pal-e-auth

Shared JWT + Google OAuth auth middleware for pal-e platform services.

Install

pip install pal-e-auth-ldraney

Quick Start

from fastapi import FastAPI, Depends
from pal_e_auth import AuthConfig, auth_router, get_current_user, require_role, User

app = FastAPI()

config = AuthConfig(
    secret_key="your-jwt-secret",
    google_client_id="your-google-client-id",
    google_client_secret="your-google-client-secret",
)
app.state.auth_config = config
app.include_router(auth_router(config))

@app.get("/protected")
async def protected(user: User = Depends(get_current_user)):
    return {"email": user.email}

@app.get("/admin-only")
async def admin_only(user: User = Depends(require_role("admin"))):
    return {"email": user.email}

Auth Flow

1. User visits /auth/google → redirected to Google consent screen
2. Google redirects back to /auth/callback with auth code
3. Server exchanges code for ID token, extracts user info
4. JWT created and set as access_token cookie
5. Subsequent requests authenticated via cookie or Authorization: Bearer header

Dependencies

FastAPI apps provide auth by reading app.state.auth_config:

• get_current_user — requires valid JWT, returns User
• optional_user — returns User | None
• require_role("admin", "coach") — requires valid JWT + matching role

Roles

admin, coach, parent, viewer (default)

Development

poetry install
poetry run pytest
poetry run ruff check .
poetry run ruff format --check .