feat: Python server adapter for FastAPI and Django #379

Activity

1. Bccorb

   added

   enhancementNew feature or requestNew feature or request

   P4Features and enhancementsFeatures and enhancements

   on Oct 8, 2026
2. Bccorb commented on Oct 8, 2026

   

   Bccorb

   on Oct 8, 2026

   ContributorAuthor

   More actions

   The Python adapter is live at https://github.com/fells-code/seamless-auth-python. It ships as one distribution, seamless-auth, installed as seamless-auth[fastapi] or seamless-auth[django], and supports Python 3.11+ and Django 5.2+.

   CI on 1f3fab7 is green: https://github.com/fells-code/seamless-auth-python/actions

   • Unit tests on Python 3.11, 3.12, 3.13 and 3.14 (137 tests against a fake auth API). 3.11 runs Django 5.2 LTS and the others run Django 6.1.
   • Conformance: the FastAPI and Django reference apps in conformance/ each pass the seamless-cli adapter suite, 25 of 25. Locally each also passed three runs in a row.

   Checklist:

   • Framework-agnostic core: synchronous and thread-safe, driven by the manifest (feat(routes): declare adapter behaviour in defineRoute and emit an adapter manifest #372), with cookie and bearer transports and JWT verification against JWKS
   • FastAPI binding: auth_router(adapter) and a RequireUser dependency
   • Django binding: include("seamless_auth.django"), a require_auth decorator for sync and async views, and settings-driven configuration
   • Reference apps passing the conformance suite (feat(verify): extract a language-agnostic adapter conformance suite seamless-cli#246)
   • Published to PyPI: release-please has opened the v0.1.0 release PR, and merging it publishes through PyPI trusted publishing

   The design follows the Rust adapter, including its two hardenings: request bodies must be JSON (415 otherwise), and the guard runs the cross-site check for cookie sessions. A security review before publishing found two medium Python-specific issues, and both are fixed with regression tests:

   1. httpx2 logged full upstream URLs, which can carry magic-link tokens and OAuth codes, at INFO. The adapter now redacts the path and query for its own calls.
   2. An async deliver callback could deadlock under Django on ASGI. It now runs through asgiref.
3. Bccorb commented on Oct 8, 2026

   

   Bccorb

   on Oct 8, 2026

   ContributorAuthor

   More actions

   Published to PyPI as seamless-auth 0.1.0: https://pypi.org/project/seamless-auth/0.1.0/ (tag v0.1.0, through trusted publishing). That completes the last checklist item.

   The first automated publish stopped before building. release-please bumped pyproject.toml but not the package's own version in uv.lock, so uv sync --locked failed. fells-code/seamless-auth-python#3 now has each release PR bump uv.lock too, and adds a workflow_dispatch path that publishes an existing tag, which is how 0.1.0 went out.
4. Bccorb

   closed this as completedon Oct 8, 2026