Authorization

The HTTP facade never hard-depends on outlabs-auth. Hosts inject a QueueAuthorizer with separate authenticate and authorize_context phases.

Built-in authorizers

from taskq.http import bearer_token_auth, static_api_key_auth

authorizer = static_api_key_auth("lab-secret")
# or: bearer_token_auth("…")

OutLabs adapter

from taskq.http.outlabs import OutlabsQueueAuthorizer

authorizer = OutlabsQueueAuthorizer(
    auth=auth,  # initialized SimpleRBAC (or bind checker lazily after startup)
    session_dependency=get_async_session,
)

Permission grammar:

Provisioning

taskq --context staging auth plan --queues mail,exports -o json
taskq --context staging --yes auth apply --queues mail,exports \
  --plan-digest "$PLAN_DIGEST" -o json

Or call provision_taskq_auth / taskq_permission_catalog from taskq.http.outlabs.

--queues is one comma-separated value. The 0.1.0a40 [outlabs] extra accepts outlabs-auth>=0.1.0a27,<0.2.0. The adapter authenticates once and delegates every authorization decision back to OutlabsAuth through its auth-owned context API; hosts must not interpret raw scope dictionaries.

Queue admission ownership

SQL contract 0.6.12 can bind each queue to one PostgreSQL producer role. This is a database capability boundary: TaskQ checks session_user before every direct admission and replay path. It does not replace a host application's tenant, user, API-key, route, spend, or business authorization.

The authoritative owner identity is the role OID. A role rename preserves the binding; a dropped role fails closed with TQ425. Use the observer identity read to verify both the current role name and owner_present before opening a queue. Strict bind is for a new empty queue. Existing retained history requires the attested adoption operation, and replacing a missing or compromised role requires attested rotation. Adoption and rotation require the queue to be paused and quiesced, require no active schedule targeting it, and append the actor and reason to queue_audit. There is no generic ownership-clear operation.

Keep database-role ownership separate from HTTP authorization tests. Prove both the owner/non-owner LOGIN boundary and the host application's positive and negative API-key or bearer-token boundary before resuming traffic. See Runtime-first upgrades.