agios-auth-verify

FastAPI dependency that checks an RBAC permission straight off the access-token JWT — decode the token, read the caller's permissions from its claims, allow the request only if the required permission is present. No configuration.

Install

pip install agios-auth-verify

Requires fastapi.

Usage

from fastapi import Depends, FastAPI
from auth_verify import authorize

app = FastAPI()


@app.delete("/users/{user_id}", dependencies=[Depends(authorize("users:delete"))])
async def delete_user(user_id: str):
    return {"ok": True}

The token is read from the access_token cookie or an Authorization: Bearer <token> header. The JWT payload is base64-decoded (signature not verified); its permissions come from the permissions claim (also accepts scope / scopes, space-delimited).

On success the dependency returns {"success": true, "userId": ..., "email": ..., "permissionKey": ...}, so it can also be injected as a value:

@app.delete("/users/{user_id}")
async def delete_user(user_id: str, auth=Depends(authorize("users:delete"))):
    return {"ok": True, "actor": auth["userId"]}

Responses

Raises fastapi.HTTPException with body {"success": false, "message": ...}:

Build

python -m build