app.auth.tokens

Bearer-token validation: pick the validator by the unverified alg.

Per module-dev-auth-bypass the validator is selected from the token’s unverified header, never by trying validators in turn:

  • RS256 -> the OIDC/JWKS validator (app.auth.oidc); never the dev validator.

  • HS256 -> the dev validator (app.auth.dev), only when ADRIANO_DEV_SHARED_SECRET is set; otherwise 401.

  • anything else (none, HS512, ES256 …) -> 401.

Both paths return verified claims that feed the same app.auth.deps.principal_from_claims() mapping.

Semantics: HTTP 503 (AuthUnavailableError) means the server can authenticate nobody right now (no mechanism configured, or the IdP is unreachable); HTTP 401 (AuthenticationError) means this request’s credentials are not acceptable.

Public API: AuthStatus, auth_status(), ensure_configured(), verify_token().

class app.auth.tokens.AuthStatus(*values)

Bases: StrEnum

Which token validators are configured (reported by /healthz).

OIDC = 'oidc'
DEV = 'dev'
OIDC_AND_DEV = 'oidc+dev'
UNCONFIGURED = 'unconfigured'
app.auth.tokens.auth_status(settings)

Describe the configured token validators.

Parameters:

settings (Settings) – Application settings.

Return type:

AuthStatus

Returns:

The status.

app.auth.tokens.ensure_configured(settings)

Refuse requests when no token validator is configured.

Parameters:

settings (Settings) – Application settings.

Raises:

AuthUnavailableError – If neither OIDC nor the dev secret is configured.

Return type:

None

app.auth.tokens.verify_token(token, settings, oidc)

Validate a bearer token with the validator its alg selects.

Parameters:

  • token (str) – Raw bearer token.

  • settings (Settings) – Application settings.

  • oidc (OidcValidator | None) – The OIDC validator, None when OIDC is not configured.

Return type:

dict[str, Any]

Returns:

The verified claims.

Raises: