tba-app-backend-public 0.4.0.dev2__tar.gz

tba_app_backend_public-0.4.0.dev2/PKG-INFO

@@ -0,0 +1,75 @@
+Metadata-Version: 2.4
+Name: tba-app-backend-public
+Version: 0.4.0.dev2
+Summary: Public OAuth/OIDC and human-login backend application for TBA.
+License-Expression: Apache-2.0
+Requires-Python: >=3.10,<3.15
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: tba-app-backend-core (==0.4.0.dev2)
+Requires-Dist: tba-auth (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-authorization (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-authorization-server-metadata (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-device-authorization (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-introspection (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-protected-resource-metadata (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-pushed-authorization-request (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-registration (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-revocation (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-token (==0.4.0.dev2)
+Requires-Dist: tba-router-oauth-token-exchange (==0.4.0.dev2)
+Requires-Dist: tba-router-oidc-discovery (==0.4.0.dev2)
+Requires-Dist: tba-router-oidc-logout (==0.4.0.dev2)
+Requires-Dist: tba-router-oidc-userinfo (==0.4.0.dev2)
+Requires-Dist: tba-router-session-login (==0.4.0.dev2)
+Requires-Dist: tba-router-webauthn (==0.4.0.dev2)
+Project-URL: Homepage, https://github.com/tigrbl/tigrbl_auth
+Project-URL: Repository, https://github.com/tigrbl/tigrbl_auth
+Project-URL: Source, https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/90-backend-apps/tba-app-backend-public
+Description-Content-Type: text/markdown
+
+# tba-app-backend-public
+
+Public OAuth/OIDC and white-label login API front door.
+
+## Surface
+
+| Property | Value |
+| --- | --- |
+| Product surface | `public-app` |
+| Intended UIX | `@tba/ui-public` |
+| Exposes | Login, authorize, token, logout, registration, discovery, JWKS, and public OAuth/OIDC helpers |
+| Excludes | `/admin/*`, `/rpc`, diagnostics, tenant lifecycle administration |
+
+## Entrypoint
+
+```python
+from tba_app_backend_public import app, build_app
+```
+
+## Docker dev deployment
+
+From the repository root:
+
+```bash
+docker compose -f docker/docker-compose.public-app.yml up -d --build
+```
+
+The dev deployment publishes the public API on `http://localhost:8013`.
+It runs the `production` profile with TLS disabled for local development so
+registration, login, authorization, token, discovery, and JWKS routes are
+available on the same localhost issuer.
+
+Useful checks:
+
+```bash
+curl http://localhost:8013/.well-known/openid-configuration
+curl http://localhost:8013/.well-known/jwks.json
+curl -i http://localhost:8013/tenant
+curl -i http://localhost:8013/diagnostics
+```
+

tba_app_backend_public-0.4.0.dev2/README.md

@@ -0,0 +1,40 @@
+# tba-app-backend-public
+
+Public OAuth/OIDC and white-label login API front door.
+
+## Surface
+
+| Property | Value |
+| --- | --- |
+| Product surface | `public-app` |
+| Intended UIX | `@tba/ui-public` |
+| Exposes | Login, authorize, token, logout, registration, discovery, JWKS, and public OAuth/OIDC helpers |
+| Excludes | `/admin/*`, `/rpc`, diagnostics, tenant lifecycle administration |
+
+## Entrypoint
+
+```python
+from tba_app_backend_public import app, build_app
+```
+
+## Docker dev deployment
+
+From the repository root:
+
+```bash
+docker compose -f docker/docker-compose.public-app.yml up -d --build
+```
+
+The dev deployment publishes the public API on `http://localhost:8013`.
+It runs the `production` profile with TLS disabled for local development so
+registration, login, authorization, token, discovery, and JWKS routes are
+available on the same localhost issuer.
+
+Useful checks:
+
+```bash
+curl http://localhost:8013/.well-known/openid-configuration
+curl http://localhost:8013/.well-known/jwks.json
+curl -i http://localhost:8013/tenant
+curl -i http://localhost:8013/diagnostics
+```

tba_app_backend_public-0.4.0.dev2/pyproject.toml

@@ -0,0 +1,38 @@
+[project]
+name = "tba-app-backend-public"
+version = "0.4.0.dev2"
+description = "Public OAuth/OIDC and human-login backend application for TBA."
+readme = "README.md"
+requires-python = ">=3.10,<3.15"
+license = "Apache-2.0"
+dependencies = [
+    "tba-auth==0.4.0.dev2",
+    "tba-app-backend-core==0.4.0.dev2",
+    "tba-router-oauth-authorization==0.4.0.dev2",
+    "tba-router-oauth-authorization-server-metadata==0.4.0.dev2",
+    "tba-router-oauth-device-authorization==0.4.0.dev2",
+    "tba-router-oauth-introspection==0.4.0.dev2",
+    "tba-router-oauth-pushed-authorization-request==0.4.0.dev2",
+    "tba-router-oauth-protected-resource-metadata==0.4.0.dev2",
+    "tba-router-oauth-registration==0.4.0.dev2",
+    "tba-router-oauth-revocation==0.4.0.dev2",
+    "tba-router-oauth-token==0.4.0.dev2",
+    "tba-router-oauth-token-exchange==0.4.0.dev2",
+    "tba-router-oidc-discovery==0.4.0.dev2",
+    "tba-router-oidc-logout==0.4.0.dev2",
+    "tba-router-oidc-userinfo==0.4.0.dev2",
+    "tba-router-session-login==0.4.0.dev2",
+    "tba-router-webauthn==0.4.0.dev2",
+]
+
+[project.urls]
+Homepage = "https://github.com/tigrbl/tigrbl_auth"
+Repository = "https://github.com/tigrbl/tigrbl_auth"
+Source = "https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/90-backend-apps/tba-app-backend-public"
+
+[build-system]
+requires = ["poetry-core>=1.0.0"]
+build-backend = "poetry.core.masonry.api"
+
+[tool.poetry]
+packages = [{ include = "tba_app_backend_public", from = "src" }]

tba_app_backend_public-0.4.0.dev2/src/tba_app_backend_public/__init__.py

@@ -0,0 +1,14 @@
+"""Public backend application package for TBA."""
+
+from __future__ import annotations
+
+from .app import PRODUCT_SURFACE, app, build_app
+from .contract import PUBLIC_BACKEND_APP_CONTRACT, PublicBackendAppContract
+
+__all__ = [
+    "PRODUCT_SURFACE",
+    "PUBLIC_BACKEND_APP_CONTRACT",
+    "PublicBackendAppContract",
+    "app",
+    "build_app",
+]

tba_app_backend_public-0.4.0.dev2/src/tba_app_backend_public/app.py

@@ -0,0 +1,64 @@
+"""ASGI entrypoint for the public TBA backend application."""
+
+from __future__ import annotations
+
+import os
+from typing import TYPE_CHECKING
+
+from tba_app_backend_core import build_product_app
+from tba_app_backend_public.contract import PUBLIC_BACKEND_APP_CONTRACT
+from tba_auth.runtime import LazyASGIApplication
+from tba_app_backend_public.openapi import patch_public_openapi
+
+if TYPE_CHECKING:
+    from tigrbl import TigrblApp
+
+PRODUCT_SURFACE = "public-app"
+
+
+def _default_settings() -> object:
+    from tba_auth.config.settings import Settings
+
+    settings = Settings()
+    env_overrides = {
+        "issuer": os.environ.get("AUTHN_ISSUER"),
+        "protected_resource_identifier": os.environ.get(
+            "TBA_AUTH_PROTECTED_RESOURCE_IDENTIFIER"
+        ),
+        "deployment_profile": os.environ.get("TBA_AUTH_PROFILE"),
+        "require_tls": os.environ.get("TBA_AUTH_REQUIRE_TLS"),
+        "session_cookie_force_secure": os.environ.get(
+            "TBA_AUTH_SESSION_COOKIE_FORCE_SECURE"
+        ),
+        "enable_rfc9207": os.environ.get("TBA_AUTH_ENABLE_RFC9207"),
+    }
+    for name, value in env_overrides.items():
+        if value in {None, ""}:
+            continue
+        current = getattr(settings, name, None)
+        if isinstance(current, bool):
+            value = str(value).lower() in {"1", "true", "yes", "on"}
+        setattr(settings, name, value)
+    return settings
+
+
+def _package_default_profile(settings_obj: object | None = None) -> str:
+    resolved = settings_obj if settings_obj is not None else _default_settings()
+    configured = str(getattr(resolved, "deployment_profile", "baseline") or "baseline")
+    return configured if configured != "baseline" else "production"
+
+
+def build_app(settings_obj: object | None = None) -> "TigrblApp":
+    if settings_obj is None:
+        settings_obj = _default_settings()
+        settings_obj.deployment_profile = _package_default_profile(settings_obj)
+    return patch_public_openapi(
+        build_product_app(
+            PRODUCT_SURFACE, settings_obj, contract=PUBLIC_BACKEND_APP_CONTRACT
+        )
+    )
+
+
+app = LazyASGIApplication(build_app)
+
+__all__ = ["PRODUCT_SURFACE", "_package_default_profile", "app", "build_app"]

tba_app_backend_public-0.4.0.dev2/src/tba_app_backend_public/contract.py

@@ -0,0 +1,110 @@
+"""Public backend-app contract for TBA."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True, slots=True)
+class PublicBackendAppContract:
+    """Machine-readable boundary for the public OAuth/OIDC backend app."""
+
+    product_surface: str
+    intended_uix: str
+    baseline_capabilities: tuple[str, ...]
+    production_capabilities: tuple[str, ...]
+    forbidden_route_prefixes: tuple[str, ...]
+    forbidden_exact_routes: tuple[str, ...]
+    consumed_packages: tuple[str, ...]
+    mounted_router_packages: tuple[str, ...]
+    app_local_route_groups: tuple[str, ...]
+
+
+PUBLIC_BACKEND_APP_CONTRACT = PublicBackendAppContract(
+    product_surface="public-app",
+    intended_uix="@tba/ui-public",
+    baseline_capabilities=(
+        "login",
+        "authorize",
+        "token",
+        "rest-only",
+        "openid-configuration",
+        "tenant-openid-configuration",
+        "oauth-authorization-server-metadata",
+        "jwks",
+        "tenant-jwks",
+        "standards-manifest",
+        "oid4vci-credential",
+        "oid4vp-verification",
+        "authzen-evaluation",
+        "gnap-transaction",
+        "set-receiver",
+        "attestation-appraisal",
+    ),
+    production_capabilities=(
+        "login",
+        "authorize",
+        "token",
+        "userinfo",
+        "introspection",
+        "register",
+        "register-management",
+        "revoke",
+        "logout",
+        "openid-configuration",
+        "tenant-openid-configuration",
+        "oauth-authorization-server-metadata",
+        "oauth-protected-resource-metadata",
+        "jwks",
+        "tenant-jwks",
+        "standards-manifest",
+        "oid4vci-credential",
+        "oid4vp-verification",
+        "authzen-evaluation",
+        "gnap-transaction",
+        "set-receiver",
+        "attestation-appraisal",
+    ),
+    forbidden_route_prefixes=(
+        "/admin",
+        "/cryptokey",
+        "/cryptokeyversion",
+        "/principalkeybinding",
+        "/keyenvelope",
+        "/keyattestationevidence",
+        "/tenant/",
+        "/diagnostics",
+    ),
+    forbidden_exact_routes=("/tenant",),
+    consumed_packages=(
+        "tba-auth",
+        "tba-server-identity",
+        "tba-runtime-identity",
+        "tba-protocol-oauth",
+        "tba-protocol-oidc",
+        "tba-provider-identity-jose",
+        "tba-protocol-oid4vci",
+        "tba-protocol-oid4vp",
+        "tba-profile-haip",
+    ),
+    mounted_router_packages=(
+        "tba-router-oauth-authorization",
+        "tba-router-oauth-authorization-server-metadata",
+        "tba-router-oauth-device-authorization",
+        "tba-router-oauth-introspection",
+        "tba-router-oauth-pushed-authorization-request",
+        "tba-router-oauth-protected-resource-metadata",
+        "tba-router-oauth-registration",
+        "tba-router-oauth-revocation",
+        "tba-router-oauth-token",
+        "tba-router-oauth-token-exchange",
+        "tba-router-oidc-discovery",
+        "tba-router-oidc-logout",
+        "tba-router-oidc-userinfo",
+        "tba-router-session-login",
+        "tba-router-webauthn",
+    ),
+    app_local_route_groups=(),
+)
+
+__all__ = ["PUBLIC_BACKEND_APP_CONTRACT", "PublicBackendAppContract"]

tba_app_backend_public-0.4.0.dev2/src/tba_app_backend_public/openapi.py

@@ -0,0 +1,350 @@
+"""OpenAPI affordances for the public backend app.
+
+The shared runtime intentionally hand-parses several OAuth/OIDC endpoints so it
+can accept exact protocol wire formats. Tigrbl cannot infer request bodies from
+those handlers, so this package overlays the public front-door documentation.
+"""
+
+from __future__ import annotations
+
+from copy import deepcopy
+from dataclasses import replace
+from typing import Any, Callable
+
+
+_LOGIN_BODY = {
+    "required": True,
+    "content": {
+        "application/json": {
+            "schema": {"$ref": "#/components/schemas/CredsIn"},
+            "example": {"identifier": "admin", "password": "AdminPass123!"},
+        }
+    },
+}
+
+_REGISTER_BODY = {
+    "required": True,
+    "content": {
+        "application/json": {
+            "schema": {"$ref": "#/components/schemas/DynamicClientRegistrationIn"},
+            "example": {
+                "tenant_slug": "public",
+                "redirect_uris": ["http://127.0.0.1:8080/callback"],
+                "grant_types": ["authorization_code", "refresh_token", "password"],
+                "response_types": ["code"],
+                "token_endpoint_auth_method": "client_secret_post",
+                "client_name": "Local dev client",
+                "scope": "openid profile email",
+            },
+        }
+    },
+}
+
+_TOKEN_BODY = {
+    "required": True,
+    "content": {
+        "application/x-www-form-urlencoded": {
+            "schema": {
+                "type": "object",
+                "required": ["grant_type", "client_id"],
+                "properties": {
+                    "grant_type": {
+                        "type": "string",
+                        "enum": [
+                            "authorization_code",
+                            "client_credentials",
+                            "password",
+                            "refresh_token",
+                        ],
+                    },
+                    "client_id": {"type": "string"},
+                    "client_secret": {"type": "string"},
+                    "username": {"type": "string"},
+                    "password": {"type": "string", "format": "password"},
+                    "scope": {"type": "string"},
+                    "code": {"type": "string"},
+                    "redirect_uri": {"type": "string", "format": "uri"},
+                    "code_verifier": {"type": "string"},
+                    "refresh_token": {"type": "string"},
+                    "resource": {"type": "string"},
+                },
+            },
+            "examples": {
+                "password": {
+                    "summary": "Password grant after dynamic client registration",
+                    "value": {
+                        "grant_type": "password",
+                        "client_id": "<registered-client-id>",
+                        "client_secret": "<registered-client-secret>",
+                        "username": "admin",
+                        "password": "AdminPass123!",
+                        "scope": "openid profile email",
+                    },
+                },
+                "authorization_code": {
+                    "summary": "Authorization code exchange",
+                    "value": {
+                        "grant_type": "authorization_code",
+                        "client_id": "<registered-client-id>",
+                        "client_secret": "<registered-client-secret>",
+                        "code": "<authorization-code>",
+                        "redirect_uri": "http://127.0.0.1:8080/callback",
+                        "code_verifier": "<pkce-code-verifier>",
+                    },
+                },
+            },
+        }
+    },
+}
+
+_LOGOUT_BODY = {
+    "required": False,
+    "content": {
+        "application/json": {
+            "schema": {"$ref": "#/components/schemas/LogoutIn"},
+            "example": {"client_id": "<registered-client-id>", "state": "dev-state"},
+        }
+    },
+}
+
+_TOKEN_REFERENCE_BODY = {
+    "required": True,
+    "content": {
+        "application/x-www-form-urlencoded": {
+            "schema": {
+                "type": "object",
+                "required": ["token"],
+                "properties": {
+                    "token": {"type": "string"},
+                    "token_type_hint": {"type": "string"},
+                    "client_id": {"type": "string"},
+                    "client_secret": {"type": "string"},
+                },
+            }
+        }
+    },
+}
+
+_AUTHORIZE_PARAMS = [
+    {
+        "name": "response_type",
+        "in": "query",
+        "required": True,
+        "schema": {"type": "string", "default": "code"},
+    },
+    {
+        "name": "client_id",
+        "in": "query",
+        "required": True,
+        "schema": {"type": "string"},
+    },
+    {
+        "name": "redirect_uri",
+        "in": "query",
+        "required": True,
+        "schema": {
+            "type": "string",
+            "format": "uri",
+            "default": "http://127.0.0.1:8080/callback",
+        },
+    },
+    {
+        "name": "scope",
+        "in": "query",
+        "required": False,
+        "schema": {"type": "string", "default": "openid profile email"},
+    },
+    {
+        "name": "state",
+        "in": "query",
+        "required": False,
+        "schema": {"type": "string", "default": "dev-state"},
+    },
+    {
+        "name": "nonce",
+        "in": "query",
+        "required": False,
+        "schema": {"type": "string", "default": "dev-nonce"},
+    },
+    {
+        "name": "code_challenge",
+        "in": "query",
+        "required": True,
+        "schema": {
+            "type": "string",
+            "default": "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
+        },
+    },
+    {
+        "name": "code_challenge_method",
+        "in": "query",
+        "required": True,
+        "schema": {"type": "string", "enum": ["S256"], "default": "S256"},
+    },
+]
+
+
+def _ensure_schema(openapi: dict[str, Any], name: str, schema: dict[str, Any]) -> None:
+    components = openapi.setdefault("components", {})
+    schemas = components.setdefault("schemas", {})
+    schemas.setdefault(name, schema)
+
+
+def _operation(openapi: dict[str, Any], path: str, method: str) -> dict[str, Any]:
+    return openapi.setdefault("paths", {}).setdefault(path, {}).setdefault(method, {})
+
+
+def _replace_params(operation: dict[str, Any], params: list[dict[str, Any]]) -> None:
+    existing = operation.get("parameters") or []
+    preserved = [
+        param
+        for param in existing
+        if (param.get("in"), param.get("name"))
+        not in {(item["in"], item["name"]) for item in params}
+    ]
+    operation["parameters"] = preserved + deepcopy(params)
+
+
+def patch_public_openapi(app: object) -> object:
+    """Patch generated OpenAPI for public protocol endpoints."""
+    target = getattr(app, "app", app)
+    original_openapi: Callable[[], dict[str, Any]] = target.openapi
+
+    def public_openapi() -> dict[str, Any]:
+        cached = getattr(target, "openapi_schema", None)
+        if cached:
+            return cached
+
+        openapi = original_openapi()
+        _ensure_schema(
+            openapi,
+            "CredsIn",
+            {
+                "type": "object",
+                "required": ["identifier", "password"],
+                "properties": {
+                    "identifier": {"type": "string", "minLength": 3},
+                    "password": {
+                        "type": "string",
+                        "format": "password",
+                        "minLength": 8,
+                    },
+                },
+            },
+        )
+        _ensure_schema(
+            openapi,
+            "DynamicClientRegistrationIn",
+            {
+                "type": "object",
+                "required": ["redirect_uris"],
+                "properties": {
+                    "tenant_slug": {"type": "string", "default": "public"},
+                    "redirect_uris": {
+                        "type": "array",
+                        "items": {"type": "string", "format": "uri"},
+                    },
+                    "grant_types": {
+                        "type": "array",
+                        "items": {"type": "string"},
+                        "default": ["authorization_code"],
+                    },
+                    "response_types": {
+                        "type": "array",
+                        "items": {"type": "string"},
+                        "default": ["code"],
+                    },
+                    "token_endpoint_auth_method": {
+                        "type": "string",
+                        "default": "client_secret_basic",
+                    },
+                    "scope": {"type": "string"},
+                    "client_name": {"type": "string"},
+                },
+            },
+        )
+        _ensure_schema(
+            openapi,
+            "LogoutIn",
+            {
+                "type": "object",
+                "properties": {
+                    "id_token_hint": {"type": "string"},
+                    "post_logout_redirect_uri": {"type": "string", "format": "uri"},
+                    "state": {"type": "string"},
+                    "sid": {"type": "string"},
+                    "client_id": {"type": "string"},
+                },
+            },
+        )
+
+        _operation(openapi, "/login", "post")["requestBody"] = deepcopy(_LOGIN_BODY)
+        _operation(openapi, "/register", "post")["requestBody"] = deepcopy(
+            _REGISTER_BODY
+        )
+        _operation(openapi, "/token", "post")["requestBody"] = deepcopy(_TOKEN_BODY)
+        _operation(openapi, "/logout", "post")["requestBody"] = deepcopy(_LOGOUT_BODY)
+        _operation(openapi, "/revoke", "post")["requestBody"] = deepcopy(
+            _TOKEN_REFERENCE_BODY
+        )
+        if "/introspect" in openapi.get("paths", {}):
+            _operation(openapi, "/introspect", "post")["requestBody"] = deepcopy(
+                _TOKEN_REFERENCE_BODY
+            )
+        if "/authorize" in openapi.get("paths", {}):
+            _replace_params(_operation(openapi, "/authorize", "get"), _AUTHORIZE_PARAMS)
+
+        setattr(target, "openapi_schema", openapi)
+        return openapi
+
+    target.openapi = public_openapi
+    if target is not app:
+        app.openapi = public_openapi
+
+    routes = getattr(target, "_routes", None)
+    if isinstance(routes, list):
+        from tigrbl_concrete._concrete._response import Response
+
+        def _openapi_handler(request: Any) -> Response:
+            return Response.json(public_openapi())
+
+        patched_routes = []
+        for route in routes:
+            path = str(
+                getattr(route, "path_template", None) or getattr(route, "path", "")
+            )
+            methods = set(getattr(route, "methods", ()) or ())
+            if path == "/openapi.json" and "GET" in methods:
+                patched_routes.append(replace(route, handler=_openapi_handler))
+            else:
+                patched_routes.append(route)
+        routes[:] = patched_routes
+    return PublicOpenAPIGate(app)
+
+
+__all__ = ["patch_public_openapi"]
+
+
+class PublicOpenAPIGate:
+    """ASGI wrapper that serves the patched public OpenAPI document."""
+
+    def __init__(self, app: object) -> None:
+        self.app = app
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self.app, name)
+
+    def openapi(self) -> dict[str, Any]:
+        return self.app.openapi()
+
+    async def __call__(self, scope: dict[str, Any], receive: Any, send: Any) -> None:
+        if (
+            scope.get("type") == "http"
+            and str(scope.get("method", "")).upper() == "GET"
+            and scope.get("path") == "/openapi.json"
+        ):
+            from tigrbl_concrete._concrete._response import Response
+
+            await Response.json(self.openapi())(scope, receive, send)
+            return
+        await self.app(scope, receive, send)