xtr-security-http 3.0.0__py3-none-any.whl

xtr_security_http/authenticator/passport/self_validating_passport.py

@@ -0,0 +1,42 @@
+"""A passport whose user was already authenticated, carrying no credentials."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, final
+
+from xtr_security_http.authenticator.passport.badge.pre_authenticated_user_badge import (
+    PreAuthenticatedUserBadge,
+)
+
+from .passport import Passport
+
+if TYPE_CHECKING:
+    from collections.abc import Iterable, Mapping
+
+    from .badge.badge_interface import BadgeInterface
+    from .badge.user_badge import UserBadge
+
+__all__ = ["SelfValidatingPassport"]
+
+
+@final
+class SelfValidatingPassport(Passport):
+    """A passport for a user proven before it was built.
+
+    A bearer token was verified by its handler, so there are no credentials to
+    check — only the user it names. Every self-validating passport carries a
+    :class:`~xtr_security_http.authenticator.passport.badge.pre_authenticated_user_badge.PreAuthenticatedUserBadge`,
+    which is resolved from the start, so the passport check has nothing to
+    verify and settles on the user the token proved.
+    """
+
+    def __init__(
+        self,
+        user_badge: UserBadge,
+        badges: Iterable[BadgeInterface] = (),
+        attributes: Mapping[str, object] | None = None,
+    ) -> None:
+        """Record the user badge, add the pre-authenticated badge, keep the rest."""
+        super().__init__(user_badge, badges, attributes)
+        if not self.has_badge(PreAuthenticatedUserBadge):
+            _ = self.add_badge(PreAuthenticatedUserBadge())

xtr_security_http/authenticator/token/__init__.py

@@ -0,0 +1,7 @@
+"""The token the HTTP edge settles on once a user is established."""
+
+from __future__ import annotations
+
+from .post_authentication_token import PostAuthenticationToken
+
+__all__ = ["PostAuthenticationToken"]

xtr_security_http/authenticator/token/post_authentication_token.py

@@ -0,0 +1,43 @@
+"""The token authentication settles on once a user is established."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from xtr_security_core.authentication.token.abstract_token import AbstractToken
+
+if TYPE_CHECKING:
+    from collections.abc import Sequence
+
+    from xtr_security_core.user.user_interface import UserInterface
+
+__all__ = ["PostAuthenticationToken"]
+
+
+class PostAuthenticationToken(AbstractToken):
+    """A user, the firewall that authenticated them, and the roles decided.
+
+    The ordinary outcome of a successful authentication. It lives in the core,
+    not only at the HTTP edge, because a worker or a command authenticates the
+    same way — it sets one of these on the token storage without a request ever
+    being involved.
+
+    Attributes:
+        firewall_name: The firewall (or unit of work) that authenticated.
+    """
+
+    _firewall_name: str
+
+    def __init__(
+        self,
+        user: UserInterface,
+        firewall_name: str,
+        roles: Sequence[str],
+    ) -> None:
+        """Record the user, the firewall that authenticated them, and their roles."""
+        super().__init__(user=user, roles=roles)
+        self._firewall_name = firewall_name
+
+    def get_firewall_name(self) -> str:
+        """Return the firewall (or unit of work) that authenticated the user."""
+        return self._firewall_name

xtr_security_http/authorization/__init__.py

@@ -0,0 +1,15 @@
+"""Authorization at the HTTP edge: scope voting and turning a denial into a response."""
+
+from __future__ import annotations
+
+from .access_denied_handler_interface import AccessDeniedHandlerInterface
+from .insufficient_scope_access_denied_handler import InsufficientScopeAccessDeniedHandler
+from .oauth2_scope_voter import OAuth2ScopeVoter, oauth2_scope, parse_oauth2_scope
+
+__all__ = [
+    "AccessDeniedHandlerInterface",
+    "InsufficientScopeAccessDeniedHandler",
+    "OAuth2ScopeVoter",
+    "oauth2_scope",
+    "parse_oauth2_scope",
+]

xtr_security_http/authorization/access_denied_handler_interface.py

@@ -0,0 +1,27 @@
+"""What turns an access denial into a response of its own."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Protocol, runtime_checkable
+
+if TYPE_CHECKING:
+    from starlette.requests import Request
+    from starlette.responses import Response
+    from xtr_security_core.exception import AccessDeniedError
+
+__all__ = ["AccessDeniedHandlerInterface"]
+
+
+@runtime_checkable
+class AccessDeniedHandlerInterface(Protocol):
+    """Shapes the response to a caller who is known but not allowed.
+
+    A firewall hands a denial here when the caller is fully authenticated —
+    the answer is a refusal, not a challenge. A handler may return a response
+    of its own, or ``None`` to leave the firewall to answer with a plain
+    ``403``.
+    """
+
+    async def handle(self, request: Request, error: AccessDeniedError) -> Response | None:
+        """Return the response that refuses ``request``, or ``None`` for a plain refusal."""
+        ...

xtr_security_http/authorization/insufficient_scope_access_denied_handler.py

@@ -0,0 +1,66 @@
+"""The access-denied handler that answers a scope shortfall the RFC 6750 way."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, final
+
+from starlette.responses import JSONResponse
+from typing_extensions import override
+
+from .access_denied_handler_interface import AccessDeniedHandlerInterface
+from .oauth2_scope_voter import parse_oauth2_scope
+
+if TYPE_CHECKING:
+    from starlette.requests import Request
+    from starlette.responses import Response
+    from xtr_security_core.exception import AccessDeniedError
+
+__all__ = ["InsufficientScopeAccessDeniedHandler"]
+
+
+@final
+class InsufficientScopeAccessDeniedHandler(AccessDeniedHandlerInterface):
+    """Answers a denied scope check with ``403`` and a bearer scope challenge.
+
+    When a bearer token is valid but lacks a scope a resource requires, RFC
+    6750 says the answer is ``403`` with a ``WWW-Authenticate: Bearer`` header
+    naming ``error="insufficient_scope"`` and the ``scope`` the resource needs.
+    This handler reads the scopes out of the denied ``OAUTH2_SCOPE(...)``
+    attribute and writes that challenge, with the realm when one is configured.
+
+    Attributes:
+        realm: The protection realm named in the challenge, when set.
+    """
+
+    __slots__ = ("_realm",)
+
+    def __init__(self, realm: str | None = None) -> None:
+        """Record the realm named in the challenge, if any."""
+        self._realm = realm
+
+    @override
+    async def handle(self, request: Request, error: AccessDeniedError) -> Response | None:
+        """Return a ``403`` carrying the RFC 6750 insufficient-scope challenge."""
+        del request
+        scope = self._required_scope(error)
+        parts = ["Bearer"]
+        if self._realm is not None:
+            parts.append(f'realm="{self._realm}"')
+        parts.append('error="insufficient_scope"')
+        parts.append('error_description="The request requires higher privileges than provided."')
+        if scope:
+            parts.append(f'scope="{scope}"')
+        challenge = parts[0] + " " + ", ".join(parts[1:])
+        return JSONResponse(
+            {"error": "insufficient_scope"},
+            status_code=403,
+            headers={"WWW-Authenticate": challenge},
+        )
+
+    def _required_scope(self, error: AccessDeniedError) -> str:
+        """Read the space-joined scopes out of the denied scope attribute."""
+        for attribute in error.attributes:
+            scopes = parse_oauth2_scope(attribute)
+            if scopes is not None:
+                return " ".join(scopes)
+        return ""

xtr_security_http/authorization/oauth2_scope_voter.py

@@ -0,0 +1,122 @@
+"""A voter that grants by the scopes a bearer token carries."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, ClassVar, Final, cast, final
+
+from typing_extensions import override
+from xtr_security_core.authorization.voter.access import Access
+from xtr_security_core.authorization.voter.cacheable_voter_interface import CacheableVoterInterface
+from xtr_security_core.exception import InvalidArgumentError
+
+if TYPE_CHECKING:
+    from collections.abc import Iterable, Sequence
+
+    from xtr_security_core.authentication.token.token_interface import TokenInterface
+    from xtr_security_core.authorization.voter.vote import Vote
+
+__all__ = ["OAuth2ScopeVoter", "oauth2_scope", "parse_oauth2_scope"]
+
+_PREFIX: Final = "OAUTH2_SCOPE("
+_SUFFIX: Final = ")"
+
+
+def oauth2_scope(*scopes: str) -> str:
+    """Build the attribute string that asks for ``scopes``.
+
+    ``oauth2_scope("books:read", "books:write")`` returns
+    ``"OAUTH2_SCOPE(books:read books:write)"`` — the attribute an access rule or
+    an ``IsGranted`` hands to
+    :class:`OAuth2ScopeVoter`.
+
+    Raises:
+        InvalidArgumentError: When called with no scopes, which would build an
+            attribute that grants any scoped token.
+    """
+    if not scopes:
+        raise InvalidArgumentError("Asking for OAuth2 scopes requires at least one scope.")
+    return f"{_PREFIX}{' '.join(scopes)}{_SUFFIX}"
+
+
+@final
+class OAuth2ScopeVoter(CacheableVoterInterface):
+    """Grants ``OAUTH2_SCOPE(...)`` when the token carries every scope asked for.
+
+    A bearer token keeps the scopes it was issued with in the ``oauth2_scope``
+    attribute — a sequence, or a single space-separated string. This voter reads
+    an ``OAUTH2_SCOPE(a b)`` attribute and grants only when every scope in it is
+    among the token's. A token that carries no scopes at all is not judged: the
+    voter abstains, leaving the question to the others.
+    """
+
+    SCOPE_ATTRIBUTE: ClassVar[str] = "oauth2_scope"
+
+    @override
+    async def vote(
+        self,
+        token: TokenInterface,
+        subject: object,
+        attributes: Sequence[object],
+        vote: Vote | None = None,
+    ) -> Access:
+        """Grant when the token holds every asked-for scope; abstain without scopes."""
+        del subject
+        result = Access.ABSTAIN
+        for attribute in attributes:
+            scopes = parse_oauth2_scope(attribute)
+            if scopes is None:
+                continue
+            if not token.has_attribute(self.SCOPE_ATTRIBUTE):
+                continue
+            result = Access.DENIED
+            held = self._held_scopes(token)
+            missing = [scope for scope in scopes if scope not in held]
+            if not missing:
+                return Access.GRANTED
+            if vote is not None:
+                vote.add_reason(f"The token is missing the scope(s): {', '.join(missing)}.")
+        return result
+
+    @override
+    def supports_attribute(self, attribute: str) -> bool:
+        """Tell whether ``attribute`` is a scope request ``parse_oauth2_scope`` would read."""
+        return parse_oauth2_scope(attribute) is not None
+
+    @override
+    def supports_type(self, subject_type: str) -> bool:
+        """Vote on any subject: scopes are read from the token alone."""
+        del subject_type
+        return True
+
+    def _held_scopes(self, token: TokenInterface) -> frozenset[str]:
+        """Read the scopes the token carries, from a string or a sequence."""
+        value = token.get_attribute(self.SCOPE_ATTRIBUTE)
+        if isinstance(value, str):
+            return frozenset(value.split())
+        if isinstance(value, (list, tuple, set, frozenset)):
+            items = cast("Iterable[object]", value)
+            return frozenset(str(scope) for scope in items)
+        return frozenset()
+
+
+def parse_oauth2_scope(attribute: object) -> tuple[str, ...] | None:
+    """Read the scopes out of an ``OAUTH2_SCOPE(...)`` attribute, or ``None``.
+
+    The one reader of the attribute :func:`oauth2_scope` writes, shared by the
+    voter, the exception listener and the insufficient-scope handler so they
+    agree on what a scope request is. A request that names no scopes —
+    ``OAUTH2_SCOPE()`` or only whitespace inside — or anything not shaped like
+    the attribute reads as ``None``, so the voter abstains rather than granting
+    every scoped token vacuously.
+    """
+    if (
+        not isinstance(attribute, str)
+        or not attribute.startswith(_PREFIX)
+        or not attribute.endswith(_SUFFIX)
+    ):
+        return None
+    inner = attribute[len(_PREFIX) : -len(_SUFFIX)]
+    scopes = tuple(inner.split())
+    if not scopes:
+        return None
+    return scopes

xtr_security_http/decorator/__init__.py

@@ -0,0 +1,16 @@
+"""The route-surface decorators: the firewall's authorization markers.
+
+:class:`~xtr_security_http.decorator.is_granted.IsGranted` and
+:class:`~xtr_security_http.decorator.current_user.CurrentUser` are the markers a
+route carries, and
+:class:`~xtr_security_http.decorator.is_granted_context.IsGrantedContext` is the
+context a closure attribute is handed.
+"""
+
+from __future__ import annotations
+
+from .current_user import CurrentUser
+from .is_granted import IsGranted
+from .is_granted_context import IsGrantedContext
+
+__all__ = ["CurrentUser", "IsGranted", "IsGrantedContext"]

xtr_security_http/decorator/current_user.py

@@ -0,0 +1,83 @@
+"""The marker that injects the authenticated user into an endpoint."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, final
+
+from fastapi.params import Depends as DependsParam
+
+# The framework reads the dependency's signature at runtime to fill it from the
+# container, so the injection marker and the storage type stay importable here.
+from xtr_dependency_injection import Injected  # noqa: TC002
+from xtr_security_core.authentication.token.storage.token_storage_interface import (  # noqa: TC002
+    TokenStorageInterface,
+)
+from xtr_security_core.exception import AuthenticationCredentialsNotFoundError, UnsupportedUserError
+
+if TYPE_CHECKING:
+    from xtr_security_core.user.user_interface import UserInterface
+
+__all__ = ["CurrentUser"]
+
+
+@final
+class CurrentUser(DependsParam):
+    """Injects the current user into an endpoint parameter.
+
+    Used as ``Annotated[User, CurrentUser()]``. By default the parameter must
+    have a user: an anonymous request raises
+    :class:`~xtr_security_core.exception.AuthenticationCredentialsNotFoundError`,
+    which becomes a ``401``. Passing ``optional=True`` — for a parameter typed
+    ``User | None`` — returns ``None`` for an anonymous request instead. When
+    ``user_class`` is given, a user of another class raises
+    :class:`~xtr_security_core.exception.UnsupportedUserError`. The dependency never
+    appears in the generated schema.
+
+    The token storage the current user comes from is a container-provided
+    dependency of the resolver, declared with :data:`~xtr_dependency_injection.Injected`
+    — so the request's scoped storage is filled by the framework, never fetched
+    from the container by hand.
+
+    (FastAPI does not hand a dependency the annotation of the parameter it
+    fills, so nullability and the expected class are stated on the marker
+    rather than read from ``User | None`` — the one departure from the
+    spelling in the plan; see the package's DoneClaim.)
+
+    Attributes:
+        optional: Whether an anonymous request yields ``None`` instead of raising.
+        user_class: The class a user must be, or ``None`` to accept any.
+    """
+
+    optional: bool  # pyright: ignore[reportUninitializedInstanceVariable]
+    user_class: type | None  # pyright: ignore[reportUninitializedInstanceVariable]
+
+    def __init__(self, user_class: type | None = None, *, optional: bool = False) -> None:
+        """Inject the current user, optionally typed and optionally nullable."""
+        object.__setattr__(self, "optional", optional)
+        object.__setattr__(self, "user_class", user_class)
+        super().__init__(dependency=self._resolve, use_cache=True)
+
+    async def _resolve(
+        self,
+        token_storage: Injected[TokenStorageInterface],
+    ) -> UserInterface | None:
+        """Return the current user, or ``None`` / an error for an anonymous request.
+
+        Raises:
+            AuthenticationCredentialsNotFoundError: When no user is
+                authenticated and the marker is not ``optional``.
+            UnsupportedUserError: When the user is not of ``user_class``.
+        """
+        token = token_storage.get_token()
+        user = token.get_user() if token is not None else None
+        if user is None:
+            if self.optional:
+                return None
+            raise AuthenticationCredentialsNotFoundError(
+                "No authenticated user is available for this request.",
+            )
+        if self.user_class is not None and not isinstance(user, self.user_class):
+            raise UnsupportedUserError(
+                f"The current user is not a {self.user_class.__name__}.",
+            )
+        return user

xtr_security_http/decorator/is_granted.py

@@ -0,0 +1,199 @@
+"""The authorization dependency: require an attribute before an endpoint runs."""
+
+from __future__ import annotations
+
+import functools
+import inspect
+from typing import TYPE_CHECKING, Annotated, Final, ParamSpec, TypeVar, cast, overload
+
+from fastapi import Depends
+from fastapi.params import Depends as DependsParam
+
+# The framework reads the dependency's signature at runtime to fill it from the
+# container, so the injection marker, the request and the service types the
+# resolver receives stay importable here.
+from starlette.requests import Request  # noqa: TC002
+from xtr_dependency_injection import Injected  # noqa: TC002
+from xtr_security_core.authentication.token.null_token import NullToken
+from xtr_security_core.authentication.token.storage.token_storage_interface import (  # noqa: TC002
+    TokenStorageInterface,
+)
+from xtr_security_core.authorization.access_decision import AccessDecision
+from xtr_security_core.authorization.access_decision_manager_interface import (  # noqa: TC002
+    AccessDecisionManagerInterface,
+)
+from xtr_security_core.exception import AccessDeniedError
+
+if TYPE_CHECKING:
+    from collections.abc import Awaitable, Callable
+
+__all__ = ["IsGranted"]
+
+_P = ParamSpec("_P")
+_R = TypeVar("_R")
+
+_HIDDEN_PREFIX: Final = "_xtr_is_granted_"
+
+
+class IsGranted(DependsParam):
+    """Requires an attribute over a subject before the endpoint runs.
+
+    Written as a dependency or a decorator:
+
+    ```python
+    @router.delete("/books/{isbn}")
+    @IsGranted("ROLE_ADMIN")                          # below the route decorator
+    async def delete_book(isbn: str) -> None: ...
+
+
+    @router.put("/books/{isbn}", dependencies=[IsGranted("BOOK_EDIT", subject=load_book)])
+    async def edit(book: Annotated[Book, Depends(load_book)]) -> Book: ...
+    ```
+
+    The attribute is a string a voter matches, or a callable
+    ``(IsGrantedContext, subject) -> bool`` the closure voter runs. The subject
+    is ``None``, the name of a path parameter, or a callable used as a FastAPI
+    dependency — resolved once per request and shared with the endpoint. A
+    denial raises an
+    :class:`~xtr_security_core.exception.AccessDeniedError`, which the firewall's
+    exception listener turns into ``401`` or ``403``; a ``status_code`` answers
+    with that status directly instead. It requires a firewall to have run;
+    without one the check is made against the anonymous token.
+
+    The token storage and the access-decision manager the check reads are
+    container-provided dependencies of the resolver, declared with
+    :data:`~xtr_dependency_injection.Injected` — so the framework fills them from
+    the request scope, never fetched from the container by hand.
+
+    Attributes:
+        attribute: The attribute required.
+        subject: How the subject is obtained, or ``None``.
+        message: The denial message.
+        status_code: The status a denial answers with directly, or ``None``.
+    """
+
+    attribute: object  # pyright: ignore[reportUninitializedInstanceVariable]
+    subject: object  # pyright: ignore[reportUninitializedInstanceVariable]
+    message: str | None  # pyright: ignore[reportUninitializedInstanceVariable]
+    status_code: int | None  # pyright: ignore[reportUninitializedInstanceVariable]
+
+    def __init__(
+        self,
+        attribute: str | Callable[..., bool | Awaitable[bool]],
+        subject: str | Callable[..., object] | None = None,
+        *,
+        message: str | None = None,
+        status_code: int | None = None,
+    ) -> None:
+        """Require ``attribute`` over ``subject`` before the endpoint runs."""
+        object.__setattr__(self, "attribute", attribute)
+        object.__setattr__(self, "subject", subject)
+        object.__setattr__(self, "message", message)
+        object.__setattr__(self, "status_code", status_code)
+        super().__init__(dependency=self._build(), use_cache=False)
+
+    def _build(self) -> Callable[..., Awaitable[None]]:
+        """Return the dependency function, wired to resolve the subject as FastAPI cares."""
+        subject = self.subject
+        if callable(subject):
+            dependency = subject
+
+            async def check_with_dependency(
+                resolved: Annotated[object, Depends(dependency)],
+                token_storage: Injected[TokenStorageInterface],
+                access_decision_manager: Injected[AccessDecisionManagerInterface],
+            ) -> None:
+                await self._decide(resolved, token_storage, access_decision_manager)
+
+            return check_with_dependency
+
+        async def check(
+            request: Request,
+            token_storage: Injected[TokenStorageInterface],
+            access_decision_manager: Injected[AccessDecisionManagerInterface],
+        ) -> None:
+            resolved = request.path_params.get(subject) if isinstance(subject, str) else None
+            await self._decide(resolved, token_storage, access_decision_manager)
+
+        return check
+
+    async def _decide(
+        self,
+        subject: object,
+        token_storage: TokenStorageInterface,
+        access_decision_manager: AccessDecisionManagerInterface,
+    ) -> None:
+        """Decide the attribute over ``subject`` for the request's token.
+
+        Raises:
+            AccessDeniedError: When the attribute is not granted and no
+                ``status_code`` was set.
+            HTTPException: When the attribute is not granted and a
+                ``status_code`` was set — answered with that status directly.
+        """
+        token = token_storage.get_token() or NullToken()
+        decision = AccessDecision()
+        granted = await access_decision_manager.decide(token, [self.attribute], subject, decision)
+        if granted:
+            return
+        if self.status_code is not None:
+            from fastapi import HTTPException  # noqa: PLC0415 -- http-only
+
+            raise HTTPException(
+                status_code=self.status_code,
+                detail=self.message or "Access denied.",
+            )
+        raise AccessDeniedError(
+            self.message or "Access Denied.",
+            attributes=(self.attribute,),
+            subject=subject,
+            access_decision=decision,
+        )
+
+    @overload
+    def __call__(self, target: Callable[_P, _R], /) -> Callable[_P, _R]: ...
+
+    @overload
+    def __call__(self, target: object, /) -> object: ...
+
+    def __call__(self, target: Callable[_P, _R] | object, /) -> Callable[_P, _R] | object:
+        """Attach this check to the endpoint ``target`` as a hidden dependency."""
+        if not callable(target):
+            return target
+        endpoint = cast("Callable[_P, _R]", target)
+        return self._decorate(endpoint)
+
+    def _decorate(self, endpoint: Callable[_P, _R]) -> Callable[_P, _R]:
+        """Return ``endpoint`` taking this check as a hidden dependency."""
+        signature = inspect.signature(endpoint)
+        taken = set(signature.parameters)
+        index = 0
+        while f"{_HIDDEN_PREFIX}{index}" in taken:
+            index += 1
+        name = f"{_HIDDEN_PREFIX}{index}"
+
+        parameters = list(signature.parameters.values())
+        keywords = [p for p in parameters if p.kind is inspect.Parameter.VAR_KEYWORD]
+        others = [p for p in parameters if p.kind is not inspect.Parameter.VAR_KEYWORD]
+        hidden = inspect.Parameter(name, inspect.Parameter.KEYWORD_ONLY, default=self)
+        extended = signature.replace(parameters=[*others, hidden, *keywords])
+
+        if inspect.iscoroutinefunction(endpoint):
+            call = cast("Callable[_P, Awaitable[object]]", endpoint)
+
+            @functools.wraps(endpoint)
+            async def asynchronous(*args: _P.args, **kwargs: _P.kwargs) -> object:
+                _ = kwargs.pop(name, None)
+                return await call(*args, **kwargs)
+
+            wrapper = cast("Callable[_P, _R]", asynchronous)
+        else:
+
+            @functools.wraps(endpoint)
+            def synchronous(*args: _P.args, **kwargs: _P.kwargs) -> _R:
+                _ = kwargs.pop(name, None)
+                return endpoint(*args, **kwargs)
+
+            wrapper = synchronous
+        wrapper.__signature__ = extended  # pyright: ignore[reportAttributeAccessIssue]  # ty: ignore[unresolved-attribute]
+        return wrapper

xtr_security_http/decorator/is_granted_context.py

@@ -0,0 +1,14 @@
+"""What a closure attribute is handed to decide access with.
+
+The concrete context is defined in :mod:`xtr_security_core` — the closure voter
+there builds it — and re-exported here so a closure the application writes next
+to :class:`~xtr_security_http.decorator.is_granted.IsGranted` annotates its
+parameter from the decorator surface. The core keeps the definition because the
+voter that constructs it must never reach across into the HTTP edge.
+"""
+
+from __future__ import annotations
+
+from xtr_security_core.authorization.is_granted_context import IsGrantedContext
+
+__all__ = ["IsGrantedContext"]

xtr_security_http/entry_point/__init__.py

@@ -0,0 +1,7 @@
+"""The entry point that starts authentication for an unauthenticated request."""
+
+from __future__ import annotations
+
+from .authentication_entry_point_interface import AuthenticationEntryPointInterface
+
+__all__ = ["AuthenticationEntryPointInterface"]