Metadata-Version: 2.4
Name: klyrek-auth
Version: 0.1.0
Summary: Authentication flow mapping for the Klyrek ecosystem
Author: Klyrek Contributors
License: MIT
Keywords: appsec,authentication,pentesting,reconnaissance,security
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Information Technology
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Requires-Python: >=3.10
Requires-Dist: klyrek-core
Requires-Dist: klyrek-http
Provides-Extra: dev
Requires-Dist: mypy>=1.10; extra == 'dev'
Requires-Dist: pytest>=8.0; extra == 'dev'
Requires-Dist: ruff>=0.6; extra == 'dev'
Description-Content-Type: text/markdown

# klyrek-auth

Authentication flow mapping. Three independent pieces:

- **`forms`** — classifies discovered form endpoints (typically `klyrek-crawler`'s
  `source="crawler-form"` entries) as `login`, `register`, `password-reset`, or `logout` based on
  the endpoint's URL and field names — no extra requests needed.
- **`session`** — inspects a response's cookies, `Authorization` header, and redirect chain
  (including `response.history`, since `klyrek-http` follows redirects) to identify session
  mechanisms: known session-cookie names, JWTs (validated by decoding the header segment, not
  just counting dots), and OAuth redirects to known providers.
- **`gating`** — probes a list of URLs and tags each as auth-gated (`Endpoint.requires_auth`)
  based on a `401`/`403` response or a redirect that lands on a login-shaped path.

```python
from klyrek_auth.forms import find_auth_forms
from klyrek_auth.gating import probe_auth_gating
from klyrek_auth.session import detect_session_mechanisms

auth_forms = find_auth_forms(crawl_result.endpoints)
mechanisms = detect_session_mechanisms(client.get("https://target.com/"))
gated = probe_auth_gating(client, ["https://target.com/account", "https://target.com/about"])
```
