Auth Client
轻量级 JWT 验证 SDK，用于接入 Auth Service 的业务项目。
安装
# 基础 JWT 校验器
pip install "seanfield-auth-client==0.3.0"
# FastAPI 依赖工厂
pip install "seanfield-auth-client[fastapi]==0.3.0"
需要验证尚未发布的源码时，可从仓库子目录安装：
pip install "seanfield-auth-client[fastapi] @ git+https://github.com/HyxiaoGe/auth-service.git@auth-client-v0.3.0#subdirectory=auth-client"
支持 Python 3.10–3.13。包内包含 py.typed，类型检查器可直接读取公开 API 的类型信息。
快速上手
FastAPI 项目 (3 行接入)
from fastapi import FastAPI, Depends
from auth_service_client import JWTValidator, require_auth, require_scopes
# 指向你部署的 Auth Service 的 JWKS 端点
validator = JWTValidator(jwks_url="http://localhost:8100/.well-known/jwks.json")
app = FastAPI()
@app.get("/public")
async def public():
return {"message": "anyone can see this"}
@app.get("/protected")
async def protected(user=Depends(require_auth(validator))):
return {
"message": "you are authenticated",
"user_id": user.sub,
"email": user.email,
"app": user.aud,
}
@app.get("/admin-only")
async def admin_only(user=Depends(require_scopes(validator, "admin"))):
return {"message": "admin access granted"}
非 FastAPI 项目 (同步验证)
from auth_service_client import JWTValidator
validator = JWTValidator(jwks_url="http://localhost:8100/.well-known/jwks.json")
def verify_request(authorization_header: str):
token = authorization_header.replace("Bearer ", "")
user = validator.verify(token)
print(f"User {user.sub} ({user.email}) authenticated")
return user
配置选项
validator = JWTValidator(
jwks_url="http://localhost:8100/.well-known/jwks.json",
issuer="http://localhost:8100", # 可选: 验证 token 签发者 (iss)
audience="app_your_client_id", # 可选: 验证 token 目标应用 (aud = 你的 client_id)
require_token_type="access", # 可选: 拒绝 refresh token 走保护路由
cache_ttl=300, # JWKS 缓存时间 (秒)
)
生产接入建议三项 (
issuer/audience/require_token_type) 全开 —— IdP 不校验aud，由消费方自己锁定 token 是发给本应用的。详见 认证契约。
发布维护
PyPI 发布仅由仓库的 python-client-publish.yml 工作流处理。工作流只响应
auth-client-v* 标签，先运行 SDK 测试、lint、构建内容校验、twine check 与隔离安装
smoke，再通过 PyPI Trusted Publishing 上传；不会读取长期 PyPI API Token。
PyPI 项目需要配置以下 Trusted Publisher：
- PyPI Project：
seanfield-auth-client - Owner：
HyxiaoGe - Repository：
auth-service - Workflow：
python-client-publish.yml - Environment：
pypi
发布前必须同步更新 pyproject.toml 与 auth_service_client/__init__.py 中的版本。标签必须
与包版本完全一致，例如 0.3.0 只能由 auth-client-v0.3.0 发布。
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file seanfield_auth_client-0.3.0.tar.gz.
File metadata
- Download URL: seanfield_auth_client-0.3.0.tar.gz
- Upload date:
- Size: 10.4 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/6.1.0 CPython/3.13.13
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
2056ebe827d4753e2a63f39c794df1867fde41d5924c3fd8798df220a3a8a94d
|
|
| MD5 |
5ca815e4131d98e64c9662e741558bd6
|
|
| BLAKE2b-256 |
37097a56d5f904f987699571885ef8dcdb52e645ce35d6ae1efbbb69f048b9e5
|
Provenance
The following attestation bundles were made for seanfield_auth_client-0.3.0.tar.gz:
Publisher:
python-client-publish.yml on HyxiaoGe/auth-service
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
seanfield_auth_client-0.3.0.tar.gz -
Subject digest:
2056ebe827d4753e2a63f39c794df1867fde41d5924c3fd8798df220a3a8a94d - Sigstore transparency entry: 2210614729
- Sigstore integration time:
-
Permalink:
HyxiaoGe/auth-service@6905f695069e2b29993afb2eba5e3e9c2c58613b -
Branch / Tag:
refs/tags/auth-client-v0.3.0 - Owner: https://github.com/HyxiaoGe
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
python-client-publish.yml@6905f695069e2b29993afb2eba5e3e9c2c58613b -
Trigger Event:
push
-
Statement type:
File details
Details for the file seanfield_auth_client-0.3.0-py3-none-any.whl.
File metadata
- Download URL: seanfield_auth_client-0.3.0-py3-none-any.whl
- Upload date:
- Size: 11.2 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/6.1.0 CPython/3.13.13
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
59f5c1da2569ef20631f1bab0b554c51091f25265b0bd4ccda1c9fea6249c2f1
|
|
| MD5 |
b81738f9856fbbf8ba78d7537818844c
|
|
| BLAKE2b-256 |
56c8620b89e71fb56f3d3269c5edb806582a6844eec8fd755532e1105a29ddee
|
Provenance
The following attestation bundles were made for seanfield_auth_client-0.3.0-py3-none-any.whl:
Publisher:
python-client-publish.yml on HyxiaoGe/auth-service
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
seanfield_auth_client-0.3.0-py3-none-any.whl -
Subject digest:
59f5c1da2569ef20631f1bab0b554c51091f25265b0bd4ccda1c9fea6249c2f1 - Sigstore transparency entry: 2210614766
- Sigstore integration time:
-
Permalink:
HyxiaoGe/auth-service@6905f695069e2b29993afb2eba5e3e9c2c58613b -
Branch / Tag:
refs/tags/auth-client-v0.3.0 - Owner: https://github.com/HyxiaoGe
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
python-client-publish.yml@6905f695069e2b29993afb2eba5e3e9c2c58613b -
Trigger Event:
push
-
Statement type:
