API
Authorization
QueueAuthorizer, built-ins, and the OutLabs adapter.
The HTTP facade never hard-depends on outlabs-auth. Hosts inject a QueueAuthorizer with separate authenticate and authorize_context phases.
Built-in authorizers
from taskq.http import bearer_token_auth, static_api_key_auth
authorizer = static_api_key_auth("lab-secret")
# or: bearer_token_auth("…")
OutLabs adapter
from taskq.http.outlabs import OutlabsQueueAuthorizer
authorizer = OutlabsQueueAuthorizer(
auth=auth, # initialized SimpleRBAC (or bind checker lazily after startup)
session_dependency=get_async_session,
)
Permission grammar:
| Pattern | Example |
|---|---|
| Global action | taskq:enqueue, taskq:read, taskq:run, taskq:control |
| Per-queue action | taskq_mail:run, taskq_courts:enqueue |
Provisioning
taskq --context staging auth plan --queues mail,exports -o json
taskq --context staging --yes auth apply --queues mail,exports \
--plan-digest "$PLAN_DIGEST" -o json
Or call provision_taskq_auth / taskq_permission_catalog from taskq.http.outlabs.
--queues is one comma-separated value. The 0.1.0a36 [outlabs] extra accepts
outlabs-auth>=0.1.0a27,<0.2.0. The adapter authenticates once and delegates every
authorization decision back to OutlabsAuth through its auth-owned context API;
hosts must not interpret raw scope dictionaries.
Authorize mutations from authoritative row lookup — never from caller-supplied queue/job_type alone (ADR-006).