plugin: Add Auth Engine (evoid-auth)

[Pakrohk]

Description

Optional plugin for Authentication & Authorization. Handles token validation, user sessions, and role-based access control at the pipeline level.

Motivation

Every production API needs auth, but each project has different requirements (JWT, OAuth2, API keys). This plugin provides pluggable auth providers.

Proposed API

Register auth engine

from evoid.auth import AuthEngine, JWTConfig

auth = AuthEngine(
    config=JWTConfig(
        secret="your-secret-key",
        algorithm="HS256",
        expiry=3600,
    )
)

register_processor("authenticate", auth.authenticate)
register_processor("authorize", auth.authorize)

Protected intents

GET_USER = Intent(
    name="GET:/users/{id}",
    level=Level.STANDARD,
    metadata={
        "processors": ("authenticate", "authorize"),
        "roles": ["admin", "user"],
    },
)

Custom auth providers

from evoid.auth import AuthProvider

class APIKeyProvider(AuthProvider):
    async def authenticate(self, ctx: Context) -> dict:
        api_key = ctx.metadata["headers"].get("x-api-key")
        if not api_key:
            raise AuthError("Missing API key")
        user = await validate_api_key(api_key)
        return {"user": user, "roles": user.roles}

Scope

• AuthEngine with authenticate/authorize processors
• JWT provider (sign, verify, refresh)
• API Key provider
• OAuth2 provider (authorization code flow)
• Role-based access control
• Custom auth provider interface

Priority

P1 — Essential for production APIs

Package

pip install evoid-auth