API
Authorization
QueueAuthorizer, built-ins, and the OutLabs adapter.
The HTTP facade never hard-depends on outlabs-auth. Hosts inject a QueueAuthorizer with separate authenticate and authorize_context phases.
Built-in authorizers
from taskq.http import bearer_token_auth, static_api_key_auth
authorizer = static_api_key_auth("lab-secret")
# or: bearer_token_auth(expected="…")
OutLabs adapter
from taskq.http.outlabs import OutlabsQueueAuthorizer
authorizer = OutlabsQueueAuthorizer(
auth=auth, # initialized SimpleRBAC (or bind checker lazily after startup)
session_dependency=get_async_session,
)
Permission grammar:
| Pattern | Example |
|---|---|
| Global action | taskq:enqueue, taskq:read, taskq:run, taskq:control |
| Per-queue action | taskq_mail:run, taskq_courts:enqueue |
Provisioning
taskq auth sync-permissions --dsn "$AUTH_DSN" --queue mail --apply
Or call provision_taskq_auth / taskq_permission_catalog from taskq.http.outlabs.
Authorize mutations from authoritative row lookup — never from caller-supplied queue/job_type alone (ADR-006).