xyberos-auth 0.1.0__tar.gz

xyberos_auth-0.1.0/PKG-INFO

@@ -0,0 +1,79 @@
+Metadata-Version: 2.4
+Name: xyberos-auth
+Version: 0.1.0
+Summary: Auth plugin (RFC-0019, M9): OAuth2, OIDC, JWT with Auth0/Okta/Entra presets
+License: Apache-2.0
+Keywords: xyberos,plugin,auth,oauth2,oidc,jwt,sso
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: xyberos>=1.0
+Provides-Extra: rsa
+Requires-Dist: cryptography; extra == "rsa"
+Provides-Extra: test
+Requires-Dist: pytest; extra == "test"
+
+# xyberos-auth
+
+**Auth plugin — RFC-0019, M9.** OAuth 2.0, OpenID Connect, and JWT, with
+Auth0 / Okta / Microsoft Entra presets. All stdlib (`urllib` + `hmac`); RS256
+uses lazy `cryptography`.
+
+## Install
+
+```bash
+pip install -e ./auth
+```
+
+## JWT
+
+```python
+from xyberos_auth import JwtCodec
+
+codec = JwtCodec("a-shared-secret")
+token = codec.encode({"sub": "user-1"}, ttl=3600)
+codec.decode(token, verify=True)   # raises AuthError on tamper/expiry
+```
+
+Or through the plugin (HS256 via `AUTH_JWT_SECRET`):
+
+```python
+from xyberos import create_app
+from xyberos_auth import AuthPlugin
+
+app = create_app()
+app.load_plugin(AuthPlugin(secret="dev-secret"))
+app.tools.execute("jwt_sign", None, payload={"sub": "user-1"}, ttl=600)
+app.tools.execute("jwt_verify", None, token=token)
+```
+
+## OAuth2 / OIDC
+
+```python
+from xyberos_auth import OAuth2Client, build_oidc
+
+oauth2 = OAuth2Client("cid", "csecret",
+                      authorize_url="https://idp/authorize",
+                      token_url="https://idp/token", scope="openid profile")
+url = oauth2.authorization_url(state="abc")
+tokens = oauth2.exchange_code("code")
+
+oidc = build_oidc("auth0", client_id="cid", client_secret="csecret", tenant="myco")
+user = oidc.userinfo(tokens["access_token"])
+claims = oidc.verify_id_token(tokens.get("id_token", ""))
+```
+
+Presets: `auth0` (`{tenant}`), `okta` (`{org}`), `entra` (`{tenant}`).
+
+## Tests
+
+```bash
+pip install pytest
+pytest tests/
+```
+
+Transport-injectable (OAuth2/OIDC) + real HMAC/RSA JWT tests (skip RS256 when
+`cryptography` is absent).
+
+## Ship location
+
+Plugin (`xyberos.plugins` entry point) — enterprise auth (M9).

xyberos_auth-0.1.0/README.md

@@ -0,0 +1,65 @@
+# xyberos-auth
+
+**Auth plugin — RFC-0019, M9.** OAuth 2.0, OpenID Connect, and JWT, with
+Auth0 / Okta / Microsoft Entra presets. All stdlib (`urllib` + `hmac`); RS256
+uses lazy `cryptography`.
+
+## Install
+
+```bash
+pip install -e ./auth
+```
+
+## JWT
+
+```python
+from xyberos_auth import JwtCodec
+
+codec = JwtCodec("a-shared-secret")
+token = codec.encode({"sub": "user-1"}, ttl=3600)
+codec.decode(token, verify=True)   # raises AuthError on tamper/expiry
+```
+
+Or through the plugin (HS256 via `AUTH_JWT_SECRET`):
+
+```python
+from xyberos import create_app
+from xyberos_auth import AuthPlugin
+
+app = create_app()
+app.load_plugin(AuthPlugin(secret="dev-secret"))
+app.tools.execute("jwt_sign", None, payload={"sub": "user-1"}, ttl=600)
+app.tools.execute("jwt_verify", None, token=token)
+```
+
+## OAuth2 / OIDC
+
+```python
+from xyberos_auth import OAuth2Client, build_oidc
+
+oauth2 = OAuth2Client("cid", "csecret",
+                      authorize_url="https://idp/authorize",
+                      token_url="https://idp/token", scope="openid profile")
+url = oauth2.authorization_url(state="abc")
+tokens = oauth2.exchange_code("code")
+
+oidc = build_oidc("auth0", client_id="cid", client_secret="csecret", tenant="myco")
+user = oidc.userinfo(tokens["access_token"])
+claims = oidc.verify_id_token(tokens.get("id_token", ""))
+```
+
+Presets: `auth0` (`{tenant}`), `okta` (`{org}`), `entra` (`{tenant}`).
+
+## Tests
+
+```bash
+pip install pytest
+pytest tests/
+```
+
+Transport-injectable (OAuth2/OIDC) + real HMAC/RSA JWT tests (skip RS256 when
+`cryptography` is absent).
+
+## Ship location
+
+Plugin (`xyberos.plugins` entry point) — enterprise auth (M9).

xyberos_auth-0.1.0/pyproject.toml

@@ -0,0 +1,27 @@
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "xyberos-auth"
+version = "0.1.0"
+description = "Auth plugin (RFC-0019, M9): OAuth2, OIDC, JWT with Auth0/Okta/Entra presets"
+readme = "README.md"
+requires-python = ">=3.10"
+license = {text = "Apache-2.0"}
+dependencies = ["xyberos>=1.0"]
+keywords = ["xyberos", "plugin", "auth", "oauth2", "oidc", "jwt", "sso"]
+
+[project.optional-dependencies]
+rsa = ["cryptography"]
+test = ["pytest"]
+
+[project.entry-points."xyberos.plugins"]
+auth = "xyberos_auth.plugin:plugin"
+
+[tool.setuptools]
+packages = ["xyberos_auth"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["."]

xyberos_auth-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

xyberos_auth-0.1.0/tests/test_jwt.py

@@ -0,0 +1,65 @@
+"""Tests for the JWT codec."""
+
+from __future__ import annotations
+
+import importlib.util
+
+import pytest
+
+from xyberos_auth import JwtCodec
+from xyberos_auth.errors import AuthError
+
+
+def test_hs256_roundtrip():
+    codec = JwtCodec("secret")
+    token = codec.encode({"sub": "user-1", "role": "admin"})
+    claims = codec.decode(token)
+    assert claims["sub"] == "user-1"
+    assert claims["role"] == "admin"
+
+
+def test_hs256_ttl():
+    codec = JwtCodec("secret")
+    token = codec.encode({"sub": "u"}, ttl=3600)
+    claims = codec.decode(token)
+    assert claims["exp"] - claims["iat"] == 3600
+
+
+def test_hs256_tamper_detected():
+    codec = JwtCodec("secret")
+    token = codec.encode({"sub": "u"})
+    tampered = token[:-2] + ("AA" if not token.endswith("AA") else "BB")
+    with pytest.raises(AuthError, match="signature"):
+        codec.decode(tampered)
+
+
+def test_hs256_wrong_secret():
+    token = JwtCodec("secret-a").encode({"sub": "u"})
+    with pytest.raises(AuthError, match="signature"):
+        JwtCodec("secret-b").decode(token)
+
+
+def test_requires_secret():
+    with pytest.raises(AuthError, match="secret"):
+        JwtCodec(algorithm="HS256")
+
+
+@pytest.mark.skipif(importlib.util.find_spec("cryptography") is None, reason="cryptography not installed")
+def test_rs256_roundtrip():
+    from cryptography.hazmat.primitives.asymmetric import rsa
+    from cryptography.hazmat.primitives import serialization
+
+    private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    private_pem = private_key.private_bytes(
+        serialization.Encoding.PEM,
+        serialization.PrivateFormat.PKCS8,
+        serialization.NoEncryption(),
+    ).decode("utf-8")
+    public_pem = (
+        private_key.public_key()
+        .public_bytes(serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo)
+        .decode("utf-8")
+    )
+    codec = JwtCodec(algorithm="RS256", private_key=private_pem, public_key=public_pem)
+    token = codec.encode({"sub": "u"})
+    assert codec.decode(token)["sub"] == "u"

xyberos_auth-0.1.0/tests/test_oauth2.py

@@ -0,0 +1,62 @@
+"""Tests for the OAuth2 client."""
+
+from __future__ import annotations
+
+import pytest
+
+from xyberos_auth import OAuth2Client
+from xyberos_auth.errors import AuthError
+
+
+def _token_response():
+    return {"access_token": "at", "token_type": "Bearer", "expires_in": 3600, "refresh_token": "rt"}
+
+
+def test_authorization_url():
+    client = OAuth2Client("cid", "csecret", authorize_url="https://idp/authorize", token_url="https://idp/token", scope="openid")
+    url = client.authorization_url("state-1")
+    assert url.startswith("https://idp/authorize?")
+    assert "client_id=cid" in url
+    assert "state=state-1" in url
+    assert "response_type=code" in url
+    assert "scope=openid" in url
+
+
+def test_exchange_code():
+    captured = {}
+
+    def request(method, url, **kwargs):
+        captured.update(kwargs)
+        return 200, _token_response()
+
+    client = OAuth2Client("cid", "csecret", token_url="https://idp/token", request=request)
+    result = client.exchange_code("the-code", redirect_uri="https://app/cb")
+    assert result["access_token"] == "at"
+    assert captured["form"]["grant_type"] == "authorization_code"
+    assert captured["form"]["code"] == "the-code"
+    assert captured["form"]["client_id"] == "cid"
+    assert captured["form"]["client_secret"] == "csecret"
+
+
+def test_refresh_and_client_credentials():
+    captured = []
+
+    def request(method, url, **kwargs):
+        captured.append(kwargs["form"])
+        return 200, _token_response()
+
+    client = OAuth2Client("cid", "csecret", token_url="https://idp/token", request=request)
+    client.refresh("refresh-tok")
+    client.client_credentials(scope="api")
+    assert captured[0]["grant_type"] == "refresh_token"
+    assert captured[1]["grant_type"] == "client_credentials"
+    assert captured[1]["scope"] == "api"
+
+
+def test_token_error_raises():
+    def request(method, url, **kwargs):
+        return 400, {"error": "invalid_grant"}
+
+    client = OAuth2Client("cid", "csecret", token_url="https://idp/token", request=request)
+    with pytest.raises(AuthError, match="400"):
+        client.exchange_code("bad")

xyberos_auth-0.1.0/tests/test_oidc.py

@@ -0,0 +1,69 @@
+"""Tests for the OIDC client and presets."""
+
+from __future__ import annotations
+
+import pytest
+
+from xyberos_auth import OidcClient, build_oidc, get_preset
+from xyberos_auth.errors import AuthError
+from xyberos_auth.jwt import JwtCodec
+
+
+def _discovery_body():
+    return {
+        "issuer": "https://idp.example.com",
+        "userinfo_endpoint": "https://idp.example.com/userinfo",
+        "authorization_endpoint": "https://idp.example.com/authorize",
+    }
+
+
+def test_discovery_and_userinfo():
+    def request(method, url, **kwargs):
+        if url.endswith("/.well-known/openid-configuration"):
+            return 200, _discovery_body()
+        if url.endswith("/userinfo"):
+            return 200, {"sub": "user-1", "email": "a@b.com"}
+        return 404, {}
+
+    client = OidcClient("https://idp.example.com", request=request)
+    metadata = client.discovery()
+    assert metadata["userinfo_endpoint"] == "https://idp.example.com/userinfo"
+    user = client.userinfo("at")
+    assert user["email"] == "a@b.com"
+
+
+def test_verify_id_token_hs256():
+    codec = JwtCodec("client-secret")
+    token = codec.encode({"sub": "u", "aud": "app-id"})
+    client = OidcClient("https://idp", client_id="app-id", client_secret="client-secret")
+    claims = client.verify_id_token(token)
+    assert claims["sub"] == "u"
+
+
+def test_verify_id_token_audience_mismatch():
+    codec = JwtCodec("client-secret")
+    token = codec.encode({"sub": "u", "aud": "other-app"})
+    client = OidcClient("https://idp", client_id="app-id", client_secret="client-secret")
+    with pytest.raises(AuthError, match="audience"):
+        client.verify_id_token(token)
+
+
+def test_presets():
+    assert get_preset("auth0", tenant="myco") == "https://myco.auth0.com"
+    assert get_preset("okta", org="myorg") == "https://myorg.okta.com/oauth2/default"
+    assert get_preset("entra", tenant="mytenant") == "https://login.microsoftonline.com/mytenant/v2.0"
+
+
+def test_preset_requires_tenant():
+    with pytest.raises(ValueError, match="tenant"):
+        get_preset("auth0")
+
+
+def test_unknown_preset():
+    with pytest.raises(ValueError, match="unknown OIDC preset"):
+        get_preset("bogus")
+
+
+def test_build_oidc():
+    client = build_oidc("auth0", client_id="cid", client_secret="s", tenant="myco")
+    assert isinstance(client, OidcClient)

xyberos_auth-0.1.0/tests/test_plugin.py

@@ -0,0 +1,36 @@
+"""Tests for loading the auth plugin into a Xyberos app."""
+
+from __future__ import annotations
+
+from xyberos import create_app
+
+from xyberos_auth import AuthPlugin
+
+
+def test_plugin_conforms_to_contract():
+    plugin = AuthPlugin()
+    assert plugin.name == "auth"
+    assert callable(plugin.register) and callable(plugin.unregister)
+
+
+def test_unconfigured_register_is_safe():
+    app = create_app()
+    app.load_plugin(AuthPlugin())  # no secret -> no-op
+    assert app.plugins.names == ("auth",)
+    app.unload_plugin("auth")
+
+
+def test_plugin_registers_jwt_tools():
+    app = create_app()
+    app.load_plugin(AuthPlugin(secret="dev-secret"))
+    assert "jwt_sign" in app.tools.names
+    assert "jwt_verify" in app.tools.names
+
+    token = app.tools.execute("jwt_sign", None, payload={"sub": "user-1"}, ttl=600)
+    assert isinstance(token, str) and token.count(".") == 2
+
+    claims = app.tools.execute("jwt_verify", None, token=token)
+    assert claims["sub"] == "user-1"
+
+    app.unload_plugin("auth")
+    assert "jwt_sign" not in app.tools.names

xyberos_auth-0.1.0/xyberos_auth/__init__.py

@@ -0,0 +1,17 @@
+"""Auth plugin (RFC-0019, M9): OAuth2, OIDC, JWT with Auth0/Okta/Entra presets."""
+
+from .jwt import JwtCodec
+from .oauth2 import OAuth2Client
+from .oidc import OidcClient
+from .plugin import AuthPlugin
+from .presets import OIDC_PRESETS, build_oidc, get_preset
+
+__all__ = [
+    "AuthPlugin",
+    "JwtCodec",
+    "OAuth2Client",
+    "OIDC_PRESETS",
+    "OidcClient",
+    "build_oidc",
+    "get_preset",
+]

xyberos_auth-0.1.0/xyberos_auth/errors.py

@@ -0,0 +1,7 @@
+"""Errors raised by the auth plugin."""
+
+from __future__ import annotations
+
+
+class AuthError(Exception):
+    """An OAuth/OIDC/JWT failure."""

xyberos_auth-0.1.0/xyberos_auth/http.py

@@ -0,0 +1,64 @@
+"""A tiny stdlib HTTP helper (no third-party deps).
+
+``default_request`` performs one HTTP request with ``urllib`` and returns
+``(status, body)`` where ``body`` is parsed JSON when the response is JSON,
+otherwise raw text. Injectable so tests run without a network.
+"""
+
+from __future__ import annotations
+
+import json
+import urllib.error
+import urllib.parse
+import urllib.request
+from typing import Any, Callable
+
+#: (method, url, *, json_body, raw_body, headers, query, timeout) -> (status, body)
+RequestTransport = Callable[..., tuple[int, Any]]
+
+
+def default_request(
+    method: str,
+    url: str,
+    *,
+    json_body: Any = None,
+    raw_body: bytes | None = None,
+    headers: dict[str, str] | None = None,
+    query: dict[str, Any] | None = None,
+    form: dict[str, str] | None = None,
+    timeout: float = 30.0,
+) -> tuple[int, Any]:
+    """Send one request and return ``(status, parsed_json_or_text)``."""
+    final_url = url
+    if query:
+        separator = "&" if "?" in url else "?"
+        final_url = url + separator + urllib.parse.urlencode(query)
+
+    data: bytes | None = None
+    request_headers = dict(headers or {})
+    if form is not None:
+        data = urllib.parse.urlencode(form).encode("utf-8")
+        request_headers.setdefault("Content-Type", "application/x-www-form-urlencoded")
+    elif raw_body is not None:
+        data = raw_body
+    elif json_body is not None:
+        data = json.dumps(json_body).encode("utf-8")
+        request_headers.setdefault("Content-Type", "application/json")
+
+    request = urllib.request.Request(
+        final_url, data=data, headers=request_headers, method=method
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=timeout) as response:
+            raw = response.read()
+            content_type = response.headers.get("Content-Type", "")
+    except urllib.error.HTTPError as exc:
+        return exc.code, exc.read().decode("utf-8", errors="replace")
+
+    text = raw.decode("utf-8", errors="replace")
+    if "application/json" in content_type or text.lstrip().startswith("{"):
+        try:
+            return 200, json.loads(text)
+        except json.JSONDecodeError:
+            return 200, text
+    return 200, text

xyberos_auth-0.1.0/xyberos_auth/jwt.py

@@ -0,0 +1,128 @@
+"""JWT encode/decode with HS256 (stdlib) and RS256 (lazy ``cryptography``)."""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import hmac
+import importlib
+import json
+import time
+from typing import Any
+
+from xyberos.exceptions.provider import ProviderError
+
+from .errors import AuthError
+
+
+def _b64url(data: bytes) -> str:
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("ascii")
+
+
+def _b64url_decode(text: str) -> bytes:
+    padding = "=" * (-len(text) % 4)
+    return base64.urlsafe_b64decode(text + padding)
+
+
+class JwtCodec:
+    """Sign and verify JSON Web Tokens (HS256 / RS256)."""
+
+    def __init__(
+        self,
+        secret: str | None = None,
+        *,
+        algorithm: str = "HS256",
+        private_key: str | None = None,
+        public_key: str | None = None,
+    ) -> None:
+        self._secret = secret
+        self._algorithm = algorithm.upper()
+        self._private_key = private_key
+        self._public_key = public_key
+        if self._algorithm not in ("HS256", "RS256"):
+            raise AuthError(f"unsupported JWT algorithm: {self._algorithm}")
+        if self._algorithm == "HS256" and not secret:
+            raise AuthError("HS256 requires a 'secret'")
+        if self._algorithm == "RS256" and not (private_key and public_key):
+            raise AuthError("RS256 requires both 'private_key' and 'public_key'")
+
+    # -- public API ---------------------------------------------------------
+
+    def encode(self, payload: dict[str, Any], *, ttl: int | None = None) -> str:
+        """Return a signed JWT for ``payload`` (optionally with an expiry)."""
+        header = {"alg": self._algorithm, "typ": "JWT"}
+        claims = dict(payload)
+        if ttl is not None:
+            now = int(time.time())
+            claims.setdefault("iat", now)
+            claims.setdefault("exp", now + ttl)
+        signing_input = (
+            _b64url(json.dumps(header, separators=(",", ":")).encode("utf-8"))
+            + "."
+            + _b64url(json.dumps(claims, separators=(",", ":")).encode("utf-8"))
+        )
+        signature = self._sign(header["alg"], signing_input.encode("utf-8"))
+        return f"{signing_input}.{_b64url(signature)}"
+
+    def decode(self, token: str, *, verify: bool = True) -> dict[str, Any]:
+        """Decode a JWT; raise :class:`AuthError` on tampering or expiry."""
+        parts = token.split(".")
+        if len(parts) != 3:
+            raise AuthError("invalid JWT: expected three dot-separated parts")
+        try:
+            header = json.loads(_b64url_decode(parts[0]))
+            claims = json.loads(_b64url_decode(parts[1]))
+        except (ValueError, json.JSONDecodeError) as exc:
+            raise AuthError("invalid JWT: malformed header/claims") from exc
+        if verify:
+            self._verify(header.get("alg"), f"{parts[0]}.{parts[1]}".encode("utf-8"), parts[2])
+            expires = claims.get("exp")
+            if isinstance(expires, (int, float)) and time.time() >= expires:
+                raise AuthError("JWT has expired")
+        return claims
+
+    # -- internals ----------------------------------------------------------
+
+    def _sign(self, alg: str, data: bytes) -> bytes:
+        if alg == "HS256":
+            return hmac.new(self._secret.encode("utf-8"), data, hashlib.sha256).digest()
+        if alg == "RS256":
+            return self._rsa_sign(data)
+        raise AuthError(f"unsupported JWT algorithm: {alg}")
+
+    def _verify(self, alg: str, data: bytes, signature: str) -> None:
+        if alg == "HS256":
+            expected = self._sign("HS256", data)
+            if not hmac.compare_digest(expected, _b64url_decode(signature)):
+                raise AuthError("JWT signature verification failed")
+            return
+        if alg == "RS256":
+            self._rsa_verify(data, _b64url_decode(signature))
+            return
+        raise AuthError(f"unsupported JWT algorithm: {alg}")
+
+    def _rsa_sign(self, data: bytes) -> bytes:
+        primitives, asymmetric, padding, serialization, hashes = self._rsa_modules()
+        key = serialization.load_pem_private_key(self._private_key.encode("utf-8"), password=None)
+        return key.sign(data, padding.PKCS1v15(), hashes.SHA256())
+
+    def _rsa_verify(self, data: bytes, signature: bytes) -> None:
+        primitives, asymmetric, padding, serialization, hashes = self._rsa_modules()
+        key = serialization.load_pem_public_key(self._public_key.encode("utf-8"))
+        try:
+            key.verify(signature, data, padding.PKCS1v15(), hashes.SHA256())
+        except Exception as exc:
+            raise AuthError("JWT signature verification failed") from exc
+
+    @staticmethod
+    def _rsa_modules() -> tuple[Any, Any, Any, Any, Any]:
+        """Lazily import the ``cryptography`` modules for RS256 (optional dep)."""
+        try:
+            primitives = importlib.import_module("cryptography.hazmat.primitives")
+            asymmetric = importlib.import_module("cryptography.hazmat.primitives.asymmetric")
+        except ImportError as exc:
+            raise ProviderError(
+                "RS256 requires 'cryptography'; install with "
+                "'pip install xyberos-auth[rsa]'"
+            ) from exc
+        return primitives, asymmetric, asymmetric.padding, primitives.serialization, primitives.hashes

xyberos_auth-0.1.0/xyberos_auth/oauth2.py

@@ -0,0 +1,96 @@
+"""OAuth 2.0 client (authorization code, client credentials, refresh)."""
+
+from __future__ import annotations
+
+import urllib.parse
+from typing import Any
+
+from .errors import AuthError
+from .http import RequestTransport, default_request
+
+
+def _raise_for_status(status: int, body: Any) -> None:
+    if 200 <= status < 300:
+        return
+    message = body if isinstance(body, str) else str(body)
+    raise AuthError(f"OAuth endpoint returned HTTP {status}: {message[:200]}")
+
+
+class OAuth2Client:
+    """A minimal OAuth 2.0 client with injectable transport."""
+
+    def __init__(
+        self,
+        client_id: str,
+        client_secret: str,
+        *,
+        authorize_url: str = "",
+        token_url: str,
+        redirect_uri: str | None = None,
+        scope: str = "",
+        request: RequestTransport | None = None,
+        timeout: float = 30.0,
+    ) -> None:
+        self._client_id = client_id
+        self._client_secret = client_secret
+        self._authorize_url = authorize_url
+        self._token_url = token_url
+        self._redirect_uri = redirect_uri
+        self._scope = scope
+        self._request = request or default_request
+        self._timeout = timeout
+
+    def authorization_url(self, state: str, *, redirect_uri: str | None = None) -> str:
+        """Build the authorization-code consent URL."""
+        if not self._authorize_url:
+            raise AuthError("authorize_url is not configured")
+        params = {
+            "response_type": "code",
+            "client_id": self._client_id,
+            "state": state,
+            "redirect_uri": redirect_uri or self._redirect_uri or "",
+            "scope": self._scope,
+        }
+        separator = "&" if "?" in self._authorize_url else "?"
+        return self._authorize_url + separator + urllib.parse.urlencode(
+            {key: value for key, value in params.items() if value}
+        )
+
+    def exchange_code(self, code: str, *, redirect_uri: str | None = None) -> dict[str, Any]:
+        """Exchange an authorization code for tokens."""
+        return self._token_request(
+            {
+                "grant_type": "authorization_code",
+                "code": code,
+                "redirect_uri": redirect_uri or self._redirect_uri or "",
+            }
+        )
+
+    def refresh(self, refresh_token: str) -> dict[str, Any]:
+        """Refresh an access token."""
+        return self._token_request(
+            {"grant_type": "refresh_token", "refresh_token": refresh_token}
+        )
+
+    def client_credentials(self, scope: str | None = None) -> dict[str, Any]:
+        """Request a token with the client_credentials grant."""
+        form = {"grant_type": "client_credentials"}
+        if scope:
+            form["scope"] = scope
+        return self._token_request(form)
+
+    # -- internals ----------------------------------------------------------
+
+    def _token_request(self, form: dict[str, str]) -> dict[str, Any]:
+        form.setdefault("client_id", self._client_id)
+        form.setdefault("client_secret", self._client_secret)
+        status, body = self._request(
+            "POST",
+            self._token_url,
+            form=form,
+            timeout=self._timeout,
+        )
+        _raise_for_status(status, body)
+        if not isinstance(body, dict) or "access_token" not in body:
+            raise AuthError(f"token endpoint returned an unexpected response: {body}")
+        return body

xyberos_auth-0.1.0/xyberos_auth/oidc.py

@@ -0,0 +1,83 @@
+"""OpenID Connect client (discovery, userinfo, id_token verification)."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from .errors import AuthError
+from .http import RequestTransport, default_request
+from .jwt import JwtCodec
+
+
+def _raise_for_status(status: int, body: Any) -> None:
+    if 200 <= status < 300:
+        return
+    message = body if isinstance(body, str) else str(body)
+    raise AuthError(f"OIDC endpoint returned HTTP {status}: {message[:200]}")
+
+
+class OidcClient:
+    """A minimal OpenID Connect client (discovery + userinfo)."""
+
+    def __init__(
+        self,
+        issuer: str,
+        *,
+        client_id: str = "",
+        client_secret: str | None = None,
+        request: RequestTransport | None = None,
+        timeout: float = 30.0,
+        codec: JwtCodec | None = None,
+    ) -> None:
+        self._issuer = issuer.rstrip("/")
+        self._client_id = client_id
+        self._client_secret = client_secret
+        self._request = request or default_request
+        self._timeout = timeout
+        self._codec = codec
+        self._metadata: dict[str, Any] | None = None
+
+    def discovery(self, *, refresh: bool = False) -> dict[str, Any]:
+        """Fetch and cache the OpenID configuration."""
+        if self._metadata is not None and not refresh:
+            return self._metadata
+        status, body = self._request(
+            "GET",
+            f"{self._issuer}/.well-known/openid-configuration",
+            timeout=self._timeout,
+        )
+        _raise_for_status(status, body)
+        if not isinstance(body, dict):
+            raise AuthError("OIDC discovery returned a non-object response")
+        self._metadata = body
+        return body
+
+    def userinfo(self, access_token: str) -> dict[str, Any]:
+        """Fetch the userinfo endpoint with ``access_token``."""
+        metadata = self.discovery()
+        endpoint = metadata.get("userinfo_endpoint")
+        if not endpoint:
+            raise AuthError("OIDC discovery did not advertise a userinfo_endpoint")
+        status, body = self._request(
+            "GET",
+            endpoint,
+            headers={"Authorization": f"Bearer {access_token}"},
+            timeout=self._timeout,
+        )
+        _raise_for_status(status, body)
+        return dict(body)
+
+    def verify_id_token(self, id_token: str) -> dict[str, Any]:
+        """Decode and verify an ``id_token`` (HS256 via client_secret)."""
+        if self._codec is not None:
+            return self._codec.decode(id_token, verify=True)
+        if not self._client_secret:
+            raise AuthError(
+                "cannot verify id_token: no client_secret (HS256) or codec configured"
+            )
+        codec = JwtCodec(self._client_secret)
+        claims = codec.decode(id_token, verify=True)
+        audience = claims.get("aud")
+        if self._client_id and audience not in (self._client_id, [self._client_id]):
+            raise AuthError(f"id_token audience mismatch: {audience}")
+        return claims

xyberos_auth-0.1.0/xyberos_auth/plugin.py

@@ -0,0 +1,91 @@
+"""Auth plugin entry point (RFC-0019, M9)."""
+
+from __future__ import annotations
+
+import os
+from typing import Any, cast
+
+from xyberos.contracts import Plugin, Tool
+from xyberos.tools import FunctionTool
+
+from .jwt import JwtCodec
+
+
+def _pop_tool(registry: Any, name: str) -> None:
+    unregister = getattr(registry, "unregister", None)
+    if callable(unregister):
+        unregister(name)
+        return
+    store = getattr(registry, "_tools", None)
+    if isinstance(store, dict):
+        cast(dict[str, Any], store).pop(name, None)
+
+
+class AuthPlugin(Plugin):
+    """Registers JWT sign/verify tools backed by a configured :class:`JwtCodec`.
+
+    ``secret`` comes from ``AUTH_JWT_SECRET`` (HS256) or the ``private_key`` /
+    ``public_key`` args (RS256). If none is configured the plugin registers
+    nothing (logs a warning).
+    """
+
+    def __init__(
+        self,
+        secret: str | None = None,
+        *,
+        algorithm: str = "HS256",
+        private_key: str | None = None,
+        public_key: str | None = None,
+    ) -> None:
+        self._secret = secret if secret is not None else os.getenv("AUTH_JWT_SECRET")
+        self._algorithm = algorithm
+        self._private_key = private_key or os.getenv("AUTH_JWT_PRIVATE_KEY")
+        self._public_key = public_key or os.getenv("AUTH_JWT_PUBLIC_KEY")
+        self._codec: JwtCodec | None = None
+
+    @property
+    def name(self) -> str:
+        return "auth"
+
+    def jwt_codec(self) -> JwtCodec:
+        if self._codec is None:
+            self._codec = JwtCodec(
+                self._secret,
+                algorithm=self._algorithm,
+                private_key=self._private_key,
+                public_key=self._public_key,
+            )
+        return self._codec
+
+    def tools(self) -> list[Tool]:
+        def _sign(payload: dict[str, Any], ttl: int = 3600) -> str:
+            return self.jwt_codec().encode(payload, ttl=ttl)
+
+        def _verify(token: str) -> dict[str, Any]:
+            return self.jwt_codec().decode(token, verify=True)
+
+        return [
+            FunctionTool("jwt_sign", _sign, description="Sign a payload as a JWT."),
+            FunctionTool("jwt_verify", _verify, description="Verify and decode a JWT."),
+        ]
+
+    def register(self, kernel: object) -> None:
+        try:
+            self.jwt_codec()
+        except Exception as exc:
+            logger = getattr(kernel, "logger", None)
+            if logger is not None and callable(getattr(logger, "warning", None)):
+                logger.warning("auth plugin not configured: %s", exc)
+            return
+        registry = kernel.resolve("tools")
+        for tool in self.tools():
+            registry.register(tool)
+
+    def unregister(self, kernel: object) -> None:
+        registry = kernel.resolve("tools")
+        for tool in self.tools():
+            _pop_tool(registry, tool.name)
+
+
+#: Auto-discovered by ``app.load_entry_points()``.
+plugin = AuthPlugin()

xyberos_auth-0.1.0/xyberos_auth/presets.py

@@ -0,0 +1,30 @@
+"""Provider presets for Auth0, Okta and Microsoft Entra (OIDC)."""
+
+from __future__ import annotations
+
+from .oidc import OidcClient
+
+#: preset name -> issuer template. ``{tenant}`` / ``{org}`` are substituted.
+OIDC_PRESETS: dict[str, str] = {
+    "auth0": "https://{tenant}.auth0.com",
+    "okta": "https://{org}.okta.com/oauth2/default",
+    "entra": "https://login.microsoftonline.com/{tenant}/v2.0",
+}
+
+
+def get_preset(name: str, **kwargs: str) -> str:
+    """Return the issuer for a named OIDC preset, filling in placeholders."""
+    key = name.lower()
+    if key not in OIDC_PRESETS:
+        raise ValueError(f"unknown OIDC preset '{name}' (choose from {sorted(OIDC_PRESETS)})")
+    template = OIDC_PRESETS[key]
+    missing = [token for token in ("{tenant}", "{org}") if token in template and token[1:-1] not in kwargs]
+    if missing:
+        raise ValueError(f"preset '{name}' requires a '{missing[0][1:-1]}' value")
+    return template.format(**kwargs)
+
+
+def build_oidc(preset: str, client_id: str, client_secret: str | None = None, **kwargs: str) -> OidcClient:
+    """Build an :class:`OidcClient` for a named preset."""
+    issuer = get_preset(preset, **kwargs)
+    return OidcClient(issuer, client_id=client_id, client_secret=client_secret)

xyberos_auth-0.1.0/xyberos_auth.egg-info/PKG-INFO

@@ -0,0 +1,79 @@
+Metadata-Version: 2.4
+Name: xyberos-auth
+Version: 0.1.0
+Summary: Auth plugin (RFC-0019, M9): OAuth2, OIDC, JWT with Auth0/Okta/Entra presets
+License: Apache-2.0
+Keywords: xyberos,plugin,auth,oauth2,oidc,jwt,sso
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: xyberos>=1.0
+Provides-Extra: rsa
+Requires-Dist: cryptography; extra == "rsa"
+Provides-Extra: test
+Requires-Dist: pytest; extra == "test"
+
+# xyberos-auth
+
+**Auth plugin — RFC-0019, M9.** OAuth 2.0, OpenID Connect, and JWT, with
+Auth0 / Okta / Microsoft Entra presets. All stdlib (`urllib` + `hmac`); RS256
+uses lazy `cryptography`.
+
+## Install
+
+```bash
+pip install -e ./auth
+```
+
+## JWT
+
+```python
+from xyberos_auth import JwtCodec
+
+codec = JwtCodec("a-shared-secret")
+token = codec.encode({"sub": "user-1"}, ttl=3600)
+codec.decode(token, verify=True)   # raises AuthError on tamper/expiry
+```
+
+Or through the plugin (HS256 via `AUTH_JWT_SECRET`):
+
+```python
+from xyberos import create_app
+from xyberos_auth import AuthPlugin
+
+app = create_app()
+app.load_plugin(AuthPlugin(secret="dev-secret"))
+app.tools.execute("jwt_sign", None, payload={"sub": "user-1"}, ttl=600)
+app.tools.execute("jwt_verify", None, token=token)
+```
+
+## OAuth2 / OIDC
+
+```python
+from xyberos_auth import OAuth2Client, build_oidc
+
+oauth2 = OAuth2Client("cid", "csecret",
+                      authorize_url="https://idp/authorize",
+                      token_url="https://idp/token", scope="openid profile")
+url = oauth2.authorization_url(state="abc")
+tokens = oauth2.exchange_code("code")
+
+oidc = build_oidc("auth0", client_id="cid", client_secret="csecret", tenant="myco")
+user = oidc.userinfo(tokens["access_token"])
+claims = oidc.verify_id_token(tokens.get("id_token", ""))
+```
+
+Presets: `auth0` (`{tenant}`), `okta` (`{org}`), `entra` (`{tenant}`).
+
+## Tests
+
+```bash
+pip install pytest
+pytest tests/
+```
+
+Transport-injectable (OAuth2/OIDC) + real HMAC/RSA JWT tests (skip RS256 when
+`cryptography` is absent).
+
+## Ship location
+
+Plugin (`xyberos.plugins` entry point) — enterprise auth (M9).

xyberos_auth-0.1.0/xyberos_auth.egg-info/SOURCES.txt

@@ -0,0 +1,20 @@
+README.md
+pyproject.toml
+tests/test_jwt.py
+tests/test_oauth2.py
+tests/test_oidc.py
+tests/test_plugin.py
+xyberos_auth/__init__.py
+xyberos_auth/errors.py
+xyberos_auth/http.py
+xyberos_auth/jwt.py
+xyberos_auth/oauth2.py
+xyberos_auth/oidc.py
+xyberos_auth/plugin.py
+xyberos_auth/presets.py
+xyberos_auth.egg-info/PKG-INFO
+xyberos_auth.egg-info/SOURCES.txt
+xyberos_auth.egg-info/dependency_links.txt
+xyberos_auth.egg-info/entry_points.txt
+xyberos_auth.egg-info/requires.txt
+xyberos_auth.egg-info/top_level.txt

xyberos_auth-0.1.0/xyberos_auth.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

xyberos_auth-0.1.0/xyberos_auth.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[xyberos.plugins]
+auth = xyberos_auth.plugin:plugin

xyberos_auth-0.1.0/xyberos_auth.egg-info/requires.txt

@@ -0,0 +1,7 @@
+xyberos>=1.0
+
+[rsa]
+cryptography
+
+[test]
+pytest

xyberos_auth-0.1.0/xyberos_auth.egg-info/top_level.txt

@@ -0,0 +1 @@
+xyberos_auth