Metadata-Version: 2.4
Name: agios-auth-verify
Version: 0.0.2
Summary: FastAPI dependency that verifies a user's RBAC permission directly against the auth database
License-Expression: ISC
Project-URL: Repository, https://github.com/AGIOS-AI-RT/auth-verify-python
Keywords: fastapi,rbac,authorization,permissions,auth,middleware
Requires-Python: >=3.9
Description-Content-Type: text/markdown
Requires-Dist: fastapi>=0.100

# agios-auth-verify

FastAPI dependency that checks an RBAC permission straight off the access-token
JWT — decode the token, read the caller's permissions from its claims, allow the
request only if the required permission is present. No configuration.

## Install

```bash
pip install agios-auth-verify
```

Requires `fastapi`.

## Usage

```python
from fastapi import Depends, FastAPI
from auth_verify import authorize

app = FastAPI()


@app.delete("/users/{user_id}", dependencies=[Depends(authorize("users:delete"))])
async def delete_user(user_id: str):
    return {"ok": True}
```

The token is read from the `access_token` cookie or an `Authorization: Bearer
<token>` header. The JWT payload is base64-decoded (signature **not** verified);
its permissions come from the `permissions` claim (also accepts `scope` /
`scopes`, space-delimited).

On success the dependency returns
`{"success": true, "userId": ..., "email": ..., "permissionKey": ...}`, so it can
also be injected as a value:

```python
@app.delete("/users/{user_id}")
async def delete_user(user_id: str, auth=Depends(authorize("users:delete"))):
    return {"ok": True, "actor": auth["userId"]}
```

## Responses

Raises `fastapi.HTTPException` with body `{"success": false, "message": ...}`:

| Status | When                                          |
| ------ | -------------------------------------------- |
| `401`  | No token, or the token payload is unreadable   |
| `403`  | The permission is not in the token's claims    |

## Build

```bash
python -m build
```
