ISP-split auth verifier seams for mgf-common consumers — a generic SessionVerifier + WebhookVerifier, a Clerk adapter (session-JWT + Svix-webhook), typed 401 errors, and mocks. Sibling of mgf-common under the mgf.* namespace.
Project description
mgf-auth
Two ISP-split auth verifier seams for mgf-common consumers — a
generic SessionVerifier + WebhookVerifier, a Clerk adapter
(session-JWT verification + Svix-webhook verification), typed 401 errors,
and test mocks. A sibling of mgf-common under the mgf.* namespace.
Extracted from PlasmaMapper after its core re-design ISP-split the auth
provider (ADR-016). A consumer keeps its own role-typed principal —
SessionVerifier is generic over the principal type; identity
resolution (Clerk ids → your principal) is your principal_resolver.
Install
pip install "mgf-auth[clerk]" # [clerk] adds pyjwt for the session adapter
Use
from mgf.auth.clerk_session import ClerkSessionVerifier, ClerkClaims
from mgf.auth.clerk_webhook import ClerkWebhookVerifier
async def resolve(claims: ClerkClaims) -> MyPrincipal:
return MyPrincipal(user_id=uuid5(NS, claims.sub), role=map_role(claims.org_role), ...)
session_verifier: ClerkSessionVerifier[MyPrincipal] = ClerkSessionVerifier(
jwt_public_key=PEM, issuer="https://clerk.acme.example", principal_resolver=resolve,
)
principal = await session_verifier.verify_session(bearer_token) # -> MyPrincipal
webhook_verifier = ClerkWebhookVerifier(webhook_secret=b"whsec_...")
event = await webhook_verifier.verify_webhook(headers, raw_body) # -> WebhookEvent
Tests use MockSessionVerifier[MyPrincipal]() (add_session) and
MockWebhookVerifier() (configure_webhook_secret + the sign()
helper) — no Clerk, no network.
What's in it
| Name | What |
|---|---|
SessionVerifier / WebhookVerifier |
the two @runtime_checkable seams (session is generic over P) |
WebhookEvent |
the verified-webhook DTO (event_type, event_id, payload, received_at) |
InvalidSessionError / InvalidWebhookSignatureError |
typed 401 errors (subclass mgf.common HttpUnauthorizedError) |
mgf.auth.clerk_session.ClerkSessionVerifier / ClerkClaims |
PyJWT session verification ([clerk] extra) |
mgf.auth.clerk_webhook.ClerkWebhookVerifier |
Svix-Signature HMAC webhook verification (stdlib) |
MockSessionVerifier / MockWebhookVerifier |
in-process test doubles |
Design
- Generic over the principal (
SessionVerifier[P]): the JWT mechanics live here; the consumer'sprincipal_resolverproduces its own principal shape — no imposed role/identity model. - Vendor SDK behind an extra: importing
mgf.authpulls nopyjwt(import-linter-enforced); the Clerk session adapter is the only place that needs it. - Webhook side is stdlib-only (HMAC-SHA256 over
<id>.<ts>.<body>). - Session revocation (checking a
revoked_sessionstable) is a consumer concern — it's DB-coupled and app-specific, so it stays in the consumer, not here.
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file mgf_auth-0.1.3.tar.gz.
File metadata
- Download URL: mgf_auth-0.1.3.tar.gz
- Upload date:
- Size: 109.8 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/6.2.0 CPython/3.11.15
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
e8f3711f23e679fe028ecab0e1521e6d161d74435e961a2399adb75cd0357a2b
|
|
| MD5 |
6f6fbe497a22f25ad86be85a4a19dfff
|
|
| BLAKE2b-256 |
00f7fabd3a55a807b3321de21b2fc497fa5c760a2b369b0684a91d9106e821ac
|
File details
Details for the file mgf_auth-0.1.3-py3-none-any.whl.
File metadata
- Download URL: mgf_auth-0.1.3-py3-none-any.whl
- Upload date:
- Size: 16.1 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/6.2.0 CPython/3.11.15
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
e2dab6996b55bd655cba45d755e64414cfc6de5325f5dbaae6c2f39efa99137c
|
|
| MD5 |
c3c126a84e68d223b1e6a69dfb8936cb
|
|
| BLAKE2b-256 |
067410f4b5c22c25a585f34a7d447131ab02264b0edc1ccef50ddb81efc1e068
|
