Metadata-Version: 2.5
Name: veltro-suite-auth
Version: 2.2.0
Summary: Veltro-owned suite authentication contracts.
Project-URL: Repository, https://github.com/veltrosecurity/veltro
Author: Veltro Security
License-Expression: AGPL-3.0-or-later
License-File: LICENSE
License-File: NOTICE
Classifier: License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)
Classifier: Typing :: Typed
Requires-Python: >=3.11
Requires-Dist: cryptography>=43.0.0
Requires-Dist: python-jose[cryptography]>=3.5.0
Description-Content-Type: text/markdown

# veltro-suite-auth

Veltro-owned suite session and service-token contracts with signed-realm compatibility.

This package is derived from the AGPL-3.0-or-later `veltro-suite-auth` 1.3.0 implementation originally maintained in VectorFlow. See `NOTICE` for provenance.

## Authority envelope v2

`verify_authority_envelope_v2` verifies and consumes short-lived ES256
`veltro-suite-service+jwt` envelopes. The receiver supplies the exact issuer,
exact audience, active generation, that audience's public P-256 JWK ring, required
scope, and an atomic synchronous or asynchronous replay consumer. The consumer
runs exactly once after all stateless checks and must return literal `True`.

This package deliberately provides no v2 minting/signing API, private-key type,
key generator, JWKS/network fetcher, settings/environment adapter, or consumer
runtime wiring. Existing HS256 v1 compatibility remains separate and unchanged.

## Browser request assertion verifier

`verify_browser_request_assertion` verifies and consumes short-lived ES256
`veltro-browser-request+jwt` request assertions minted by Veltro identity. The
receiver supplies the exact issuer, exact audience, active generation, that
audience's public P-256 JWK ring, the request being authorized (`request` with
`method` and `path`), and an atomic synchronous or asynchronous replay consumer.

The verifier enforces every binding the mint records: exact `typ`, `alg=ES256`
allowlist, audience key ring and `kid`, signature, issuer/audience, active
generation, nbf/iat/expiry capped at 60s, fixed realm `default`, grant-product
consistency, and — the point of the artifact — that the signed method and
canonical path match the request being authorized, using the same shared
`normalize_request_path` contract the mint uses. An assertion minted for
`GET /chad/api/alerts` never authorizes `POST /chad/api/rules`.

One-use semantics are the receiver's: after all stateless checks, the verifier
calls the replay consumer exactly once with a frozen `{issuer, audience,
generation, jti, expires_at}` tuple. The consumer must return literal `True`
only if it has not previously seen that tuple; a replayed `jti` is rejected when
the consumer returns `False`. The consumer must persist at least
`{issuer, audience, generation, jti}` until `expires_at` to enforce one-use
semantics across the token's validity window.

This package deliberately provides no request-assertion minting/signing API,
private-key type, key generator, JWKS/network fetcher, settings/environment
adapter, or consumer runtime wiring.

