore`` — permanent user row; survives logout/login.
+2. The session store — per-login principal snapshot; survives reload.
+3. The ``AuthChannel`` — in-memory fan-out; updates every live tab now.
+
+App code shouldn't have to know about any of that. ``AuthActions`` bundles
+all three behind a small surface. ``connect_auth`` constructs one per app
+and stashes it on ``app.state.auth``; pages use it like::
+
+    await app.state.auth.grant(self.user, self.request, "role", "admin")
+    await app.state.auth.revoke_claim(self.user, self.request, "role")
+    await app.state.auth.revoke_session(self.user, self.request)
+
+Every method runs all three writes in the right order so a hard reload,
+a fresh login, and every concurrent tab stay consistent.
+"""
+
+from __future__ import annotations
+
+from dataclasses import replace
+from typing import Any, Dict, Iterable, List, Optional
+
+from pywire.auth import (
+    Claim,
+    ClaimsPrincipal,
+    clear_principal_from_session,
+    write_principal_to_session,
+)
+
+
+def _bare_user_id(principal: ClaimsPrincipal) -> str:
+    """Strip the ``<provider>:`` prefix — auth stores key on the bare id."""
+    if not principal.user_id:
+        return ""
+    return principal.user_id.split(":", 1)[-1]
+
+
+def _claims_to_dict(claims: Iterable[Claim]) -> Dict[str, str]:
+    """Collapse the claim list to a dict for ``AuthStore.update_user``.
+
+    Strips ``sub`` / ``email`` because LocalIdP re-emits them from the
+    user row's top-level columns on every :meth:`principal_for_user`.
+    Including them in ``record['claims']`` would just cause duplicates.
+    """
+    return {c.type: c.value for c in claims if c.type not in ("sub", "email")}
+
+
+class AuthActions:
+    """Bundles AuthStore + session + channel writes for claim/session ops."""
+
+    def __init__(self, app: Any) -> None:
+        self._app = app
+
+    # --- claim mutations ---
+
+    async def update_claims(
+        self,
+        principal: ClaimsPrincipal,
+        request: Any,
+        claims: List[Claim],
+    ) -> ClaimsPrincipal:
+        """Replace the principal's claims. Writes through all three layers."""
+        new_principal = replace(
+            principal,
+            is_authenticated=True,
+            claims=list(claims),
+        )
+
+        store = self._auth_store()
+        if store is not None:
+            raw_uid = _bare_user_id(principal)
+            if raw_uid:
+                await store.update_user(raw_uid, claims=_claims_to_dict(claims))
+
+        await self._write_session(request, new_principal)
+
+        channel = getattr(self._app, "_auth_channel", None)
+        if channel is not None and principal.user_id:
+            await channel.update_principal(principal.user_id, principal=new_principal)
+
+        return new_principal
+
+    async def grant(
+        self,
+        principal: ClaimsPrincipal,
+        request: Any,
+        claim_type: str,
+        claim_value: str,
+    ) -> ClaimsPrincipal:
+        """Add or overwrite a claim, keeping the rest untouched."""
+        remaining = [c for c in principal.claims if c.type != claim_type]
+        return await self.update_claims(
+            principal,
+            request,
+            remaining + [Claim(type=claim_type, value=claim_value)],
+        )
+
+    async def revoke_claim(
+        self,
+        principal: ClaimsPrincipal,
+        request: Any,
+        claim_type: str,
+    ) -> ClaimsPrincipal:
+        """Drop every claim of the given type. No-op if none exist."""
+        filtered = [c for c in principal.claims if c.type != claim_type]
+        return await self.update_claims(principal, request, filtered)
+
+    # --- session lifecycle ---
+
+    async def revoke_session(
+        self,
+        principal: ClaimsPrincipal,
+        request: Any,
+    ) -> None:
+        """Clear this session's auth + fire a channel-wide revoke.
+
+        The WS live-auth loop translates the channel event into a
+        navigate-away for each connected tab; the current tab's session
+        is also cleared so a hard reload lands on the login page via
+        the ``!auth`` guard.
+        """
+        session_store = getattr(self._app, "session_store", None)
+        sid = self._session_id(request)
+        if session_store is not None and sid:
+            data = await session_store.get(sid) or {}
+            clear_principal_from_session(data)
+            data.pop("_refresh_token", None)
+            await session_store.set(
+                sid, data, ttl=getattr(self._app, "session_ttl", 1800)
+            )
+
+        channel = getattr(self._app, "_auth_channel", None)
+        if channel is not None and principal.user_id:
+            await channel.revoke(principal.user_id)
+
+    # --- helpers ---
+
+    def _auth_store(self) -> Any:
+        state = getattr(getattr(self._app, "app", None), "state", None)
+        return getattr(state, "auth_store", None) if state is not None else None
+
+    async def _write_session(
+        self, request: Any, principal: ClaimsPrincipal
+    ) -> None:
+        session_store = getattr(self._app, "session_store", None)
+        sid = self._session_id(request)
+        if session_store is None or not sid:
+            return
+        data = await session_store.get(sid) or {}
+        write_principal_to_session(data, principal)
+        await session_store.set(
+            sid, data, ttl=getattr(self._app, "session_ttl", 1800)
+        )
+
+    @staticmethod
+    def _session_id(request: Any) -> Optional[str]:
+        scope = getattr(request, "scope", None)
+        if scope is None:
+            return None
+        return scope.get("pywire_session_id")