Package: pecanhq
PecanHQTo get started, make sure you have signed up athttps://www.pecanhq.com/, released an artifact, and created an application user with access to theapprole.Follow the steps below to embed the client library into your application.Step 1: Install the pip package.python3-mpipinstallpecanhqThePecanHQ pippackage can be used to embedPecaninto your python application.Step 2: Set up the client# Create the authorization serviceimportpecanhq,requestspecan=pecanhq.create(requests.session(),"<app-key>","<app-secret>","<artifact>",<version>)Create a single instance of the service on application startup. The service requires application credentials and a released schema, and will try load that schema from thePecanAPI.Step 2: Load a user profile# Look up a security principal by an identity claimassertion=pecan.find("<claim>","<value>",tenant=None)ifassertionisNone:# In this case, user profiles are being lazily createdprofile=pecan.resource.as_assign_identity_uri().post("<claim>","<value>",["<scope>"])# Construct a claims principal from the newly-created profileprincipal={f"{x['issuer']}{x.['key']}":x['value']forxinprofile['assertions']}else:# Load all claims associated with the account.result=pecan.load(assertion['account_id'])ifresult:# Construct a claims principal from the resultprincipal=result['claims'];else:principal={}After authentication, the client library locates user profiles using unique asserted claims. Once located, the full profile can be be loaded using the identifier. The data in that profile can then be added to the security principal.Step 3: Use an authorization session# Create an authorization sessionsession=pecanhq.Session(pecan,principal)# Assert access to a specific resourceifsession.has_permissions("<service>","<resource>","<permissions>"):# Do guarded actionpass# Assume system-level access for the usersession=session.escalate_privileges();# Fetch a typed assertion for attribute-based access controlvalue=session.as_decimal("<claim>")Before each request, a new authentication session is created for the current principal. This session can be used to ensure access to a specific resource, escalate permissions, or extract data to use in attribute-based access control.Advanced UsageA key design goal ofPecanwas to minimise communication with the API during normal operation. To achieve that, services and profiles can be locally cached, and enough data exists in each profile to make all authorization decisions locally.Caching the service# All schema details can be exported to JSON and cached.cached=pecan.dump()# Cached state can be used to reconstruct the service locally.pecan=pecanhq.create(schema,"<app-key>","<app-secret>","<artifact>",<version>,cached=cached)The client library loads the schema from the API, and uses it to make authorization decisions. To improve startup times, the service can be dumped to JSON and reloaded from this local copy on startup.Caching profiles# The claim profiles can be exported to JSON and cached.data=pecan.as_json(result)# Cached claims can be used to reconstruct profiles locallyresult=pecan.from_json(data)You don't control third party services. If they go down, or are too slow, they can affect your SLAs. So limit your exposure to that risk, and speed up your code, by caching user profiles locally.