the37lab-authlib 0.1.1750837371__tar.gz → 0.1.1750840380__tar.gz

{the37lab_authlib-0.1.1750837371 → the37lab_authlib-0.1.1750840380}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: the37lab_authlib
-Version: 0.1.1750837371
+Version: 0.1.1750840380
 Summary: Python SDK for the Authlib
 Author-email: the37lab <info@the37lab.com>
 Classifier: Programming Language :: Python :: 3
@@ -70,21 +70,8 @@ auth = AuthManager(
 @auth.require_auth(roles=["admin"])
 def protected_route():
     return "Protected content"
-
-@app.route("/public")
-@auth.public_endpoint
-def custom_public_route():
-    return "Public content"
 ```
 
-`AuthManager`'s blueprint now registers a global error handler for
-`AuthError` and authenticates requests for all of its routes by default.
-Authenticated users are made available as `flask.g.requesting_user`.
-Only the login, OAuth, token refresh, registration and role listing
-endpoints are exempt from this check. Additional routes can be marked as
-public using the `@auth.public_endpoint` decorator or
-`auth.add_public_endpoint("auth.some_endpoint")`.
-
 ## Configuration
 
 ### Required Parameters
@@ -139,8 +126,8 @@ public using the `@auth.public_endpoint` decorator or
 
 ### API Tokens
 - `POST /api/v1/users/{user}/api-tokens` - Create API token
-  - **Request:** `{ "name": "string", "scopes": [ ... ] }`
-  - **Response:** `{ "token": "string", "id": "uuid", ... }`
+  - **Request:** `{ "name": "string", "expires_in_days": number | null }`
+  - **Response:** `{ "token": "string", "id": "uuid", "name": "string", "created_at": "timestamp", "expires_at": "timestamp | null" }`
 - `GET /api/v1/users/{user}/api-tokens` - List API tokens
   - **Response:** `[ { "id": "uuid", "name": "string", ... } ]`
 - `DELETE /api/v1/users/{user}/api-tokens/{token_id}` - Delete API token
@@ -157,9 +144,7 @@ public using the `@auth.public_endpoint` decorator or
    - Get redirect URL from `/api/v1/users/login/oauth`.
    - Complete OAuth flow via `/api/v1/users/login/oauth2callback`.
 4. **Protected Routes:**
-   - All routes inside the provided blueprint are authenticated by default.
-     The authenticated user can be accessed via `g.requesting_user`.
-     Use `@auth.require_auth()` to protect custom routes in your application.
+   - Use `@auth.require_auth()` decorator to protect Flask routes.
 
 ## User Object
 

{the37lab_authlib-0.1.1750837371 → the37lab_authlib-0.1.1750840380}/README.md

@@ -53,21 +53,8 @@ auth = AuthManager(
 @auth.require_auth(roles=["admin"])
 def protected_route():
     return "Protected content"
-
-@app.route("/public")
-@auth.public_endpoint
-def custom_public_route():
-    return "Public content"
 ```
 
-`AuthManager`'s blueprint now registers a global error handler for
-`AuthError` and authenticates requests for all of its routes by default.
-Authenticated users are made available as `flask.g.requesting_user`.
-Only the login, OAuth, token refresh, registration and role listing
-endpoints are exempt from this check. Additional routes can be marked as
-public using the `@auth.public_endpoint` decorator or
-`auth.add_public_endpoint("auth.some_endpoint")`.
-
 ## Configuration
 
 ### Required Parameters
@@ -122,8 +109,8 @@ public using the `@auth.public_endpoint` decorator or
 
 ### API Tokens
 - `POST /api/v1/users/{user}/api-tokens` - Create API token
-  - **Request:** `{ "name": "string", "scopes": [ ... ] }`
-  - **Response:** `{ "token": "string", "id": "uuid", ... }`
+  - **Request:** `{ "name": "string", "expires_in_days": number | null }`
+  - **Response:** `{ "token": "string", "id": "uuid", "name": "string", "created_at": "timestamp", "expires_at": "timestamp | null" }`
 - `GET /api/v1/users/{user}/api-tokens` - List API tokens
   - **Response:** `[ { "id": "uuid", "name": "string", ... } ]`
 - `DELETE /api/v1/users/{user}/api-tokens/{token_id}` - Delete API token
@@ -140,9 +127,7 @@ public using the `@auth.public_endpoint` decorator or
    - Get redirect URL from `/api/v1/users/login/oauth`.
    - Complete OAuth flow via `/api/v1/users/login/oauth2callback`.
 4. **Protected Routes:**
-   - All routes inside the provided blueprint are authenticated by default.
-     The authenticated user can be accessed via `g.requesting_user`.
-     Use `@auth.require_auth()` to protect custom routes in your application.
+   - Use `@auth.require_auth()` decorator to protect Flask routes.
 
 ## User Object
 

{the37lab_authlib-0.1.1750837371 → the37lab_authlib-0.1.1750840380}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "the37lab_authlib"
-version = "0.1.1750837371"
+version = "0.1.1750840380"
 description = "Python SDK for the Authlib"
 authors = [{name = "the37lab", email = "info@the37lab.com"}]
 dependencies = ["flask", "psycopg2-binary", "pyjwt", "python-dotenv", "requests", "authlib", "bcrypt"]

{the37lab_authlib-0.1.1750837371 → the37lab_authlib-0.1.1750840380}/src/the37lab_authlib/auth.py

@@ -1,5 +1,5 @@
 import inspect
-from flask import Blueprint, request, jsonify, current_app, url_for, redirect, g
+from flask import Blueprint, request, jsonify, current_app, url_for, redirect
 import jwt
 from datetime import datetime, timedelta
 from .db import Database
@@ -15,6 +15,17 @@ from functools import wraps
 logging.basicConfig(level=logging.DEBUG)
 logger = logging.getLogger(__name__)
 
+def handle_auth_errors(f):
+    @wraps(f)
+    def decorated(*args, **kwargs):
+        try:
+            return f(*args, **kwargs)
+        except AuthError as e:
+            response = jsonify(e.to_dict())
+            response.status_code = e.status_code
+            return response
+    return decorated
+
 class AuthManager:
     def __init__(self, app=None, db_dsn=None, jwt_secret=None, oauth_config=None, id_type='integer'):
         logger.info("INITIALIZING AUTHMANAGER {} - {} - {}".format(db_dsn, jwt_secret, not app))
@@ -22,15 +33,6 @@ class AuthManager:
         self.jwt_secret = jwt_secret
         logger.debug(f"Initializing AuthManager with JWT secret: {jwt_secret[:5]}..." if jwt_secret else "No JWT secret provided")
         self.oauth_config = oauth_config or {}
-        self.public_endpoints = {
-            'auth.login',
-            'auth.oauth_login',
-            'auth.oauth_callback',
-            'auth.refresh_token',
-            'auth.register',
-            'auth.get_roles'
-        }
-        self.bp = None
         
         if app:
             self.init_app(app)
@@ -122,17 +124,6 @@ class AuthManager:
 
             return f(*args, **kwargs)
         return decorated
-
-    def add_public_endpoint(self, endpoint):
-        """Mark an endpoint as public so it bypasses authentication."""
-        self.public_endpoints.add(endpoint)
-
-    def public_endpoint(self, f):
-        """Decorator to mark a view function as public."""
-        if self.bp:
-            endpoint = f"{self.bp.name}.{f.__name__}"
-            self.add_public_endpoint(endpoint)
-        return f
     
     def init_app(self, app):
         app.auth_manager = self
@@ -140,21 +131,9 @@ class AuthManager:
 
     def create_blueprint(self):
         bp = Blueprint('auth', __name__, url_prefix='/api/v1/users')
-        self.bp = bp
-        bp.public_endpoint = self.public_endpoint
-
-        @bp.errorhandler(AuthError)
-        def handle_auth_error(err):
-            response = jsonify(err.to_dict())
-            response.status_code = err.status_code
-            return response
-
-        @bp.before_request
-        def load_user():
-            if request.endpoint not in self.public_endpoints:
-                g.requesting_user = self._authenticate_request()
 
         @bp.route('/login', methods=['POST'])
+        @handle_auth_errors
         def login():
             data = request.get_json()
             username = data.get('username')
@@ -189,6 +168,7 @@ class AuthManager:
                 })
 
         @bp.route('/login/oauth', methods=['POST'])
+        @handle_auth_errors
         def oauth_login():
             provider = request.json.get('provider')
             if provider not in self.oauth_config:
@@ -200,6 +180,7 @@ class AuthManager:
             })
 
         @bp.route('/login/oauth2callback')
+        @handle_auth_errors
         def oauth_callback():
             code = request.args.get('code')
             provider = request.args.get('state')
@@ -216,22 +197,28 @@ class AuthManager:
             return redirect(f"{frontend_url}/oauth-callback?token={token}&refresh_token={refresh_token}")
 
         @bp.route('/login/profile')
+        @handle_auth_errors
         def profile():
-            user = g.requesting_user
+            token = request.headers.get('Authorization', '').split(' ')[-1]
+            user = self.validate_token(token)
             return jsonify(user)
 
         @bp.route('/api-tokens', methods=['GET'])
-        def get_tokens():
-            tokens = self.get_user_api_tokens(g.requesting_user['id'])
+        @handle_auth_errors
+        @self.require_auth
+        def get_tokens(requesting_user):
+            tokens = self.get_user_api_tokens(requesting_user['id'])
             return jsonify(tokens)
 
         @bp.route('/api-tokens', methods=['POST'])
-        def create_token():
+        @handle_auth_errors
+        @self.require_auth
+        def create_token(requesting_user):
             name = request.json.get('name')
             expires_in_days = request.json.get('expires_in_days')
             if not name:
                 raise AuthError('Token name is required', 400)
-            api_token = self.create_api_token(g.requesting_user['id'], name, expires_in_days)
+            api_token = self.create_api_token(requesting_user['id'], name, expires_in_days)
             return jsonify({
                 'id': api_token.id,
                 'name': api_token.name,
@@ -241,6 +228,7 @@ class AuthManager:
             })
 
         @bp.route('/token-refresh', methods=['POST'])
+        @handle_auth_errors
         def refresh_token():
             refresh_token = request.json.get('refresh_token')
             if not refresh_token:
@@ -264,17 +252,10 @@ class AuthManager:
             except jwt.InvalidTokenError:
                 raise AuthError('Invalid refresh token', 401)
 
-        @bp.route('/api-tokens', methods=['POST'])
-        def create_api_token():
-            name = request.json.get('name')
-            if not name:
-                raise AuthError('Token name required', 400)
-
-            token = self.create_api_token(g.requesting_user['id'], name)
-            return jsonify({'token': token.token})
-
         @bp.route('/api-tokens/validate', methods=['GET'])
-        def validate_api_token():
+        @handle_auth_errors
+        @self.require_auth
+        def validate_api_token(requesting_user):
             token = request.json.get('token')
             if not token:
                 raise AuthError('No API token provided', 401)
@@ -284,7 +265,7 @@ class AuthManager:
                 cur.execute("""
                     SELECT * FROM api_tokens 
                     WHERE user_id = %s AND id = %s
-                """, (g.requesting_user['id'], token))
+                """, (requesting_user['id'], token))
                 api_token = cur.fetchone()
 
             if not api_token:
@@ -305,7 +286,9 @@ class AuthManager:
             return jsonify({'valid': True})
 
         @bp.route('/api-tokens', methods=['DELETE'])
-        def delete_api_token():
+        @handle_auth_errors
+        @self.require_auth
+        def delete_api_token(requesting_user):
             token = request.json.get('token')
             if not token:
                 raise AuthError('Token required', 400)
@@ -316,7 +299,7 @@ class AuthManager:
                     DELETE FROM api_tokens 
                     WHERE user_id = %s AND id = %s
                     RETURNING id
-                """, (g.requesting_user['id'], token))
+                """, (requesting_user['id'], token))
                 deleted_id = cur.fetchone()
                 if not deleted_id:
                     raise ValueError('Token not found or already deleted')
@@ -324,6 +307,7 @@ class AuthManager:
             return jsonify({'deleted': True})
 
         @bp.route('/register', methods=['POST'])
+        @handle_auth_errors
         def register():
             data = request.get_json()
             
@@ -362,6 +346,7 @@ class AuthManager:
             return jsonify({'id': user.id}), 201
 
         @bp.route('/roles', methods=['GET'])
+        @handle_auth_errors
         def get_roles():
             with self.db.get_cursor() as cur:
                 cur.execute("SELECT * FROM roles")

{the37lab_authlib-0.1.1750837371 → the37lab_authlib-0.1.1750840380}/src/the37lab_authlib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: the37lab_authlib
-Version: 0.1.1750837371
+Version: 0.1.1750840380
 Summary: Python SDK for the Authlib
 Author-email: the37lab <info@the37lab.com>
 Classifier: Programming Language :: Python :: 3
@@ -70,21 +70,8 @@ auth = AuthManager(
 @auth.require_auth(roles=["admin"])
 def protected_route():
     return "Protected content"
-
-@app.route("/public")
-@auth.public_endpoint
-def custom_public_route():
-    return "Public content"
 ```
 
-`AuthManager`'s blueprint now registers a global error handler for
-`AuthError` and authenticates requests for all of its routes by default.
-Authenticated users are made available as `flask.g.requesting_user`.
-Only the login, OAuth, token refresh, registration and role listing
-endpoints are exempt from this check. Additional routes can be marked as
-public using the `@auth.public_endpoint` decorator or
-`auth.add_public_endpoint("auth.some_endpoint")`.
-
 ## Configuration
 
 ### Required Parameters
@@ -139,8 +126,8 @@ public using the `@auth.public_endpoint` decorator or
 
 ### API Tokens
 - `POST /api/v1/users/{user}/api-tokens` - Create API token
-  - **Request:** `{ "name": "string", "scopes": [ ... ] }`
-  - **Response:** `{ "token": "string", "id": "uuid", ... }`
+  - **Request:** `{ "name": "string", "expires_in_days": number | null }`
+  - **Response:** `{ "token": "string", "id": "uuid", "name": "string", "created_at": "timestamp", "expires_at": "timestamp | null" }`
 - `GET /api/v1/users/{user}/api-tokens` - List API tokens
   - **Response:** `[ { "id": "uuid", "name": "string", ... } ]`
 - `DELETE /api/v1/users/{user}/api-tokens/{token_id}` - Delete API token
@@ -157,9 +144,7 @@ public using the `@auth.public_endpoint` decorator or
    - Get redirect URL from `/api/v1/users/login/oauth`.
    - Complete OAuth flow via `/api/v1/users/login/oauth2callback`.
 4. **Protected Routes:**
-   - All routes inside the provided blueprint are authenticated by default.
-     The authenticated user can be accessed via `g.requesting_user`.
-     Use `@auth.require_auth()` to protect custom routes in your application.
+   - Use `@auth.require_auth()` decorator to protect Flask routes.
 
 ## User Object