app.auth.dev

Dev-only HS256 tokens signed with ADRIANO_DEV_SHARED_SECRET.

Follows module-dev-auth-bypass: HS256 tokens are accepted only when the shared secret is configured (it has no default and must be unset in production). Dev tokens enforce the same aud and iss as real tokens and carry their roles at the configured roles claim path, so they go through exactly the same claim mapping and authorization code as real IdP tokens.

Dev issuer: ADRIANO_OIDC_ISSUER when set, else DEV_ISSUER (adriano-dev). With a real issuer configured, a dev token can therefore act as any issuer|subject – which is why the secret must never be set in production.

Tokens are minted by adriano mint-dev-token (CLI) and by POST /auth/dev/token (mounted only when ADRIANO_DEV_AUTH_ENABLED is true; see app.routers.auth_dev).

Public API: DEV_ISSUER, DEFAULT_MINUTES, DevIdentity, dev_issuer(), decode_dev_token(), mint_dev_token().

app.auth.dev.DEFAULT_MINUTES = 60

Default dev token lifetime in minutes.

app.auth.dev.DEV_ISSUER = 'adriano-dev'

iss of dev tokens when ADRIANO_OIDC_ISSUER is not set.

class app.auth.dev.DevIdentity(sub, name=None, email=None, roles=())

Bases: object

The identity a dev token asserts.

Parameters:

  • sub (str) – Subject.

  • name (str | None) – Display name, if any.

  • email (str | None) – Email, if any.

  • roles (Sequence[str]) – Role names.

sub: str
name: str | None
email: str | None
roles: Sequence[str]
app.auth.dev.decode_dev_token(token, settings)

Validate a dev HS256 token and return its claims.

Parameters:

  • token (str) – Raw bearer token.

  • settings (Settings) – Application settings.

Return type:

dict[str, Any]

Returns:

The verified claims.

Raises:

AuthenticationError – If the secret is unset or the token is not acceptable.

app.auth.dev.dev_issuer(settings)

Return the issuer dev tokens carry and must match.

Parameters:

settings (Settings) – Application settings.

Return type:

str

Returns:

ADRIANO_OIDC_ISSUER or DEV_ISSUER.

app.auth.dev.mint_dev_token(settings, identity, *, minutes=60, now=None)

Sign a dev token for identity.

Parameters:

  • settings (Settings) – Application settings (secret, audience, issuer, roles claim path).

  • identity (DevIdentity) – The asserted identity.

  • minutes (int) – Lifetime in minutes.

  • now (datetime | None) – Issue time (default: now).

Return type:

str

Returns:

The encoded token.

Raises:

ValueError – If ADRIANO_DEV_SHARED_SECRET is not set.