mic-platform

Briques policy, contrôle et intégrations d'identité du framework MIC. Sommet du DAG platform → data → core : dépend de mic-core ET mic-datastore.

Modules

Module	Rôle
`mic.authz`	Autorisation : moteur in-memory, OPA, OpenFGA (appels API via httpx)
`mic.identity.keycloak`	Client OIDC Keycloak concret, sans dépendance FastAPI/Litestar ; client d'administration pour provisionner des clients machine
`mic.ratelimit`	Rate limiting (in-memory / Redis Lua) + `RateLimitMiddleware`

Namespace PEP 420 (pas de mic/__init__.py).

Installation

pip install "mic-platform[keycloak,openfga,redis]"

Extras

Extra	Tire
`opa`	`mic-core[client]` (httpx — appels HTTP vers l'agent OPA)
`openfga`	`mic-core[client]` (httpx — API OpenFGA ; pas le SDK officiel)
`keycloak`	`mic-core[client]` (httpx : discovery, authorization code + PKCE, refresh, logout, Admin REST)
`redis`	`mic-datastore[redis]` (backend Lua du rate limiter)

ℹ️ L'adaptateur OpenFGA (mic.authz.openfga) parle à l'API HTTP via httpx, il n'utilise pas openfga-sdk.

mic.identity.keycloak.KeycloakClient ne dépend d'aucun transport entrant : les adaptateurs FastAPI, Litestar, WebSocket ou gRPC extraient les credentials, puis appellent ce client et mic.auth.OidcTokenVerifier. Le client ne réimplémente pas la validation JWT/JWKS et n'expose volontairement pas le password grant.

mic.identity.keycloak.KeycloakAdminClient provisionne des clients machine (agents, workers, services partenaires) par l'API Admin REST, authentifié en client_credentials :

from mic.identity import KeycloakAdminClient

with KeycloakAdminClient(server_url="https://sso.example.org", realm="library",
                         client_id="library-provisioner", client_secret=secret) as admin:
    agent = admin.ensure_confidential_client(client_id="agent-site-a", name="Agent site A",
                                             default_client_scopes=["ingestion:deposit"])
    credential = admin.get_client_secret(agent.id)      # SecretStr
    admin.rotate_client_secret(agent.id)                # révocation du secret
    admin.set_client_enabled(agent.id, False)           # plus aucun jeton émis

ensure_confidential_client est idempotent : un client existant garde son secret et son état (jamais réactivé) ; un client existant qui n'est pas un client machine confidentiel (public, flux navigateur, password grant) lève keycloak.client_conflict au lieu d'être modifié. Rôles minimaux de l'identité d'administration (realm-management) : manage-clients, view-clients, plus manage-users pour grant_service_account_realm_roles.

Versionnage

Brique volatile (OPA/OpenFGA bougent vite) — reste en 0.x. Contraindre avec >=0.1,<1. Release : make release-pkg PKG=platform VERSION=x.y.z → tag platform-vX.Y.Z (cf. ../../RELEASING.md).

Metadata

Release files for mic-platform 0.1.26

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for mic-platform 0.1.26
File	Size	Uploaded	Provenance
mic_platform-0.1.26.tar.gz	31.3 kB	Sep 30, 2026	Without provenance	Details

Built distribution (wheel)

Table of built distributions (wheels) for mic-platform 0.1.26
File	Interpreter	ABI	Platform	Reset
mic_platform-0.1.26-py3-none-any.whl 41.1 kB Sep 30, 2026 Without provenance	Python 3	none	any	Details

Total release size: 72.4 kB

Release files / mic_platform-0.1.26.tar.gz

Download URL	mic_platform-0.1.26.tar.gz
Size	31.3 kB
Tags	Source
SHA-256 checksum How to use checksums	`1099f87efeffbab788b5fb3e25c2350f46c33292f7a2675823f9c61aef11393a`
BLAKE2b-256 checksum How to use checksums	`2fbd02afb9213333b61bb8a2d82a4dbfceb5f64cf0728330de8f3e5af375209c`
Upload date	Sep 30, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/7.0.0 CPython/3.14.7`

Release files / mic_platform-0.1.26-py3-none-any.whl

Download URL	mic_platform-0.1.26-py3-none-any.whl
Size	41.1 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`4872a5f4e2d0d480384aefbc4a0c5f6890b3d7a2d8468185a072455e615a6161`
BLAKE2b-256 checksum How to use checksums	`d653b1d4de8106c6d09fe0cd62ad650ebccbcdf464a52fdf546df2e73d7a92ee`
Upload date	Sep 30, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/7.0.0 CPython/3.14.7`

Security for mic-platform 0.1.26

Report project as malware

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

No provenance found

None of the files in this release were uploaded with provenance metadata.

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.