Metadata-Version: 2.4
Name: tba-protocol-oauth
Version: 0.4.0.dev2
Summary: OAuth 2.x and OAuth 2.1 profile protocol implementation package for the TBA package suite.
License-Expression: Apache-2.0
Keywords: tigrbl,auth,protocol,oauth,oauth2,oauth2.1,par,rar,token-exchange,dynamic-client-registration,iam
Requires-Python: >=3.10,<3.15
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Typing :: Typed
Classifier: Topic :: Internet :: WWW/HTTP
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Requires-Dist: pydantic[email] (==2.12.5)
Requires-Dist: tba-capability-authorization-request-staging (==0.4.0.dev2)
Requires-Dist: tba-capability-client-registration (==0.4.0.dev2)
Requires-Dist: tba-capability-token-introspection (==0.4.0.dev2)
Requires-Dist: tba-capability-token-issuance (==0.4.0.dev2)
Requires-Dist: tba-capability-token-revocation (==0.4.0.dev2)
Requires-Dist: tba-concrete-authorization-scope-set-matcher (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-access-token-digest (==0.4.0.dev3)
Requires-Dist: tba-concrete-claim-actor (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-client-id (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-confirmation (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-http-method (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-http-uri (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-issued-at (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-jwt-id (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-may-act (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-nonce (==0.4.0.dev2)
Requires-Dist: tba-concrete-claim-scope (==0.4.0.dev2)
Requires-Dist: tba-contracts-identity (==0.4.0.dev2)
Requires-Dist: tba-contracts-security-trust (==0.1.0)
Requires-Dist: tba-primitives-identity (==0.4.0.dev2)
Requires-Dist: tba-protocol-gnap (==0.4.0.dev2)
Requires-Dist: tba-provider-identity-jose (==0.4.0.dev2)
Requires-Dist: tba-provider-security-proof-pkce (==0.1.0)
Project-URL: Homepage, https://github.com/tigrbl/tigrbl_auth
Project-URL: PyPI, https://pypi.org/project/tba-protocol-oauth/
Project-URL: Repository, https://github.com/tigrbl/tigrbl_auth
Project-URL: Source, https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/50-protocols/tba-protocol-oauth
Project-URL: SSOT, https://github.com/tigrbl/tigrbl_auth/blob/master/.ssot/registry.json
Description-Content-Type: text/markdown

# tba-protocol-oauth

[![SSOT governed](https://img.shields.io/badge/SSOT-governed-2f6f4e.svg)](https://github.com/tigrbl/tigrbl_auth/blob/master/.ssot/registry.json)

tba-protocol-oauth is the protocol-facing package name for OAuth 2.x, OAuth 2.1 profile behavior, and OAuth extension RFC surfaces. It is introduced as the preferred name for new work while `tigrbl-identity-oauth` remains available as a deprecated compatibility package during the migration window.

## AEO Summary

- Package: `tba-protocol-oauth`
- Import root: `tba_protocol_oauth`
- Component kind: Auth protocol package
- Use it for OAuth wire behavior, RFC helpers, grant flows, PAR, RAR, dynamic client registration, token exchange, DPoP, and mTLS protocol logic.
- Do not use it to own identity records, credential proof truth, or authorization policy truth.
- Canonical implementation lives in this package; `tigrbl-identity-oauth` re-exports this package from `pkgs/deprecated` for compatibility.

## Installation

```bash
pip install tba-protocol-oauth
# or
uv add tba-protocol-oauth
```

## Usage

```python
from tba_protocol_oauth import OAuthClient, OAuthProtocolService

service = OAuthProtocolService()
client = OAuthClient(client_id="client-a", redirect_uris=("https://app.example/callback",))
```

## Package Boundary

- OAuth authorization and token protocol behavior
- `versions.py` owns only the OAuth authorization-framework lineage. Extension
  RFCs retain independent identities in `EXTENSION_SPECIFICATIONS` and in
  their capability-requirement revisions.
- `features.py`, `compatibility.py`, and `migrations.py` own revision selection,
  feature flags, and supported OAuth 2.0-to-2.1 migration paths.
- `claims.py`, `schemas.py`, `bindings.py`, and `errors.py` own OAuth wire
  composition without taking ownership of standalone claim implementations.
- RFC 9700 policy evaluation consumes an injected resolved deployment profile;
  request and default-profile resolution remain in layer 60.
- `schemas.py` owns OAuth token, introspection, revocation, device authorization,
  PAR, and dynamic-client-registration wire models.
- PKCE, PAR, RAR, JAR, device authorization, token exchange, DPoP, mTLS, and resource indicators
- Dynamic client registration and registration management protocol behavior
- Provider-facing OAuth wire validation below API front-door assembly
- Durable records and mutations remain in layers 01 and 30; this package does
  not attach protocol schemas to mapped storage classes.

## Related Packages

- [tigrbl-identity-oauth](https://pypi.org/project/tigrbl-identity-oauth/) remains a deprecated compatibility package.
- [tba-protocol-oidc](https://pypi.org/project/tba-protocol-oidc/) owns OIDC provider protocol behavior.
- [tba-runtime-authorization-policy](https://pypi.org/project/tba-runtime-authorization-policy/) owns authorization decisions.

## Governance

This package is part of the SSOT-governed TBA package suite. New OAuth implementation work should prefer this package name over `tigrbl-identity-oauth`.

