woggioni
e73c4b2c18
CI / Build Pip package (push) Successful in 8m49s
OIDCClient.validate_id_token compared the iss claim against OIDCConfig.issuer (the discovery URL) instead of the issuer advertised by the provider metadata. This broke Microsoft Entra ID, whose v2 metadata advertises the templated issuer https://login.microsoftonline.com/{tenantid}/v2.0 while tokens carry the concrete tenant GUID, and it also affected tenant-domain issuers. - Validate iss against the discovered metadata issuer and substitute {tenantid} with the token's tid claim. - Catch jwt.PyJWTError in the OIDC callback so invalid tokens return 400 instead of 500 (InvalidIssuerError is not a ValueError). - Re-enable aud/exp/iat/nbf checks for unsigned (alg: none) ID tokens. - Validate ID tokens returned by the refresh grant before storing them, including nonce continuity when present and sub continuity with the session user. - Document Entra ID support and update tests.
kaya
A lightweight ASGI web framework with method-aware routing, path matching, and recursive wildcard support.
Packages
This repository is a monorepo for the Kaya framework. The code is split into independent packages under packages/:
- kaya-core — core routing, HTTP/WS abstractions, and ASGI adapter (
packages/kaya-core/) - kaya-rsgi — RSGI/Granian integration (
packages/kaya-rsgi/) - kaya-session — server-side HTTP session management (
packages/kaya-session/) - kaya-session-redis — Redis-backed session storage (
packages/kaya-session-redis/) - kaya-session-memcache — memcached-backed session storage (
packages/kaya-session-memcache/) - kaya-oidc — OpenID Connect authentication (
packages/kaya-oidc/) - kaya-openapi — automatic OpenAPI specification generation (
packages/kaya-openapi/) - kaya-cors — CORS (Cross-Origin Resource Sharing) support (
packages/kaya-cors/) - kaya-forwarded — trusted-proxy
Forwarded/X-Forwarded-*client address resolution (packages/kaya-forwarded/) - kaya-otel — OpenTelemetry tracing and metrics (
packages/kaya-otel/)
Additional kaya-* packages can be added as new directories under packages/.
Build & run locally
Install dev dependencies:
pip install --index-url https://gitea.woggioni.net/api/packages/woggioni/pypi/simple --extra-index-url https://pypi.org/simple -r requirements-dev.txt
Install the packages in development mode:
pip install -e packages/kaya-core -e packages/kaya-rsgi -e packages/kaya-session -e packages/kaya-session-redis -e packages/kaya-session-memcache -e packages/kaya-oidc -e packages/kaya-openapi -e packages/kaya-cors -e packages/kaya-forwarded -e packages/kaya-otel
Run the example:
python example/hello.py
Tests
python -m unittest discover -s packages/kaya-core/tests
python -m unittest discover -s packages/kaya-rsgi/tests
python -m unittest discover -s packages/kaya-session/tests
python -m unittest discover -s packages/kaya-session-redis/tests
python -m unittest discover -s packages/kaya-session-memcache/tests
python -m unittest discover -s packages/kaya-oidc/tests
python -m unittest discover -s packages/kaya-openapi/tests
python -m unittest discover -s packages/kaya-cors/tests
python -m unittest discover -s packages/kaya-forwarded/tests
python -m unittest discover -s packages/kaya-otel/tests
Static analysis
mypy -p kaya.core
mypy -p kaya.rsgi
mypy -p kaya.session
mypy -p kaya.session.redis
mypy -p kaya.session.memcache
mypy -p kaya.oidc
mypy -p kaya.openapi
mypy -p kaya.cors
mypy -p kaya.forwarded
mypy -p kaya.otel
Building packages
python -m build packages/kaya-core
python -m build packages/kaya-rsgi
python -m build packages/kaya-session
python -m build packages/kaya-session-redis
python -m build packages/kaya-session-memcache
python -m build packages/kaya-oidc
python -m build packages/kaya-openapi
python -m build packages/kaya-cors
python -m build packages/kaya-forwarded
python -m build packages/kaya-otel