Skip to main content

@ccp4/ccp4i2-api / ccp4i2-api

Shared API contract for CCP4i2 and consumers (CCP4i2 Compounds, third-party integrators) — auth handshake, api-fetch helpers, and request/response types. One package, two language artifacts: TypeScript on the client side (browser, Electron) and Python on the server side (Django middleware, DRF authentication). Both halves agree on the canonical bearer-token format, 401 response shape, and the typed payloads carried over the authenticated channel.

Status

Draft v0 — published to npm + PyPI from the in-tree workspace. Source of truth lives at packages/ccp4i2-api/ inside the ccp4/ccp4i2 monorepo on the django branch. The npm scope @ccp4 and the PyPI name ccp4i2-api are CCP4-owned (claimed April 2026); a dedicated ccp4/ccp4i2-api GitHub repo may follow later but is not required while the monorepo hosts the source.

Versions 0.1.0–0.3.0 were published under the previous name @ccp4/ccp4i2-auth / ccp4i2-auth; the package was renamed at 0.3.0 because its scope had grown beyond auth to cover the broader API contract. The old name is unpublished/yanked; consumers should depend on @ccp4/ccp4i2-api and ccp4i2-api from 0.3.0 onward.

Versioning follows semver from 0.x.y onwards. The v0 contract is documented in docs/CCP4I2_SERVICE_CONTRACT.md; field stability promises take effect from this version.

Layout

Path Purpose
src/ TypeScript source. Built to lib/ via npm run build.
lib/ Built TypeScript output. Generated; gitignored.
dist/ Python distribution output (python -m build). Generated; gitignored. Kept distinct from lib/ so twine upload dist/* doesn't accidentally pick up TypeScript artefacts.
ccp4i2_api/ Python source. Installed editable via pip install -e ..
tests/js/ TypeScript tests (vitest).
tests/python/ Python tests (pytest + pytest-django, run on the 3.9/3.11/3.12 × Django 4.2/5.2 matrix).

Python surface

Module What it provides
ccp4i2_api.middleware Django auth middleware, one per deployment shape: azure_ad.AzureADAuthMiddleware (validates Azure AD JWTs, also accepting the X-MS-TOKEN-AAD-ACCESS-TOKEN header set by Container Apps Easy Auth), local_session.LocalSessionAuthMiddleware (a per-launch shared secret, for the desktop app), and dev_admin.DevAdminMiddleware (DEBUG-gated local development). They share base.BaseAuthMiddleware, which owns the 401/403 response shape and sets the trust flag the DRF class checks. Install exactly one — each is inert unless its own configuration is present.
ccp4i2_api.drf AzureADAuthentication, the DRF authentication class that surfaces the middleware's user to IsAuthenticated. It honours request.user only when the middleware set the trust flag, so nothing else can spoof it. Despite the name it is not Azure-specific — it works for any middleware inheriting the base.
ccp4i2_api.file_grants New in 0.4.0. Scoped, expiring read capabilities for requests a browser issues on its own behalf — a report page's images, stylesheets and relative fetches, which cannot carry a bearer token. mint_grant() signs one for a directory subtree of the path-based file endpoint; the middleware validates it, but only after normal authentication has failed, and only for GET/HEAD within that subtree. Lifetime is an hour, overridable with the CCP4I2_FILE_GRANT_TTL setting.
ccp4i2_api.exceptions AuthenticationFailed / AuthorizationFailed, the two signals middleware raise to produce a 401 or a 403.

Consumer wiring

In-monorepo consumers can reference this package by local path for fast iteration; out-of-monorepo consumers pull the published versions.

TypeScript — in-monorepo (client/package.json):

"dependencies": {
  "@ccp4/ccp4i2-api": "file:../packages/ccp4i2-api"
}

(Path depth varies by consumer location.) Out-of-monorepo consumers use the published range, e.g. "@ccp4/ccp4i2-api": "^0.3.0".

Python — in-monorepo (Docker/server/Dockerfile, local dev setup):

pip install -e packages/ccp4i2-api/

Out-of-monorepo consumers pip install ccp4i2-api>=0.3.

Development

# TypeScript
cd packages/ccp4i2-api
npm install
npm run build       # produces lib/
npm run watch       # rebuilds on change

# Python
cd packages/ccp4i2-api
ccp4-python -m pip install -e .
ccp4-python -c "import ccp4i2_api; print(ccp4i2_api.__version__)"

Release files for ccp4i2-api 0.5.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for ccp4i2-api 0.5.0
File Size Uploaded
ccp4i2_api-0.5.0.tar.gz 21.4 kB Details

Built distribution (wheel)

Table of built distributions (wheels) for ccp4i2-api 0.5.0
File Interpreter ABI Platform
ccp4i2_api-0.5.0-py3-none-any.whl Python 3 none any Details

Total release size: 41.0 kB

Release files / ccp4i2_api-0.5.0.tar.gz

Download URL ccp4i2_api-0.5.0.tar.gz
Size 21.4 kB
Tags Source
SHA-256 checksum
How to use checksums
9f16607d6ce057d27456875fec3987094df4ce98a809f3c83e9232d2a552b7cd
BLAKE2b-256 checksum
How to use checksums
0a25dde3e7923e7b40a0fcc4ca91cfff579e0e26d4e8d5fd68d6e19baf9e5407
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Sep 21, 2026.

Transparency log

Release files / ccp4i2_api-0.5.0-py3-none-any.whl

Download URL ccp4i2_api-0.5.0-py3-none-any.whl
Size 19.6 kB
Tags Python 3
SHA-256 checksum
How to use checksums
de3fe8956efc0957a9d9f046b06ef3557936ee3041ae909b7f06d622a975c391
BLAKE2b-256 checksum
How to use checksums
85f2198d7d7b0060f1654a5d6a929fbe6caf04a87dbceb7097a4d41a868bc6cd
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Sep 21, 2026.

Transparency log

Release history Release notifications | RSS feed

This release

0.5.0 This release

2 release files

0.4.0

2 release files

0.3.5

2 release files

0.3.4

2 release files

0.3.3

2 release files

0.3.1

2 release files

0.3.0

2 release files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page