enlace_auth

enlace_auth — authentication, sessions, admin dashboard, and per-user stores.

Plug into enlace at compose time:

from enlace import build_backend, PlatformConfig
from enlace_auth import plugin as auth_plugin

config = PlatformConfig.from_toml()
app = build_backend(config, plugins=[auth_plugin])

When config.auth.enabled is True the plugin mounts:

• /auth/* — login, logout, register, whoami, csrf, me/password

• /_admin/api/* — admin user/app management (gated by admin allowlist)

• /api/{app}/store/* — per-user data store

• middleware: PlatformAuthMiddleware, CSRFMiddleware, StoreInjectionMiddleware

When it’s False the plugin is a no-op, so installing this package never changes platform behavior unless the operator opts in.

class enlace_auth.AuthConfig(*, enabled: bool = False, session_cookie_name: str = 'enlace_session', session_max_age_seconds: int = 86400, signing_key_env: str = 'ENLACE_SIGNING_KEY', secure_cookies: bool = True, stores: StoreBackendConfig = <factory>, oauth: dict[str, ~enlace_auth.config.OAuthProviderConfig]=<factory>, oauth_server: OAuthServerConfig = <factory>, admin_emails_env: str = 'ENLACE_ADMIN_EMAILS', registration_open: bool = False, registration_allowlist_env: str = 'ENLACE_REGISTRATION_ALLOWLIST')

Platform-wide authentication configuration.

model_config = {}

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

exception enlace_auth.EnlaceAuthConfigError

Raised when auth configuration is unusable at startup.

class enlace_auth.OAuthProviderConfig(*, client_id_env: str, client_secret_env: str, scopes: list[str] = <factory>, authorize_url: str | None = None, token_url: str | None = None, userinfo_url: str | None = None, server_metadata_url: str | None = None)

Configuration for a single OAuth2/OIDC provider.

model_config = {}

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class enlace_auth.StoreBackendConfig(*, backend: str = 'file', path: str = '~/.enlace/platform_store')

Backend configuration for a MutableMapping-backed store.

model_config = {}

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

enlace_auth.plugin(parent: FastAPI, config) → None

Mount /auth/, /_admin/, store routes, and middleware on parent.

Plugin entry point. Safe to call when auth is disabled — does nothing.

enlace_auth.wire(parent: FastAPI, config) → None

Mount /auth/, /_admin/, store routes, and middleware on parent.

Plugin entry point. Safe to call when auth is disabled — does nothing.