magogi/prod/: mgf-auth-0.1.10 metadata and description

Simple index

ISP-split auth verifier seams for mgf-common consumers — a generic SessionVerifier + WebhookVerifier, a Clerk adapter (session-JWT + Svix-webhook), typed 401 errors, and mocks. Sibling of mgf-common under the mgf.* namespace.

author Bassam Alsanie, mgf-auth contributors
classifiers
  • Development Status :: 3 - Alpha
  • Intended Audience :: Developers
  • License :: OSI Approved :: Apache Software License
  • Programming Language :: Python :: 3
  • Programming Language :: Python :: 3.11
  • Programming Language :: Python :: 3.12
  • Programming Language :: Python :: 3.13
  • Topic :: Software Development :: Libraries
  • Typing :: Typed
description_content_type text/markdown
keywords auth, clerk, jwt, session, svix, webhook
license Apache-2.0
license_file
  • LICENSE
  • NOTICE
metadata_version 2.5
requires_dist
  • mgf-common<1.0,>=0.49
  • pyjwt>=2.8; extra == 'clerk'
  • cryptography<51,>=50; extra == 'dev'
  • import-linter>=2.0; extra == 'dev'
  • mgf-test-supervisor<0.2,>=0.1.2; extra == 'dev'
  • mypy>=1.10; extra == 'dev'
  • pyjwt>=2.8; extra == 'dev'
  • pytest-asyncio>=0.23; extra == 'dev'
  • pytest-cov>=5.0; extra == 'dev'
  • pytest-timeout>=2.3; extra == 'dev'
  • pytest>=8.0; extra == 'dev'
  • ruff<0.16,>=0.4; extra == 'dev'
  • mgf-common[standards]<1.0,>=0.49; extra == 'standards'
  • cryptography<51,>=50; extra == 'test'
  • pyjwt>=2.8; extra == 'test'
requires_python >=3.11

Because this project isn't in the mirror_whitelist, no releases from root/pypi are included.

File Tox results History
mgf_auth-0.1.10-py3-none-any.whl
Size
19 KB
Type
Python Wheel
Python
3
mgf_auth-0.1.10.tar.gz
Size
137 KB
Type
Source

mgf-auth

Two ISP-split auth verifier seams for mgf-common consumers — a generic SessionVerifier + WebhookVerifier, a Clerk adapter (session-JWT verification + Svix-webhook verification), typed 401 errors, and test mocks. A sibling of mgf-common under the mgf.* namespace.

Extracted from PlasmaMapper after its core re-design ISP-split the auth provider (ADR-016). A consumer keeps its own role-typed principal — SessionVerifier is generic over the principal type; identity resolution (Clerk ids → your principal) is your principal_resolver.

Install

pip install "mgf-auth[clerk]"   # [clerk] adds pyjwt for the session adapter

Use

from mgf.auth.clerk_session import ClerkSessionVerifier, ClerkClaims
from mgf.auth.clerk_webhook import ClerkWebhookVerifier

async def resolve(claims: ClerkClaims) -> MyPrincipal:
    return MyPrincipal(user_id=uuid5(NS, claims.sub), role=map_role(claims.org_role), ...)

session_verifier: ClerkSessionVerifier[MyPrincipal] = ClerkSessionVerifier(
    jwt_public_key=PEM, issuer="https://clerk.acme.example", principal_resolver=resolve,
)
principal = await session_verifier.verify_session(bearer_token)   # -> MyPrincipal

webhook_verifier = ClerkWebhookVerifier(webhook_secret=b"whsec_...")
event = await webhook_verifier.verify_webhook(headers, raw_body)   # -> WebhookEvent

Tests use MockSessionVerifier[MyPrincipal]() (add_session) and MockWebhookVerifier() (configure_webhook_secret + the sign() helper) — no Clerk, no network.

What's in it

Name What
SessionVerifier / WebhookVerifier the two @runtime_checkable seams (session is generic over P)
WebhookEvent the verified-webhook DTO (event_type, event_id, payload, received_at)
InvalidSessionError / InvalidWebhookSignatureError typed 401 errors (subclass mgf.common HttpUnauthorizedError)
mgf.auth.clerk_session.ClerkSessionVerifier / ClerkClaims PyJWT session verification ([clerk] extra)
mgf.auth.clerk_webhook.ClerkWebhookVerifier Svix-Signature HMAC webhook verification (stdlib)
MockSessionVerifier / MockWebhookVerifier in-process test doubles

Design