tba-app-backend-my-account 0.4.0.dev2__tar.gz

tba_app_backend_my_account-0.4.0.dev2/PKG-INFO

@@ -0,0 +1,44 @@
+Metadata-Version: 2.4
+Name: tba-app-backend-my-account
+Version: 0.4.0.dev2
+Summary: End-user account self-service backend application for TBA.
+License-Expression: Apache-2.0
+Requires-Python: >=3.10,<3.15
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: pydantic (==2.12.5)
+Requires-Dist: tba-app-backend-core (==0.4.0.dev2)
+Requires-Dist: tba-auth (==0.4.0.dev2)
+Requires-Dist: tba-capability-account-self-service (==0.4.0.dev2)
+Requires-Dist: tba-contracts-identity (==0.4.0.dev2)
+Requires-Dist: tba-router-oidc-discovery (==0.4.0.dev2)
+Requires-Dist: tba-server-identity (==0.4.0.dev2)
+Requires-Dist: tigrbl (==0.4.5.dev8)
+Project-URL: Homepage, https://github.com/tigrbl/tigrbl_auth
+Project-URL: Repository, https://github.com/tigrbl/tigrbl_auth
+Project-URL: Source, https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/90-backend-apps/tba-app-backend-my-account
+Description-Content-Type: text/markdown
+
+# tba-app-backend-my-account
+
+End-user self-service account API front door for TBA.
+
+This package exposes the authenticated current subject's account surface:
+
+- `GET /account/profile`
+- `PATCH /account/profile`
+- `GET /account/sessions`
+- `DELETE /account/sessions/{session_id}`
+- `GET /account/authorized-apps`
+- `DELETE /account/authorized-apps/{client_id}`
+- `GET /account/consents`
+- `DELETE /account/consents/{consent_id}`
+- `POST /account/password/change`
+
+It does not expose platform administration, tenant-wide user management, RPC,
+or table CRUD. All account operations are scoped to the authenticated end user.
+

tba_app_backend_my_account-0.4.0.dev2/README.md

@@ -0,0 +1,18 @@
+# tba-app-backend-my-account
+
+End-user self-service account API front door for TBA.
+
+This package exposes the authenticated current subject's account surface:
+
+- `GET /account/profile`
+- `PATCH /account/profile`
+- `GET /account/sessions`
+- `DELETE /account/sessions/{session_id}`
+- `GET /account/authorized-apps`
+- `DELETE /account/authorized-apps/{client_id}`
+- `GET /account/consents`
+- `DELETE /account/consents/{consent_id}`
+- `POST /account/password/change`
+
+It does not expose platform administration, tenant-wide user management, RPC,
+or table CRUD. All account operations are scoped to the authenticated end user.

tba_app_backend_my_account-0.4.0.dev2/pyproject.toml

@@ -0,0 +1,29 @@
+[project]
+name = "tba-app-backend-my-account"
+version = "0.4.0.dev2"
+description = "End-user account self-service backend application for TBA."
+readme = "README.md"
+requires-python = ">=3.10,<3.15"
+license = "Apache-2.0"
+dependencies = [
+    "pydantic==2.12.5",
+    "tba-auth==0.4.0.dev2",
+    "tba-app-backend-core==0.4.0.dev2",
+    "tigrbl==0.4.5.dev8",
+    "tba-capability-account-self-service==0.4.0.dev2",
+    "tba-contracts-identity==0.4.0.dev2",
+    "tba-server-identity==0.4.0.dev2",
+    "tba-router-oidc-discovery==0.4.0.dev2",
+]
+
+[project.urls]
+Homepage = "https://github.com/tigrbl/tigrbl_auth"
+Repository = "https://github.com/tigrbl/tigrbl_auth"
+Source = "https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/90-backend-apps/tba-app-backend-my-account"
+
+[build-system]
+requires = ["poetry-core>=1.0.0"]
+build-backend = "poetry.core.masonry.api"
+
+[tool.poetry]
+packages = [{ include = "tba_app_backend_my_account", from = "src" }]

tba_app_backend_my_account-0.4.0.dev2/src/tba_app_backend_my_account/__init__.py

@@ -0,0 +1,35 @@
+"""My Account backend application package for TBA."""
+
+from __future__ import annotations
+
+from .common import MyAccountMutationOut
+from .contract import MY_ACCOUNT_BACKEND_APP_CONTRACT, MyAccountBackendAppContract
+from .profiles import (
+    MyAccountPasswordChangeIn,
+    MyAccountProfileOut,
+    MyAccountProfileUpdateIn,
+)
+from .sessions import MyAccountSessionOut
+
+PRODUCT_SURFACE = "my-account-app"
+
+
+def __getattr__(name: str):
+    if name in {"app", "build_app"}:
+        from .app import app, build_app
+
+        return app if name == "app" else build_app
+    raise AttributeError(name)
+
+__all__ = [
+    "MY_ACCOUNT_BACKEND_APP_CONTRACT",
+    "MyAccountMutationOut",
+    "MyAccountPasswordChangeIn",
+    "MyAccountBackendAppContract",
+    "MyAccountProfileOut",
+    "MyAccountProfileUpdateIn",
+    "MyAccountSessionOut",
+    "PRODUCT_SURFACE",
+    "app",
+    "build_app",
+]

tba_app_backend_my_account-0.4.0.dev2/src/tba_app_backend_my_account/app.py

@@ -0,0 +1,132 @@
+"""ASGI entrypoint for the My Account TBA backend application."""
+
+from __future__ import annotations
+
+import os
+from typing import TYPE_CHECKING, Any, Awaitable, Callable
+
+from tba_app_backend_core import build_product_app
+from tba_app_backend_my_account.contract import MY_ACCOUNT_BACKEND_APP_CONTRACT
+from tba_auth.runtime import LazyASGIApplication
+from tba_app_backend_my_account.openapi import patch_my_account_openapi
+from tba_app_backend_my_account.routes import router as account_router
+
+if TYPE_CHECKING:
+    from tigrbl import TigrblApp
+
+PRODUCT_SURFACE = "my-account-app"
+DEFAULT_CORS_ORIGINS = ("http://localhost:3019", "http://127.0.0.1:3019")
+
+
+class MyAccountCors:
+    """Small ASGI CORS wrapper for the standalone My Account/UIX demo surface."""
+
+    def __init__(
+        self, app: Any, origins: tuple[str, ...] = DEFAULT_CORS_ORIGINS
+    ) -> None:
+        self.app = app
+        self.origins = origins
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self.app, name)
+
+    async def __call__(
+        self,
+        scope: dict[str, Any],
+        receive: Callable[[], Awaitable[dict[str, Any]]],
+        send: Callable[[dict[str, Any]], Awaitable[None]],
+    ) -> None:
+        if scope.get("type") != "http":
+            await self.app(scope, receive, send)
+            return
+
+        headers = {
+            key.decode("latin-1").lower(): value.decode("latin-1")
+            for key, value in scope.get("headers", [])
+        }
+        origin = headers.get("origin")
+        allowed_origin = origin if origin in self.origins else None
+
+        if str(scope.get("method", "")).upper() == "OPTIONS" and allowed_origin:
+            await send(
+                {
+                    "type": "http.response.start",
+                    "status": 204,
+                    "headers": self._cors_headers(allowed_origin)
+                    + [
+                        (
+                            b"access-control-allow-methods",
+                            b"GET,PATCH,POST,DELETE,OPTIONS",
+                        ),
+                        (
+                            b"access-control-allow-headers",
+                            headers.get(
+                                "access-control-request-headers",
+                                "content-type,authorization",
+                            ).encode("latin-1"),
+                        ),
+                        (b"content-length", b"0"),
+                    ],
+                }
+            )
+            await send({"type": "http.response.body", "body": b""})
+            return
+
+        async def cors_send(message: dict[str, Any]) -> None:
+            if message.get("type") == "http.response.start" and allowed_origin:
+                message = dict(message)
+                response_headers = list(message.get("headers", []))
+                response_headers.extend(self._cors_headers(allowed_origin))
+                message["headers"] = response_headers
+            await send(message)
+
+        await self.app(scope, receive, cors_send)
+
+    @staticmethod
+    def _cors_headers(origin: str) -> list[tuple[bytes, bytes]]:
+        return [
+            (b"access-control-allow-origin", origin.encode("latin-1")),
+            (b"access-control-allow-credentials", b"true"),
+            (b"vary", b"Origin"),
+        ]
+
+
+def _default_settings() -> object:
+    from tba_auth.config.settings import Settings
+
+    settings = Settings()
+    env_overrides = {
+        "issuer": os.environ.get("AUTHN_ISSUER"),
+        "protected_resource_identifier": os.environ.get(
+            "TBA_AUTH_PROTECTED_RESOURCE_IDENTIFIER"
+        ),
+        "deployment_profile": os.environ.get("TBA_AUTH_PROFILE"),
+        "require_tls": os.environ.get("TBA_AUTH_REQUIRE_TLS"),
+        "session_cookie_force_secure": os.environ.get(
+            "TBA_AUTH_SESSION_COOKIE_FORCE_SECURE"
+        ),
+    }
+    for name, value in env_overrides.items():
+        if value in {None, ""}:
+            continue
+        current = getattr(settings, name, None)
+        if isinstance(current, bool):
+            value = str(value).lower() in {"1", "true", "yes", "on"}
+        setattr(settings, name, value)
+    return settings
+
+
+def build_app(settings_obj: object | None = None) -> "TigrblApp":
+    if settings_obj is None:
+        settings_obj = _default_settings()
+    app = build_product_app(
+        PRODUCT_SURFACE, settings_obj, contract=MY_ACCOUNT_BACKEND_APP_CONTRACT
+    )
+    app.include_router(account_router)
+    app = patch_my_account_openapi(app)
+    return MyAccountCors(app)
+
+
+app = LazyASGIApplication(build_app)
+
+__all__ = ["PRODUCT_SURFACE", "app", "build_app"]

tba_app_backend_my_account-0.4.0.dev2/src/tba_app_backend_my_account/common.py

@@ -0,0 +1,58 @@
+"""Shared HTTP concerns for the My Account API product."""
+
+from __future__ import annotations
+
+import inspect
+from typing import Any
+
+from pydantic import BaseModel
+from tigrbl.requests import Request
+from tigrbl.security import Depends
+from tba_contracts_identity.account_self_service import AccountPrincipal
+from tba_server_identity.account_self_service import (
+    current_account_principal,
+    get_db,
+)
+
+
+class MyAccountMutationOut(BaseModel):
+    status: str
+    id: str | None = None
+
+
+async def current_principal_dependency(
+    request: Request,
+    authorization: str | None = None,
+    api_key: str | None = None,
+    dpop: str | None = None,
+    db: Any = Depends(get_db),
+) -> AccountPrincipal:
+    app_state = getattr(getattr(request, "app", None), "state", None)
+    provider = getattr(app_state, "tba_auth_account_principal_provider", None)
+    if callable(provider):
+        provided = provider(request)
+        principal = await provided if inspect.isawaitable(provided) else provided
+        if not isinstance(principal, AccountPrincipal):
+            raise TypeError("account principal provider returned an invalid principal")
+        return principal
+    headers = getattr(request, "headers", {})
+    authorization = (
+        authorization
+        or headers.get("Authorization", "")
+        or headers.get("authorization", "")
+    )
+    api_key = api_key or headers.get("x-api-key")
+    dpop = dpop or headers.get("DPoP") or headers.get("dpop")
+    return await current_account_principal(
+        request,
+        authorization=authorization,
+        api_key=api_key,
+        dpop=dpop,
+        db=db,
+    )
+
+
+__all__ = [
+    "MyAccountMutationOut",
+    "current_principal_dependency",
+]

tba_app_backend_my_account-0.4.0.dev2/src/tba_app_backend_my_account/consents.py

@@ -0,0 +1,164 @@
+"""Current-subject consent and authorized-application HTTP routes."""
+
+from __future__ import annotations
+
+from datetime import datetime
+from typing import Any
+from uuid import UUID
+
+from pydantic import BaseModel
+from tigrbl import TigrblRouter
+from tigrbl.requests import Request
+from tigrbl.runtime.status import HTTPException
+from tigrbl.security import Depends
+from tba_contracts_identity.account_self_service import (
+    AccountConsent,
+    AccountNotFoundError,
+    AccountPrincipal,
+)
+from tba_server_identity.account_self_service import (
+    account_principal,
+    account_self_service_for_request,
+    get_db,
+)
+
+from .common import current_principal_dependency
+
+
+router = TigrblRouter()
+MY_ACCOUNT_TAGS = ["My Account"]
+
+
+class MyAccountConsentOut(BaseModel):
+    id: UUID
+    tenant_id: UUID
+    user_id: UUID
+    client_id: UUID
+    scope: str
+    claims: dict[str, Any] | None = None
+    state: str
+    granted_at: datetime | None = None
+    expires_at: datetime | None = None
+    revoked_at: datetime | None = None
+
+
+class MyAccountAuthorizedAppOut(BaseModel):
+    client_id: UUID
+    tenant_id: UUID
+    scope: str
+    consent_state: str
+    granted_at: datetime | None = None
+    revoked_at: datetime | None = None
+
+
+def _consent_payload(record: AccountConsent) -> MyAccountConsentOut:
+    return MyAccountConsentOut(
+        id=record.consent_id,
+        tenant_id=record.tenant_id,
+        user_id=record.identity_id,
+        client_id=record.client_id,
+        scope=record.scope,
+        claims=dict(record.claims) if record.claims is not None else None,
+        state=record.state,
+        granted_at=record.granted_at,
+        expires_at=record.expires_at,
+        revoked_at=record.revoked_at,
+    )
+
+
+def _authorized_app_payload(record: AccountConsent) -> MyAccountAuthorizedAppOut:
+    return MyAccountAuthorizedAppOut(
+        client_id=record.client_id,
+        tenant_id=record.tenant_id,
+        scope=record.scope,
+        consent_state=record.state,
+        granted_at=record.granted_at,
+        revoked_at=record.revoked_at,
+    )
+
+
+@router.route(
+    "/account/consents",
+    methods=["GET"],
+    response_model=list[MyAccountConsentOut],
+    tags=MY_ACCOUNT_TAGS,
+)
+async def list_account_consents(
+    request: Request | None = None,
+    current_user: AccountPrincipal | object = Depends(current_principal_dependency),
+    db: Any = Depends(get_db),
+) -> list[MyAccountConsentOut]:
+    records = await account_self_service_for_request(
+        request or object(), db
+    ).list_consents(account_principal(current_user))
+    return [_consent_payload(record) for record in records]
+
+
+@router.route(
+    "/account/consents/{consent_id}",
+    methods=["DELETE"],
+    response_model=MyAccountConsentOut,
+    tags=MY_ACCOUNT_TAGS,
+)
+async def revoke_account_consent(
+    consent_id: str,
+    request: Request | None = None,
+    current_user: AccountPrincipal | object = Depends(current_principal_dependency),
+    db: Any = Depends(get_db),
+) -> MyAccountConsentOut:
+    try:
+        record = await account_self_service_for_request(
+            request or object(), db
+        ).revoke_consent(account_principal(current_user), consent_id)
+    except AccountNotFoundError as exc:
+        raise HTTPException(404, str(exc)) from exc
+    return _consent_payload(record)
+
+
+@router.route(
+    "/account/authorized-apps",
+    methods=["GET"],
+    response_model=list[MyAccountAuthorizedAppOut],
+    tags=MY_ACCOUNT_TAGS,
+)
+async def list_account_authorized_apps(
+    request: Request | None = None,
+    current_user: AccountPrincipal | object = Depends(current_principal_dependency),
+    db: Any = Depends(get_db),
+) -> list[MyAccountAuthorizedAppOut]:
+    records = await account_self_service_for_request(
+        request or object(), db
+    ).list_authorized_apps(account_principal(current_user))
+    return [_authorized_app_payload(record) for record in records]
+
+
+@router.route(
+    "/account/authorized-apps/{client_id}",
+    methods=["DELETE"],
+    response_model=list[MyAccountConsentOut],
+    tags=MY_ACCOUNT_TAGS,
+)
+async def revoke_account_authorized_app(
+    client_id: str,
+    request: Request | None = None,
+    current_user: AccountPrincipal | object = Depends(current_principal_dependency),
+    db: Any = Depends(get_db),
+) -> list[MyAccountConsentOut]:
+    try:
+        records = await account_self_service_for_request(
+            request or object(), db
+        ).revoke_authorized_app(account_principal(current_user), client_id)
+    except AccountNotFoundError as exc:
+        raise HTTPException(404, str(exc)) from exc
+    return [_consent_payload(record) for record in records]
+
+
+__all__ = [
+    "MyAccountAuthorizedAppOut",
+    "MyAccountConsentOut",
+    "list_account_authorized_apps",
+    "list_account_consents",
+    "revoke_account_authorized_app",
+    "revoke_account_consent",
+    "router",
+]

tba_app_backend_my_account-0.4.0.dev2/src/tba_app_backend_my_account/contract.py

@@ -0,0 +1,82 @@
+"""My Account backend-app contract for TBA."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True, slots=True)
+class MyAccountBackendAppContract:
+    """Machine-readable boundary for the end-user account backend app."""
+
+    product_surface: str
+    intended_uix: str
+    baseline_capabilities: tuple[str, ...]
+    forbidden_route_prefixes: tuple[str, ...]
+    forbidden_exact_routes: tuple[str, ...]
+    consumed_packages: tuple[str, ...]
+    mounted_router_packages: tuple[str, ...]
+    app_local_route_groups: tuple[str, ...]
+
+
+MY_ACCOUNT_BACKEND_APP_CONTRACT = MyAccountBackendAppContract(
+    product_surface="my-account-app",
+    intended_uix="@tba/ui-my-account",
+    baseline_capabilities=(
+        "account-profile",
+        "account-sessions",
+        "account-consents",
+        "account-credentials",
+        "rest-only",
+        "openid-configuration",
+        "tenant-openid-configuration",
+        "jwks",
+        "tenant-jwks",
+    ),
+    forbidden_route_prefixes=(
+        "/admin",
+        "/tenant",
+        "/client",
+        "/serviceidentity",
+        "/user",
+        "/credentialapikey",
+        "/credentialservicekey",
+        "/cryptokey",
+        "/cryptokeyversion",
+        "/principalkeybinding",
+        "/keyenvelope",
+        "/keyattestationevidence",
+        "/tokenrecord",
+        "/authsession",
+        "/auditevent",
+    ),
+    forbidden_exact_routes=(
+        "/login",
+        "/authorize",
+        "/token",
+        "/register",
+        "/logout",
+        "/revoke",
+        "/userinfo",
+        "/introspect",
+    ),
+    consumed_packages=(
+        "tba-auth",
+        "tba-server-identity",
+        "tba-runtime-identity",
+        "tba-concrete-identity-principals",
+        "tba-credentials",
+        "tba-runtime-authorization-policy",
+        "tba-protocol-oidc",
+        "tba-storage-core",
+    ),
+    mounted_router_packages=("tba-router-oidc-discovery",),
+    app_local_route_groups=(
+        "profiles",
+        "sessions",
+        "consents",
+        "credentials",
+    ),
+)
+
+__all__ = ["MY_ACCOUNT_BACKEND_APP_CONTRACT", "MyAccountBackendAppContract"]

tba_app_backend_my_account-0.4.0.dev2/src/tba_app_backend_my_account/openapi.py

@@ -0,0 +1,52 @@
+"""OpenAPI affordances for the My Account backend app."""
+
+from __future__ import annotations
+
+from dataclasses import replace
+from typing import Any, Callable
+
+
+def patch_my_account_openapi(app: object) -> object:
+    """Patch generated OpenAPI metadata for the My Account surface."""
+    target = getattr(app, "app", app)
+    original_openapi: Callable[[], dict[str, Any]] = target.openapi
+
+    def my_account_openapi() -> dict[str, Any]:
+        cached = getattr(target, "openapi_schema", None)
+        if cached:
+            return cached
+        openapi = original_openapi()
+        openapi["title"] = "tba-app-backend-my-account"
+        for path, methods in openapi.get("paths", {}).items():
+            if path.startswith("/account/"):
+                for operation in methods.values():
+                    operation["tags"] = ["My Account"]
+        setattr(target, "openapi_schema", openapi)
+        return openapi
+
+    target.openapi = my_account_openapi
+    if target is not app:
+        app.openapi = my_account_openapi
+
+    routes = getattr(target, "_routes", None)
+    if isinstance(routes, list):
+        from tigrbl_concrete._concrete._response import Response
+
+        def _openapi_handler(request: Any) -> Response:
+            return Response.json(my_account_openapi())
+
+        patched_routes = []
+        for route in routes:
+            path = str(
+                getattr(route, "path_template", None) or getattr(route, "path", "")
+            )
+            methods = set(getattr(route, "methods", ()) or ())
+            if path == "/openapi.json" and "GET" in methods:
+                patched_routes.append(replace(route, handler=_openapi_handler))
+            else:
+                patched_routes.append(route)
+        routes[:] = patched_routes
+    return app
+
+
+__all__ = ["patch_my_account_openapi"]

tba_app_backend_my_account-0.4.0.dev2/src/tba_app_backend_my_account/profiles.py

@@ -0,0 +1,177 @@
+"""Current-subject profile and password HTTP routes."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from pydantic import BaseModel, Field, constr
+from tigrbl import TigrblRouter
+from tigrbl.requests import Request
+from tigrbl.runtime.status import HTTPException
+from tigrbl.security import Depends
+from tba_contracts_identity.account_self_service import (
+    AccountAuthenticationError,
+    AccountPrincipal,
+    AccountProfile,
+    AccountProfileUpdate,
+    AccountValidationError,
+)
+from tba_server_identity.account_self_service import (
+    account_principal,
+    account_self_service_for_request,
+    get_db,
+)
+
+from .common import MyAccountMutationOut, current_principal_dependency
+
+
+_email = constr(strip_whitespace=True, min_length=3, max_length=120)
+_password = constr(min_length=8, max_length=256)
+_username = constr(strip_whitespace=True, min_length=3, max_length=80)
+
+
+class MyAccountProfileOut(BaseModel):
+    id: str
+    tenant_id: str
+    username: str
+    email: str
+    is_active: bool = True
+    must_change_password: bool = False
+    roles: list[str] = Field(default_factory=list)
+    created_at: str | None = None
+    updated_at: str | None = None
+
+
+class MyAccountProfileUpdateIn(BaseModel):
+    username: _username | None = None
+    email: _email | None = None
+
+
+class MyAccountPasswordChangeIn(BaseModel):
+    current_password: _password
+    new_password: _password
+
+
+def _profile_payload(profile: AccountProfile) -> MyAccountProfileOut:
+    return MyAccountProfileOut(
+        id=profile.identity_id,
+        tenant_id=profile.tenant_id,
+        username=profile.username,
+        email=profile.email,
+        is_active=profile.is_active,
+        must_change_password=profile.must_change_password,
+        roles=list(profile.roles),
+        created_at=profile.created_at,
+        updated_at=profile.updated_at,
+    )
+
+
+async def _principal(
+    request: Request | None, current_user: object | None, db: object
+) -> AccountPrincipal:
+    if current_user is not None:
+        return account_principal(current_user)
+    if request is None:
+        raise HTTPException(401, "authenticated account required")
+    return await current_principal_dependency(request, db=db)
+
+
+def _capability(request: Request | None, db: object):
+    return (
+        account_self_service_for_request(request, db)
+        if request
+        else account_self_service_for_request(object(), db)
+    )
+
+
+def _raise_http(exc: Exception) -> None:
+    if isinstance(exc, AccountAuthenticationError):
+        raise HTTPException(401, str(exc)) from exc
+    if isinstance(exc, AccountValidationError):
+        raise HTTPException(400, str(exc)) from exc
+    raise exc
+
+
+router = TigrblRouter()
+MY_ACCOUNT_TAGS = ["My Account"]
+
+
+@router.route(
+    "/account/profile",
+    methods=["GET"],
+    response_model=MyAccountProfileOut,
+    tags=MY_ACCOUNT_TAGS,
+)
+async def get_account_profile(
+    request: Request | None = None,
+    current_user: object | None = None,
+    db: Any = Depends(get_db),
+) -> MyAccountProfileOut:
+    principal = await _principal(request, current_user, db)
+    try:
+        return _profile_payload(await _capability(request, db).get_profile(principal))
+    except (AccountAuthenticationError, AccountValidationError) as exc:
+        _raise_http(exc)
+
+
+@router.route(
+    "/account/profile",
+    methods=["PATCH"],
+    response_model=MyAccountProfileOut,
+    tags=MY_ACCOUNT_TAGS,
+)
+async def update_account_profile(
+    request: Request | None = None,
+    payload: MyAccountProfileUpdateIn | None = None,
+    current_user: object | None = None,
+    db: Any = Depends(get_db),
+) -> MyAccountProfileOut:
+    principal = await _principal(request, current_user, db)
+    if payload is None:
+        if request is None:
+            raise HTTPException(400, "request payload required")
+        payload = MyAccountProfileUpdateIn.model_validate(await request.json() or {})
+    try:
+        profile = await _capability(request, db).update_profile(
+            principal, AccountProfileUpdate(payload.username, payload.email)
+        )
+        return _profile_payload(profile)
+    except (AccountAuthenticationError, AccountValidationError) as exc:
+        _raise_http(exc)
+
+
+@router.route(
+    "/account/password/change",
+    methods=["POST"],
+    response_model=MyAccountMutationOut,
+    tags=MY_ACCOUNT_TAGS,
+)
+async def change_account_password(
+    request: Request | None = None,
+    payload: MyAccountPasswordChangeIn | None = None,
+    current_user: object | None = None,
+    db: Any = Depends(get_db),
+) -> MyAccountMutationOut:
+    principal = await _principal(request, current_user, db)
+    if payload is None:
+        if request is None:
+            raise HTTPException(400, "request payload required")
+        payload = MyAccountPasswordChangeIn.model_validate(await request.json() or {})
+    try:
+        result = await _capability(request, db).change_password(
+            principal, payload.current_password, payload.new_password
+        )
+        return MyAccountMutationOut(status=result.status, id=result.resource_id)
+    except (AccountAuthenticationError, AccountValidationError) as exc:
+        _raise_http(exc)
+
+
+__all__ = [
+    "MyAccountPasswordChangeIn",
+    "MyAccountProfileOut",
+    "MyAccountProfileUpdateIn",
+    "change_account_password",
+    "get_account_profile",
+    "router",
+    "update_account_profile",
+]

tba_app_backend_my_account-0.4.0.dev2/src/tba_app_backend_my_account/routes.py

@@ -0,0 +1,18 @@
+"""HTTP route composition for the My Account API product."""
+
+from __future__ import annotations
+
+from tigrbl import TigrblRouter
+
+from .consents import router as consent_router
+from .profiles import router as profile_router
+from .sessions import router as session_router
+
+
+router = TigrblRouter()
+router.include_router(profile_router)
+router.include_router(session_router)
+router.include_router(consent_router)
+
+
+__all__ = ["router"]

tba_app_backend_my_account-0.4.0.dev2/src/tba_app_backend_my_account/sessions.py

@@ -0,0 +1,102 @@
+"""Current-subject authentication-session HTTP routes."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from pydantic import BaseModel
+from tigrbl import TigrblRouter
+from tigrbl.requests import Request
+from tigrbl.runtime.status import HTTPException
+from tigrbl.security import Depends
+from tba_contracts_identity.account_self_service import (
+    AccountNotFoundError,
+    AccountPrincipal,
+    AccountSession,
+)
+from tba_server_identity.account_self_service import (
+    account_principal,
+    account_self_service_for_request,
+    get_db,
+)
+
+from .common import MyAccountMutationOut, current_principal_dependency
+
+
+class MyAccountSessionOut(BaseModel):
+    id: str
+    tenant_id: str
+    user_id: str
+    username: str
+    client_id: str | None = None
+    state: str = "active"
+    auth_time: str | None = None
+    last_seen_at: str | None = None
+    expires_at: str | None = None
+    ended_at: str | None = None
+
+
+def _session_payload(session: AccountSession) -> MyAccountSessionOut:
+    return MyAccountSessionOut(
+        id=session.session_id,
+        tenant_id=session.tenant_id,
+        user_id=session.identity_id,
+        username=session.username,
+        client_id=session.client_id,
+        state=session.state,
+        auth_time=session.auth_time,
+        last_seen_at=session.last_seen_at,
+        expires_at=session.expires_at,
+        ended_at=session.ended_at,
+    )
+
+
+router = TigrblRouter()
+MY_ACCOUNT_TAGS = ["My Account"]
+
+
+@router.route(
+    "/account/sessions",
+    methods=["GET"],
+    response_model=list[MyAccountSessionOut],
+    tags=MY_ACCOUNT_TAGS,
+)
+async def list_account_sessions(
+    request: Request | None = None,
+    current_user: AccountPrincipal | object = Depends(current_principal_dependency),
+    db: Any = Depends(get_db),
+) -> list[MyAccountSessionOut]:
+    principal = account_principal(current_user)
+    sessions = await account_self_service_for_request(
+        request or object(), db
+    ).list_sessions(principal)
+    return [_session_payload(session) for session in sessions]
+
+
+@router.route(
+    "/account/sessions/{session_id}",
+    methods=["DELETE"],
+    response_model=MyAccountMutationOut,
+    tags=MY_ACCOUNT_TAGS,
+)
+async def revoke_account_session(
+    session_id: str,
+    request: Request | None = None,
+    current_user: AccountPrincipal | object = Depends(current_principal_dependency),
+    db: Any = Depends(get_db),
+) -> MyAccountMutationOut:
+    try:
+        result = await account_self_service_for_request(
+            request or object(), db
+        ).revoke_session(account_principal(current_user), session_id)
+    except AccountNotFoundError as exc:
+        raise HTTPException(404, str(exc)) from exc
+    return MyAccountMutationOut(status=result.status, id=result.resource_id)
+
+
+__all__ = [
+    "MyAccountSessionOut",
+    "list_account_sessions",
+    "revoke_account_session",
+    "router",
+]