# pico-client-auth v0.1.0

**Initial release** — JWT authentication client for pico-fastapi.

## Features

- **Automatic Bearer token validation** via FastAPI middleware (`AuthFastapiConfigurer`, priority=10)
- **`SecurityContext`** — ContextVar-backed request-scoped accessor for authenticated user claims
- **`@allow_anonymous`** — Decorator to skip authentication on specific endpoints
- **`@requires_role("admin", "editor")`** — Decorator for role-based access control
- **`JWKSClient`** — JWKS fetcher with TTL-based cache and automatic key rotation support
- **`TokenValidator`** — RS256 JWT decode and validation (issuer, audience, expiration)
- **`RoleResolver` protocol** — Pluggable role extraction with `DefaultRoleResolver` fallback
- **`TokenClaims`** — Frozen dataclass with `sub`, `email`, `role`, `org_id`, `jti`
- **Fail-fast startup** — `AuthConfigurationError` if `issuer`/`audience` missing when enabled
- **Error responses** — JSON `{"detail": "..."}` with HTTP 401 (auth) or 403 (authz)

## Configuration

```yaml
auth_client:
  enabled: true
  issuer: "https://auth.example.com"
  audience: "my-api"
  jwks_ttl_seconds: 300       # optional, default 300
  jwks_endpoint: ""            # optional, auto-derived from issuer
```

## Dependencies

- pico-ioc >= 2.2.0
- pico-fastapi >= 0.1.0
- python-jose[cryptography] >= 3.3
- httpx >= 0.24

## Compatibility

- Python 3.11, 3.12, 3.13, 3.14
