Metadata-Version: 2.4
Name: authweave-workload
Version: 7.3.2
Summary: Framework-neutral sender-constrained workload authentication
Project-URL: homepage, https://github.com/ZYLVEXT/litestar-auth
Project-URL: documentation, https://zylvext.github.io/litestar-auth/
Project-URL: source, https://github.com/ZYLVEXT/litestar-auth
Project-URL: tracker, https://github.com/ZYLVEXT/litestar-auth/issues
Author-email: Vladislav Shepilov <shepilov.v@protonmail.com>
Maintainer-email: Vladislav Shepilov <shepilov.v@protonmail.com>
License-Expression: MIT
License-File: LICENSE
Keywords: authentication,dpop,introspection,mtls,oauth,spiffe,workload,x509
Classifier: Development Status :: 5 - Production/Stable
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Libraries
Requires-Python: <3.15.0,>=3.12.0
Requires-Dist: authweave-core==7.3.2
Provides-Extra: all
Requires-Dist: anyio<5.0,>=4.14.2; extra == 'all'
Requires-Dist: cryptography<51.0,>=50.0.0; extra == 'all'
Requires-Dist: httpx<1.0,>=0.28.1; extra == 'all'
Requires-Dist: litestar-auth==7.3.2; extra == 'all'
Requires-Dist: litestar<3.0,>=2.24.0; extra == 'all'
Requires-Dist: pyjwt<3.0,>=2.13.0; extra == 'all'
Requires-Dist: redis<9.0,>=8.1.0; extra == 'all'
Requires-Dist: spiffe<0.4.0,>=0.3.0; extra == 'all'
Requires-Dist: sqlalchemy<3.0,>=2.0.51; extra == 'all'
Provides-Extra: dpop
Requires-Dist: anyio<5.0,>=4.14.2; extra == 'dpop'
Requires-Dist: cryptography<51.0,>=50.0.0; extra == 'dpop'
Requires-Dist: httpx<1.0,>=0.28.1; extra == 'dpop'
Requires-Dist: pyjwt<3.0,>=2.13.0; extra == 'dpop'
Provides-Extra: introspection
Requires-Dist: anyio<5.0,>=4.14.2; extra == 'introspection'
Requires-Dist: cryptography<51.0,>=50.0.0; extra == 'introspection'
Requires-Dist: httpx<1.0,>=0.28.1; extra == 'introspection'
Requires-Dist: pyjwt<3.0,>=2.13.0; extra == 'introspection'
Provides-Extra: jwt
Requires-Dist: anyio<5.0,>=4.14.2; extra == 'jwt'
Requires-Dist: cryptography<51.0,>=50.0.0; extra == 'jwt'
Requires-Dist: httpx<1.0,>=0.28.1; extra == 'jwt'
Requires-Dist: pyjwt<3.0,>=2.13.0; extra == 'jwt'
Provides-Extra: litestar
Requires-Dist: litestar-auth==7.3.2; extra == 'litestar'
Requires-Dist: litestar<3.0,>=2.24.0; extra == 'litestar'
Requires-Dist: sqlalchemy<3.0,>=2.0.51; extra == 'litestar'
Provides-Extra: mtls
Requires-Dist: cryptography<51.0,>=50.0.0; extra == 'mtls'
Provides-Extra: redis
Requires-Dist: redis<9.0,>=8.1.0; extra == 'redis'
Provides-Extra: spiffe
Requires-Dist: cryptography<51.0,>=50.0.0; extra == 'spiffe'
Requires-Dist: spiffe<0.4.0,>=0.3.0; extra == 'spiffe'
Provides-Extra: sqlalchemy
Requires-Dist: sqlalchemy<3.0,>=2.0.51; extra == 'sqlalchemy'
Provides-Extra: token-exchange
Requires-Dist: anyio<5.0,>=4.14.2; extra == 'token-exchange'
Requires-Dist: cryptography<51.0,>=50.0.0; extra == 'token-exchange'
Requires-Dist: httpx<1.0,>=0.28.1; extra == 'token-exchange'
Requires-Dist: pyjwt<3.0,>=2.13.0; extra == 'token-exchange'
Description-Content-Type: text/markdown

# authweave-workload

Framework-neutral authentication for registered service applications and
service, workload, or agent principals. Version 7 supports registered X.509
credentials, direct mTLS, mTLS-bound access tokens, DPoP-bound access tokens
issued by an external OAuth Authorization Server, SPIFFE X.509-SVID
resource-server verification, RFC 7662 mTLS- or DPoP-bound opaque-token introspection,
and sender-constrained outbound RFC 8693 token exchange.
Issuer-specific payment authority is available through the strict RFC 9396
payment authorization-details profile.

```bash
uv add 'authweave-workload[mtls,jwt,dpop,spiffe,introspection,token-exchange]'
```

The base package never accepts or stores private keys and imports no web
framework, ORM, or cryptography implementation. Optional DPoP verification lives
behind `authweave-workload[dpop]` and never mints tokens. Optional SPIFFE
verification lives behind `authweave-workload[spiffe]` and never registers
short-lived SVIDs by thumbprint (see ADR 0006). Optional introspection lives
behind `authweave-workload[introspection]` (see ADR 0007). Merchant notes:
`docs/merchant/dpop.md`, `docs/merchant/spiffe.md`, `docs/merchant/introspection.md`,
`docs/merchant/token-exchange.md`.
The payment profile and application guard are documented in
`docs/merchant/authorization-details.md`.

Lifecycle mutations require a verified actor, a correlation ID, and an application recorder that
writes the security event in the same transaction. X.509 registration accepts only opaque
`CertificateMetadata` returned by an AuthWeave validator; it cannot be built from unchecked fields.
Use `validate_public_certificate` when the application owns the PKIX trust anchors. For a managed CA
that intentionally does not export its root, use `validate_attested_certificate` with a fresh
`ProviderCertificateAttestation` constructed only from the pinned provider's authenticated control
plane response. That path binds the leaf profile, fingerprint, dates, active status, provider, and
application trust-anchor identity without claiming local PKIX validation.
Custom stores raise `StoreOwnerStateConflictError` when concurrent owner revalidation rejects a
principal or credential write; the lifecycle service maps that typed conflict to `LifecycleConflictError`.

The optional Litestar adapter accepts Envoy evidence only over an explicitly
trusted TCP peer or permission-restricted Unix socket. Envoy's hex certificate
fingerprint is normalized to canonical base64url, while revocation freshness
comes from application-trusted CRL/control-plane metadata rather than an
inbound request header.
