Metadata-Version: 2.4
Name: authweave-http-signatures
Version: 7.3.3
Summary: Payment HTTP Message Signatures profile for AuthWeave
Project-URL: homepage, https://github.com/ZYLVEXT/litestar-auth
Project-URL: documentation, https://zylvext.github.io/litestar-auth/
Project-URL: source, https://github.com/ZYLVEXT/litestar-auth
Project-URL: tracker, https://github.com/ZYLVEXT/litestar-auth/issues
Author-email: Vladislav Shepilov <shepilov.v@protonmail.com>
Maintainer-email: Vladislav Shepilov <shepilov.v@protonmail.com>
License-Expression: MIT
License-File: LICENSE
Keywords: content-digest,http-message-signatures,payments,rfc9421,security
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Libraries
Requires-Python: <3.15.0,>=3.12.0
Requires-Dist: authweave-core==7.3.3
Requires-Dist: cryptography<51.0,>=50.0.0
Requires-Dist: http-message-signatures<3.0,>=2.0.1
Requires-Dist: typing-extensions<5.0,>=4.16.0
Provides-Extra: litestar
Requires-Dist: litestar<3.0,>=2.24.0; extra == 'litestar'
Provides-Extra: redis
Requires-Dist: redis<9.0,>=8.1.0; extra == 'redis'
Description-Content-Type: text/markdown

# authweave-http-signatures

Payment HTTP Message Signatures profile (`authweave-payment-http-sig-v1`)
for AuthWeave. Verifies RFC 9530 `Content-Digest` and RFC 9421 signatures after
machine authentication (mTLS or DPoP), then binds `keyid` to the authenticated
principal and consumes a signature nonce.

This package does **not** authenticate callers and does **not** implement business
idempotency. Structured Fields parsing uses the maintained
`http-message-signatures` library (RFC 8941 / RFC 9421).

`PaymentHttpSignatureVerifier(..., observer=...)` emits logical integrity and
nonce-replay observations through the neutral `authweave-core` observer seam.
`verify(..., links=(TraceCorrelation(...),))` supports async/retry causality;
linked trace context never participates in authentication or key binding.

Frozen/custom verifier clocks are request-local; the package does not mutate the
process-global clock of the Structured Fields/signature implementation.

`sign_payment_message` is a local reference/test helper and accepts an in-process
`Ed25519PrivateKey`. Production producers keep non-exportable keys in their own KMS/HSM
signer and emit the same documented RFC 9421 profile outside this verifier package.

```bash
uv add authweave-http-signatures
```

See ADR 0004 and `docs/roadmap.md`. Optional extras: `[redis]`, `[litestar]`.
