Backends

Backends in Tasteful are pluggable components that handle specific concerns like authentication, data storage, caching, and external service integrations. They provide a standardized interface that flavors can use without being tightly coupled to specific implementations.

Authentication Backends

Authentication backends handle user verification and session management. Tasteful provides a flexible authentication system based on OpenID Connect (OIDC) with support for both synchronous and asynchronous authentication patterns.

OIDC Backend

OpenID Connect integration with OAuth providers and custom OIDC servers

Async Authentication

High-performance async authentication for modern applications

Custom User Models

Extensible user models with BaseUser foundation

Token Introspection

Automatic token validation with OIDC introspection endpoints

OIDC Authentication Backend

The OIDCAuthenticationBackend provides comprehensive OpenID Connect authentication with automatic token validation and user creation:

from tasteful.authn.oidc import OIDCAuthenticationBackend

# Basic OIDC configuration
oidc_backend = OIDCAuthenticationBackend(
    name="my_oidc_app",
    metadata_url="https://your-provider.com/.well-known/openid_configuration",
    client_id="your-client-id",
    client_secret="your-client-secret",
    scopes="openid profile email"
)

Key Features:

Automatic Discovery: Uses OIDC metadata URLs for automatic endpoint discovery
Token Introspection: Validates tokens using the provider’s introspection endpoint
Async Support: Built on AsyncAuthenticationBackend for high performance
Custom Scopes: Configurable OAuth scopes for fine-grained permissions
User Creation: Automatic user object creation from token claims

Configuration Parameters:

name: Unique identifier for the OIDC client
metadata_url: OIDC discovery endpoint URL
client_id: OAuth client identifier
client_secret: OAuth client secret
scopes: Space-separated OAuth scopes
introspection_endpoint: Optional custom introspection endpoint

Base Authentication Classes

Tasteful provides base classes for building custom authentication backends:

AsyncAuthenticationBackend

For high-performance async authentication:

from tasteful.authn.base import AsyncAuthenticationBackend, BaseUser
from fastapi import Request

class CustomAsyncBackend(AsyncAuthenticationBackend):
    async def authenticate(self, request: Request) -> BaseUser | None:
        # Custom async authentication logic
        token = request.headers.get("Authorization")
        if token and await self.validate_token(token):
            return BaseUser(name="authenticated_user")
        return None

AuthenticationBackend

For synchronous authentication scenarios:

from tasteful.authn.base import AuthenticationBackend, BaseUser
from fastapi import Request

class CustomSyncBackend(AuthenticationBackend):
    def authenticate(self, request: Request) -> BaseUser | None:
        # Custom sync authentication logic
        api_key = request.headers.get("X-API-Key")
        if api_key and self.validate_api_key(api_key):
            return BaseUser(name="api_user")
        return None

User Models

BaseUser

The foundation for all user models in Tasteful:

from tasteful.authn.base import BaseUser

class BaseUser(BaseModel):
    name: str

OIDCUser

Extended user model for OIDC authentication with token claims:

from tasteful.authn.oidc import OIDCUser

class OIDCUser(BaseUser):
    user_info: dict  # Contains all OIDC token claims

Custom User Models

Create custom user models by extending BaseUser:

from tasteful.authn.base import BaseUser
from typing import Optional

class CustomUser(BaseUser):
    email: str
    roles: list[str] = []
    department: Optional[str] = None
    is_active: bool = True

Storage Backends

Storage backends implementation and documentation coming soon.

Message Backends

Message backends implementation and documentation coming soon.

Custom Backends

Custom backend documentation coming soon.

Backend Configuration

Authentication backends are configured when creating your Tasteful application. The backends are passed as FastAPI dependencies to secure your entire application:

from tasteful import TastefulApp
from tasteful.authn.oidc import OIDCAuthenticationBackend

# Configure OIDC backend
oidc_backend = OIDCAuthenticationBackend(
    name="company_sso",
    metadata_url="https://auth.company.com/.well-known/openid_configuration",
    client_id="tasteful-app-client",
    client_secret="your-client-secret",
    scopes="openid profile email groups"
)

# Create application with authentication
app = TastefulApp(
    title="My Secure Application",
    version="1.0.0",
    authentication_backends=[oidc_backend],
    flavors=[YourFlavor]
)

Multiple Authentication Backends

You can configure multiple authentication backends for different use cases:

from tasteful.authn.oidc import OIDCAuthenticationBackend
from tasteful.authn.base import AuthenticationBackend

# OIDC for user authentication
user_auth = OIDCAuthenticationBackend(
    name="user_sso",
    metadata_url="https://auth.company.com/.well-known/openid_configuration",
    client_id="user-client",
    client_secret="user-secret",
    scopes="openid profile email"
)

# Custom backend for API keys
class APIKeyBackend(AuthenticationBackend):
    def authenticate(self, request):
        # API key validation logic
        pass

api_auth = APIKeyBackend()

# Use both backends
app = TastefulApp(
    title="Multi-Auth Application",
    authentication_backends=[user_auth, api_auth],
    flavors=[YourFlavor]
)

Environment-Based Configuration

Use environment variables for secure configuration:

import os
from tasteful.authn.oidc import OIDCAuthenticationBackend

oidc_backend = OIDCAuthenticationBackend(
    name=os.getenv("OIDC_CLIENT_NAME", "default_app"),
    metadata_url=os.getenv("OIDC_METADATA_URL"),
    client_id=os.getenv("OIDC_CLIENT_ID"),
    client_secret=os.getenv("OIDC_CLIENT_SECRET"),
    scopes=os.getenv("OIDC_SCOPES", "openid profile email")
)

Authentication Middleware

Authentication backends in Tasteful work as FastAPI dependencies, automatically handling:

Token Extraction: Automatically extracts tokens from Authorization headers
Token Validation: Validates tokens using OIDC introspection or custom logic
User Creation: Creates user objects from validated tokens
Request State: Adds authenticated user to request.state.user
Error Handling: Returns appropriate HTTP status codes for authentication failures

Middleware Flow

Request Received: Incoming request with Authorization header
Token Extraction: Backend extracts Bearer token from header
Token Validation: Backend validates token (OIDC introspection, etc.)
User Creation: Backend creates user object from token claims
State Injection: User object added to request.state.user
Route Execution: Your flavor controller receives authenticated request

Error Responses

Authentication backends automatically handle error responses:

401 Unauthorized: Missing or invalid token
500 Internal Server Error: Authentication backend errors

# Automatic error handling - no additional code needed
{
    "detail": "Unauthorized"  # 401 response for invalid tokens
}

Core Concepts

Flavors Concepts

Backends

Backends

Authentication Backends

OIDC Backend

Async Authentication

Custom User Models

Token Introspection

OIDC Authentication Backend

Base Authentication Classes

AsyncAuthenticationBackend

AuthenticationBackend

User Models

BaseUser

OIDCUser

Custom User Models

Storage Backends

Message Backends

Custom Backends

Backend Configuration

Multiple Authentication Backends

Environment-Based Configuration

Authentication Middleware

Middleware Flow

Error Responses

​Backends

​Authentication Backends

OIDC Backend

Async Authentication

Custom User Models

Token Introspection

​OIDC Authentication Backend

​Base Authentication Classes

​AsyncAuthenticationBackend

​AuthenticationBackend

​User Models

​BaseUser

​OIDCUser

​Custom User Models

​Storage Backends

​Message Backends

​Custom Backends

​Backend Configuration

​Multiple Authentication Backends

​Environment-Based Configuration

​Authentication Middleware

​Middleware Flow

​Error Responses

Backends

Authentication Backends

OIDC Authentication Backend

Base Authentication Classes

AsyncAuthenticationBackend

AuthenticationBackend

User Models

BaseUser

OIDCUser

Custom User Models

Storage Backends

Message Backends

Custom Backends

Backend Configuration

Multiple Authentication Backends

Environment-Based Configuration

Authentication Middleware

Middleware Flow

Error Responses