enlace_auth.config

Auth-side configuration models.

These were originally in enlace.base. They have moved here because they describe the auth subsystem’s behavior, not the platform’s composition. enlace itself no longer imports anything from here; enlace_auth.plugin reads them off PlatformConfig via getattr(config, "auth", None) and the loose stores mapping.

The TOML loader in enlace.base.PlatformConfig.from_toml accepts [auth.*] and [stores.*] tables and forwards them through the model; we just deserialize them into typed objects here when the plugin runs.

Functions

coerce_auth_config(raw)	Accept dict / AuthConfig / None and return an AuthConfig.
coerce_stores_map(raw)	Accept the loose config.stores dict and yield typed configs.

Classes

AuthConfig(*[, enabled, ...])	Platform-wide authentication configuration.
OAuthProviderConfig(*, client_id_env, ...[, ...])	Configuration for a single OAuth2/OIDC provider.
OAuthServerConfig(*[, enabled, issuer, ...])	OAuth 2.1 authorization-server settings (for MCP connectors).
StoreBackendConfig(*[, backend, path])	Backend configuration for a MutableMapping-backed store.

class enlace_auth.config.AuthConfig(*, enabled=False, session_cookie_name='enlace_session', session_max_age_seconds=86400, signing_key_env='ENLACE_SIGNING_KEY', secure_cookies=True, stores=<factory>, oauth=<factory>, oauth_server=<factory>, admin_emails=<factory>, admin_emails_env='ENLACE_ADMIN_EMAILS', registration_open=False, registration_allowlist_env='ENLACE_REGISTRATION_ALLOWLIST')

Bases: _StrictModel

Platform-wide authentication configuration.

model_config: ClassVar[ConfigDict] = {'extra': 'forbid'}

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class enlace_auth.config.OAuthProviderConfig(*, client_id_env, client_secret_env, scopes=<factory>, authorize_url=None, token_url=None, userinfo_url=None, server_metadata_url=None, trust_unverified_email=False)

Bases: _StrictModel

Configuration for a single OAuth2/OIDC provider.

model_config: ClassVar[ConfigDict] = {'extra': 'forbid'}

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class enlace_auth.config.OAuthServerConfig(*, enabled=False, issuer=None, key_dir='~/.enlace/oauth_keys', access_token_ttl_seconds=3600, refresh_token_ttl_seconds=2592000, refresh_reuse_grace_seconds=60, refresh_reuse_detection_seconds=86400, refresh_family_max_lifetime_seconds=7776000, client_ttl_seconds=15552000, code_ttl_seconds=120, consent_ttl_seconds=600, scopes_supported=<factory>, require_consent=True, resource_allowlist=<factory>, allow_unlisted_resources=False, resource_display_names=<factory>)

Bases: _StrictModel

OAuth 2.1 authorization-server settings (for MCP connectors).

When enabled, enlace_auth issues signed JWT access tokens that a Claude.ai custom connector validates — reusing the platform user store and session login. See enlace_auth.auth.oauth_server.

model_config: ClassVar[ConfigDict] = {'extra': 'forbid'}

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class enlace_auth.config.StoreBackendConfig(*, backend='file', path='~/.enlace/platform_store')

Bases: _StrictModel

Backend configuration for a MutableMapping-backed store.

model_config: ClassVar[ConfigDict] = {'extra': 'forbid'}

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

enlace_auth.config.coerce_auth_config(raw)

Accept dict / AuthConfig / None and return an AuthConfig.

Used by the plugin so it can read whatever PlatformConfig happens to hold without forcing enlace to know about AuthConfig itself.

Return type:

AuthConfig

enlace_auth.config.coerce_stores_map(raw)

Accept the loose config.stores dict and yield typed configs.

Return type:

dict[str, StoreBackendConfig]