tba-app-backend-core 0.4.0.dev2__tar.gz

tba_app_backend_core-0.4.0.dev2/PKG-INFO

@@ -0,0 +1,60 @@
+Metadata-Version: 2.4
+Name: tba-app-backend-core
+Version: 0.4.0.dev2
+Summary: Shared layer-90 ASGI and router composition for TBA backend applications.
+License-Expression: Apache-2.0
+Requires-Python: >=3.10,<3.15
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: tba-capability-client-secret-authentication (==0.4.0.dev2)
+Requires-Dist: tba-contracts-identity (==0.4.0.dev2)
+Requires-Dist: tba-operator-identity (==0.4.0.dev2)
+Requires-Dist: tba-plugin-tigrbl (==0.4.0.dev2)
+Requires-Dist: tba-primitives-identity (==0.4.0.dev2)
+Requires-Dist: tba-protocol-gnap (==0.4.0.dev2)
+Requires-Dist: tba-protocol-oauth (==0.4.0.dev2)
+Requires-Dist: tba-provider-secret-hashing-bcrypt (==0.1.0)
+Requires-Dist: tba-router-administration-gate (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-authorization (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-authorization-server-metadata (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-device-authorization (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-introspection (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-protected-resource-metadata (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-pushed-authorization-request (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-registration (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-revocation (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-token (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-token-exchange (==0.4.0.dev2)
+Requires-Dist: tba-router-oidc-discovery (==0.4.0.dev2)
+Requires-Dist: tba-router-oidc-logout (==0.4.0.dev2)
+Requires-Dist: tba-router-oidc-userinfo (==0.4.0.dev2)
+Requires-Dist: tba-router-resource-validation-metadata (==0.4.0.dev2)
+Requires-Dist: tba-router-session-login (==0.4.0.dev2)
+Requires-Dist: tba-runtime-identity (==0.4.0.dev2)
+Requires-Dist: tba-runtime-identity-storage (==0.4.0.dev2)
+Requires-Dist: tba-server-identity (==0.4.0.dev2)
+Requires-Dist: tba-storage-core (==0.4.0.dev4)
+Requires-Dist: tba-storage-oauth (==0.4.0.dev2)
+Requires-Dist: tba-storage-tenancy (==0.4.0.dev2)
+Requires-Dist: tigrbl (==0.4.5.dev8)
+Project-URL: Homepage, https://github.com/tigrbl/tigrbl_auth
+Project-URL: Repository, https://github.com/tigrbl/tigrbl_auth
+Project-URL: Source, https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/90-backend-apps/tba-app-backend-core
+Description-Content-Type: text/markdown
+
+# tba-app-backend-core
+
+Shared layer-90 composition for deployable TBA backend applications.
+
+This package owns ASGI application construction, layer-80 router closure, HTTP
+surface assembly, administrative gate wrapping, and product-surface selection.
+Product backend-app packages supply a declared product contract and call the
+shared build_product_app factory.
+
+It does not own protocol semantics, capability implementations, durable table
+behavior, runtime handlers, or storage. Those remain in layers 50, 40, 30, and
+60 and are injected or imported downward.

tba_app_backend_core-0.4.0.dev2/README.md

@@ -0,0 +1,12 @@
+# tba-app-backend-core
+
+Shared layer-90 composition for deployable TBA backend applications.
+
+This package owns ASGI application construction, layer-80 router closure, HTTP
+surface assembly, administrative gate wrapping, and product-surface selection.
+Product backend-app packages supply a declared product contract and call the
+shared build_product_app factory.
+
+It does not own protocol semantics, capability implementations, durable table
+behavior, runtime handlers, or storage. Those remain in layers 50, 40, 30, and
+60 and are injected or imported downward.

tba_app_backend_core-0.4.0.dev2/pyproject.toml

@@ -0,0 +1,52 @@
+[project]
+name = "tba-app-backend-core"
+version = "0.4.0.dev2"
+description = "Shared layer-90 ASGI and router composition for TBA backend applications."
+readme = "README.md"
+requires-python = ">=3.10,<3.15"
+license = "Apache-2.0"
+dependencies = [
+    "tigrbl==0.4.5.dev8",
+    "tba-protocol-gnap==0.4.0.dev2",
+    "tba-protocol-oauth==0.4.0.dev2",
+    "tba-plugin-tigrbl==0.4.0.dev2",
+    "tba-router-administration-gate==0.4.0.dev2",
+    "tba-router-oauth-authorization==0.4.0.dev2",
+    "tba-router-oauth-authorization-server-metadata==0.4.0.dev2",
+    "tba-router-oauth-device-authorization==0.4.0.dev2",
+    "tba-router-oauth-introspection==0.4.0.dev2",
+    "tba-router-oauth-pushed-authorization-request==0.4.0.dev2",
+    "tba-router-oauth-protected-resource-metadata==0.4.0.dev2",
+    "tba-router-oauth-registration==0.4.0.dev2",
+    "tba-router-oauth-revocation==0.4.0.dev2",
+    "tba-router-oauth-token==0.4.0.dev2",
+    "tba-router-oauth-token-exchange==0.4.0.dev2",
+    "tba-router-oidc-discovery==0.4.0.dev2",
+    "tba-router-oidc-logout==0.4.0.dev2",
+    "tba-router-oidc-userinfo==0.4.0.dev2",
+    "tba-router-resource-validation-metadata==0.4.0.dev2",
+    "tba-router-session-login==0.4.0.dev2",
+    "tba-capability-client-secret-authentication==0.4.0.dev2",
+    "tba-contracts-identity==0.4.0.dev2",
+    "tba-primitives-identity==0.4.0.dev2",
+    "tba-operator-identity==0.4.0.dev2",
+    "tba-runtime-identity==0.4.0.dev2",
+    "tba-server-identity==0.4.0.dev2",
+    "tba-storage-core==0.4.0.dev4",
+    "tba-storage-oauth==0.4.0.dev2",
+    "tba-storage-tenancy==0.4.0.dev2",
+    "tba-runtime-identity-storage==0.4.0.dev2",
+    "tba-provider-secret-hashing-bcrypt==0.1.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/tigrbl/tigrbl_auth"
+Repository = "https://github.com/tigrbl/tigrbl_auth"
+Source = "https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/90-backend-apps/tba-app-backend-core"
+
+[build-system]
+requires = ["poetry-core>=1.0.0"]
+build-backend = "poetry.core.masonry.api"
+
+[tool.poetry]
+packages = [{ include = "tba_app_backend_core", from = "src" }]

tba_app_backend_core-0.4.0.dev2/src/tba_app_backend_core/__init__.py

@@ -0,0 +1,15 @@
+"""Shared backend-application composition APIs."""
+
+from .app import app, build_app, build_application_runtime_plan
+from .plugin import TbaBackendAppPlugin, install
+from .product import build_product_app, validate_backend_app_contract
+
+__all__ = [
+    "app",
+    "build_app",
+    "build_application_runtime_plan",
+    "TbaBackendAppPlugin",
+    "build_product_app",
+    "install",
+    "validate_backend_app_contract",
+]

tba_app_backend_core-0.4.0.dev2/src/tba_app_backend_core/app.py

@@ -0,0 +1,146 @@
+from __future__ import annotations
+
+from dataclasses import replace
+from importlib.metadata import (
+    PackageNotFoundError,
+    version as installed_package_version,
+)
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+from tba_runtime_identity.deployment import ResolvedDeployment, resolve_deployment
+from tba_operator_identity.repo_truth import (
+    package_version as repository_package_version,
+)
+from tba_runtime_identity import LazyASGIApplication
+from tba_server_identity.composition.app import (
+    _load_default_settings,
+    build_application_runtime_plan as _build_application_runtime_plan,
+)
+
+if TYPE_CHECKING:
+    from tigrbl import TigrblApp
+    from tba_server_identity.composition.lifecycle import AssemblyFactory
+
+
+def _runtime_package_version() -> str:
+    try:
+        return installed_package_version("tba-app-backend-core")
+    except PackageNotFoundError:
+        return repository_package_version(Path(__file__).resolve().parents[2])
+
+
+def _path_has_prefix(path: str, prefix: str) -> bool:
+    return path == prefix or path.startswith(f"{prefix}/")
+
+
+def _hide_disabled_control_plane_docs(
+    app: object,
+    deployment: ResolvedDeployment,
+    *,
+    diagnostics_prefix: str,
+) -> None:
+    routes = getattr(app, "_routes", None)
+    if not isinstance(routes, list):
+        return
+
+    hidden = []
+    for route in routes:
+        path = str(getattr(route, "path_template", None) or getattr(route, "path", ""))
+        hide = not deployment.flag_enabled(
+            "surface_diagnostics_enabled"
+        ) and _path_has_prefix(path, diagnostics_prefix)
+        if hide and hasattr(route, "include_in_schema"):
+            hidden.append(replace(route, include_in_schema=False))
+        else:
+            hidden.append(route)
+    routes[:] = hidden
+
+
+def build_app(
+    settings_obj: object | None = None,
+    *,
+    deployment: ResolvedDeployment | None = None,
+    runtime_assembly_factory: AssemblyFactory | None = None,
+) -> "TigrblApp":
+    resolved_settings = (
+        settings_obj if settings_obj is not None else _load_default_settings()
+    )
+    resolved_deployment = deployment or resolve_deployment(resolved_settings)
+    if runtime_assembly_factory is None:
+        from tba_server_identity.composition.runtime_assembly import (
+            build_server_runtime_assembly_async,
+        )
+
+        async def default_runtime_assembly_factory():
+            return await build_server_runtime_assembly_async(resolved_settings)
+
+        runtime_assembly_factory = default_runtime_assembly_factory
+
+    from tba_contracts_identity.protocol_configuration import (
+        ProtocolSettingsOverlay,
+        bind_protocol_settings,
+    )
+
+    protocol_settings = ProtocolSettingsOverlay(
+        resolved_settings, _load_default_settings()
+    )
+    bind_protocol_settings(protocol_settings)
+
+    from tigrbl import TigrblApp
+
+    from tba_server_identity.composition.lifecycle import register_lifecycle
+    from tba_app_backend_core.surfaces import (
+        admin_resource_path_prefixes,
+        attach_runtime_surfaces,
+    )
+    from tba_router_administration_gate import AdminGate
+    from tba_runtime_identity_storage.engine import dsn
+
+    app = TigrblApp(
+        title="tba_auth",
+        version=_runtime_package_version(),
+        openapi_url="/openapi.json",
+        docs_url="/docs",
+        engine=dsn,
+    )
+    state = getattr(app, "state", None)
+    if state is not None:
+        state.tba_auth_deployment = resolved_deployment
+        state.tba_auth_settings = resolved_settings
+    surface_router = attach_runtime_surfaces(
+        app,
+        resolved_settings,
+        deployment=resolved_deployment,
+        diagnostics_prefix="/system",
+    )
+    _hide_disabled_control_plane_docs(
+        app,
+        resolved_deployment,
+        diagnostics_prefix="/system",
+    )
+    register_lifecycle(
+        app,
+        assembly_factory=runtime_assembly_factory,
+        surface_initializer=surface_router.initialize,
+    )
+    return AdminGate(
+        app,
+        deployment=resolved_deployment,
+        settings_obj=resolved_settings,
+        admin_path_prefixes=admin_resource_path_prefixes(resolved_deployment),
+        diagnostics_prefix="/system",
+    )
+
+
+def build_application_runtime_plan(*args: object, **kwargs: object):
+    kwargs.setdefault(
+        "app_factory",
+        "tba_app_backend_core.app.build_app",
+    )
+    return _build_application_runtime_plan(*args, **kwargs)
+
+
+app = LazyASGIApplication(build_app)
+
+__all__ = ["app", "build_app", "build_application_runtime_plan"]

tba_app_backend_core-0.4.0.dev2/src/tba_app_backend_core/plugin.py

@@ -0,0 +1,36 @@
+"""Layer-90 host-application plugin with HTTP surface ownership."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from tba_plugin_tigrbl import TbaPlugin as RuntimePlugin
+
+from .surfaces import attach_runtime_surfaces
+
+if TYPE_CHECKING:
+    from tigrbl import TigrblApp
+
+
+class TbaBackendAppPlugin(RuntimePlugin):
+    def __init__(
+        self,
+        *,
+        diagnostics_prefix: str = "/system",
+        settings: object | None = None,
+    ) -> None:
+        super().__init__(
+            surface_attacher=attach_runtime_surfaces,
+            diagnostics_prefix=diagnostics_prefix,
+            settings=settings,
+        )
+
+
+def install(app: "TigrblApp", settings: object | None = None) -> "TigrblApp":
+    return TbaBackendAppPlugin(settings=settings).install(
+        app,
+        settings=settings,
+    )
+
+
+__all__ = ["TbaBackendAppPlugin", "install"]

tba_app_backend_core-0.4.0.dev2/src/tba_app_backend_core/product.py

@@ -0,0 +1,55 @@
+"""Product-specific backend application assembly."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from tba_runtime_identity.deployment import (
+    PRODUCT_SURFACE_REGISTRY,
+    resolve_deployment,
+)
+
+from .app import build_app
+
+if TYPE_CHECKING:
+    from tigrbl import TigrblApp
+
+
+def validate_backend_app_contract(contract: object, deployment: object) -> None:
+    expected_surface = getattr(contract, "product_surface", None)
+    actual_surface = getattr(deployment, "product_surface", None)
+    if expected_surface != actual_surface:
+        raise ValueError(
+            "backend-app contract product surface does not match deployment: "
+            f"{expected_surface!r} != {actual_surface!r}"
+        )
+
+    declared_routers = tuple(getattr(contract, "mounted_router_packages", ()))
+    resolved_routers = tuple(getattr(deployment, "router_packages", ()))
+    if declared_routers != resolved_routers:
+        raise ValueError(
+            "backend-app contract router closure does not match deployment: "
+            f"{declared_routers!r} != {resolved_routers!r}"
+        )
+
+
+def build_product_app(
+    product_surface: str,
+    settings_obj: object | None = None,
+    *,
+    contract: object | None = None,
+) -> "TigrblApp":
+    """Build the shared ASGI app constrained to one declared product surface."""
+    if product_surface not in PRODUCT_SURFACE_REGISTRY:
+        raise ValueError(f"unknown tba_auth product surface: {product_surface}")
+    deployment = resolve_deployment(
+        settings_obj,
+        product_surface=product_surface,
+        runtime_style="standalone",
+    )
+    if contract is not None:
+        validate_backend_app_contract(contract, deployment)
+    return build_app(settings_obj, deployment=deployment)
+
+
+__all__ = ["build_product_app", "validate_backend_app_contract"]

tba_app_backend_core-0.4.0.dev2/src/tba_app_backend_core/surfaces/__init__.py

@@ -0,0 +1,3 @@
+"""HTTP surface and router composition owned by layer 90."""
+
+from .surface_api import *