tba-app-backend-tenant-administration 0.4.0.dev2__tar.gz

tba_app_backend_tenant_administration-0.4.0.dev2/PKG-INFO

@@ -0,0 +1,59 @@
+Metadata-Version: 2.4
+Name: tba-app-backend-tenant-administration
+Version: 0.4.0.dev2
+Summary: Tenant-scoped administration backend application for TBA.
+License-Expression: Apache-2.0
+Requires-Python: >=3.10,<3.15
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: tba-app-backend-core (==0.4.0.dev2)
+Requires-Dist: tba-auth (==0.4.0.dev2)
+Requires-Dist: tba-router-administration-gate (==0.4.0.dev2)
+Project-URL: Homepage, https://github.com/tigrbl/tigrbl_auth
+Project-URL: Repository, https://github.com/tigrbl/tigrbl_auth
+Project-URL: Source, https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/90-backend-apps/tba-app-backend-tenant-administration
+Description-Content-Type: text/markdown
+
+# tba-app-backend-tenant-administration
+
+Tenant-scoped identity, admin delegation, JWKS, and local policy API front door.
+
+## Surface
+
+| Property | Value |
+| --- | --- |
+| Product surface | `tenant-admin-app` |
+| Intended UIX | `@tba/ui-tenant-administration` |
+| Exposes | Tenant identities, clients, consents, sessions, tenant keys/JWKS, tenant-local audit |
+| Excludes | Platform tenant creation/deletion and cross-tenant authority assignment |
+
+## Entrypoint
+
+```python
+from tba_app_backend_tenant_administration import app, build_app
+```
+
+## Local Dev Deployment
+
+The Docker dev surface listens on `http://localhost:8016` and uses the
+admin API key `dev-tenant-admin-key` unless overridden.
+
+```bash
+docker compose -f docker/docker-compose.tenant-admin-app.yml up -d --build
+```
+
+Useful checks:
+
+- `GET /openapi.json`
+- `GET /openrpc.json`
+- `POST /rpc` with `X-API-Key: dev-tenant-admin-key`
+- `GET /user`, `/client`, `/clientregistration`, `/consent`
+
+The tenant-admin surface intentionally does not expose `/tenant`, public
+OAuth/OIDC routes, platform tenant lifecycle RPC, or service/workload admin
+resources.
+

tba_app_backend_tenant_administration-0.4.0.dev2/README.md

@@ -0,0 +1,38 @@
+# tba-app-backend-tenant-administration
+
+Tenant-scoped identity, admin delegation, JWKS, and local policy API front door.
+
+## Surface
+
+| Property | Value |
+| --- | --- |
+| Product surface | `tenant-admin-app` |
+| Intended UIX | `@tba/ui-tenant-administration` |
+| Exposes | Tenant identities, clients, consents, sessions, tenant keys/JWKS, tenant-local audit |
+| Excludes | Platform tenant creation/deletion and cross-tenant authority assignment |
+
+## Entrypoint
+
+```python
+from tba_app_backend_tenant_administration import app, build_app
+```
+
+## Local Dev Deployment
+
+The Docker dev surface listens on `http://localhost:8016` and uses the
+admin API key `dev-tenant-admin-key` unless overridden.
+
+```bash
+docker compose -f docker/docker-compose.tenant-admin-app.yml up -d --build
+```
+
+Useful checks:
+
+- `GET /openapi.json`
+- `GET /openrpc.json`
+- `POST /rpc` with `X-API-Key: dev-tenant-admin-key`
+- `GET /user`, `/client`, `/clientregistration`, `/consent`
+
+The tenant-admin surface intentionally does not expose `/tenant`, public
+OAuth/OIDC routes, platform tenant lifecycle RPC, or service/workload admin
+resources.

tba_app_backend_tenant_administration-0.4.0.dev2/pyproject.toml

@@ -0,0 +1,24 @@
+[project]
+name = "tba-app-backend-tenant-administration"
+version = "0.4.0.dev2"
+description = "Tenant-scoped administration backend application for TBA."
+readme = "README.md"
+requires-python = ">=3.10,<3.15"
+license = "Apache-2.0"
+dependencies = [
+    "tba-auth==0.4.0.dev2",
+    "tba-app-backend-core==0.4.0.dev2",
+    "tba-router-administration-gate==0.4.0.dev2",
+]
+
+[project.urls]
+Homepage = "https://github.com/tigrbl/tigrbl_auth"
+Repository = "https://github.com/tigrbl/tigrbl_auth"
+Source = "https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/90-backend-apps/tba-app-backend-tenant-administration"
+
+[build-system]
+requires = ["poetry-core>=1.0.0"]
+build-backend = "poetry.core.masonry.api"
+
+[tool.poetry]
+packages = [{ include = "tba_app_backend_tenant_administration", from = "src" }]

tba_app_backend_tenant_administration-0.4.0.dev2/src/tba_app_backend_tenant_administration/__init__.py

@@ -0,0 +1,14 @@
+"""Tenant admin backend application package for TBA."""
+
+from __future__ import annotations
+
+from .app import PRODUCT_SURFACE, app, build_app
+from .contract import TENANT_ADMIN_BACKEND_APP_CONTRACT, TenantAdminBackendAppContract
+
+__all__ = [
+    "PRODUCT_SURFACE",
+    "TENANT_ADMIN_BACKEND_APP_CONTRACT",
+    "TenantAdminBackendAppContract",
+    "app",
+    "build_app",
+]

tba_app_backend_tenant_administration-0.4.0.dev2/src/tba_app_backend_tenant_administration/app.py

@@ -0,0 +1,130 @@
+"""ASGI entrypoint for the tenant admin TBA backend application."""
+
+from __future__ import annotations
+
+import os
+from typing import TYPE_CHECKING, Any, Awaitable, Callable
+
+from tba_app_backend_core import build_product_app
+from tba_app_backend_tenant_administration.contract import (
+    TENANT_ADMIN_BACKEND_APP_CONTRACT,
+)
+from tba_auth.runtime import LazyASGIApplication
+
+if TYPE_CHECKING:
+    from tigrbl import TigrblApp
+
+PRODUCT_SURFACE = "tenant-admin-app"
+DEFAULT_CORS_ORIGINS = ("http://localhost:3012", "http://127.0.0.1:3012")
+
+
+class TenantAdminCors:
+    """Small ASGI CORS wrapper for the standalone tenant admin UIX demo."""
+
+    def __init__(
+        self, app: Any, origins: tuple[str, ...] = DEFAULT_CORS_ORIGINS
+    ) -> None:
+        self.app = app
+        self.origins = origins
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self.app, name)
+
+    async def __call__(
+        self,
+        scope: dict[str, Any],
+        receive: Callable[[], Awaitable[dict[str, Any]]],
+        send: Callable[[dict[str, Any]], Awaitable[None]],
+    ) -> None:
+        if scope.get("type") != "http":
+            await self.app(scope, receive, send)
+            return
+
+        headers = {
+            key.decode("latin-1").lower(): value.decode("latin-1")
+            for key, value in scope.get("headers", [])
+        }
+        origin = headers.get("origin")
+        allowed_origin = origin if origin in self.origins else None
+
+        if str(scope.get("method", "")).upper() == "OPTIONS" and allowed_origin:
+            await send(
+                {
+                    "type": "http.response.start",
+                    "status": 204,
+                    "headers": self._cors_headers(allowed_origin)
+                    + [
+                        (
+                            b"access-control-allow-methods",
+                            b"GET,POST,PATCH,DELETE,OPTIONS",
+                        ),
+                        (
+                            b"access-control-allow-headers",
+                            headers.get(
+                                "access-control-request-headers",
+                                "content-type,authorization,x-api-key",
+                            ).encode("latin-1"),
+                        ),
+                        (b"content-length", b"0"),
+                    ],
+                }
+            )
+            await send({"type": "http.response.body", "body": b""})
+            return
+
+        async def cors_send(message: dict[str, Any]) -> None:
+            if message.get("type") == "http.response.start" and allowed_origin:
+                message = dict(message)
+                response_headers = list(message.get("headers", []))
+                response_headers.extend(self._cors_headers(allowed_origin))
+                message["headers"] = response_headers
+            await send(message)
+
+        await self.app(scope, receive, cors_send)
+
+    @staticmethod
+    def _cors_headers(origin: str) -> list[tuple[bytes, bytes]]:
+        return [
+            (b"access-control-allow-origin", origin.encode("latin-1")),
+            (b"access-control-allow-credentials", b"true"),
+            (b"vary", b"Origin"),
+        ]
+
+
+def _default_settings() -> object:
+    from tba_auth.config.settings import Settings
+
+    settings = Settings()
+    env_overrides = {
+        "issuer": os.environ.get("AUTHN_ISSUER"),
+        "protected_resource_identifier": os.environ.get(
+            "TBA_AUTH_PROTECTED_RESOURCE_IDENTIFIER"
+        ),
+        "deployment_profile": os.environ.get("TBA_AUTH_PROFILE"),
+        "require_tls": os.environ.get("TBA_AUTH_REQUIRE_TLS"),
+        "admin_api_key": os.environ.get("TBA_AUTH_ADMIN_API_KEY"),
+        "admin_api_key_dir": os.environ.get("TBA_AUTH_ADMIN_API_KEY_DIR"),
+    }
+    for name, value in env_overrides.items():
+        if value in {None, ""}:
+            continue
+        current = getattr(settings, name, None)
+        if isinstance(current, bool):
+            value = str(value).lower() in {"1", "true", "yes", "on"}
+        setattr(settings, name, value)
+    return settings
+
+
+def build_app(settings_obj: object | None = None) -> "TigrblApp":
+    if settings_obj is None:
+        settings_obj = _default_settings()
+    return TenantAdminCors(
+        build_product_app(
+            PRODUCT_SURFACE, settings_obj, contract=TENANT_ADMIN_BACKEND_APP_CONTRACT
+        )
+    )
+
+
+app = LazyASGIApplication(build_app)
+
+__all__ = ["PRODUCT_SURFACE", "app", "build_app"]

tba_app_backend_tenant_administration-0.4.0.dev2/src/tba_app_backend_tenant_administration/contract.py

@@ -0,0 +1,73 @@
+"""Tenant-admin backend-app contract for TBA."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True, slots=True)
+class TenantAdminBackendAppContract:
+    """Machine-readable boundary for the tenant control-plane backend app."""
+
+    product_surface: str
+    intended_uix: str
+    admin_resources: tuple[str, ...]
+    admin_rest_groups: tuple[str, ...]
+    forbidden_route_prefixes: tuple[str, ...]
+    forbidden_exact_routes: tuple[str, ...]
+    consumed_packages: tuple[str, ...]
+    mounted_router_packages: tuple[str, ...]
+    app_local_route_groups: tuple[str, ...]
+
+
+TENANT_ADMIN_BACKEND_APP_CONTRACT = TenantAdminBackendAppContract(
+    product_surface="tenant-admin-app",
+    intended_uix="@tba/ui-tenant-administration",
+    admin_resources=(
+        "User",
+        "Client",
+        "ClientRegistration",
+        "Consent",
+        "AuditEvent",
+        "CryptoKey",
+        "CryptoKeyVersion",
+        "PrincipalKeyBinding",
+        "KeyEnvelope",
+        "KeyAttestationEvidence",
+        "KeyRotationEvent",
+    ),
+    admin_rest_groups=("admin_auth", "admin_identities"),
+    forbidden_route_prefixes=(
+        "/tenant",
+        "/serviceidentity",
+        "/credentialservicekey",
+        "/credentialapikey",
+        "/tokenrecord",
+        "/revokedtoken",
+        "/authsession",
+    ),
+    forbidden_exact_routes=(
+        "/login",
+        "/authorize",
+        "/token",
+        "/register",
+        "/logout",
+        "/revoke",
+        "/userinfo",
+        "/introspect",
+        "/.well-known/jwks.json",
+        "/.well-known/openid-configuration",
+    ),
+    consumed_packages=(
+        "tba-auth",
+        "tba-server-identity",
+        "tba-runtime-identity",
+        "tba-runtime-identity-administration",
+        "tba-concrete-identity-principals",
+        "tba-runtime-authorization-policy",
+    ),
+    mounted_router_packages=("tba-router-administration-gate",),
+    app_local_route_groups=(),
+)
+
+__all__ = ["TENANT_ADMIN_BACKEND_APP_CONTRACT", "TenantAdminBackendAppContract"]