Metadata-Version: 2.5
Name: armasec-lite
Version: 0.1.5
Summary: Injectable FastAPI auth via OIDC, with three dependencies
Project-URL: Homepage, https://docs.vantagecompute.ai/developer/armasec-lite/
Project-URL: Documentation, https://docs.vantagecompute.ai/developer/armasec-lite/
Project-URL: Repository, https://github.com/vantagecompute/armasec-lite
Project-URL: Issues, https://github.com/vantagecompute/armasec-lite/issues
Project-URL: Changelog, https://github.com/vantagecompute/armasec-lite/releases
Author-email: Vantage Compute <info@vantagecompute.ai>
Maintainer-email: Vantage Compute <info@vantagecompute.ai>
License-Expression: MIT
License-File: LICENSE
Keywords: auth,auth0,authentication,authorization,fastapi,jwks,jwt,keycloak,oauth2,oidc,openid-connect,security
Classifier: Development Status :: 3 - Alpha
Classifier: Framework :: FastAPI
Classifier: Framework :: Pytest
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Internet :: WWW/HTTP
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Classifier: Topic :: System :: Systems Administration :: Authentication/Directory
Classifier: Typing :: Typed
Requires-Python: >=3.12
Requires-Dist: cryptography<51,>=50.0.1
Requires-Dist: fastapi<1,>=0.141.1
Requires-Dist: pydantic<3,>=2.13.5
Provides-Extra: test
Requires-Dist: pytest<10,>=9.1.1; extra == 'test'
Description-Content-Type: text/markdown

<div align="center">
<a href="https://www.vantagecompute.ai/">
  <img src="https://vantage-compute-public-assets.s3.us-east-1.amazonaws.com/branding/vantage-logo-text-black-horz.png" alt="Vantage Compute Logo" width="100" style="margin-bottom: 0.5em;"/>
</a>
</div>

<div align="center">

# armasec-lite

Injectable FastAPI auth via OIDC, with three dependencies instead of ten.

[![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
[![Python](https://img.shields.io/badge/python-3.12+-blue.svg)](https://python.org)
[![PyPI](https://img.shields.io/pypi/v/armasec-lite.svg)](https://pypi.org/project/armasec-lite/)
![Build Status](https://img.shields.io/github/actions/workflow/status/vantagecompute/armasec-lite/release.yml?branch=main&label=build&logo=github&style=plastic)
![GitHub Issues](https://img.shields.io/github/issues/vantagecompute/armasec-lite?label=issues&logo=github&style=plastic)
![Pull Requests](https://img.shields.io/github/issues-pr/vantagecompute/armasec-lite?label=pull-requests&logo=github&style=plastic)
![GitHub Contributors](https://img.shields.io/github/contributors/vantagecompute/armasec-lite?logo=github&style=plastic)

</div>

`armasec-lite` validates bearer tokens against your identity provider's JWKS, checks
scopes and issuer/audience claims, and guards a route with a single `Depends()`. It is a
dependency-minimal reimplementation of
[armasec](https://github.com/omnivector-solutions/armasec) 3.x with the same public API,
built almost entirely on the standard library. Runtime dependencies are `fastapi`,
`cryptography` and `pydantic`.

## Install

```bash
uv add armasec-lite
```

The pytest fixtures, including the mock OIDC provider, live behind an extra:

```bash
uv add "armasec-lite[test]"
```

## Usage

```python
"""Secure a single route against one OIDC domain."""

import os

from armasec_lite import Armasec
from fastapi import Depends, FastAPI

app = FastAPI()
armasec = Armasec(
    domain=os.environ.get("ARMASEC_DOMAIN"),
    audience=os.environ.get("ARMASEC_AUDIENCE"),
)


@app.get("/stuff", dependencies=[Depends(armasec.lockdown("read:stuff"))])
async def check_access():
    return {"message": "Successfully authenticated!"}
```

Runnable variants, including multiple domains, `match_keys`, permission extractors and the
plugin system, are in [`examples/`](examples/).

## Documentation

[docs.vantagecompute.ai/developer/armasec-lite](https://docs.vantagecompute.ai/developer/armasec-lite/)

- [Installation](https://docs.vantagecompute.ai/developer/armasec-lite/installation)
- [Quickstart](https://docs.vantagecompute.ai/developer/armasec-lite/quickstart)
- [Migrating from armasec](https://docs.vantagecompute.ai/developer/armasec-lite/migration)
  covers every behavior difference from upstream 3.x, and what each one requires of you.
- [Security](https://docs.vantagecompute.ai/developer/armasec-lite/security/) covers the
  JWT verification order, the threat model, and what the attack suite defends.
- [Architecture](https://docs.vantagecompute.ai/developer/armasec-lite/architecture/)
  covers the request lifecycle, the caching model and the threading model.
- [API Reference](https://docs.vantagecompute.ai/developer/armasec-lite/api-reference/)

## License

MIT. See [LICENSE](LICENSE).
