app.auth

Authentication and authorization.

  • app.auth.oidc – RS256 bearer tokens from the configured IdP (discovery document + cached JWKS).

  • app.auth.dev – dev-only HS256 tokens (shared secret), minted by adriano mint-dev-token or POST /auth/dev/token.

  • app.auth.tokens – validator selection by the unverified alg header and claim mapping.

  • app.auth.rbac – role -> permission mapping and reviewer eligibility.

  • app.auth.deps – FastAPI dependencies (Principal, get_principal, require_permission).

  • app.auth.push – constant-time CI push-token checks for candidate intake (a separate scheme, never OIDC).