spakky-oidc

spakky-oidc는 OIDC/OAuth bearer JWT credential을 검증하는 인증 provider 플러그인입니다. 검증된 claim을 spakky.auth.AuthContext로 매핑하고 bearer authentication capability를 제공합니다.

이 플러그인은 spakky.contributions.spakky.auth entry point로 AuthCapability.AUTHENTICATION을 제공합니다. Browser login, callback, session, refresh, logout route는 포함하지 않습니다. FastAPI, gRPC, Typer 같은 inbound adapter가 경계에서 bearer credential을 읽고 provider-neutral IAuthenticationProvider port로 전달합니다.

제공 기능

  • issuer/.well-known/openid-configuration 또는 명시적 discovery URL 기반 OIDC discovery
  • kid 기반 JWKS key 선택과 RS256 signature 검증
  • issuer, audience, azp, exp, nbf, iat, clock skew 검증
  • sub, 표시 이름, tenant, role, scope, 선택된 safe claim의 AuthContext 매핑
  • raw bearer token을 AuthContext.claims, metadata, credential_carrier에 남기지 않음

설치

pip install spakky-auth spakky-oidc spakky-fastapi

사용법

from fastapi import FastAPI
from spakky.auth import protected, require_scope
from spakky.core.application.application import SpakkyApplication
from spakky.core.application.application_context import ApplicationContext
from spakky.plugins.fastapi.routes import get
from spakky.plugins.fastapi.stereotypes.api_controller import ApiController
import spakky.auth
import spakky.plugins.fastapi
import spakky.plugins.oidc


@ApiController("/documents")
class DocumentController:
    @get("/{document_id}")
    @require_scope("documents:read")
    @protected
    def read(self, document_id: str) -> dict[str, str]:
        return {"id": document_id}


app = (
    SpakkyApplication(ApplicationContext())
    .load_plugins(
        include={
            spakky.auth.PLUGIN_NAME,
            spakky.plugins.fastapi.PLUGIN_NAME,
            spakky.plugins.oidc.PLUGIN_NAME,
        }
    )
    .add(DocumentController)
    .start()
)
api = app.container.get(FastAPI)

OidcProviderConfig는 Spakky @Configuration Pod입니다. SPAKKY_OIDC_ISSUER, SPAKKY_OIDC_AUDIENCE, SPAKKY_OIDC_CLIENT_ID와 SPAKKY_OIDC_ROLES_CLAIM, SPAKKY_OIDC_SCOPES_CLAIM, SPAKKY_OIDC_TENANT_CLAIM, SPAKKY_OIDC_DISPLAY_NAME_CLAIM 같은 claim 매핑 환경변수로 설정합니다. 기본 scope claim은 표준 공백 구분 scope 문자열을 허용하며, role과 custom scope claim은 문자열 배열도 허용합니다.

Inbound adapter는 boundary에서 bearer credential을 관찰하고 provider-neutral auth port를 호출해 AuthContext를 저장합니다. 애플리케이션 코드는 provider를 직접 호출하지 않고 spakky-auth decorator로 요구사항을 선언합니다.

개발 검증

패키지 단위 검증은 해당 패키지 디렉토리에서 실행합니다.

uv run ruff format .
uv run ruff check .
uv run pyrefly check
uv run pytest

pytest는 각 패키지 pyproject.toml의 coverage 설정을 사용합니다.

라이선스

MIT

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (8.0.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for Spakky from gravatar.com Spakky

Credits

PyPI data
Data sourced directly from PyPI's database.

Author: Spakky

License

MIT

Requires

Python >=3.12

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

spakky_oidc-7.1.1.tar.gz (7.1 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

spakky_oidc-7.1.1-py3-none-any.whl (9.6 kB view details)

Uploaded Python 3

File details

Details for the file spakky_oidc-7.1.1.tar.gz.

File metadata

  • Download URL: spakky_oidc-7.1.1.tar.gz
  • Upload date:
  • Size: 7.1 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for spakky_oidc-7.1.1.tar.gz
Algorithm Hash digest
SHA256 8f8c5063e7a9beedfbdb92f2af97b94dcc127a62dbb71ad72ef7a452f9f7959e
MD5 fdd9a7ac684ac98b6ea64a9c96770a18
BLAKE2b-256 0584c62931e41c5bfca647bc75394a0bff74c3ad072eb922d8b9c0d68fc150e4

See more details on using hashes here.

Provenance

The following attestation bundles were made for spakky_oidc-7.1.1.tar.gz:

Publisher: release.yml on E5presso/spakky-framework

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file spakky_oidc-7.1.1-py3-none-any.whl.

File metadata

  • Download URL: spakky_oidc-7.1.1-py3-none-any.whl
  • Upload date:
  • Size: 9.6 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for spakky_oidc-7.1.1-py3-none-any.whl
Algorithm Hash digest
SHA256 a72b95a5b0d0ecd19b5450dd2d21bc682bb1283fc6809095c735f6e5b1d32701
MD5 9defe11606e98549ac9e934266480ac2
BLAKE2b-256 6a56c278776b78aa68bc825023284f8c38685bb9e66393afffdfb18c086b643c

See more details on using hashes here.

Provenance

The following attestation bundles were made for spakky_oidc-7.1.1-py3-none-any.whl:

Publisher: release.yml on E5presso/spakky-framework

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page