feat(bfabric): OAuth webapp launch-token primitives#527
Draft
leoschwarz wants to merge 3 commits into
Draft
Conversation
Core, additive + opt-in primitives that are the foundation for migrating B-Fabric webapps to OAuth (the bfabric_asgi_auth adapter and the rest_proxy service-account migration both build on these). Harvested from the closed PR #513 (Appendix A1-A5 of the asgi-auth OAuth design doc). - OAuthCredentialProvider gains an optional on_token_update callback, fired after each token refresh; deliberately dropped on pickle (not picklable). - verify_jwt gains opt-in audience/issuer validation; defaults preserve the previous behavior (aud/iss not validated). - Bfabric.connect_oauth_token: build a client from an already-exchanged token via the refresh-token grant, with an on_token_refresh passthrough. - bfabric.experimental.webapp_oauth.exchange_launch_token: RFC 8693 launch-JWT exchange + local verify/decode to UrlTokenContext (aud/iss TODOs left as the real-server merge gate for the later webapp-wiring PR). - bfabric.experimental.webapp_oauth_settings: OAuthClientCredentials and WebappOAuthSettings config models.
Contributor
📝 "TODO" Changes DetectedSummary: ➕ 2 "TODO"s added ➕ Added "TODO"s (2)
This comment is automatically updated when "TODO" changes are detected. |
leoschwarz
marked this pull request as draft
June 25, 2026 15:03
Member
Author
|
Held as draft — do not merge yet. On review, these primitives are premature and partly duplicative:
Plan: build these with Effort 1 (the |
Prompted by an agent (me) duplicating WebappClient's launch-token exchange because nothing pointed at the existing auth surface and a migration *sketch* was mistaken for current state. - AGENTS.md: add an 'Authentication & OAuth' map naming the existing entry points, with WebappClient.create called out as the webapp launch-token entry point to reuse rather than reimplement; link the design doc and flag the asgi-auth migration doc as a plan, not current state. - AGENTS.md: add a 'doc types & source of truth' note (design content lives in the human docs; plan/migration docs are not current behavior) and a metacognition rule to fix docs that misled you (near-duplicate capability, or a documented method that no longer exists). - oauth_integration.md: fix drift (parse_url_token -> verify_jwt; remove the non-existent Bfabric.from_url_token row) and add a 'defer to code for exact signatures' note.
…ient) WebappClient.create and exchange_launch_token both implemented the RFC 8693 launch-JWT exchange + verify_jwt decode. Move that composition into one place (bfabric._oauth.launch_token.exchange_launch_token) and have both consume it: - New _oauth/launch_token.py holds the canonical exchange_launch_token. - experimental/webapp_oauth.py re-exports it (public path unchanged), so _oauth no longer depends on experimental. - WebappClient.create now calls exchange_launch_token + Bfabric.connect_oauth_token instead of re-implementing the exchange and the user-client provider inline. No behavior change; resolves the duplication flagged in review of #527.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Core, opt-in OAuth 2.0 primitives for the webapp launch-token flow, the
WebappClientdedupe onto them, and auth-doc signposting. Foundation for migrating B-Fabric webapps to OAuth; thebfabric_asgi_authadapter that consumes them is a stacked follow-up.Primitives (additive; defaults preserve current behavior):
Bfabric.connect_oauth_token— client from an already-exchanged token (refresh-token grant), with anon_token_refreshcallback.OAuthCredentialProvider(on_token_update=…)— fires after each refresh; dropped on pickle (honors the picklability contract).verify_jwt(audience=…, issuer=…)— opt-inaud/issvalidation, off by default.bfabric.experimental.webapp_oauth—exchange_launch_token,OAuthClientCredentials,WebappOAuthSettings.Dedupe: the RFC 8693 launch exchange now lives once in
_oauth/launch_token.py;WebappClient.createand the public facade both consume it._oauthno longer depends onexperimental.Docs: AGENTS.md gains an auth entry-point map and a doc-maintenance rule;
oauth_integration.mddrift fixed.Why this stays draft: the OAuth exchange and
aud/issvalidation are not yet verified against a live B-Fabric server —aud/issship off by default with TODOs, to be confirmed on a test server before any consumer enables the OAuth path.Testing:
pytest tests/bfabric(587) andbasedpyright(bfabric)green; no baseline edits.🤖 Prepared with assistance from Claude Code.