toolframe-auth 0.2.0__py3-none-any.whl

toolframe_auth/__init__.py

@@ -0,0 +1 @@
+"""Access Password authentication provider."""

toolframe_auth/crypto.py

@@ -0,0 +1,34 @@
+"""Salted scrypt verification and separately keyed secret identification."""
+
+import hashlib
+import hmac
+import secrets
+
+SCRYPT_N = 2**17
+SCRYPT_R = 8
+SCRYPT_P = 1
+
+
+def lookup(key, secret):
+    return hmac.new(key, secret.encode(), hashlib.sha256).hexdigest()
+
+
+def verifier(secret, salt):
+    return hashlib.scrypt(
+        secret.encode(),
+        salt=bytes.fromhex(salt),
+        n=SCRYPT_N,
+        r=SCRYPT_R,
+        p=SCRYPT_P,
+        maxmem=256 * 1024 * 1024,
+        dklen=32,
+    ).hex()
+
+
+def new_verifier(secret):
+    salt = secrets.token_hex(16)
+    return salt, verifier(secret, salt)
+
+
+def session_digest(token):
+    return hashlib.sha256(token.encode()).hexdigest()

toolframe_auth/identities.py

@@ -0,0 +1,355 @@
+"""Local identities, browser sessions and revocable delegation authority."""
+
+import json
+import math
+import secrets
+import time
+import uuid
+
+from toolframe_sdk import PluginError, Principal
+
+from .crypto import session_digest
+
+SCHEMA = """
+CREATE TABLE users (
+ id TEXT PRIMARY KEY, label TEXT NOT NULL, scopes TEXT NOT NULL,
+ created_at REAL NOT NULL, expires_at REAL, disabled INTEGER NOT NULL DEFAULT 0
+);
+CREATE TABLE external_identities (
+ issuer TEXT NOT NULL, subject TEXT NOT NULL, user_id TEXT NOT NULL REFERENCES users(id),
+ PRIMARY KEY(issuer,subject)
+);
+CREATE TABLE user_sessions (
+ digest TEXT PRIMARY KEY, user_id TEXT NOT NULL REFERENCES users(id),
+ created_at REAL NOT NULL, absolute_expires REAL NOT NULL, last_activity REAL NOT NULL,
+ invalidated INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX user_sessions_user ON user_sessions(user_id);
+CREATE TABLE agent_grants (
+ id TEXT PRIMARY KEY, user_id TEXT NOT NULL REFERENCES users(id),
+ issuer TEXT NOT NULL, client_id TEXT NOT NULL, client_name TEXT NOT NULL,
+ resource TEXT NOT NULL, scopes TEXT NOT NULL, created_at REAL NOT NULL,
+ expires_at REAL NOT NULL, revoked_at REAL
+);
+CREATE INDEX agent_grants_user ON agent_grants(user_id);
+"""
+
+METHODS = (
+    "federated_login",
+    "users",
+    "user_update",
+    "grant_create",
+    "grant_check",
+    "grants",
+    "revoke_grant",
+)
+
+
+def public(record):
+    return {**record, "scopes": json.loads(record["scopes"])}
+
+
+def text(value, maximum=2048):
+    return (
+        isinstance(value, str)
+        and 0 < len(value) <= maximum
+        and not any(ord(char) < 32 or 0xD800 <= ord(char) <= 0xDFFF for char in value)
+    )
+
+
+class IdentityAuthority:
+    def __init__(self, authority):
+        self.auth = authority
+        self.context = authority.context
+        self.store = authority.store
+
+    def trusted_provider(self):
+        if self.context.call_info.get("owner") != self.context.config.get(
+            "identity_provider", "oidc-auth"
+        ):
+            raise PluginError(
+                "forbidden",
+                "Only the configured identity provider may authenticate users",
+            )
+
+    def actor(self):
+        value = self.context.call_info.get("principal")
+        if not value:
+            raise PluginError(
+                "authentication_required", "Sign in to manage your account"
+            )
+        return Principal.model_validate(value)
+
+    def administrator(self):
+        actor = self.actor()
+        if not actor.unrestricted and "system.auth.users" not in actor.scopes:
+            raise PluginError("forbidden", "User administration permission required")
+        return actor
+
+    async def user(self, identifier, store=None):
+        if not text(identifier, 128):
+            raise PluginError("invalid_credentials", "User is unavailable")
+        rows = await (store or self.store).query(
+            "SELECT * FROM users WHERE id=?", [identifier]
+        )
+        if not rows:
+            raise PluginError("invalid_credentials", "User is unavailable")
+        return rows[0]
+
+    def active(self, user):
+        if user["disabled"] or (
+            user["expires_at"] is not None and user["expires_at"] <= time.time()
+        ):
+            raise PluginError("invalid_credentials", "User is unavailable")
+
+    def principal(self, user):
+        self.active(user)
+        return Principal(
+            kind="user",
+            credential_id=user["id"],
+            user_id=user["id"],
+            scopes=tuple(
+                sorted(set(json.loads(user["scopes"])) | {"system.auth.self"})
+            ),
+            expires_at=user["expires_at"],
+        )
+
+    def scopes(self, values, *, business=False):
+        catalog = self.context.call_info.get("scope_catalog", {})
+        if not isinstance(values, list) or not all(
+            isinstance(s, str)
+            and s in catalog
+            and (not business or catalog[s].get("category") == "business")
+            for s in values
+        ):
+            raise PluginError("invalid_request", "Supply declared permissions")
+        return sorted(set(values))
+
+    async def login(self, params):
+        self.trusted_provider()
+        issuer, subject = params.get("issuer"), params.get("subject")
+        if not text(issuer) or not text(subject, 255):
+            raise PluginError("invalid_credentials", "Invalid external identity")
+        async with self.store.transaction() as store:
+            links = await store.query(
+                "SELECT user_id FROM external_identities WHERE issuer=? AND subject=?",
+                [issuer, subject],
+            )
+            if links:
+                user = await self.user(links[0]["user_id"], store)
+            else:
+                admission = next(
+                    (
+                        rule
+                        for rule in self.context.config.get("federated_identities", [])
+                        if rule["issuer"] == issuer and rule["subject"] == subject
+                    ),
+                    None,
+                )
+                if admission is None:
+                    raise PluginError(
+                        "forbidden",
+                        "This identity has not been admitted by an administrator",
+                    )
+                scopes = self.scopes(admission["scopes"])
+                identifier = uuid.uuid4().hex
+                await store.execute(
+                    "INSERT INTO users(id,label,scopes,created_at) VALUES(?,?,?,?)",
+                    [identifier, admission["label"], json.dumps(scopes), time.time()],
+                )
+                await store.execute(
+                    "INSERT INTO external_identities VALUES(?,?,?)",
+                    [issuer, subject, identifier],
+                )
+                user = await self.user(identifier, store)
+            actor = self.principal(user)
+            now = time.time()
+            expiry = min(now + self.auth.lifetime, user["expires_at"] or float("inf"))
+            token = "tf_user_" + secrets.token_urlsafe(32)
+            await store.execute(
+                "INSERT INTO user_sessions(digest,user_id,created_at,absolute_expires,last_activity) VALUES(?,?,?,?,?)",
+                [session_digest(token), user["id"], now, expiry, now],
+            )
+        return {"token": token, "expires_at": expiry, "principal": actor.model_dump()}
+
+    async def resolve(self, params):
+        token = params.get("token")
+        if not isinstance(token, str) or len(token) > 256:
+            raise PluginError("session_invalid", "Sign in again")
+        rows = await self.store.query(
+            "SELECT * FROM user_sessions WHERE digest=?", [session_digest(token)]
+        )
+        if not rows:
+            raise PluginError("session_invalid", "Sign in again")
+        session, now = rows[0], time.time()
+        if (
+            session["invalidated"]
+            or now >= session["absolute_expires"]
+            or now >= session["last_activity"] + self.auth.idle
+        ):
+            raise PluginError("session_invalid", "Sign in again")
+        try:
+            actor = self.principal(await self.user(session["user_id"]))
+        except PluginError:
+            raise PluginError("session_invalid", "Sign in again") from None
+        if params.get("activity", False):
+            await self.store.execute(
+                "UPDATE user_sessions SET last_activity=? WHERE digest=?",
+                [now, session["digest"]],
+            )
+        return {"principal": actor.model_dump()}
+
+    async def invoke(self, method, params):
+        if method == "federated_login":
+            return await self.login(params)
+        if method == "users":
+            actor = self.administrator()
+            rows = await self.store.query(
+                "SELECT * FROM users ORDER BY created_at DESC"
+            )
+            return {
+                "users": [
+                    public(r)
+                    for r in rows
+                    if actor.unrestricted
+                    or actor.allows(
+                        json.loads(r["scopes"]),
+                        self.context.call_info.get("scope_catalog", {}),
+                    )
+                ]
+            }
+        if method == "user_update":
+            actor = self.administrator()
+            user = await self.user(params.get("id"))
+            scopes = self.scopes(params.get("scopes"))
+            expiry, disabled = params.get("expires_at"), params.get("disabled", False)
+            if not isinstance(disabled, bool) or (
+                expiry is not None
+                and (
+                    type(expiry) not in (int, float)
+                    or not math.isfinite(expiry)
+                    or expiry <= time.time()
+                )
+            ):
+                raise PluginError(
+                    "invalid_request", "Supply a valid user expiry and disabled flag"
+                )
+            self.auth.bounds(
+                actor, json.loads(user["scopes"]), False, user["expires_at"]
+            )
+            self.auth.bounds(actor, scopes, False, expiry)
+            async with self.store.transaction() as store:
+                await store.execute(
+                    "UPDATE users SET scopes=?,expires_at=?,disabled=? WHERE id=?",
+                    [json.dumps(scopes), expiry, int(disabled), user["id"]],
+                )
+                if disabled:
+                    await store.execute(
+                        "UPDATE user_sessions SET invalidated=1 WHERE user_id=?",
+                        [user["id"]],
+                    )
+                    await store.execute(
+                        "UPDATE agent_grants SET revoked_at=COALESCE(revoked_at,?) WHERE user_id=?",
+                        [time.time(), user["id"]],
+                    )
+            return {"user": public(await self.user(user["id"]))}
+        if method == "grant_create":
+            self.trusted_provider()
+            user = await self.user(params.get("user_id"))
+            actor = self.principal(user)
+            scopes = self.scopes(params.get("scopes"), business=True)
+            expiry = params.get("expires_at")
+            if (
+                not scopes
+                or type(expiry) not in (int, float)
+                or not math.isfinite(expiry)
+                or not time.time() < expiry <= time.time() + 31536000
+            ):
+                raise PluginError(
+                    "invalid_request",
+                    "Supply business scopes and a bounded grant expiry",
+                )
+            if not all(
+                text(params.get(k))
+                for k in ("issuer", "client_id", "client_name", "resource")
+            ):
+                raise PluginError(
+                    "invalid_request", "Supply the client, issuer and resource"
+                )
+            self.auth.bounds(actor, scopes, False, expiry)
+            identifier = uuid.uuid4().hex
+            await self.store.execute(
+                "INSERT INTO agent_grants(id,user_id,issuer,client_id,client_name,resource,scopes,created_at,expires_at) VALUES(?,?,?,?,?,?,?,?,?)",
+                [
+                    identifier,
+                    user["id"],
+                    params["issuer"],
+                    params["client_id"],
+                    params["client_name"],
+                    params["resource"],
+                    json.dumps(scopes),
+                    time.time(),
+                    expiry,
+                ],
+            )
+            return {"id": identifier}
+        if method == "grant_check":
+            self.trusted_provider()
+            if not text(params.get("id"), 128):
+                raise PluginError("invalid_credentials", "Grant is unavailable")
+            rows = await self.store.query(
+                "SELECT * FROM agent_grants WHERE id=?", [params.get("id")]
+            )
+            if not rows:
+                raise PluginError("invalid_credentials", "Grant is unavailable")
+            grant = rows[0]
+            user = await self.user(grant["user_id"])
+            actor = self.principal(user)
+            if grant["revoked_at"] is not None or grant["expires_at"] <= time.time():
+                raise PluginError("invalid_credentials", "Grant is unavailable")
+            scopes = self.scopes(json.loads(grant["scopes"]), business=True)
+            # Permission reductions affect existing grants without issuing new tokens.
+            scopes = [s for s in scopes if s in actor.scopes]
+            return {
+                "grant": {
+                    **public(grant),
+                    "scopes": scopes,
+                    "expires_at": min(
+                        grant["expires_at"], user["expires_at"] or float("inf")
+                    ),
+                }
+            }
+        if method == "grants":
+            actor = self.actor()
+            if actor.kind != "user" or not actor.user_id:
+                raise PluginError("forbidden", "Sign in with a user identity")
+            self.active(await self.user(actor.user_id))
+            rows = await self.store.query(
+                "SELECT * FROM agent_grants WHERE user_id=? ORDER BY created_at DESC",
+                [actor.user_id],
+            )
+            return {"grants": [public(r) for r in rows]}
+        if method == "revoke_grant":
+            if not text(params.get("id"), 128):
+                raise PluginError("invalid_request", "Unknown grant")
+            rows = await self.store.query(
+                "SELECT * FROM agent_grants WHERE id=?", [params.get("id")]
+            )
+            if not rows:
+                raise PluginError("invalid_request", "Unknown grant")
+            if self.context.call_info.get("owner") != self.context.config.get(
+                "identity_provider", "oidc-auth"
+            ):
+                actor = self.actor()
+                if not actor.unrestricted and not (
+                    actor.kind == "user" and actor.user_id == rows[0]["user_id"]
+                ):
+                    raise PluginError(
+                        "forbidden", "You can only revoke your own grants"
+                    )
+            await self.store.execute(
+                "UPDATE agent_grants SET revoked_at=COALESCE(revoked_at,?) WHERE id=?",
+                [time.time(), rows[0]["id"]],
+            )
+            return {"revoked": True}
+        raise PluginError("invalid_request", "Unknown identity operation")

toolframe_auth/migrations/v1.postgresql.sql

@@ -0,0 +1,14 @@
+
+CREATE TABLE credentials (
+ id TEXT PRIMARY KEY, label TEXT NOT NULL, lookup TEXT NOT NULL,
+ salt TEXT NOT NULL, verifier TEXT NOT NULL, created_at DOUBLE PRECISION NOT NULL,
+ expires_at DOUBLE PRECISION, revoked_at DOUBLE PRECISION, scopes TEXT NOT NULL,
+ all_business INTEGER NOT NULL, last_login DOUBLE PRECISION, last_used DOUBLE PRECISION
+);
+CREATE INDEX credentials_lookup ON credentials(lookup);
+CREATE TABLE sessions (
+ digest TEXT PRIMARY KEY, credential_id TEXT NOT NULL REFERENCES credentials(id),
+ created_at DOUBLE PRECISION NOT NULL, absolute_expires DOUBLE PRECISION NOT NULL,
+ last_activity DOUBLE PRECISION NOT NULL, invalidated INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX sessions_credential ON sessions(credential_id);

toolframe_auth/migrations/v2.postgresql.sql

@@ -0,0 +1,22 @@
+
+CREATE TABLE users (
+ id TEXT PRIMARY KEY, label TEXT NOT NULL, scopes TEXT NOT NULL,
+ created_at DOUBLE PRECISION NOT NULL, expires_at DOUBLE PRECISION, disabled INTEGER NOT NULL DEFAULT 0
+);
+CREATE TABLE external_identities (
+ issuer TEXT NOT NULL, subject TEXT NOT NULL, user_id TEXT NOT NULL REFERENCES users(id),
+ PRIMARY KEY(issuer,subject)
+);
+CREATE TABLE user_sessions (
+ digest TEXT PRIMARY KEY, user_id TEXT NOT NULL REFERENCES users(id),
+ created_at DOUBLE PRECISION NOT NULL, absolute_expires DOUBLE PRECISION NOT NULL, last_activity DOUBLE PRECISION NOT NULL,
+ invalidated INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX user_sessions_user ON user_sessions(user_id);
+CREATE TABLE agent_grants (
+ id TEXT PRIMARY KEY, user_id TEXT NOT NULL REFERENCES users(id),
+ issuer TEXT NOT NULL, client_id TEXT NOT NULL, client_name TEXT NOT NULL,
+ resource TEXT NOT NULL, scopes TEXT NOT NULL, created_at DOUBLE PRECISION NOT NULL,
+ expires_at DOUBLE PRECISION NOT NULL, revoked_at DOUBLE PRECISION
+);
+CREATE INDEX agent_grants_user ON agent_grants(user_id);

toolframe_auth/plugin.py

@@ -0,0 +1,497 @@
+"""Credential authority. All persistence goes through the managed SQL service."""
+
+from __future__ import annotations
+
+import asyncio
+import hmac
+import json
+import re
+import secrets
+import time
+import uuid
+from importlib.resources import files
+
+from toolframe_sdk import (
+    AuthorizationSpec,
+    MethodSpec,
+    Migration,
+    Plugin,
+    PluginDefinition,
+    PluginError,
+    Principal,
+    Requirement,
+    ServiceSpec,
+    StoreSchema,
+)
+
+from .crypto import lookup, new_verifier, session_digest, verifier
+from .identities import METHODS as IDENTITY_METHODS
+from .identities import SCHEMA as IDENTITY_SCHEMA
+from .identities import IdentityAuthority
+
+SERVICE = "toolframe.auth"
+SCHEMA = """
+CREATE TABLE credentials (
+ id TEXT PRIMARY KEY, label TEXT NOT NULL, lookup TEXT NOT NULL,
+ salt TEXT NOT NULL, verifier TEXT NOT NULL, created_at REAL NOT NULL,
+ expires_at REAL, revoked_at REAL, scopes TEXT NOT NULL,
+ all_business INTEGER NOT NULL, last_login REAL, last_used REAL
+);
+CREATE INDEX credentials_lookup ON credentials(lookup);
+CREATE TABLE sessions (
+ digest TEXT PRIMARY KEY, credential_id TEXT NOT NULL REFERENCES credentials(id),
+ created_at REAL NOT NULL, absolute_expires REAL NOT NULL,
+ last_activity REAL NOT NULL, invalidated INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX sessions_credential ON sessions(credential_id);
+"""
+EXPECTED_ERRORS = {
+    "invalid_credentials",
+    "session_invalid",
+    "password_conflict",
+    "credential_missing",
+    "credential_revoked",
+    "invalid_request",
+    "forbidden",
+    "rate_limited",
+}
+
+
+def valid(record, now):
+    return record["revoked_at"] is None and (
+        record["expires_at"] is None or record["expires_at"] > now
+    )
+
+
+def valid_text(value):
+    if not isinstance(value, str):
+        return False
+    try:
+        value.encode("utf-8")
+        return True
+    except UnicodeError:
+        return False
+
+
+def principal(record):
+    return Principal(
+        kind="password",
+        credential_id=record["id"],
+        scopes=tuple(json.loads(record["scopes"])),
+        all_business=bool(record["all_business"]),
+        expires_at=record["expires_at"],
+    )
+
+
+def public_record(record):
+    return {
+        key: value
+        for key, value in record.items()
+        if key not in {"lookup", "salt", "verifier"}
+    } | {
+        "scopes": json.loads(record["scopes"]),
+        "all_business": bool(record["all_business"]),
+    }
+
+
+class AuthProvider(Plugin):
+    def __init__(self, context):
+        super().__init__(context)
+        self.lock = asyncio.Lock()
+        self.key = None
+        self.store = context.storage()
+        self.idle = context.config.get("session_idle_seconds", 86400)
+        self.lifetime = context.config.get("session_max_seconds", 604800)
+        self.pending_hashes = 0
+        self.identities = IdentityAuthority(self)
+
+    async def activate(self):
+        self.key = bytes.fromhex(self.context.private_secrets["password-lookup"])
+        # Probe read is allowed during activation; host already ensured the schema.
+        await self.store.query("SELECT id FROM credentials LIMIT 1")
+
+    async def rows(self, sql, params=(), store=None):
+        return await (store or self.store).query(sql, params)
+
+    async def get(self, identifier, store=None):
+        rows = await self.rows(
+            "SELECT * FROM credentials WHERE id=?", [identifier], store
+        )
+        if not rows:
+            raise PluginError("credential_missing", "Access password record not found")
+        return rows[0]
+
+    def actor(self):
+        value = self.context.call_info.get("principal")
+        if not value:
+            raise PluginError("forbidden", "A host-admitted administrator is required")
+        actor = Principal.model_validate(value)
+        if not actor.unrestricted and "system.auth.passwords" not in actor.scopes:
+            raise PluginError("forbidden", "Password management scope required")
+        return actor
+
+    def bounds(self, actor, scopes, all_business, expires_at):
+        if actor.unrestricted:
+            return
+        catalog = self.context.call_info.get("scope_catalog", {})
+        if (all_business and not actor.all_business) or not actor.allows(
+            scopes, catalog
+        ):
+            raise PluginError(
+                "forbidden", "Cannot delegate scopes beyond your own grant"
+            )
+        if actor.expires_at is not None and (
+            expires_at is None or expires_at > actor.expires_at
+        ):
+            raise PluginError(
+                "forbidden", "Cannot delegate beyond your password expiry"
+            )
+
+    def fields(self, params):
+        label, scopes = params.get("label", ""), params.get("scopes", [])
+        expiry, all_business = (
+            params.get("expires_at"),
+            params.get("all_business", False),
+        )
+        catalog = self.context.call_info.get("scope_catalog", {})
+        if (
+            not valid_text(label)
+            or not label.strip()
+            or len(label) > 120
+            or not isinstance(scopes, list)
+            or not all(isinstance(x, str) and x in catalog for x in scopes)
+            or not isinstance(all_business, bool)
+            or (
+                expiry is not None
+                and (
+                    isinstance(expiry, bool)
+                    or not isinstance(expiry, (int, float))
+                    or not time.time() < expiry < 253402300800
+                )
+            )
+        ):
+            raise PluginError(
+                "invalid_request",
+                "Supply a label, known scopes and a future expiry (or null)",
+            )
+        return label.strip(), sorted(set(scopes)), all_business, expiry
+
+    async def hash_work(self, function, *args):
+        # Reject excess work before submitting to the thread pool; no unbounded queue.
+        if self.pending_hashes >= 2:
+            raise PluginError("rate_limited", "Password verifier is busy; retry later")
+        self.pending_hashes += 1
+        task = asyncio.create_task(asyncio.to_thread(function, *args))
+        try:
+            return await asyncio.shield(task)
+        finally:
+            # Cancellation cannot release the memory budget before scrypt finishes.
+            if not task.done():
+                await asyncio.shield(task)
+            self.pending_hashes -= 1
+
+    async def invoke(self, service, method, params):
+        if method == "login":
+            return await self.login(params)
+        if method == "create":
+            return await self.create(params)
+        async with self.lock:
+            if method in IDENTITY_METHODS:
+                return await self.identities.invoke(method, params)
+            if method == "resolve":
+                if isinstance(params.get("token"), str) and params["token"].startswith(
+                    "tf_user_"
+                ):
+                    return await self.identities.resolve(params)
+                return await self.resolve(params)
+            if method == "logout":
+                await self.store.execute(
+                    "UPDATE sessions SET invalidated=1 WHERE digest=?",
+                    [session_digest(params["token"])],
+                )
+                await self.store.execute(
+                    "UPDATE user_sessions SET invalidated=1 WHERE digest=?",
+                    [session_digest(params["token"])],
+                )
+                return {}
+            actor = self.actor()
+            if method == "list":
+                records = await self.rows(
+                    "SELECT * FROM credentials ORDER BY created_at DESC"
+                )
+                result = []
+                for record in records:
+                    try:
+                        self.bounds(
+                            actor,
+                            json.loads(record["scopes"]),
+                            record["all_business"],
+                            record["expires_at"],
+                        )
+                    except PluginError:
+                        continue
+                    result.append(public_record(record))
+                return {"credentials": result}
+            if method in {"update", "revoke"}:
+                if not isinstance(params.get("id"), str) or not re.fullmatch(
+                    r"[0-9a-f]{32}", params["id"]
+                ):
+                    raise PluginError(
+                        "invalid_request", "Supply a credential record ID"
+                    )
+                async with self.store.transaction() as store:
+                    record = await self.get(params.get("id"), store)
+                    self.bounds(
+                        actor,
+                        json.loads(record["scopes"]),
+                        record["all_business"],
+                        record["expires_at"],
+                    )
+                    if method == "revoke":
+                        await store.execute(
+                            "UPDATE credentials SET revoked_at=COALESCE(revoked_at,?) WHERE id=?",
+                            [time.time(), record["id"]],
+                        )
+                    else:
+                        if record["revoked_at"] is not None:
+                            raise PluginError(
+                                "credential_revoked",
+                                "Create a new password record instead",
+                            )
+                        label, scopes, all_business, expiry = self.fields(params)
+                        self.bounds(actor, scopes, all_business, expiry)
+                        await self.unique(
+                            record["lookup"], exclude=record["id"], store=store
+                        )
+                        await store.execute(
+                            "UPDATE credentials SET label=?,scopes=?,all_business=?,expires_at=? WHERE id=?",
+                            [
+                                label,
+                                json.dumps(scopes),
+                                int(all_business),
+                                expiry,
+                                record["id"],
+                            ],
+                        )
+                    # Grant/expiry changes require a fresh login. Revocation is immediate.
+                    await store.execute(
+                        "UPDATE sessions SET invalidated=1 WHERE credential_id=?",
+                        [record["id"]],
+                    )
+                    return public_record(await self.get(record["id"], store))
+            raise PluginError("invalid_request", "Unknown auth operation")
+
+    async def unique(self, index, *, exclude="", store=None):
+        rows = await self.rows(
+            "SELECT id FROM credentials WHERE lookup=? AND id<>? AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at>?)",
+            [index, exclude, time.time()],
+            store,
+        )
+        if rows:
+            raise PluginError(
+                "password_conflict", "This password already has an active authorization"
+            )
+
+    async def create(self, params):
+        actor = self.actor()
+        label, scopes, all_business, expiry = self.fields(params)
+        self.bounds(actor, scopes, all_business, expiry)
+        secret = params.get("password")
+        generated = secret is None
+        if generated:
+            secret = secrets.token_urlsafe(24)
+        if not valid_text(secret) or not 8 <= len(secret) <= 32:
+            raise PluginError(
+                "invalid_request", "Passwords must contain 8–32 characters"
+            )
+        index = lookup(self.key, secret)
+        salt, encoded = await self.hash_work(new_verifier, secret)
+        async with self.lock, self.store.transaction() as store:
+            await self.unique(index, store=store)
+            first = not await self.rows(
+                "SELECT id FROM credentials LIMIT 1", store=store
+            )
+            identifier = uuid.uuid4().hex
+            await store.execute(
+                "INSERT INTO credentials(id,label,lookup,salt,verifier,created_at,expires_at,scopes,all_business) VALUES(?,?,?,?,?,?,?,?,?)",
+                [
+                    identifier,
+                    label,
+                    index,
+                    salt,
+                    encoded,
+                    time.time(),
+                    expiry,
+                    json.dumps(scopes),
+                    int(all_business),
+                ],
+            )
+            result = public_record(await self.get(identifier, store))
+        return {
+            "credential": result,
+            "first_password": first,
+            "password": secret if generated else None,
+        }
+
+    async def login(self, params):
+        secret = params.get("password")
+        if not valid_text(secret) or not 1 <= len(secret) <= 1024:
+            raise PluginError("invalid_credentials", "Invalid password")
+        # Unique active lookup is serialized with create/extend/revoke.
+        async with self.lock:
+            records = await self.rows(
+                "SELECT * FROM credentials WHERE lookup=? AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at>?)",
+                [lookup(self.key, secret), time.time()],
+            )
+            record = records[0] if len(records) == 1 else None
+        # Dummy verification makes unknown/expired passwords take the same hash work.
+        salt = record["salt"] if record else "00" * 16
+        result = await self.hash_work(verifier, secret, salt)
+        if record is None or not hmac.compare_digest(result, record["verifier"]):
+            raise PluginError("invalid_credentials", "Invalid password")
+        async with self.lock, self.store.transaction() as store:
+            record = await self.get(record["id"], store)
+            now = time.time()
+            if not valid(record, now):
+                raise PluginError("invalid_credentials", "Invalid password")
+            token = secrets.token_urlsafe(32)
+            expires = min(now + self.lifetime, record["expires_at"] or float("inf"))
+            await store.execute(
+                "INSERT INTO sessions(digest,credential_id,created_at,absolute_expires,last_activity) VALUES(?,?,?,?,?)",
+                [session_digest(token), record["id"], now, expires, now],
+            )
+            await store.execute(
+                "UPDATE credentials SET last_login=?,last_used=? WHERE id=?",
+                [now, now, record["id"]],
+            )
+        return {
+            "token": token,
+            "expires_at": expires,
+            "principal": principal(record).model_dump(),
+        }
+
+    async def resolve(self, params):
+        token = params.get("token", "")
+        if not valid_text(token) or len(token) > 256:
+            raise PluginError("session_invalid", "Sign in again")
+        sessions = await self.rows(
+            "SELECT * FROM sessions WHERE digest=?", [session_digest(token)]
+        )
+        if not sessions:
+            raise PluginError("session_invalid", "Sign in again")
+        session = sessions[0]
+        record = await self.get(session["credential_id"])
+        now = time.time()
+        if (
+            session["invalidated"]
+            or now >= session["absolute_expires"]
+            or now >= session["last_activity"] + self.idle
+            or not valid(record, now)
+        ):
+            if not session["invalidated"]:
+                await self.store.execute(
+                    "UPDATE sessions SET invalidated=1 WHERE digest=?",
+                    [session["digest"]],
+                )
+            raise PluginError("session_invalid", "Sign in again")
+        if params.get("activity", False):
+            async with self.store.transaction() as store:
+                await store.execute(
+                    "UPDATE sessions SET last_activity=? WHERE digest=?",
+                    [now, session["digest"]],
+                )
+                await store.execute(
+                    "UPDATE credentials SET last_used=? WHERE id=?", [now, record["id"]]
+                )
+        return {"principal": principal(record).model_dump()}
+
+
+plugin = PluginDefinition(
+    id="auth",
+    kind="provider",
+    provider_kind="auth",
+    factory="toolframe_auth.plugin:AuthProvider",
+    authorization=AuthorizationSpec(),
+    private_secrets=("password-lookup",),
+    requires={"storage": Requirement(service="toolframe.storage.sql")},
+    services={
+        SERVICE: ServiceSpec(
+            methods={
+                name: MethodSpec(audience="internal")
+                for name in (
+                    "login",
+                    "resolve",
+                    "logout",
+                    "create",
+                    "list",
+                    "update",
+                    "revoke",
+                    *IDENTITY_METHODS,
+                )
+            }
+        )
+    },
+    config_schema={
+        "type": "object",
+        "properties": {
+            "identity_provider": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9-]{0,63}$",
+            },
+            "federated_identities": {
+                "type": "array",
+                "maxItems": 10000,
+                "items": {
+                    "type": "object",
+                    "additionalProperties": False,
+                    "required": ["issuer", "subject", "label", "scopes"],
+                    "properties": {
+                        "issuer": {"type": "string", "minLength": 1, "maxLength": 2048},
+                        "subject": {"type": "string", "minLength": 1, "maxLength": 255},
+                        "label": {"type": "string", "minLength": 1, "maxLength": 120},
+                        "scopes": {
+                            "type": "array",
+                            "items": {"type": "string"},
+                            "uniqueItems": True,
+                        },
+                    },
+                },
+            },
+            "session_idle_seconds": {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 31536000,
+            },
+            "session_max_seconds": {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 31536000,
+            },
+        },
+        "additionalProperties": False,
+    },
+    store=StoreSchema(
+        revision="v2",
+        migrations=(
+            Migration(
+                revision="v1",
+                sql=SCHEMA,
+                dialects={
+                    "postgresql": files(__package__)
+                    .joinpath("migrations", "v1.postgresql.sql")
+                    .read_text()
+                },
+            ),
+            Migration(
+                revision="v2",
+                parent="v1",
+                sql=IDENTITY_SCHEMA,
+                dialects={
+                    "postgresql": files(__package__)
+                    .joinpath("migrations", "v2.postgresql.sql")
+                    .read_text()
+                },
+            ),
+        ),
+    ),
+)

toolframe_auth-0.2.0.dist-info/METADATA

@@ -0,0 +1,129 @@
+Metadata-Version: 2.5
+Name: toolframe-auth
+Version: 0.2.0
+Summary: Managed access passwords and sessions for Toolframe
+Project-URL: Homepage, https://github.com/toolframe/toolframe-auth
+Project-URL: Repository, https://github.com/toolframe/toolframe-auth
+Project-URL: Documentation, https://github.com/toolframe/toolframe-auth#readme
+Project-URL: Issues, https://github.com/toolframe/toolframe-auth/issues
+Author-email: byfb <62798989+byfb@users.noreply.github.com>
+License-Expression: Apache-2.0
+License-File: LICENSE
+License-File: NOTICE
+Requires-Python: >=3.14
+Requires-Dist: toolframe-sdk==0.3.0
+Description-Content-Type: text/markdown
+
+# Toolframe Auth
+
+Authentication and grant decisions for access passwords, federated users and
+revocable agent delegation. This provider owns `auth`'s managed SQL store; it never opens
+database files itself. It requires SDK 0.3.0 and `toolframe.storage.sql`.
+
+## Install
+
+With a running Toolframe application and an active SQL storage provider:
+
+```sh
+toolframe --home APP plugin add pypi:toolframe-auth==0.2.0 --enable
+```
+
+The [Entry Register template](https://github.com/toolframe/toolframe-core#readme)
+includes Auth and Dashboard Auth. The host resolves the SDK and the plugin's
+isolated environment automatically.
+
+Core supplies the private `password-lookup` key separately from configuration.
+Credential records store a keyed HMAC-SHA256 lookup plus a per-record salted
+scrypt verifier (`N=131072`, `r=8`, `p=1`, 32-byte output). At most two hashes run
+concurrently. Core also limits login attempts. Sessions use random opaque tokens;
+only SHA-256 digests of those high-entropy tokens are persisted. Metadata/list
+responses exclude lookup values, salts and verifiers.
+
+The internal `toolframe.auth` service implements login, resolve/touch, logout,
+create/list/update/revoke. Core admits administrators and passes their trusted
+principal/catalog. These methods are not directly published business APIs.
+`toolframe-dashboard-auth` supplies presentation through core's protected API.
+
+New passwords accept 8–32 characters; omitted passwords generate a random
+32-character secret. Existing longer passwords issued by 0.1.0 can still log in.
+The password-length policy preserves existing password records and sessions.
+
+## Federated users and agent grants
+
+Enable `toolframe-oidc-auth` for OIDC login. Auth remains the local identity and
+permission authority; it does not implement provider discovery or OAuth endpoints.
+Configure the trusted plugin ID with `identity_provider` (default `oidc-auth`) and
+initial admission with exact `federated_identities` entries:
+
+```toml
+[plugins.auth.config]
+identity_provider = "oidc-auth"
+federated_identities = [
+  { issuer = "https://accounts.google.com", subject = "VERIFIED_SUB", label = "Alice", scopes = ["notes.read"] },
+]
+```
+
+The trusted plugin must supply verified issuer/subject claims. No email matching
+or automatic account merging occurs. The admission entry creates a local user
+once; later permission/disablement changes use the protected user-management API.
+Changing admission configuration does not overwrite existing users. Every user
+gets `system.auth.self`; `system.auth.users` permits bounded administration.
+
+The internal service additionally implements `federated_login`, `users`,
+`user_update`, `grant_create`, `grant_check`, `grants` and `revoke_grant`.
+Core verifies administrative/self-service callers; only the configured identity
+provider may admit external identities or issue/check delegated grants.
+Agent grants include user, issuer, client, resource, explicit business scopes and
+expiry. Grant checks intersect current user permissions. Revocation does not end
+the browser session; disabling a user invalidates sessions and revokes all their
+agent grants. Password and MCP-key credentials retain their independent behavior.
+
+This feature introduces additive **store revision v2**. Existing v1 stores require
+Core's explicit `migrate plan auth` / `migrate apply auth --plan-id ...` workflow
+after staging a compatible Auth build. Back up the store and retained secrets
+first. The migration leaves existing password/session tables intact.
+
+Active secret uniqueness is transactional. Expired/revoked secrets can be reused
+in a new record with a new grant; old sessions remain tied to the old record.
+Revoked records cannot be restored. Editing a grant invalidates its sessions.
+Delegation is limited by the administrator's own scopes, dynamic-business selector
+and expiry. Issued grants do not inherit a revocation dependency on their creator.
+
+Configuration: `session_max_seconds` defaults to 604800; `session_idle_seconds`
+defaults to 86400. Password expiry caps both. Successful logins and authorized
+functional activity update usage; polling and denied attempts do not.
+
+Back up the consistent auth SQLite store and retained private key together. A
+missing key with an existing store is a recovery error, not a reason to regenerate
+the key. Removing/reloading the plugin retains both. Runtime validation uses
+temporary storage and secrets.
+
+```sh
+uv sync
+uv run pytest -q
+uv run ruff check src tests
+uv build --wheel
+```
+
+For the same isolated lint, tests, distribution and wheel-install checks used by
+GitHub Actions, run `python3.14 scripts/ci.py`. See [CI and publishing](docs/ci.md)
+for pinned sibling sources, local requirements and TestPyPI/PyPI setup.
+
+Core owns access policy. Its compatible OIDC integration supports
+`access.failure_mode = "closed"` for protected deployments; the default preserves
+legacy public business fallback. MCP, llms and explicitly public business APIs
+have independent policies.
+
+For release validation and Trusted Publisher setup, see [releasing](docs/releasing.md).
+
+## License
+
+Licensed under the Apache License, Version 2.0. See [LICENSE](LICENSE) and [NOTICE](NOTICE).
+
+## PostgreSQL storage
+
+Version 0.2 requires SDK 0.3 and declares PostgreSQL migration SQL alongside the
+unchanged SQLite history. Provision this plugin’s stable store owner with the
+PostgreSQL provider before enabling it. The application still runs one Core;
+retain its private keys and configuration with the application home. Existing
+SQLite records are not imported automatically.

toolframe_auth-0.2.0.dist-info/RECORD

@@ -0,0 +1,12 @@
+toolframe_auth/__init__.py,sha256=Fi1pOy3Sq42boSaPh5BPWxp3uephua4r6L-bWJ6p_P0,47
+toolframe_auth/crypto.py,sha256=2FQroy58arAu5-gtIpgcF8_xjLIBCtbsMoVWebVOjKY,685
+toolframe_auth/identities.py,sha256=q1idkMrmiM2v425LXcfcuHD8lYINp9s3iPlsHq-oB1o,14385
+toolframe_auth/plugin.py,sha256=S0LCa4YQw5zGc1foPG06_WEC19RCGIw1-582S0PYYOw,18989
+toolframe_auth/migrations/v1.postgresql.sql,sha256=plTp_P-urHRDA_6EHhJ9_zGYVT_s2nflMiOqK5UUcXA,738
+toolframe_auth/migrations/v2.postgresql.sql,sha256=8D-RtlAx965JmUa7jF9SXkiYMv9ehj85_fTZHpwFXCE,1057
+toolframe_auth-0.2.0.dist-info/METADATA,sha256=KJomdS--HqnWwRCXbHVCH05acjPtF507WjS0Wh0on2k,6216
+toolframe_auth-0.2.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+toolframe_auth-0.2.0.dist-info/entry_points.txt,sha256=Dbns662YpIQPQN9T-MypGViWkHxKsuArqUKxqagEhOI,56
+toolframe_auth-0.2.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+toolframe_auth-0.2.0.dist-info/licenses/NOTICE,sha256=cmOwtaBn-GZfDGPMQQuvCLRVnnuD41REN1cDLuzc9yI,35
+toolframe_auth-0.2.0.dist-info/RECORD,,

toolframe_auth-0.2.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.4
+Root-Is-Purelib: true
+Tag: py3-none-any

toolframe_auth-0.2.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[toolframe.plugins]
+auth = toolframe_auth.plugin:plugin

toolframe_auth-0.2.0.dist-info/licenses/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

toolframe_auth-0.2.0.dist-info/licenses/NOTICE

@@ -0,0 +1,2 @@
+toolframe-auth
+Copyright 2026 byfb