cl4im 0.2.2

Python client for the Identora authorizer (OIDC + RBAC)

cl4im

Python client for the Identora authorizer — handles app authentication, JWT validation, permission checking and automatic operation sync.

Installation

pip install cl4im
# With FastAPI support
pip install "cl4im[fastapi]"

Quick start with FastAPI

from fastapi import FastAPI, Request
from cl4im.adapters.fastapi import Cl4im, operation

app = FastAPI()

cl4im = Cl4im(
    app,
    authorizer_url="http://localhost:4000/api",
    app_id="your-app-uuid",
    secret="your-app-secret",
)


@app.get("/public")
@operation(id="public.info", level="public")
async def public_info():
    """Anyone can call this — no token needed."""
    return {"message": "Hello, world!"}


@app.get("/items")
@operation(id="items.list", level="private")
async def list_items(request: Request):
    """Requires any authenticated user (token with non-empty groups)."""
    user = request.state.user  # TokenClaims
    return {"user": user.sub, "items": []}


@app.delete("/items/{item_id}")
@operation(id="items.delete", level="protected")
async def delete_item(item_id: str, request: Request):
    """Requires a user whose group has explicit permission for items.delete."""
    return {"deleted": item_id}

Standalone client

import asyncio
from cl4im import Cl4imClient, OperationDescriptor

client = Cl4imClient(
    authorizer_url="http://localhost:4000/api",
    app_id="your-app-uuid",
    secret="your-app-secret",
)

client.register_operation(
    OperationDescriptor(identifier="items.list", method="read", level="private")
)

async def main():
    await client.startup()

    # Validate a token from an incoming request
    claims = await client.validate_token("<bearer-token>")

    # Check whether the token has permission
    allowed = client.check_permission(claims, "items.list", "read")
    print(f"Allowed: {allowed}")

asyncio.run(main())

Operation levels

Level	Who can access
public	Everyone — no token required
private	Any authenticated user (token with at least one group)
protected	Only users whose groups intersect the operation's allowed_groups

Method auto-detection

The @operation decorator infers the method from the function name:

Function name prefix/keyword	Detected method
get_, list_, fetch_, read_	read
delete_, remove_, destroy_	delete
contains stream, subscribe, watch	stream
anything else	write

Configuration

Parameter	Description
authorizer_url	Base URL of Identora, including the API prefix (e.g. http://host/api)
app_id	UUID of the app registered in auth.apps
secret	Plain-text app secret (never committed — use env vars)

import os
from cl4im.adapters.fastapi import Cl4im

cl4im = Cl4im(
    app,
    authorizer_url=os.environ["AUTHORIZER_URL"],
    app_id=os.environ["APP_ID"],
    secret=os.environ["APP_SECRET"],
)