Metadata-Version: 2.5
Name: eager-auth
Version: 2.0.0
Summary: Standard OIDC relying party for Eager FastAPI services — verification core
Project-URL: Homepage, https://github.com/Whats-Next-CC/eager-auth
Project-URL: Source, https://github.com/Whats-Next-CC/eager-auth
Project-URL: Issues, https://github.com/Whats-Next-CC/eager-auth/issues
Author-email: What's Next <engineering@whatsnext.cc>
License-Expression: Apache-2.0
License-File: LICENSE
Keywords: authentication,fastapi,keycloak,oidc,openid-connect
Classifier: Development Status :: 4 - Beta
Classifier: Framework :: FastAPI
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Internet :: WWW/HTTP :: Session
Classifier: Typing :: Typed
Requires-Python: >=3.12
Requires-Dist: httpx>=0.27
Requires-Dist: joserfc>=1.0
Requires-Dist: pyjwt[crypto]>=2.9
Provides-Extra: dev
Requires-Dist: black>=24.0; extra == 'dev'
Requires-Dist: fastapi>=0.110; extra == 'dev'
Requires-Dist: pytest-cov>=5.0; extra == 'dev'
Requires-Dist: pytest>=8.0; extra == 'dev'
Requires-Dist: ruff>=0.6; extra == 'dev'
Provides-Extra: fastapi
Requires-Dist: fastapi>=0.110; extra == 'fastapi'
Description-Content-Type: text/markdown

# eager-auth (Python)

Standard OIDC relying party for Eager FastAPI services. Verification core.

```python
from eager_auth import AuthConfig, HttpJwksSource, KeyResolver, verify_id_token

config = AuthConfig(
    issuer=os.environ["AUTH_ISSUER"],            # e.g. https://id.whatsnext.cc
    client_id=os.environ["AUTH_CLIENT_ID"],
    client_secret=os.environ["AUTH_CLIENT_SECRET"],
)
keys = KeyResolver(HttpJwksSource(config), max_age_seconds=config.jwks_max_age_seconds)

principal = verify_id_token(id_token, config=config, keys=keys, nonce=flow_nonce)
principal.sub, principal.email, principal.org, principal.roles
```

No vendor SDK, no database, no knowledge of orgs: everything about the provider comes from
`{issuer}/.well-known/openid-configuration`, which is what makes the broker swappable.

The behaviour is specified in `CONTRACT.md` at the repository root and enforced by
`conformance/vectors.json`, which the TypeScript adapter runs against the same matrix.

## Development

```bash
uv venv && uv pip install -e ".[dev]"
.venv/bin/python -m pytest
.venv/bin/ruff check src tests && .venv/bin/black --check src tests
```
