tino.auth

OIDC authentication and role-based access control.

async tino.auth.callback(request: Request)

Handle the OIDC callback, exchange code for tokens, and create a session.

tino.auth.check_access(user: User, access: list[AccessEntry], min_role: str, slug: str | None = None) → None

Raise 403 if the user lacks the minimum required role on a bucket.

tino.auth.get_api_key_service() → ApiKeyService

Return the global ApiKeyService instance.

tino.auth.get_current_user(request: Request) → User

Extract the authenticated user from the session or an API key Bearer token.

tino.auth.is_global_admin(user: User) → bool

Check if the user belongs to any of the configured admin groups.

async tino.auth.login(request: Request)

Redirect the user to the OIDC provider for authentication.

async tino.auth.login_page()

Serve the login page.

async tino.auth.logout(request: Request)

Clear the session and redirect to the OIDC provider’s logout endpoint.

async tino.auth.me(user: User = Depends(dependency=<function get_current_user>, use_cache=True, scope=None))

Return the currently authenticated user’s info including admin status.

tino.auth.resolve_role(user: User, access: list[AccessEntry], slug: str | None = None) → str | None

Return the highest role the user holds in a bucket, or None if no access.

For API key users the role is looked up directly from user.api_key_access using slug; the bucket ACL is ignored.

async tino.auth.setup_oauth()

Register the OIDC provider with authlib and pre-fetch discovery metadata.