simple-module-keycloak 0.0.24__py3-none-any.whl

keycloak/__init__.py

@@ -0,0 +1 @@
+"""Keycloak OIDC authentication provider for simple_module."""

keycloak/contracts/__init__.py

@@ -0,0 +1 @@
+"""Keycloak module contracts."""

keycloak/endpoints/__init__.py

@@ -0,0 +1 @@
+"""Keycloak endpoint routers."""

keycloak/endpoints/api.py

@@ -0,0 +1,92 @@
+"""Keycloak OIDC API endpoints — login redirect, callback."""
+
+from __future__ import annotations
+
+import logging
+import secrets
+from typing import TYPE_CHECKING
+
+from fastapi import APIRouter, HTTPException, Request
+from starlette.responses import RedirectResponse
+
+if TYPE_CHECKING:
+    from keycloak.settings import KeycloakSettings
+
+logger = logging.getLogger(__name__)
+router = APIRouter(prefix="/auth", tags=["keycloak-auth"])
+
+_SESSION_OIDC_STATE = "keycloak_oidc_state"
+_SESSION_OIDC_NONCE = "keycloak_oidc_nonce"
+_SESSION_USER_CTX = "user_ctx"
+_SESSION_ID_TOKEN = "keycloak_id_token"
+_SESSION_NEXT = "next"
+
+
+def _get_settings(request: Request) -> KeycloakSettings:
+    return request.app.state.keycloak.settings
+
+
+def _get_oidc_client(request: Request):
+    from keycloak.oidc import OIDCClient
+
+    s = _get_settings(request)
+    return OIDCClient(
+        server_url=s.server_url,
+        realm=s.realm,
+        client_id=s.client_id,
+        client_secret=s.client_secret,
+    )
+
+
+@router.get("/login")
+async def oidc_login(request: Request):
+    client = _get_oidc_client(request)
+    callback_url = str(request.url_for("oidc_callback"))
+    nonce = secrets.token_urlsafe(32)
+    url, state = client.build_authorization_url(
+        redirect_uri=callback_url,
+        nonce=nonce,
+    )
+    request.session[_SESSION_OIDC_STATE] = state
+    request.session[_SESSION_OIDC_NONCE] = nonce
+    return RedirectResponse(url, status_code=302)
+
+
+@router.get("/callback")
+async def oidc_callback(request: Request):
+    code = request.query_params.get("code")
+    state = request.query_params.get("state")
+
+    expected_state = request.session.pop(_SESSION_OIDC_STATE, None)
+    request.session.pop(_SESSION_OIDC_NONCE, None)
+
+    if not code or not state or state != expected_state:
+        raise HTTPException(status_code=400, detail="Invalid OIDC state")
+
+    client = _get_oidc_client(request)
+    callback_url = str(request.url_for("oidc_callback"))
+
+    try:
+        tokens = await client.exchange_code(code=code, redirect_uri=callback_url)
+    except Exception:
+        logger.exception("Token exchange failed")
+        raise HTTPException(status_code=502, detail="Token exchange failed") from None
+
+    id_token = tokens.get("id_token", "")
+    access_token = tokens.get("access_token", "")
+
+    jwks_cache = request.app.state.keycloak.jwks_cache
+    claims = await jwks_cache.validate_jwt(access_token) if jwks_cache else None
+    if claims is None:
+        raise HTTPException(status_code=401, detail="Token validation failed")
+
+    provider = request.app.state.auth.auth_provider
+    cache_id = await provider._upsert_user_cache(request, claims)
+    user_ctx = provider._claims_to_user_context(claims, cache_id=cache_id)
+
+    request.session[_SESSION_USER_CTX] = user_ctx.to_session_dict()
+    request.session[_SESSION_ID_TOKEN] = id_token
+
+    s = _get_settings(request)
+    next_url = request.session.pop(_SESSION_NEXT, None) or s.login_redirect_url
+    return RedirectResponse(next_url, status_code=303)

keycloak/endpoints/views.py

@@ -0,0 +1,40 @@
+"""Keycloak Inertia view routes — login page, logout."""
+
+from __future__ import annotations
+
+from fastapi import APIRouter, Request
+from simple_module_hosting.inertia_deps import InertiaDep
+from starlette.responses import RedirectResponse
+
+router = APIRouter(tags=["keycloak-views"])
+
+_SESSION_ID_TOKEN = "keycloak_id_token"
+_PAGE_LOGIN = "Keycloak/Login"
+
+
+@router.get("/login")
+async def login_page(request: Request, inertia: InertiaDep):
+    return await inertia.render(_PAGE_LOGIN)
+
+
+@router.post("/logout")
+async def logout(request: Request):
+    from keycloak.oidc import OIDCClient
+
+    s = request.app.state.keycloak.settings
+    id_token = request.session.get(_SESSION_ID_TOKEN)
+
+    request.session.clear()
+
+    client = OIDCClient(
+        server_url=s.server_url,
+        realm=s.realm,
+        client_id=s.client_id,
+        client_secret=s.client_secret,
+    )
+    base_url = str(request.base_url).rstrip("/")
+    logout_url = client.build_logout_url(
+        post_logout_redirect_uri=f"{base_url}/keycloak/login",
+        id_token_hint=id_token,
+    )
+    return RedirectResponse(logout_url, status_code=303)

keycloak/jwks.py

@@ -0,0 +1,113 @@
+"""JWKS key cache and JWT validation for Keycloak tokens."""
+
+from __future__ import annotations
+
+import logging
+import time
+from typing import Any
+
+import httpx
+import jwt
+from jwt.algorithms import RSAAlgorithm
+
+logger = logging.getLogger(__name__)
+
+
+class JWKSCache:
+    """Caches Keycloak's public signing keys and validates JWTs.
+
+    On validation failure with cached keys, refetches JWKS once before
+    rejecting -- this handles Keycloak key rotation gracefully.
+    """
+
+    def __init__(
+        self,
+        jwks_url: str,
+        ttl_seconds: int = 3600,
+        *,
+        issuer: str,
+        audience: str,
+    ) -> None:
+        if not issuer:
+            raise ValueError("issuer is required for JWT validation")
+        if not audience:
+            raise ValueError("audience is required for JWT validation")
+        self._jwks_url = jwks_url
+        self._ttl = ttl_seconds
+        self._issuer = issuer
+        self._audience = audience
+        self._keys: dict[str, Any] = {}
+        self._fetched_at: float = 0
+
+    async def validate_jwt(self, token: str) -> dict[str, Any] | None:
+        """Decode and validate a JWT. Returns claims dict or None."""
+        try:
+            unverified = jwt.get_unverified_header(token)
+        except jwt.exceptions.DecodeError:
+            return None
+
+        kid = unverified.get("kid")
+        if kid is None:
+            return None
+
+        key = await self._get_key(kid)
+        if key is None:
+            return None
+
+        return self._decode(token, key)
+
+    def _decode(self, token: str, key: Any) -> dict[str, Any] | None:
+        try:
+            return jwt.decode(
+                token,
+                key,
+                algorithms=["RS256"],
+                issuer=self._issuer,
+                audience=self._audience,
+            )
+        except (
+            jwt.ExpiredSignatureError,
+            jwt.InvalidIssuerError,
+            jwt.InvalidAudienceError,
+        ):
+            return None
+        except jwt.PyJWTError:
+            logger.exception("JWT validation failed")
+            return None
+
+    async def _get_key(self, kid: str) -> Any | None:
+        if self._is_stale() or kid not in self._keys:
+            await self._fetch_keys()
+
+        if kid in self._keys:
+            return self._keys[kid]
+
+        await self._fetch_keys(force=True)
+        return self._keys.get(kid)
+
+    def _is_stale(self) -> bool:
+        return time.monotonic() - self._fetched_at > self._ttl
+
+    async def _fetch_keys(self, *, force: bool = False) -> None:
+        if not force and not self._is_stale():
+            return
+        try:
+            async with httpx.AsyncClient() as client:
+                resp = await client.get(self._jwks_url, timeout=10)
+                resp.raise_for_status()
+                jwks_data = resp.json()
+        except Exception:
+            logger.exception("Failed to fetch JWKS from %s", self._jwks_url)
+            return
+
+        new_keys: dict[str, Any] = {}
+        for key_data in jwks_data.get("keys", []):
+            kid = key_data.get("kid")
+            if kid and key_data.get("alg") == "RS256":
+                try:
+                    public_key = RSAAlgorithm.from_jwk(key_data)
+                    new_keys[kid] = public_key
+                except Exception:
+                    logger.warning("Failed to parse JWK kid=%s", kid)
+        self._keys = new_keys
+        self._fetched_at = time.monotonic()

keycloak/locales/en.json

@@ -0,0 +1,15 @@
+{
+  "login": {
+    "redirecting": "Redirecting to identity provider…",
+    "title": "Sign In"
+  },
+  "logout": {
+    "title": "Signed Out",
+    "message": "You have been signed out successfully."
+  },
+  "errors": {
+    "callback_failed": "Authentication failed. Please try again.",
+    "invalid_state": "Invalid authentication state. Please try again.",
+    "token_validation_failed": "Token validation failed."
+  }
+}

keycloak/models.py

@@ -0,0 +1,21 @@
+"""Keycloak user cache -- maps Keycloak sub to a stable framework UUID."""
+
+from __future__ import annotations
+
+import uuid as uuid_mod
+from datetime import datetime
+
+from simple_module_db.base import create_module_base
+from sqlmodel import Field
+
+Base = create_module_base("keycloak")
+
+
+class KeycloakUserCache(Base, table=True):  # ty: ignore[unsupported-base]
+    __tablename__ = "keycloak_user_cache"
+
+    id: uuid_mod.UUID = Field(default_factory=uuid_mod.uuid4, primary_key=True)
+    keycloak_sub: str = Field(unique=True, index=True)
+    email: str = ""
+    full_name: str | None = None
+    last_login_at: datetime | None = None

keycloak/module.py

@@ -0,0 +1,83 @@
+"""Keycloak OIDC authentication module."""
+
+from __future__ import annotations
+
+import importlib.resources
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+from simple_module_core.menu import MenuItem, MenuRegistry, MenuSection
+from simple_module_core.module import ModuleBase, ModuleMeta
+
+if TYPE_CHECKING:
+    from fastapi import APIRouter, FastAPI
+
+_MODULE_DEPENDENCY_AUTH = "Auth"
+_MODULE_DEPENDENCY_SETTINGS = "Settings"
+
+
+class KeycloakModule(ModuleBase):
+    meta = ModuleMeta(
+        name="Keycloak",
+        route_prefix="/api/keycloak",
+        view_prefix="/keycloak",
+        depends_on=[_MODULE_DEPENDENCY_AUTH, _MODULE_DEPENDENCY_SETTINGS],
+    )
+    _is_auth_provider = True
+
+    def register_settings(self, app: FastAPI) -> None:
+        import importlib
+
+        from keycloak.provider import KeycloakAuthProvider
+        from keycloak.settings import KeycloakSettings
+        from keycloak.state import KeycloakState
+
+        register_module_settings = importlib.import_module(
+            "settings.registration"
+        ).register_module_settings
+
+        register_module_settings(
+            app,
+            "keycloak",
+            KeycloakSettings,
+            lambda s: KeycloakState(settings=s),
+        )
+
+        app.state.auth.auth_provider = KeycloakAuthProvider(app.state.keycloak.settings)
+
+    def register_menu_items(self, registry: MenuRegistry) -> None:
+        registry.add(
+            MenuItem(
+                label="Logout",
+                url="/keycloak/logout",
+                icon="log-out",
+                order=999,
+                section=MenuSection.USER_DROPDOWN,
+                method="post",
+            )
+        )
+
+    def register_routes(self, api_router: APIRouter, view_router: APIRouter) -> None:
+        from keycloak.endpoints.api import router as api
+        from keycloak.endpoints.views import router as views
+
+        api_router.include_router(api)
+        view_router.include_router(views)
+
+    async def on_startup(self, app: FastAPI) -> None:
+        from keycloak.jwks import JWKSCache
+
+        state = app.state.keycloak
+        s = state.settings
+        if s.server_url and s.realm:
+            state.jwks_cache = JWKSCache(
+                jwks_url=(f"{s.server_url}/realms/{s.realm}/protocol/openid-connect/certs"),
+                ttl_seconds=s.jwks_cache_ttl_seconds,
+                issuer=f"{s.server_url}/realms/{s.realm}",
+                audience=s.client_id,
+            )
+            provider = app.state.auth.auth_provider
+            provider.jwks_cache = state.jwks_cache
+
+    def locale_dirs(self) -> dict[str, Path]:
+        return {"keycloak": Path(str(importlib.resources.files(__package__) / "locales"))}

keycloak/oidc.py

@@ -0,0 +1,85 @@
+"""OIDC helpers for Keycloak -- authorization URL, token exchange, logout."""
+
+from __future__ import annotations
+
+import secrets
+from typing import Any
+from urllib.parse import urlencode
+
+import httpx
+
+
+class OIDCClient:
+    """Thin wrapper around Keycloak's OIDC endpoints."""
+
+    def __init__(
+        self,
+        server_url: str,
+        realm: str,
+        client_id: str,
+        client_secret: str,
+    ) -> None:
+        self._base = f"{server_url.rstrip('/')}/realms/{realm}/protocol/openid-connect"
+        self._client_id = client_id
+        self._client_secret = client_secret
+        self._server_url = server_url.rstrip("/")
+        self._realm = realm
+
+    @property
+    def issuer(self) -> str:
+        return f"{self._server_url}/realms/{self._realm}"
+
+    @property
+    def token_endpoint(self) -> str:
+        return f"{self._base}/token"
+
+    @property
+    def jwks_url(self) -> str:
+        return f"{self._base}/certs"
+
+    def build_authorization_url(
+        self,
+        redirect_uri: str,
+        nonce: str,
+        scope: str = "openid email profile",
+    ) -> tuple[str, str]:
+        state = secrets.token_urlsafe(32)
+        params = {
+            "client_id": self._client_id,
+            "redirect_uri": redirect_uri,
+            "response_type": "code",
+            "scope": scope,
+            "state": state,
+            "nonce": nonce,
+        }
+        url = f"{self._base}/auth?{urlencode(params)}"
+        return url, state
+
+    async def exchange_code(
+        self,
+        code: str,
+        redirect_uri: str,
+    ) -> dict[str, Any]:
+        data = {
+            "grant_type": "authorization_code",
+            "code": code,
+            "redirect_uri": redirect_uri,
+            "client_id": self._client_id,
+            "client_secret": self._client_secret,
+        }
+        async with httpx.AsyncClient() as client:
+            resp = await client.post(self.token_endpoint, data=data, timeout=10)
+            resp.raise_for_status()
+            return resp.json()
+
+    def build_logout_url(
+        self,
+        post_logout_redirect_uri: str,
+        id_token_hint: str | None = None,
+    ) -> str:
+        params: dict[str, str] = {
+            "post_logout_redirect_uri": post_logout_redirect_uri,
+        }
+        if id_token_hint:
+            params["id_token_hint"] = id_token_hint
+        return f"{self._base}/logout?{urlencode(params)}"

keycloak/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "@simple-module/keycloak",
+  "private": true,
+  "version": "0.0.0",
+  "type": "module",
+  "dependencies": {}
+}

keycloak/pages/LoggedOut.tsx

@@ -0,0 +1,13 @@
+import { Link } from '@inertiajs/react';
+
+export default function LoggedOut() {
+  return (
+    <div className="flex min-h-screen flex-col items-center justify-center gap-4">
+      <h1 className="text-2xl font-bold">Signed Out</h1>
+      <p className="text-muted-foreground">You have been signed out successfully.</p>
+      <Link href="/keycloak/login" className="text-primary underline">
+        Sign in again
+      </Link>
+    </div>
+  );
+}

keycloak/pages/Login.tsx

@@ -0,0 +1,14 @@
+import { router } from '@inertiajs/react';
+import { useEffect } from 'react';
+
+export default function Login() {
+  useEffect(() => {
+    router.get('/api/keycloak/auth/login');
+  }, []);
+
+  return (
+    <div className="flex min-h-screen items-center justify-center">
+      <p className="text-muted-foreground">Redirecting to identity provider...</p>
+    </div>
+  );
+}

keycloak/provider.py

@@ -0,0 +1,138 @@
+"""KeycloakAuthProvider — resolves users from Keycloak JWTs or session."""
+
+from __future__ import annotations
+
+import logging
+from datetime import UTC
+from typing import TYPE_CHECKING, Any
+
+from auth.contracts.schemas import UserContext
+from starlette.requests import Request
+
+if TYPE_CHECKING:
+    from keycloak.jwks import JWKSCache
+    from keycloak.settings import KeycloakSettings
+
+logger = logging.getLogger(__name__)
+
+_SESSION_USER_CTX_KEY = "user_ctx"
+
+
+class KeycloakAuthProvider:
+    """OIDC auth provider backed by Keycloak."""
+
+    name = "keycloak"
+    _is_auth_provider = True
+
+    def __init__(self, settings: KeycloakSettings | None = None) -> None:
+        self._settings = settings
+        self.jwks_cache: JWKSCache | None = None
+
+    async def resolve_user(self, request: Request) -> UserContext | None:
+        auth_header = request.headers.get("authorization", "")
+        if auth_header.startswith("Bearer "):
+            return await self._resolve_bearer(request, auth_header[7:])
+
+        session = request.scope.get("session", {})
+        return UserContext.from_session_dict(session.get(_SESSION_USER_CTX_KEY))
+
+    def get_login_url(self, request: Request | None, next_url: str | None = None) -> str:
+        return "/keycloak/login"
+
+    def get_logout_url(self, request: Request | None) -> str:
+        return "/keycloak/logout"
+
+    def get_public_paths(self) -> tuple[tuple[str, ...], tuple[str, ...]]:
+        return (
+            ("/keycloak/login", "/keycloak/logout", "/api/keycloak/auth/"),
+            (),
+        )
+
+    def is_bearer_request(self, request: Request | None) -> bool:
+        if request is None:
+            return False
+        return request.headers.get("authorization", "").startswith("Bearer ")
+
+    async def _resolve_bearer(self, request: Request, token: str) -> UserContext | None:
+        if self.jwks_cache is None:
+            logger.warning("JWKS cache not initialized; rejecting bearer token")
+            return None
+        claims = await self.jwks_cache.validate_jwt(token)
+        if claims is None:
+            return None
+
+        cache_id = await self._upsert_user_cache(request, claims)
+        return self._claims_to_user_context(claims, cache_id=cache_id)
+
+    def _claims_to_user_context(
+        self,
+        claims: dict[str, Any],
+        *,
+        cache_id: str,
+    ) -> UserContext:
+        roles_raw = (
+            _extract_nested(claims, self._settings.roles_claim_path) if self._settings else None
+        )
+        mapped = [
+            self._settings.role_mapping[r]
+            for r in (roles_raw or [])
+            if self._settings and r in self._settings.role_mapping
+        ]
+        return UserContext(
+            id=cache_id,
+            email=claims.get("email", ""),
+            name=(claims.get("preferred_username") or claims.get("name", "")),
+            roles=mapped,
+            tenant_id=claims.get("tenant_id"),
+        )
+
+    async def _upsert_user_cache(self, request: Request, claims: dict) -> str:
+        try:
+            from sqlalchemy import select
+
+            from keycloak.models import KeycloakUserCache
+
+            session_factory = request.app.state.sm.db.session_factory
+            sub = claims["sub"]
+            async with session_factory() as db:
+                stmt = select(KeycloakUserCache).where(KeycloakUserCache.keycloak_sub == sub)
+                row = (await db.execute(stmt)).scalar_one_or_none()
+                if row is None:
+                    import uuid as uuid_mod
+                    from datetime import datetime
+
+                    row = KeycloakUserCache(
+                        id=uuid_mod.uuid4(),
+                        keycloak_sub=sub,
+                        email=claims.get("email", ""),
+                        full_name=claims.get("preferred_username"),
+                        last_login_at=datetime.now(UTC),
+                    )
+                    db.add(row)
+                    await db.flush()
+                else:
+                    from datetime import datetime
+
+                    row.email = claims.get("email", row.email)
+                    row.full_name = claims.get("preferred_username", row.full_name)
+                    row.last_login_at = datetime.now(UTC)
+                    await db.flush()
+                return str(row.id)
+        except Exception:
+            logger.exception(
+                "Failed to upsert KeycloakUserCache for sub=%s",
+                claims.get("sub"),
+            )
+            return claims.get("sub", "unknown")
+
+
+def _extract_nested(data: dict, path: str) -> list[str] | None:
+    parts = path.split(".")
+    current: Any = data
+    for part in parts:
+        if not isinstance(current, dict):
+            return None
+        current = current.get(part)
+        if current is None:
+            return None
+    return current if isinstance(current, list) else None

keycloak/settings.py

@@ -0,0 +1,49 @@
+"""Keycloak module settings -- DB-backed via ``register_module_settings``."""
+
+from __future__ import annotations
+
+from pydantic import Field, model_validator
+from pydantic_settings import BaseSettings, SettingsConfigDict
+from simple_module_core.dotenv import env_str
+from simple_module_core.environments import NON_PROD_ENVIRONMENTS
+
+
+class KeycloakSettings(BaseSettings):
+    """Keycloak OIDC configuration."""
+
+    model_config = SettingsConfigDict(extra="ignore")
+
+    server_url: str = env_str("SM_KEYCLOAK_SERVER_URL", "")
+    realm: str = env_str("SM_KEYCLOAK_REALM", "")
+    client_id: str = env_str("SM_KEYCLOAK_CLIENT_ID", "")
+    client_secret: str = env_str("SM_KEYCLOAK_CLIENT_SECRET", "")
+
+    roles_claim_path: str = "realm_access.roles"
+    admin_role: str = "admin"
+    login_redirect_url: str = "/dashboard/"
+    jwks_cache_ttl_seconds: int = 3600
+
+    role_mapping: dict[str, str] = Field(
+        default_factory=lambda: {"admin": "admin", "user": "user"},
+    )
+
+    @model_validator(mode="after")
+    def _check_required_in_production(self) -> KeycloakSettings:
+        import os
+
+        env = os.environ.get("SM_ENVIRONMENT", "development")
+        if env in NON_PROD_ENVIRONMENTS:
+            return self
+        missing = []
+        if not self.server_url:
+            missing.append("SM_KEYCLOAK_SERVER_URL")
+        if not self.realm:
+            missing.append("SM_KEYCLOAK_REALM")
+        if not self.client_id:
+            missing.append("SM_KEYCLOAK_CLIENT_ID")
+        if not self.client_secret:
+            missing.append("SM_KEYCLOAK_CLIENT_SECRET")
+        if missing:
+            msg = f"Keycloak settings required in production: {', '.join(missing)}"
+            raise ValueError(msg)
+        return self

keycloak/state.py

@@ -0,0 +1,18 @@
+"""Module-scoped state container for the keycloak module."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from keycloak.jwks import JWKSCache
+    from keycloak.settings import KeycloakSettings
+
+
+@dataclass
+class KeycloakState:
+    """Keycloak-module singletons. Single slot at ``app.state.keycloak``."""
+
+    settings: KeycloakSettings
+    jwks_cache: JWKSCache | None = None

simple_module_keycloak-0.0.24.dist-info/METADATA

@@ -0,0 +1,59 @@
+Metadata-Version: 2.4
+Name: simple_module_keycloak
+Version: 0.0.24
+Summary: Keycloak OIDC authentication provider for simple_module — swap with simple_module_users
+Project-URL: Homepage, https://github.com/antosubash/simple_module_python
+Project-URL: Repository, https://github.com/antosubash/simple_module_python
+Author-email: Anto Subash <antosubash@live.com>
+License-Expression: MIT
+Keywords: authentication,fastapi,keycloak,oidc,simple-module
+Classifier: Development Status :: 3 - Alpha
+Classifier: Framework :: FastAPI
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
+Classifier: Typing :: Typed
+Requires-Python: >=3.12
+Requires-Dist: httpx>=0.27
+Requires-Dist: pyjwt[crypto]>=2.8
+Requires-Dist: simple-module-auth==0.0.24
+Requires-Dist: simple-module-core==0.0.24
+Requires-Dist: simple-module-db==0.0.24
+Requires-Dist: simple-module-hosting==0.0.24
+Requires-Dist: simple-module-settings==0.0.24
+Description-Content-Type: text/markdown
+
+# simple_module_keycloak
+
+Keycloak OIDC authentication provider for simple_module. Swap with `simple_module_users` for Keycloak-backed identity management — users, roles, and login all handled by Keycloak.
+
+## Install
+
+Add to your app's `pyproject.toml` dependencies instead of `simple_module_users`:
+
+```toml
+dependencies = [
+    "simple_module_keycloak==0.0.17",
+]
+```
+
+Run `uv sync --all-packages` to install.
+
+## Usage
+
+Set the required environment variables (or configure via the settings admin UI after first boot):
+
+```bash
+SM_KEYCLOAK_SERVER_URL=https://keycloak.example.com
+SM_KEYCLOAK_REALM=my-realm
+SM_KEYCLOAK_CLIENT_ID=my-app
+SM_KEYCLOAK_CLIENT_SECRET=my-secret
+```
+
+The module auto-registers as the auth provider. Browser users are redirected to Keycloak's hosted login page. Mobile clients authenticate directly with Keycloak and send bearer tokens to the framework API.
+
+Keycloak realm roles are mapped to framework permissions via the `role_mapping` setting (default: `admin` and `user` map 1:1).

simple_module_keycloak-0.0.24.dist-info/RECORD

@@ -0,0 +1,20 @@
+keycloak/__init__.py,sha256=fwprBcURWW9H9_AZ0qq1_HyKkz6t9e2IrKUs4M47SFo,63
+keycloak/jwks.py,sha256=tYWEgcj_y_1OvJicqT2ydqqbzt1Yz3X51i2gGJ67Jkk,3442
+keycloak/models.py,sha256=MOX-aZE6RuxUksVblqUglHiojtuwuefgWBbZuKyp8LU,636
+keycloak/module.py,sha256=q7IrMTUOXRsL5RLJsRVOA684BWJhlqUiuE9qfWwGy-A,2709
+keycloak/oidc.py,sha256=UldTMdq58P8ca3xmwRTplu9eu6B1R2BR6fobb9DGzKk,2398
+keycloak/provider.py,sha256=hE3Um1njU6XYFVlvkNK-Gwm2p3WfPl_0fazE5unw3Nk,4893
+keycloak/settings.py,sha256=vQbRX5gBT5KFrcjTAM3pMMmS2NIl6K_Yf5HHYnpBfEc,1743
+keycloak/state.py,sha256=16b2FN6Nq4HWmyrxXA5oJueSgmAHg6-uWdM6m0nKw70,458
+keycloak/contracts/__init__.py,sha256=-u1EUS42D4ppuyCsk_JUb4IQNeVVahyAzorHBBRwgH8,33
+keycloak/endpoints/__init__.py,sha256=CSNcRfO6KidoCB91FhZE4-eiHe9A5ZFS5OaJiRVWkyA,33
+keycloak/endpoints/api.py,sha256=wDkAIn47v84yMx70ufDntP70YTTq1r3z9Lp0PJjjJ8Q,3023
+keycloak/endpoints/views.py,sha256=bmxI0oVp3o2X8xzdEvmETgai30IIcJwhmmQUE7NcbTY,1127
+keycloak/locales/en.json,sha256=pUG6eYSjXz49p2v3ECikcje3Sr0Wp0vqtYoMGskMa3s,420
+keycloak/pages/LoggedOut.tsx,sha256=_CFMcYguiMN84h6pmdldGQBaUKF2gCCbW6arEzixH_k,442
+keycloak/pages/Login.tsx,sha256=l85qBrbY6D9evgRsxxNxM3ZutS8uAULbJmMTBrXgCCc,368
+keycloak/package.json,sha256=lb3jCpfV8lriqPRtE767SAPoVZvHbx9TqM3R2MGv1jk,123
+simple_module_keycloak-0.0.24.dist-info/METADATA,sha256=ctmmAQjv7RHB8ELYO23UWp0hXdh74Lq_v5XwKv0uRhE,2275
+simple_module_keycloak-0.0.24.dist-info/WHEEL,sha256=mffPy8wBnZQn2VnJUU5jE99KsxaSfiyMHV9Yt0aLVxs,87
+simple_module_keycloak-0.0.24.dist-info/entry_points.txt,sha256=aiqnDG3AGTjz9babDtbuH-mWm_9o1VUfsddO1Qp6DNQ,58
+simple_module_keycloak-0.0.24.dist-info/RECORD,,

simple_module_keycloak-0.0.24.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.30.1
+Root-Is-Purelib: true
+Tag: py3-none-any

simple_module_keycloak-0.0.24.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[simple_module]
+keycloak = keycloak.module:KeycloakModule