tahportal-sso 1.0.0

TAHPortal SSO integration for Python web applications (FastAPI and Flask)

tahportal-sso

TAHPortal SSO integration package for Python web applications. Connects your product to the TAHPortal identity gateway with minimal setup.

Installation

```bash pip install tahportal-sso

with FastAPI support

pip install tahportal-sso[fastapi]

with Flask support

pip install tahportal-sso[flask] ```

Quick start

Set three environment variables in your product:

```bash TAHPORTAL_URL=https://your-tahportal-domain.com TAHPORTAL_PRODUCT_ID= TAHPORTAL_SESSION_SECRET=<random 64-char hex string> TAHPORTAL_SESSION_TTL=3600 # optional, defaults to 3600 seconds ```

FastAPI

```python from fastapi import FastAPI, Depends from tahportal_sso import TahPortalSSO, TahPortalConfig, SSOUser

config = TahPortalConfig.from_env() sso = TahPortalSSO(config)

app = FastAPI() app.include_router(sso.get_fastapi_router())

@app.get("/dashboard") async def dashboard(user: SSOUser = Depends(sso.require_user)): return {"welcome": user.full_name, "role": user.user_role} ```

Flask

```python from flask import Flask from tahportal_sso import TahPortalSSO, TahPortalConfig

config = TahPortalConfig.from_env() sso = TahPortalSSO(config)

app = Flask(name) sso.init_flask(app)

@app.route("/dashboard") @sso.login_required def dashboard(): user = sso.get_current_user() return {"welcome": user.full_name} ```

How it works

1. TAHPortal generates a short-lived one-time code when a user launches this product
2. This package exchanges the code for the user's identity at TAHPortal's /api/sso/exchange endpoint
3. A local session JWT is created and stored in an httpOnly cookie
4. All subsequent requests are validated locally — no network call to TAHPortal on every request
5. When the session expires the user is redirected back to TAHPortal to re-authenticate

Session expiry and access revocation

Sessions expire after TAHPORTAL_SESSION_TTL seconds. When a session expires, the user is redirected to TAHPortal. If their subscription has been revoked, TAHPortal will deny access at that point.

Set a shorter TTL for higher-security products: ```bash TAHPORTAL_SESSION_TTL=900 # 15 minutes ```

License

MIT — Copyright (c) 2026 STOP THE TRAFFIK / Traffik Analysis Hub