Metadata-Version: 2.4
Name: tba-capability-protected-resource-authorization
Version: 0.4.0.dev2
Summary: Composable protocol-neutral protected-resource authorization capability for TBA.
License-Expression: Apache-2.0
Requires-Python: >=3.10,<3.15
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Requires-Dist: tba-concrete-capability (==0.4.0.dev2)
Requires-Dist: tba-concrete-dpop-confirmation-binding (==0.4.0.dev2)
Requires-Dist: tba-concrete-mtls-confirmation-binding (==0.4.0.dev2)
Requires-Dist: tba-contracts-identity (==0.4.0.dev2)
Requires-Dist: tba-contracts-security-trust (==0.1.0)
Description-Content-Type: text/markdown

# tba-capability-protected-resource-authorization

Layer-40 orchestration for a protected resource's normalized authorization
decision over validated access-token material.

## Injected dependencies

A required `ResourceServerVerifierPort` supplies token and claims verification.
The injected implementation may compose local signature validation,
introspection, sender constraints, and policy evaluation below this boundary.

## Operations and readiness

The required delegated operations are `verify_token` and `verify_claims`.
Construction fails when either operation is unavailable. The capability report
exposes both effective bindings and provider readiness.

## Protocol consumers

Layer-50 OAuth protected-resource profiles map bearer-token, JWT access-token,
introspection, DPoP, mTLS, and authorization requirements to this capability.

## Non-goals

This package does not parse HTTP, decode protocol wire formats, resolve keys,
open storage sessions, select trust anchors, or publish resource-server routes.

