Metadata-Version: 2.4
Name: tba-app-backend-public
Version: 0.4.0.dev2
Summary: Public OAuth/OIDC and human-login backend application for TBA.
License-Expression: Apache-2.0
Requires-Python: >=3.10,<3.15
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Requires-Dist: tba-app-backend-core (==0.4.0.dev2)
Requires-Dist: tba-auth (==0.4.0.dev2)
Requires-Dist: tba-router-oauth-authorization (==0.4.0.dev2)
Requires-Dist: tba-router-oauth-authorization-server-metadata (==0.4.0.dev2)
Requires-Dist: tba-router-oauth-device-authorization (==0.4.0.dev2)
Requires-Dist: tba-router-oauth-introspection (==0.4.0.dev2)
Requires-Dist: tba-router-oauth-protected-resource-metadata (==0.4.0.dev2)
Requires-Dist: tba-router-oauth-pushed-authorization-request (==0.4.0.dev2)
Requires-Dist: tba-router-oauth-registration (==0.4.0.dev2)
Requires-Dist: tba-router-oauth-revocation (==0.4.0.dev2)
Requires-Dist: tba-router-oauth-token (==0.4.0.dev2)
Requires-Dist: tba-router-oauth-token-exchange (==0.4.0.dev2)
Requires-Dist: tba-router-oidc-discovery (==0.4.0.dev2)
Requires-Dist: tba-router-oidc-logout (==0.4.0.dev2)
Requires-Dist: tba-router-oidc-userinfo (==0.4.0.dev2)
Requires-Dist: tba-router-session-login (==0.4.0.dev2)
Requires-Dist: tba-router-webauthn (==0.4.0.dev2)
Project-URL: Homepage, https://github.com/tigrbl/tigrbl_auth
Project-URL: Repository, https://github.com/tigrbl/tigrbl_auth
Project-URL: Source, https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/90-backend-apps/tba-app-backend-public
Description-Content-Type: text/markdown

# tba-app-backend-public

Public OAuth/OIDC and white-label login API front door.

## Surface

| Property | Value |
| --- | --- |
| Product surface | `public-app` |
| Intended UIX | `@tba/ui-public` |
| Exposes | Login, authorize, token, logout, registration, discovery, JWKS, and public OAuth/OIDC helpers |
| Excludes | `/admin/*`, `/rpc`, diagnostics, tenant lifecycle administration |

## Entrypoint

```python
from tba_app_backend_public import app, build_app
```

## Docker dev deployment

From the repository root:

```bash
docker compose -f docker/docker-compose.public-app.yml up -d --build
```

The dev deployment publishes the public API on `http://localhost:8013`.
It runs the `production` profile with TLS disabled for local development so
registration, login, authorization, token, discovery, and JWKS routes are
available on the same localhost issuer.

Useful checks:

```bash
curl http://localhost:8013/.well-known/openid-configuration
curl http://localhost:8013/.well-known/jwks.json
curl -i http://localhost:8013/tenant
curl -i http://localhost:8013/diagnostics
```

