base ¶

Shared authentication base types used by all providers.

Classes:

AuthContext –

Framework-agnostic authentication context passed to providers.
AuthProvider –

Abstract base for authentication providers.
AuthUser –

Authenticated user extracted from JWT claims.
AuthenticationError –

Raised by a provider when the request should be rejected with 403.

AuthContext ¶

AuthContext(context: Mapping[str, str])


              flowchart TD
              oqtopus_auth.base.AuthContext[AuthContext]

              

              click oqtopus_auth.base.AuthContext href "" "oqtopus_auth.base.AuthContext"

Framework-agnostic authentication context passed to providers.

Behaves as a read-only mapping so providers can call context.get(key) without depending on any web framework.

AuthProvider ¶


              flowchart TD
              oqtopus_auth.base.AuthProvider[AuthProvider]

              

              click oqtopus_auth.base.AuthProvider href "" "oqtopus_auth.base.AuthProvider"

Abstract base for authentication providers.

Methods:

authenticate –

Authenticate the request context.

authenticate `abstractmethod` `async` ¶

authenticate(context: AuthContext) -> AuthUser | None

Authenticate the request context.

Returns:

AuthUser | None –

AuthUser on success, or None if an implementation chooses
AuthUser | None –

to let anonymous requests through without a user identity.
AuthUser | None –

NullProvider (provider: none) does not use this — it
AuthUser | None –

always returns a synthetic AuthUser built from its config.

Raises:

AuthenticationError –

If the request should be rejected with 403.

AuthUser `dataclass` ¶

AuthUser(
    account: str,
    roles: list[str] = list(),
    raw_groups: list[str] = list(),
)

Authenticated user extracted from JWT claims.

Attributes:

role (str) –

The primary role, for backward-compatible single-role display.

role `property` ¶

role: str

The primary role, for backward-compatible single-role display.

AuthenticationError ¶

AuthenticationError(reason: str)


              flowchart TD
              oqtopus_auth.base.AuthenticationError[AuthenticationError]

              

              click oqtopus_auth.base.AuthenticationError href "" "oqtopus_auth.base.AuthenticationError"

Raised by a provider when the request should be rejected with 403.