feat(service-auth-py): Python S2S auth client + verifier + middleware - #876
Merged
Conversation
…ware [skip ci] WIP: builds fuzefront-service-auth (packages/service-auth-py), the Python peer of packages/service-auth, against the frozen packages/security/openapi.yaml tokens contract. Local pytest run pending (dependency install contended by concurrent worktree agents on this machine) -- pushing now per no-stall policy. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session-Id: fe3aa738-cb24-4315-a29b-29834ddea892
Align error codes/status, MachineIdentity.scopes, and invalidate() with the merged TypeScript sibling (FuzeFront PR #873) so both languages' resource servers emit the same {error, code} JSON body and share one error-code vocabulary (MISCONFIGURED/TOKEN_REQUEST_FAILED/MALFORMED_RESPONSE/NO_TOKEN/ INTROSPECTION_UNAVAILABLE/TOKEN_INACTIVE/FORBIDDEN/UNKNOWN). Verified: pytest -q -> 40 passed (includes the fail-open regression test: an introspection response with HTTP 200 and active:false is rejected, in the verifier, the FastAPI dependency, and the Flask decorator). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session-Id: fe3aa738-cb24-4315-a29b-29834ddea892
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| steps: | ||
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 | ||
|
|
||
| - uses: actions/setup-python@v7 |
| headers={"Content-Type": "application/json", "Accept": "application/json"}, | ||
| ) | ||
| try: | ||
| with urllib.request.urlopen(request, timeout=timeout) as response: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
fuzefront-service-auth(packages/service-auth-py), the Python peer of the merged TypeScriptpackages/service-auth(Add @fuzefront/service-auth: runtime S2S auth (client + fail-closed verifier + middleware) #873) and@fuzefront/security-client.ServiceAuthClient: caller-side M2M token acquisition againstPOST /api/v1/security/tokens, in-memory caching, refresh-before-expiry with a safety margin, thread-safe single-flight refresh,invalidate().MachineTokenVerifier.verify_machine_token(): callee-side verification againstPOST /api/v1/security/tokens/introspect. Fails closed on every ambiguity (connection error, timeout, malformed body, missing/non-boolactive) and — critically — branches on theactiveboolean in the response BODY, never on HTTP status, because that endpoint always answers HTTP 200 per the real server route (backend/security/src/routes/security.ts).middleware/fastapi.py) and Flask decorator (middleware/flask.py), both emitting the same{"error", "code"}JSON body shape as the TS sibling's Express middleware, sharing itsServiceAuthErrorCodevocabulary.exp; failures are never cached.authorizehook seam (authz.py) for per-caller authorization once/authz/*is wired in by callers..github/workflows/service-auth-py-publish.yml, mirroringidentity-py-publish.yml/config-client-py-publish.yml(GitHub Release asset — GitHub Packages has no PyPI-style registry and this is a private family package).Why this repo/location
Python client packages that peer a TS runtime already live under
packages/*-pyin this repo (identity-py,config-client-py,selection-list-client-py), all distributed as GitHub Release assets.packages/service-auth-pyis the natural sibling ofpackages/service-auth(#873), so backend/UI/tests all read as one product rather than splitting the S2S story across repos. FuzeKeys was considered and ruled out — it's a separate identity/vault product, not this cross-service concern.Test plan
pytest -q→ 40 passed (mocked HTTP layer, no real network calls)active: falseis rejected — in the verifier, the FastAPI dependency, and the Flask decorator🤖 Generated with Claude Code