context

module wittgenstein_oidc_backend.context

Per-request token payload, held in a contextvar (the async-safe equivalent of thread-local) so has_role and application code can read the caller's claims without threading them through every function signature — set once by OidcMiddleware per request.

Classes

• OidcMiddleware — ASGI middleware: decodes the bearer token (if present) with the given callable and makes the resulting payload available to get_current_payload()/has_role for the rest of the request.

Functions

• get_current_payload — The decoded token payload for the request currently being handled, or None if no token was presented/decoded.

• set_current_payload

wittgenstein_oidc_backend.context.get_current_payload

get_current_payload() → dict[str, Any] | None

The decoded token payload for the request currently being handled, or None if no token was presented/decoded.

wittgenstein_oidc_backend.context.set_current_payload

set_current_payload(payload: dict[str, Any] | None) → None

wittgenstein_oidc_backend.context.OidcMiddleware

class OidcMiddleware(app: Any, decode: Any)

ASGI middleware: decodes the bearer token (if present) with the given callable and makes the resulting payload available to get_current_payload()/has_role for the rest of the request.

decode is expected to be a zero-arg-besides-token async callable already bound to a mode/issuer/jwks_client — see wittgenstein_oidc_backend.tokens.decode_token partially applied, e.g. via functools.partial. Decode failures are swallowed here (payload stays None) — routes that require auth still get a 401/403 from has_role; routes that don't require it keep working unauthenticated (config-gated integrations must never hard-fail on a missing/bad token if the route itself doesn't demand one).