header_provider

Header-based JWT authentication provider.

Classes:

• HeaderProvider –

  Provider that extracts user and roles from JWT claims set by a reverse proxy.

Functions:

• extract_token –

  Extract the raw JWT string from a header value.

HeaderProvider

HeaderProvider(
    header_config: HeaderProviderConfig,
    role_mappings: dict[str, str],
)

              flowchart TD
              oqtopus_auth.header_provider.HeaderProvider[HeaderProvider]
              oqtopus_auth.base.AuthProvider[AuthProvider]

                              oqtopus_auth.base.AuthProvider --> oqtopus_auth.header_provider.HeaderProvider
                


              click oqtopus_auth.header_provider.HeaderProvider href "" "oqtopus_auth.header_provider.HeaderProvider"
              click oqtopus_auth.base.AuthProvider href "" "oqtopus_auth.base.AuthProvider"
            

Provider that extracts user and roles from JWT claims set by a reverse proxy.

Methods:

• authenticate –

  Extract user and roles from JWT claims, then optionally verify the signature.

authenticate async

authenticate(context: AuthContext) -> AuthUser | None

Extract user and roles from JWT claims, then optionally verify the signature.

Returns:

• AuthUser | None –

  Authenticated AuthUser.

Raises:

• AuthenticationError –

  If the JWT is missing/invalid, no roles match, or signature verification fails.

extract_token

extract_token(
    jwt_header: str, header_value: str
) -> str | None

Extract the raw JWT string from a header value.

For the authorization header, strips the Bearer prefix. For all other headers, treats the value as a raw JWT.

Returns:

• str | None –

  Raw JWT string, or None if absent or Bearer prefix is missing.