toolframe-dashboard-auth 0.1.3__py3-none-any.whl

toolframe_dashboard_auth/__init__.py

@@ -0,0 +1 @@
+"""Login and access management presentation."""

toolframe_dashboard_auth/connections.py

@@ -0,0 +1,40 @@
+"""Own-account delegation management backed by the shared authority."""
+
+import time
+
+from toolframe_sdk import PluginError
+
+
+def render(context):
+    import streamlit as st
+
+    st.title("Connected agents")
+    st.caption(
+        "Each connection has its own permissions. Revoking an agent keeps your Dashboard session signed in."
+    )
+    try:
+        records = context.auth("grants")["grants"]
+    except PluginError as error:
+        st.info(error.message)
+        return
+    if not records:
+        st.info(
+            "No agents connected. Add this application's MCP URL in your agent to authorize a connection."
+        )
+    for record in records:
+        with st.container(border=True):
+            st.subheader(record["client_name"])
+            st.write(record["resource"])
+            st.write("Permissions: " + ", ".join(record["scopes"]))
+            if record["revoked_at"] is not None:
+                st.caption("Revoked")
+            elif record["expires_at"] <= time.time():
+                st.caption("Expired")
+            elif st.button("Revoke access", key="revoke-" + record["id"]):
+                try:
+                    context.auth("revoke_grant", {"id": record["id"]})
+                    st.rerun()
+                except PluginError as error:
+                    st.error(error.message)
+    if st.button("Refresh connections"):
+        st.rerun()

toolframe_dashboard_auth/login.html

@@ -0,0 +1,24 @@
+<!doctype html>
+<html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Sign in · Toolframe</title>
+<style>
+:root{color-scheme:light dark;font-family:system-ui,sans-serif}body{max-width:28rem;margin:15vh auto;padding:2rem}h1{font-size:2rem}label,input,button{display:block;width:100%;box-sizing:border-box}input,button{font:inherit;padding:.85rem;margin:.6rem 0 1.2rem;border-radius:.5rem;border:1px solid #888}button{cursor:pointer;background:#2369d8;color:white;border:0}#error{color:#e96565}p{line-height:1.5}a{color:#579aff}
+</style>
+<h1>Toolframe</h1><p>Sign in to open the Dashboard.</p>
+<div id="identity-providers"></div>
+<form method="post" action="/_toolframe/auth/login">
+<label for="password">Access password</label><input id="password" name="password" type="password" required maxlength="1024" autocomplete="current-password" autofocus>
+<button>Sign in</button><p id="error" role="alert"></p></form>
+<p><a href="/_toolframe/session">Operator sign in</a></p>
+<script>
+fetch('/_toolframe/oidc/providers').then(response=>response.ok?response.json():{providers:[]}).then(data=>{
+ const target=document.querySelector('#identity-providers');
+ for(const provider of data.providers){const link=document.createElement('a');link.href=provider.url;link.textContent='Continue with '+provider.label;const row=document.createElement('p');row.append(link);target.append(row)}
+}).catch(()=>{});
+document.querySelector('form').addEventListener('submit',async event=>{
+ event.preventDefault();const button=document.querySelector('button'),error=document.querySelector('#error');button.disabled=true;error.textContent='';
+ try{const response=await fetch('/_toolframe/auth/login',{method:'POST',headers:{'Content-Type':'application/json','Accept':'application/json'},body:JSON.stringify({password:document.querySelector('#password').value})});
+ const data=await response.json();if(response.ok){location.assign('/')}else{error.textContent=data.error?.message||'Sign in failed. Please retry.'}}
+ catch{error.textContent='Connection interrupted. Please retry.'}finally{button.disabled=false}
+});
+</script></html>

toolframe_dashboard_auth/mcp_page.py

@@ -0,0 +1,146 @@
+"""MCP key presentation; key material is generated only by the credential service."""
+
+import time
+from urllib.parse import urlsplit, urlunsplit
+
+from toolframe_sdk import PluginError
+
+from .page import browser_timezone, expiry_fields, timestamp
+
+
+def render(context):
+    import streamlit as st
+
+    st.title("MCP keys")
+    zone = browser_timezone(st.context.timezone, st.context.timezone_offset)
+    try:
+        settings = context.auth("mcp.catalog")
+    except PluginError as error:
+        st.error(error.message)
+        return
+    state = settings["status"]
+    if state["mode"] == "public":
+        st.warning("MCP is public. Enable protected access to require bearer keys.")
+    elif state["mode"] == "unavailable":
+        st.warning(
+            "Protected MCP is unavailable until its authentication provider is ready."
+        )
+    else:
+        st.success("MCP requires a bearer key for every request.")
+    if context.can("system.settings.manage"):
+        with st.expander("MCP access policy"):
+            mode = st.selectbox(
+                "MCP access",
+                ["public", "protected"],
+                index=0 if settings["policy"]["mode"] == "public" else 1,
+            )
+            if st.button("Save MCP access policy"):
+                try:
+                    context.auth(
+                        "mcp.policy",
+                        {"mode": mode, "expected_revision": settings["revision"]},
+                    )
+                    st.rerun()
+                except PluginError as error:
+                    st.error(error.message)
+    if not state["provider_available"]:
+        st.info("Install and enable the MCP authentication plugin to manage keys.")
+        return
+    try:
+        records = context.auth("mcp.list")["keys"]
+    except PluginError as error:
+        st.error(error.message)
+        return
+    st.caption(
+        "Create a separate key for each client. Keys grant only the selected business permissions."
+    )
+    generation = st.session_state.get("mcp-draft-generation", 0)
+    prefix = f"mcp-key-{generation}"
+    with st.container(border=True):
+        st.subheader("New MCP key")
+        label = st.text_input(
+            "Name", value="Unnamed MCP key", max_chars=120, key=f"{prefix}-label"
+        )
+        catalog = settings["scopes"]
+        scopes = st.multiselect(
+            "Business permissions",
+            list(catalog),
+            format_func=lambda s: f"{catalog[s]['title']} ({s})",
+            key=f"{prefix}-scopes",
+        )
+        expiry = expiry_fields(st, prefix, zone=zone)
+        if settings["max_expires_at"] is not None:
+            st.caption(
+                f"Your grant permits keys expiring no later than {timestamp(settings['max_expires_at'], zone)}."
+            )
+        create = st.button("Generate key", type="primary")
+    if create:
+        try:
+            result = context.auth(
+                "mcp.create", {"label": label, "scopes": scopes, "expires_at": expiry}
+            )
+        except PluginError as error:
+            st.error(error.message)
+        else:
+            st.session_state["created-mcp-key"] = result["token"]
+            st.session_state["mcp-draft-generation"] = generation + 1
+            st.rerun()
+    token = st.session_state.pop("created-mcp-key", None)
+    if token:
+        st.success("Key created. Copy it now; it cannot be retrieved later.")
+        st.code(token, language=None)
+        st.code(f"Authorization: Bearer {token}", language=None)
+    if st.context.url:
+        location = urlsplit(st.context.url)
+        st.text_input(
+            "MCP URL",
+            value=urlunsplit((location.scheme, location.netloc, "/mcp", "", "")),
+            disabled=True,
+        )
+    else:
+        st.caption("MCP URL: your application's address followed by /mcp.")
+    st.caption(
+        "Use HTTPS for remote connections and configure the Authorization header in your MCP client."
+    )
+    st.subheader("Key records")
+    now = time.time()
+    st.dataframe(
+        [
+            {
+                "Name": row["label"],
+                "Key": row["masked_key"],
+                "Permissions": ", ".join(row["scopes"]),
+                "Status": "Revoked"
+                if row["revoked_at"] is not None
+                else "Expired"
+                if row["expires_at"] is not None and row["expires_at"] <= now
+                else "Active",
+                "Created": timestamp(row["created_at"], zone),
+                "Expires": timestamp(row["expires_at"], zone),
+                "Last used": timestamp(row["last_used"], zone),
+            }
+            for row in records
+        ],
+        hide_index=True,
+        width="stretch",
+    )
+    if st.button("Refresh keys"):
+        st.rerun()
+    active = [row for row in records if row["revoked_at"] is None]
+    if active:
+        identifier = st.selectbox(
+            "Key to revoke",
+            [row["id"] for row in active],
+            format_func=lambda key: next(
+                f"{row['label']} ({key[:8]})" for row in active if row["id"] == key
+            ),
+        )
+        if st.button("Revoke key"):
+            try:
+                context.auth("mcp.revoke", {"id": identifier})
+                st.rerun()
+            except PluginError as error:
+                st.error(error.message)
+    st.caption(
+        "To rotate a key, generate a replacement, update the client, then revoke the old key."
+    )

toolframe_dashboard_auth/page.py

@@ -0,0 +1,338 @@
+"""UI-only auth integration; credentials remain in the auth service."""
+
+import calendar
+import secrets
+from datetime import UTC, datetime, timedelta, timezone
+from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
+
+from toolframe_sdk import PluginError
+
+
+def browser_timezone(name, offset):
+    if name:
+        try:
+            return ZoneInfo(name)
+        except ZoneInfoNotFoundError, ValueError:
+            pass
+    if offset is not None and -1440 < offset < 1440:
+        return timezone(-timedelta(minutes=offset))
+    return UTC
+
+
+def timestamp(value, zone=UTC):
+    return (
+        datetime.fromtimestamp(value, zone).strftime("%Y-%m-%d %H:%M:%S %Z")
+        if value is not None
+        else "—"
+    )
+
+
+def unnamed_label(records):
+    labels = {record["label"] for record in records}
+    label, number = "Unnamed password", 1
+    while label in labels:
+        number += 1
+        label = f"Unnamed password {number}"
+    return label
+
+
+def expiry_after(now, amount, unit):
+    if unit == "Months":
+        month = now.year * 12 + now.month - 1 + amount
+        year, month = divmod(month, 12)
+        month += 1
+        return now.replace(
+            year=year,
+            month=month,
+            day=min(now.day, calendar.monthrange(year, month)[1]),
+        ).timestamp()
+    seconds = {"Minutes": 60, "Hours": 3600, "Days": 86400, "Weeks": 604800}[unit]
+    return now.timestamp() + amount * seconds
+
+
+def expiry_fields(st, prefix, expiry=None, zone=UTC):
+    limited = st.checkbox(
+        "Set expiry", value=expiry is not None, key=f"{prefix}-limited"
+    )
+    if not limited:
+        return None
+    with st.container(key=f"expiry-controls-{prefix}"):
+        duration_column, unit_column = st.columns(2, gap="small")
+    amount = duration_column.number_input(
+        "Expire after",
+        min_value=1,
+        max_value=3650,
+        value=None if expiry is not None else 1,
+        step=1,
+        placeholder="Keep current expiry",
+        help="From the time you save. Leave blank to keep an existing expiry.",
+        key=f"{prefix}-duration",
+    )
+    unit = unit_column.selectbox(
+        "Unit",
+        ["Minutes", "Hours", "Days", "Weeks", "Months"],
+        index=3,
+        key=f"{prefix}-unit",
+    )
+    result = expiry_after(datetime.now(zone), amount, unit) if amount else expiry
+    if result is not None:
+        st.caption(f"Expires on {timestamp(result, zone)}")
+    else:
+        st.caption("Enter a duration to set an expiry.")
+    return result
+
+
+def grant_fields(st, catalog, prefix, record=None, default_label="", zone=UTC):
+    record = record or {}
+    label = st.text_input(
+        "Name",
+        value=record.get("label", default_label),
+        max_chars=120,
+        key=f"{prefix}-label",
+    )
+    all_business = st.checkbox(
+        "All business scopes (including future plugins)",
+        value=record.get("all_business", True),
+        key=f"{prefix}-all",
+    )
+    scopes = []
+    owners = sorted({item["owner"] for item in catalog.values()})
+    for owner in owners:
+        options = [name for name, item in catalog.items() if item["owner"] == owner]
+        selected = st.multiselect(
+            f"{owner} scopes",
+            options,
+            default=[s for s in record.get("scopes", []) if s in options],
+            format_func=lambda s: f"{catalog[s]['title']} ({s})",
+            key=f"{prefix}-{owner}",
+        )
+        scopes.extend(selected)
+    return {
+        "label": label.strip() or default_label,
+        "scopes": scopes,
+        "all_business": all_business,
+        "expires_at": expiry_fields(st, prefix, record.get("expires_at"), zone),
+    }
+
+
+def render(context):
+    import streamlit as st
+
+    zone = browser_timezone(st.context.timezone, st.context.timezone_offset)
+    # Streamlit stacks columns below 640px; this short pair still fits side by side.
+    st.html("""<style>
+    [class*="st-key-expiry-controls-"] [data-testid="stHorizontalBlock"] {
+        flex-wrap: nowrap;
+    }
+    [class*="st-key-expiry-controls-"] [data-testid="stColumn"] {
+        min-width: 0; flex: 1 1 0; width: 0;
+    }
+    </style>""")
+    st.title("Access passwords")
+    try:
+        settings = context.auth("catalog")
+    except PluginError as error:
+        st.error(error.message)
+        return
+    entrances = settings.get("entrances")
+    if entrances:
+        with st.expander("Access by entrance", expanded=True):
+            dashboard, mcp = entrances["dashboard"], entrances["mcp"]
+            st.markdown(
+                f"**Dashboard and service calls:** {dashboard['mode']} "
+                f"(configured: {dashboard['configured']}). "
+                f"**MCP:** {mcp['mode']} (configured: {mcp['configured']})."
+            )
+            st.caption(
+                "MCP uses its own policy and credentials. Manage it on the MCP keys page. "
+                "Dashboard passwords do not protect explicitly public HTTP methods or llms.txt."
+            )
+            st.caption(
+                f"Direct local control: {'enabled' if settings['policy']['local_control'] else 'disabled'}. "
+                f"Current caller: {entrances['actor']}. System operations still require operator authority or system scopes."
+            )
+            public = entrances["declared_public_api"]
+            st.markdown("**Declared public HTTP methods**")
+            for path in public:
+                st.caption(path)
+            if not public:
+                st.caption("No public HTTP methods declared by installed plugins.")
+            st.caption(
+                "Declared methods are served only while their plugin is available."
+            )
+    if context.can("system.settings.manage"):
+        with st.expander("Application access policy"):
+            mode = st.selectbox(
+                "Dashboard access",
+                ["public", "protected"],
+                index=0 if settings["policy"]["mode"] == "public" else 1,
+            )
+            local = st.checkbox(
+                "Allow direct local control", value=settings["policy"]["local_control"]
+            )
+            failure = None
+            if "failure_modes" in settings.get("policy_options", {}):
+                failure = st.selectbox(
+                    "When Dashboard authentication is unavailable",
+                    ["closed", "public"],
+                    index=0 if settings["policy"]["failure_mode"] == "closed" else 1,
+                    format_func=lambda value: {
+                        "closed": "Deny protected business access (recommended)",
+                        "public": "Allow anonymous business access",
+                    }[value],
+                )
+                if failure == "public":
+                    st.warning(
+                        "If authentication fails or is disabled, anonymous visitors receive all business scopes."
+                    )
+                st.caption(
+                    "This applies to protected Dashboard/service access. MCP and public HTTP keep their own rules."
+                )
+            else:
+                st.caption(
+                    "This Core version cannot edit the authentication failure policy here."
+                )
+            if st.button("Save access policy"):
+                try:
+                    context.auth(
+                        "policy",
+                        {
+                            "mode": mode,
+                            "local_control": local,
+                            "expected_revision": settings["revision"],
+                            **(
+                                {"failure_mode": failure} if failure is not None else {}
+                            ),
+                        },
+                    )
+                    st.rerun()
+                except PluginError as error:
+                    st.error(error.message)
+    st.caption(
+        "System scopes are excluded by default. Names identify grants, not people. MCP has a separate access policy. llms.txt and explicitly public business APIs stay public."
+    )
+    try:
+        records = context.auth("list")["credentials"]
+    except PluginError as error:
+        st.error(error.message)
+        return
+    if "password-draft" not in st.session_state:
+        st.session_state["password-draft"] = {
+            "key": f"new-{secrets.token_hex(8)}",
+            "label": unnamed_label(records),
+            "password": secrets.token_urlsafe(24),
+        }
+    draft = st.session_state["password-draft"]
+    # Regular widgets rerun immediately, so the expiry toggle can reveal its fields.
+    with st.container(border=True):
+        st.subheader("New access password")
+        fields = grant_fields(
+            st,
+            settings["scopes"],
+            draft["key"],
+            default_label=draft["label"],
+            zone=zone,
+        )
+        custom = st.text_input(
+            "Password (8–32 characters)",
+            type="password",
+            max_chars=32,
+            placeholder=draft["password"],
+            help="Leave blank to use the suggested password. Copy it after creation.",
+            key=f"{draft['key']}-password",
+        )
+        create = st.button("Create password")
+    if create:
+        password = custom or draft["password"]
+        try:
+            if not 8 <= len(password) <= 32:
+                raise PluginError(
+                    "invalid_request", "Passwords must contain 8–32 characters"
+                )
+            if (
+                st.session_state[f"{draft['key']}-limited"]
+                and fields["expires_at"] is None
+            ):
+                raise PluginError("invalid_request", "Enter an expiry duration")
+            result = context.auth(
+                "create",
+                {
+                    **fields,
+                    "password": password,
+                    "expected_revision": settings["revision"],
+                },
+            )
+        except PluginError as error:
+            st.error(error.message)
+        else:
+            st.session_state["created-password"] = {
+                "password": password,
+                "policy_error": result.get("policy_error"),
+            }
+            del st.session_state["password-draft"]
+            st.rerun()
+    created = st.session_state.pop("created-password", None)
+    if created:
+        st.success("Password created. Copy it now; it cannot be retrieved later.")
+        st.code(created["password"], language=None)
+        if created["policy_error"]:
+            st.error(created["policy_error"])
+    st.subheader("Password records")
+    st.dataframe(
+        [
+            {
+                **{k: v for k, v in row.items() if k not in {"scopes", "all_business"}},
+                "scopes": ", ".join(row["scopes"]),
+                "all_business": row["all_business"],
+                **{
+                    k: timestamp(row[k], zone)
+                    for k in (
+                        "created_at",
+                        "expires_at",
+                        "revoked_at",
+                        "last_login",
+                        "last_used",
+                    )
+                },
+            }
+            for row in records
+        ],
+        hide_index=True,
+        width="stretch",
+    )
+    if st.button("Refresh records"):
+        st.rerun()
+    if records:
+        identifier = st.selectbox(
+            "Password record",
+            [r["id"] for r in records],
+            format_func=lambda key: next(r["label"] for r in records if r["id"] == key),
+        )
+        record = next(r for r in records if r["id"] == identifier)
+        if record["revoked_at"] is not None:
+            st.info("Revoked. Create a new record to issue a new authorization.")
+            return
+        edit_key = f"{identifier}-{st.session_state.get('grant-edit-generation', 0)}"
+        with st.container(border=True):
+            fields = grant_fields(st, settings["scopes"], edit_key, record, zone=zone)
+            edit = st.button("Save password grant")
+        if edit:
+            try:
+                if (
+                    st.session_state[f"{edit_key}-limited"]
+                    and fields["expires_at"] is None
+                ):
+                    raise PluginError("invalid_request", "Enter an expiry duration")
+                context.auth("update", {"id": identifier, **fields})
+                st.session_state["grant-edit-generation"] = (
+                    st.session_state.get("grant-edit-generation", 0) + 1
+                )
+                st.rerun()
+            except PluginError as error:
+                st.error(error.message)
+        if st.button("Revoke password", type="primary"):
+            try:
+                context.auth("revoke", {"id": identifier})
+                st.rerun()
+            except PluginError as error:
+                st.error(error.message)

toolframe_dashboard_auth/plugin.py

@@ -0,0 +1,69 @@
+from importlib.resources import files
+
+from toolframe_sdk import (
+    AuthorizationSpec,
+    MethodSpec,
+    Plugin,
+    PluginDefinition,
+    Requirement,
+    Resource,
+    ServiceSpec,
+)
+
+
+class DashboardAuth(Plugin):
+    async def invoke(self, service, method, params):
+        return {
+            "html": files("toolframe_dashboard_auth").joinpath("login.html").read_text()
+        }
+
+
+plugin = PluginDefinition(
+    id="dashboard-auth",
+    kind="provider",
+    provider_kind="dashboard-auth",
+    factory="toolframe_dashboard_auth.plugin:DashboardAuth",
+    authorization=AuthorizationSpec(),
+    requires={"auth": Requirement(service="toolframe.auth")},
+    services={
+        "dashboard-auth.presentation": ServiceSpec(
+            methods={"login": MethodSpec(audience="internal", read_only=True)}
+        )
+    },
+    resources=(
+        Resource(
+            id="connections",
+            kind="dashboard.page",
+            title="Connected agents",
+            required_scopes=("system.auth.self",),
+            data={
+                "entrypoint": "toolframe_dashboard_auth.connections:render",
+                "order": 890,
+            },
+        ),
+        Resource(
+            id="users",
+            kind="dashboard.page",
+            title="User access",
+            required_scopes=("system.auth.users",),
+            data={"entrypoint": "toolframe_dashboard_auth.users:render", "order": 895},
+        ),
+        Resource(
+            id="passwords",
+            kind="dashboard.page",
+            title="Access passwords",
+            required_scopes=("system.auth.passwords",),
+            data={"entrypoint": "toolframe_dashboard_auth.page:render", "order": 900},
+        ),
+        Resource(
+            id="mcp-keys",
+            kind="dashboard.page",
+            title="MCP keys",
+            required_scopes=("system.auth.mcp_keys",),
+            data={
+                "entrypoint": "toolframe_dashboard_auth.mcp_page:render",
+                "order": 910,
+            },
+        ),
+    ),
+)

toolframe_dashboard_auth/users.py

@@ -0,0 +1,52 @@
+"""Administration of admitted federated users; no provider tokens enter the UI."""
+
+from toolframe_sdk import PluginError
+
+
+def render(context):
+    import streamlit as st
+
+    st.title("User access")
+    st.caption(
+        "External identities are admitted through application configuration. Manage their local permissions here after their first sign-in."
+    )
+    try:
+        settings = context.auth("user_catalog")
+        users = context.auth("users")["users"]
+    except PluginError as error:
+        st.error(error.message)
+        return
+    if not users:
+        st.info("No admitted users have signed in yet.")
+        return
+    by_id = {user["id"]: user for user in users}
+    identifier = st.selectbox(
+        "User", list(by_id), format_func=lambda key: by_id[key]["label"]
+    )
+    user = by_id[identifier]
+    scopes = st.multiselect(
+        "Permissions",
+        list(settings["scopes"]),
+        default=[scope for scope in user["scopes"] if scope in settings["scopes"]],
+        key="user-scopes-" + identifier,
+    )
+    disabled = st.checkbox(
+        "Disable user", value=bool(user["disabled"]), key="user-disabled-" + identifier
+    )
+    if st.button("Save user access"):
+        try:
+            context.auth(
+                "user_update",
+                {
+                    "id": identifier,
+                    "scopes": scopes,
+                    "disabled": disabled,
+                    "expires_at": user["expires_at"],
+                },
+            )
+            st.success("User access saved.")
+        except PluginError as error:
+            st.error(error.message)
+    st.caption(
+        "Permission reductions affect existing connections. Disabling a user also revokes their sessions and agent grants."
+    )

toolframe_dashboard_auth-0.1.3.dist-info/METADATA

@@ -0,0 +1,106 @@
+Metadata-Version: 2.5
+Name: toolframe-dashboard-auth
+Version: 0.1.3
+Summary: Password login and access management pages for Toolframe
+Project-URL: Homepage, https://github.com/toolframe/toolframe-dashboard-auth
+Project-URL: Repository, https://github.com/toolframe/toolframe-dashboard-auth
+Project-URL: Documentation, https://github.com/toolframe/toolframe-dashboard-auth#readme
+Project-URL: Issues, https://github.com/toolframe/toolframe-dashboard-auth/issues
+Author-email: byfb <62798989+byfb@users.noreply.github.com>
+License-Expression: Apache-2.0
+License-File: LICENSE
+License-File: NOTICE
+Requires-Python: >=3.14
+Requires-Dist: toolframe-sdk<0.4,>=0.2
+Provides-Extra: ui
+Requires-Dist: streamlit==1.61.0; extra == 'ui'
+Description-Content-Type: text/markdown
+
+# Toolframe Dashboard Auth
+
+The `dashboard-auth` provider supplies password and configured OIDC login choices,
+plus Streamlit access-management pages. It depends on the `toolframe.auth` service
+and SDK 0.2–0.3. Core handles cookies, admission and protected auth API calls; this
+plugin holds no credential database or verifier key.
+
+Install the package in a running application with compatible Auth and Dashboard
+providers, then open **Access passwords** as a local operator:
+
+```sh
+toolframe --home APP plugin add pypi:toolframe-dashboard-auth==0.1.3 --enable
+```
+
+With Core 0.6.1, **Access by entrance** reports Dashboard/service access, independent
+MCP policy, declared public HTTP methods and the current local/operator context.
+The policy form lets settings administrators choose closed or public behavior
+when Dashboard authentication fails. Closed is the default for new applications;
+existing application choices are preserved. Older Core versions keep the existing
+policy controls but do not offer the unsupported failure-policy editor. Public
+HTTP declarations and llms documents remain public, and method scopes do not
+provide per-person row isolation.
+While this page is available, credential-list errors leave its policy controls
+usable by local operators. If Dashboard Auth itself is unavailable, use Core's
+local management API for recovery.
+
+With compatible Core/Auth and `toolframe-oidc-auth` installed, the login page
+loads provider buttons from Core's safe provider catalogue. **Connected agents**
+requires `system.auth.self` and lets a federated user revoke their own connections
+without logging out. **User access** requires `system.auth.users` and manages
+permissions/disablement for identities already admitted by application
+configuration. Disabling a user revokes their browser sessions and agent grants.
+The pages call Core's protected facade; no upstream credentials enter Streamlit.
+
+The optional **MCP keys** page requires `system.auth.mcp_keys` and manages named
+256-bit bearer keys through core's separate MCP auth API. Install/enable
+`toolframe-mcp-auth` to generate keys, select business scopes and expiry, copy each
+secret once and revoke it later. `system.settings.manage` also permits changing
+the independent MCP public/protected policy. The page remains available for policy
+recovery when the MCP auth provider is absent. See the MCP authentication guide
+in the core repository for configuration details.
+
+The management page fills in an editable **Unnamed password** label, adding a
+number for names already in use. The password field accepts 8–32 characters and
+shows a stable random suggestion as its placeholder. Leave the field blank to use
+that exact suggestion; after creation, copy the one-time displayed password.
+Failed submissions preserve the draft; successful creation starts a fresh one.
+
+**Set expiry** immediately reveals a duration and unit side by side, with minutes,
+hours, days, weeks or calendar months and a calculated local expiry preview.
+Preview and record timestamps use the browser's timezone (its UTC offset is a
+fallback, then UTC if neither is available). Durations start when saved; months
+follow that local calendar and clamp to the destination month's last day. Other
+units measure elapsed time, including across daylight-saving changes. No
+date/time entry is needed.
+Turning expiry off hides the controls and saves no expiry. When editing, leave the
+duration blank to preserve the exact existing expiry, or enter a duration to
+replace it. Saving other grant fields never silently extends the expiry.
+
+The page selects scopes, edits grants, revokes records and shows creation,
+last-login and last-use timestamps. Its page
+requires `system.auth.passwords`; access-policy controls additionally require
+`system.settings.manage`. Core/auth enforce the same rules beyond the UI.
+
+Core serves the login page at `/_toolframe/auth/login`. The existing Dashboard
+provider owns the common local/public/protected header so it remains available
+when this integration fails or is disabled. Streamlit is supplied by the shared
+Dashboard execution environment, not the business/auth worker.
+
+```sh
+uv sync
+uv run pytest -q
+uv run ruff check src tests
+uv build --wheel
+```
+
+For the same isolated validation used by GitHub Actions, run `bash scripts/ci.sh`
+with Python 3.14.7, uv 0.12.8 and a sibling `toolframe-sdk` Git checkout available.
+This runs the presentation tests against a newly built wheel, checks both
+distributions, and verifies a separate installation with only runtime dependencies.
+See [CI and publishing](docs/ci.md) for the pinned SDK revision, workflow triggers,
+release prerequisites and local validation limits.
+
+For release validation and Trusted Publisher setup, see [releasing](docs/releasing.md).
+
+## License
+
+Licensed under the Apache License, Version 2.0. See [LICENSE](LICENSE) and [NOTICE](NOTICE).

toolframe_dashboard_auth-0.1.3.dist-info/RECORD

@@ -0,0 +1,13 @@
+toolframe_dashboard_auth/__init__.py,sha256=_E2k7r37iXtb0I16etnkMCEgX1PUL5zBQkPkikWddeI,48
+toolframe_dashboard_auth/connections.py,sha256=85Soev_cdH2qDA79fBJmV1RfQpTQwew2Eb2TAPEUE-k,1382
+toolframe_dashboard_auth/login.html,sha256=aUaikJX9LmsYn6EGvtigvS7UAKiqa3dk5Rt65lohB3Y,2161
+toolframe_dashboard_auth/mcp_page.py,sha256=86feBt3XmP4SWPMRdacGhBKOUAWIpWsmvPtRsG5v8rw,5432
+toolframe_dashboard_auth/page.py,sha256=qFd8qJx4cmNPYYkfOc3ziCHdA3WkvZ4TPkWM1vM2DsA,12833
+toolframe_dashboard_auth/plugin.py,sha256=Nl1ZmwQQqOHDk5wW3G7j-6Ut00BfIq3WpLvpW53U0cg,2023
+toolframe_dashboard_auth/users.py,sha256=88uXpsB-xFPzQKZ8bFo8WYf75Q_GHW9FdPX-s9Y81A8,1760
+toolframe_dashboard_auth-0.1.3.dist-info/METADATA,sha256=HlgeTTcw984JngCnQpVTBgIaGyVjf0VYRYT-8qsaBng,5652
+toolframe_dashboard_auth-0.1.3.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+toolframe_dashboard_auth-0.1.3.dist-info/entry_points.txt,sha256=bpL7Pz-rrx9tFpDQFnM_8FJr03g_YszmJD50ryjiG5A,76
+toolframe_dashboard_auth-0.1.3.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+toolframe_dashboard_auth-0.1.3.dist-info/licenses/NOTICE,sha256=2OqhMZQ58LnnFMuKDOyip9m_S6Gvf4_HcAEBiyHt4mw,45
+toolframe_dashboard_auth-0.1.3.dist-info/RECORD,,

toolframe_dashboard_auth-0.1.3.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.4
+Root-Is-Purelib: true
+Tag: py3-none-any

toolframe_dashboard_auth-0.1.3.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[toolframe.plugins]
+dashboard-auth = toolframe_dashboard_auth.plugin:plugin

toolframe_dashboard_auth-0.1.3.dist-info/licenses/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

toolframe_dashboard_auth-0.1.3.dist-info/licenses/NOTICE

@@ -0,0 +1,2 @@
+toolframe-dashboard-auth
+Copyright 2026 byfb