Metadata-Version: 2.4
Name: tba-app-backend-resource-validation
Version: 0.4.0.dev2
Summary: JWKS, introspection, and protected-resource validation backend application for TBA.
License-Expression: Apache-2.0
Requires-Python: >=3.10,<3.15
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Requires-Dist: tba-app-backend-core (==0.4.0.dev2)
Requires-Dist: tba-auth (==0.4.0.dev2)
Requires-Dist: tba-router-oauth-introspection (==0.4.0.dev2)
Requires-Dist: tba-router-oauth-protected-resource-metadata (==0.4.0.dev2)
Requires-Dist: tba-router-oidc-discovery (==0.4.0.dev2)
Requires-Dist: tba-router-resource-validation-metadata (==0.4.0.dev2)
Project-URL: Homepage, https://github.com/tigrbl/tigrbl_auth
Project-URL: Repository, https://github.com/tigrbl/tigrbl_auth
Project-URL: Source, https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/90-backend-apps/tba-app-backend-resource-validation
Description-Content-Type: text/markdown

# tba-app-backend-resource-validation

Resource-server validation API front door for protected APIs that need issuer metadata.

## Surface

| Property | Value |
| --- | --- |
| Product surface | `resource-validation-app` |
| Intended consumers | Resource servers, API gateways, validation middleware |
| Exposes | JWKS, tenant JWKS, introspection, OIDC discovery, protected-resource metadata |
| Excludes | Public human login/consent pages, dynamic client registration, admin resources, `/rpc` |

## Entrypoint

```python
from tba_app_backend_resource_validation import app, build_app
```

## Local dev deployment

Run the isolated validation front door on port `8014`:

```bash
docker compose -f docker/docker-compose.resource-validation-app.yml up -d --build
```

Useful endpoints:

| Endpoint | Purpose |
| --- | --- |
| `/.well-known/openid-configuration` | Issuer metadata needed by validators. |
| `/.well-known/oauth-protected-resource` | Protected-resource metadata and verifier contract projection. |
| `/.well-known/jwks.json` | Issuer key set for local JWT validation. |
| `/tenants/{tenant_slug}/.well-known/jwks.json` | Tenant-scoped key set. |
| `/introspect` | RFC 7662 token status checks for authorized callers. |

