tba-app-backend-developer 0.4.0.dev2__tar.gz

tba_app_backend_developer-0.4.0.dev2/PKG-INFO

@@ -0,0 +1,65 @@
+Metadata-Version: 2.4
+Name: tba-app-backend-developer
+Version: 0.4.0.dev2
+Summary: Developer OIDC/OAuth backend application for TBA.
+License-Expression: Apache-2.0
+Requires-Python: >=3.10,<3.15
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: tba-app-backend-core (==0.4.0.dev2)
+Requires-Dist: tba-auth (==0.4.0.dev2)
+Requires-Dist: tba-router-administration-gate (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-authorization-server-metadata (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-registration (==0.4.0.dev2)
+Requires-Dist: tba-router-oidc-discovery (==0.4.0.dev2)
+Project-URL: Homepage, https://github.com/tigrbl/tigrbl_auth
+Project-URL: Repository, https://github.com/tigrbl/tigrbl_auth
+Project-URL: Source, https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/90-backend-apps/tba-app-backend-developer
+Description-Content-Type: text/markdown
+
+# tba-app-backend-developer
+
+Developer self-service OAuth/OIDC client registration API front door.
+
+## Surface
+
+| Property | Value |
+| --- | --- |
+| Product surface | `developer-app` |
+| Intended UIX | `@tba/ui-developer` |
+| Exposes | Dynamic client registration, client management, client metadata, JWKS/discovery helpers |
+| Excludes | Tenant lifecycle operations, platform authority assignment, service identity administration |
+
+## Entrypoint
+
+```python
+from tba_app_backend_developer import app, build_app
+```
+
+## Local dev deployment
+
+```powershell
+docker compose -f docker/docker-compose.developer-app.yml up -d --build
+```
+
+The dev deployment listens on `http://localhost:8017` and uses
+`dev-developer-key` for the admin client-management routes and RPC methods.
+
+Useful checks:
+
+| Check | Expected |
+| --- | --- |
+| `GET /openapi.json` | Developer OpenAPI document |
+| `GET /openrpc.json` | Client-management OpenRPC document |
+| `POST /register` | Dynamic client-registration route exists without admin key |
+| `GET /client` | Admin-key guarded client REST surface |
+| `GET /clientregistration` | Admin-key guarded client-registration REST surface |
+| `GET /tenants/public/.well-known/jwks.json` | Tenant JWKS metadata helper |
+
+The developer API intentionally does not expose `/tenant`, `/authorize`,
+`/token`, or service/workload administration routes.
+

tba_app_backend_developer-0.4.0.dev2/README.md

@@ -0,0 +1,41 @@
+# tba-app-backend-developer
+
+Developer self-service OAuth/OIDC client registration API front door.
+
+## Surface
+
+| Property | Value |
+| --- | --- |
+| Product surface | `developer-app` |
+| Intended UIX | `@tba/ui-developer` |
+| Exposes | Dynamic client registration, client management, client metadata, JWKS/discovery helpers |
+| Excludes | Tenant lifecycle operations, platform authority assignment, service identity administration |
+
+## Entrypoint
+
+```python
+from tba_app_backend_developer import app, build_app
+```
+
+## Local dev deployment
+
+```powershell
+docker compose -f docker/docker-compose.developer-app.yml up -d --build
+```
+
+The dev deployment listens on `http://localhost:8017` and uses
+`dev-developer-key` for the admin client-management routes and RPC methods.
+
+Useful checks:
+
+| Check | Expected |
+| --- | --- |
+| `GET /openapi.json` | Developer OpenAPI document |
+| `GET /openrpc.json` | Client-management OpenRPC document |
+| `POST /register` | Dynamic client-registration route exists without admin key |
+| `GET /client` | Admin-key guarded client REST surface |
+| `GET /clientregistration` | Admin-key guarded client-registration REST surface |
+| `GET /tenants/public/.well-known/jwks.json` | Tenant JWKS metadata helper |
+
+The developer API intentionally does not expose `/tenant`, `/authorize`,
+`/token`, or service/workload administration routes.

tba_app_backend_developer-0.4.0.dev2/pyproject.toml

@@ -0,0 +1,27 @@
+[project]
+name = "tba-app-backend-developer"
+version = "0.4.0.dev2"
+description = "Developer OIDC/OAuth backend application for TBA."
+readme = "README.md"
+requires-python = ">=3.10,<3.15"
+license = "Apache-2.0"
+dependencies = [
+    "tba-auth==0.4.0.dev2",
+    "tba-app-backend-core==0.4.0.dev2",
+    "tba-router-administration-gate==0.4.0.dev2",
+    "tba-router-oauth-authorization-server-metadata==0.4.0.dev2",
+    "tba-router-oauth-registration==0.4.0.dev2",
+    "tba-router-oidc-discovery==0.4.0.dev2",
+]
+
+[project.urls]
+Homepage = "https://github.com/tigrbl/tigrbl_auth"
+Repository = "https://github.com/tigrbl/tigrbl_auth"
+Source = "https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/90-backend-apps/tba-app-backend-developer"
+
+[build-system]
+requires = ["poetry-core>=1.0.0"]
+build-backend = "poetry.core.masonry.api"
+
+[tool.poetry]
+packages = [{ include = "tba_app_backend_developer", from = "src" }]

tba_app_backend_developer-0.4.0.dev2/src/tba_app_backend_developer/__init__.py

@@ -0,0 +1,14 @@
+"""Developer backend application package for TBA."""
+
+from __future__ import annotations
+
+from .app import PRODUCT_SURFACE, app, build_app
+from .contract import DEVELOPER_BACKEND_APP_CONTRACT, DeveloperBackendAppContract
+
+__all__ = [
+    "DEVELOPER_BACKEND_APP_CONTRACT",
+    "DeveloperBackendAppContract",
+    "PRODUCT_SURFACE",
+    "app",
+    "build_app",
+]

tba_app_backend_developer-0.4.0.dev2/src/tba_app_backend_developer/app.py

@@ -0,0 +1,52 @@
+"""ASGI entrypoint for the developer TBA backend application."""
+
+from __future__ import annotations
+
+import os
+from typing import TYPE_CHECKING
+
+from tba_app_backend_core import build_product_app
+from tba_app_backend_developer.contract import DEVELOPER_BACKEND_APP_CONTRACT
+from tba_auth.runtime import LazyASGIApplication
+
+if TYPE_CHECKING:
+    from tigrbl import TigrblApp
+
+PRODUCT_SURFACE = "developer-app"
+
+
+def _default_settings() -> object:
+    from tba_auth.config.settings import Settings
+
+    settings = Settings()
+    env_overrides = {
+        "issuer": os.environ.get("AUTHN_ISSUER"),
+        "protected_resource_identifier": os.environ.get(
+            "TBA_AUTH_PROTECTED_RESOURCE_IDENTIFIER"
+        ),
+        "deployment_profile": os.environ.get("TBA_AUTH_PROFILE"),
+        "require_tls": os.environ.get("TBA_AUTH_REQUIRE_TLS"),
+        "admin_api_key": os.environ.get("TBA_AUTH_ADMIN_API_KEY"),
+        "admin_api_key_dir": os.environ.get("TBA_AUTH_ADMIN_API_KEY_DIR"),
+    }
+    for name, value in env_overrides.items():
+        if value in {None, ""}:
+            continue
+        current = getattr(settings, name, None)
+        if isinstance(current, bool):
+            value = str(value).lower() in {"1", "true", "yes", "on"}
+        setattr(settings, name, value)
+    return settings
+
+
+def build_app(settings_obj: object | None = None) -> "TigrblApp":
+    if settings_obj is None:
+        settings_obj = _default_settings()
+    return build_product_app(
+        PRODUCT_SURFACE, settings_obj, contract=DEVELOPER_BACKEND_APP_CONTRACT
+    )
+
+
+app = LazyASGIApplication(build_app)
+
+__all__ = ["PRODUCT_SURFACE", "app", "build_app"]

tba_app_backend_developer-0.4.0.dev2/src/tba_app_backend_developer/contract.py

@@ -0,0 +1,83 @@
+"""Developer backend-app contract for TBA."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True, slots=True)
+class DeveloperBackendAppContract:
+    """Machine-readable boundary for the developer self-service backend app."""
+
+    product_surface: str
+    intended_uix: str
+    public_capabilities: tuple[str, ...]
+    admin_resources: tuple[str, ...]
+    admin_rest_groups: tuple[str, ...]
+    forbidden_route_prefixes: tuple[str, ...]
+    forbidden_exact_routes: tuple[str, ...]
+    consumed_packages: tuple[str, ...]
+    mounted_router_packages: tuple[str, ...]
+    app_local_route_groups: tuple[str, ...]
+
+
+DEVELOPER_BACKEND_APP_CONTRACT = DeveloperBackendAppContract(
+    product_surface="developer-app",
+    intended_uix="@tba/ui-developer",
+    public_capabilities=(
+        "register",
+        "register-management",
+        "openid-configuration",
+        "tenant-openid-configuration",
+        "realm-openid-configuration",
+        "oauth-authorization-server-metadata",
+        "jwks",
+        "tenant-jwks",
+        "realm-jwks",
+    ),
+    admin_resources=("Client", "ClientRegistration", "AuditEvent"),
+    admin_rest_groups=(),
+    forbidden_route_prefixes=(
+        "/tenant",
+        "/user",
+        "/authsession",
+        "/consent",
+        "/serviceidentity",
+        "/credentialservicekey",
+        "/credentialapikey",
+        "/cryptokey",
+        "/cryptokeyversion",
+        "/principalkeybinding",
+        "/keyenvelope",
+        "/keyattestationevidence",
+        "/tokenrecord",
+        "/revokedtoken",
+    ),
+    forbidden_exact_routes=(
+        "/login",
+        "/authorize",
+        "/token",
+        "/logout",
+        "/revoke",
+        "/userinfo",
+        "/introspect",
+    ),
+    consumed_packages=(
+        "tba-auth",
+        "tba-server-identity",
+        "tba-runtime-identity",
+        "tba-runtime-identity-administration",
+        "tba-concrete-identity-principals",
+        "tba-protocol-oauth",
+        "tba-protocol-oidc",
+    ),
+    mounted_router_packages=(
+        "tba-router-administration-gate",
+        "tba-router-oauth-authorization-server-metadata",
+        "tba-router-oauth-registration",
+        "tba-router-oidc-discovery",
+    ),
+    app_local_route_groups=(),
+)
+
+__all__ = ["DEVELOPER_BACKEND_APP_CONTRACT", "DeveloperBackendAppContract"]