multipass-auth

Reusable browser-login building blocks, spun out of canvasser. Import name is multipass; the distribution is multipass-auth (the bare name is a decade-old stub on PyPI). GPL-3.0-or-later.

Ships four modules: credential resolution (multipass.credentials), persistent browser contexts with 700/600 debug snapshots (multipass.browser), a branding skeleton (multipass.config — state layout plus every brandable string in one frozen object), and the recogniser-loop auth engine (multipass.auth: LoginState dispatch, one IdP row, structural rejection check, allowlist liveness) with Duo answered through the duo-pass dependency. Factor plugins beyond Duo arrive through extra_recognisers.

from pathlib import Path
from multipass import CredentialNames, configure, resolve_credentials

configure(names=CredentialNames(
    username_vars=("CONCURRER_USERNAME",),
    password_vars=("CONCURRER_PASSWORD",),
    program="concurrer",
))

user, pw = resolve_credentials(
    default_file=Path.home() / ".local" / "state" / "concurrer" / "secrets.env",
)

Branding

A library must not hardcode its first host's variable names. Every variable, flag example, and program name the module can utter comes from one frozen CredentialNames object, replaced wholesale by configure(names=...) — the same hook pattern as duo-pass. The MULTIPASS_* defaults are provisional; a host renames them once, here, and every prompt, error, and source report follows.