sahra-shared
A reusable Python library — the shared kernel for Sahra Trans services.
sahra-shared is a library, not a service. It has no HTTP server, no database, no
port, no container and no entrypoint. Nothing here starts; you import it. It is
published to PyPI and consumed by the Sahra Trans services as an ordinary dependency.
The import namespace is sahra_shared.
Install
uv add sahra-shared
Use
from sahra_shared.auth import Capability, CapabilityGuards
from sahra_shared.events import NATSPublisher, SahraEvent
from sahra_shared.http import ProblemDetail, make_health_router
from sahra_shared.privacy import CountryPrivacyPolicy, PIIEmail
from sahra_shared.telemetry import AppLogger, setup_otel
from sahra_shared.tenancy import TenantScope, tenant_transaction
What it provides
| Sub-package | Surface |
|---|---|
sahra_shared.auth |
TokenClaims, RS256 JWT verification against JWKS, the closed Capability vocabulary and deny-by-default CapabilityGuards |
sahra_shared.events |
SahraEvent (CloudEvents envelope), NATSPublisher / consumer helpers |
sahra_shared.http |
ProblemDetail (RFC 7807) and make_health_router — a router factory a service mounts; this library serves nothing itself |
sahra_shared.privacy |
PII types (PIIEmail, PIIPhone, …) and per-country privacy policies |
sahra_shared.telemetry |
OpenTelemetry setup, structured logging, call_service (propagates traceparent) |
sahra_shared.tenancy |
TenantScope, transaction-bound tenant context, row-level-security helpers |
Sub-packages are independent: they do not import one another (only telemetry is
depended upon in common). That boundary is enforced by
tests/test_import_boundaries.py.
Requirements
Python >= 3.13.
Development
This repository is uv-only. Do not use pip, venv, Poetry or Twine.
uv sync --all-groups # install dev + test dependency groups
uv run pytest # tests
uv run ruff check . # lint
uv run ruff format --check .# format
uv run ty check # type-check
uv build # build wheel + sdist
uv.lock is committed deliberately: the resolved dependency set is part of what a
release tag means.
Documentation
Design notes, the tenancy/RLS reference and the logging integration guide live in the project repository alongside the source, and are not shipped in the distribution.
Releasing
Releases are built and published to PyPI by GitHub Actions using Trusted
Publishing (OIDC). There is no PyPI API token and no stored publishing
credential. A vX.Y.Z tag builds, gates and publishes; a vX.Y.Z-rc1 tag runs
the identical gate and stops before publishing.
License
MIT — see LICENSE.
1 maintainer
Metadata
1 maintainer
Release files for sahra-shared 0.5.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| sahra_shared-0.5.1.tar.gz | 142.2 kB | Without provenance | Details for sahra_shared-0.5.1.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| sahra_shared-0.5.1-py3-none-any.whl | Python 3 | none | any | Details for sahra_shared-0.5.1-py3-none-any.whl |
Total release size: 232.6 kB
Security for sahra-shared 0.5.1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
