enlace_auth.config

Auth-side configuration models.

These were originally in enlace.base. They have moved here because they describe the auth subsystem’s behavior, not the platform’s composition. enlace itself no longer imports anything from here; enlace_auth.plugin reads them off PlatformConfig via getattr(config, "auth", None) and the loose stores mapping.

The TOML loader in enlace.base.PlatformConfig.from_toml accepts [auth.*] and [stores.*] tables and forwards them through the model; we just deserialize them into typed objects here when the plugin runs.

class enlace_auth.config.AuthConfig(*, enabled: bool = False, session_cookie_name: str = 'enlace_session', session_max_age_seconds: int = 86400, signing_key_env: str = 'ENLACE_SIGNING_KEY', secure_cookies: bool = True, stores: StoreBackendConfig = <factory>, oauth: dict[str, ~enlace_auth.config.OAuthProviderConfig]=<factory>, oauth_server: OAuthServerConfig = <factory>, admin_emails_env: str = 'ENLACE_ADMIN_EMAILS', registration_open: bool = False, registration_allowlist_env: str = 'ENLACE_REGISTRATION_ALLOWLIST')

Platform-wide authentication configuration.

model_config = {}

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class enlace_auth.config.OAuthProviderConfig(*, client_id_env: str, client_secret_env: str, scopes: list[str] = <factory>, authorize_url: str | None = None, token_url: str | None = None, userinfo_url: str | None = None, server_metadata_url: str | None = None)

Configuration for a single OAuth2/OIDC provider.

model_config = {}

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class enlace_auth.config.OAuthServerConfig(*, enabled: bool = False, issuer: str | None = None, key_dir: str = '~/.enlace/oauth_keys', access_token_ttl_seconds: int = 3600, code_ttl_seconds: int = 120, scopes_supported: list[str] = <factory>, require_consent: bool = True, resource_allowlist: dict[str, list[str]]=<factory>, resource_display_names: dict[str, str]=<factory>)

OAuth 2.1 authorization-server settings (for MCP connectors).

When enabled, enlace_auth issues signed JWT access tokens that a Claude.ai custom connector validates — reusing the platform user store and session login. See enlace_auth.auth.oauth_server.

model_config = {}

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class enlace_auth.config.StoreBackendConfig(*, backend: str = 'file', path: str = '~/.enlace/platform_store')

Backend configuration for a MutableMapping-backed store.

model_config = {}

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

enlace_auth.config.coerce_auth_config(raw: Any) → AuthConfig

Accept dict / AuthConfig / None and return an AuthConfig.

Used by the plugin so it can read whatever PlatformConfig happens to hold without forcing enlace to know about AuthConfig itself.

enlace_auth.config.coerce_stores_map(raw: Any) → dict[str, StoreBackendConfig]

Accept the loose config.stores dict and yield typed configs.