Feature/oauth2 client credentials

[NEFORCEO]

🚀 Description

Add OAuth2ClientCredentials — a new authentication class that implements the OAuth2 Client Credentials grant with automatic token refresh. Works per-route via the auth parameter on any decorator and is fully compatible with the existing resolve_auth pipeline.

---

🧩 Type of Change

• feat: New feature
• docs: Documentation update

---

✅ Checklist

• Tests added or updated
• Documentation updated
• No breaking changes
• Code follows project style

---

🔗 Related Issues

N/A

---

📸 Additional Context

What was done

fasthttp/auth.py

• Added OAuth2ClientCredentials(token_url, client_id, client_secret, scopes, extra) class
• Added _HttpxOAuth2Auth — httpx-compatible auth that fetches the token lazily on first request, caches it, and auto-refreshes 60s before expiry
• Updated resolve_auth() to handle the new auth type

fasthttp/routing.py

• Updated auth type annotations (BasicAuth | DigestAuth | BearerAuth | OAuth2ClientCredentials | None) in Route, _RouteDef, _add_route, and all 7 HTTP method decorators

fasthttp/app.py

• Updated auth type annotations in _add_route and all 7 HTTP method decorators

fasthttp/openapi/generator.py

• Added OAuth2ClientCredentials to OpenAPI security scheme generation — emits oauth2 / clientCredentials flow with tokenUrl and scopes

fasthttp/__init__.py

• Exported OAuth2ClientCredentials

Documentation (docs/en/ and docs/ru/)

• tutorial/authentication.md — new OAuth2ClientCredentials section with example and parameter table
• tutorial/openapi/swagger-ui.md — added OAuth2ClientCredentials row to security schemes table

Usage

from fasthttp import FastHTTP
from fasthttp.auth import OAuth2ClientCredentials

app = FastHTTP()

auth = OAuth2ClientCredentials(
    token_url="https://auth.example.com/oauth/token",
    client_id="my-client",
    client_secret="my-secret",
    scopes=["read", "write"],
)

@app.get(url="https://api.example.com/users", auth=auth)
async def get_users(resp):
    return resp.json()

if __name__ == "__main__":
    app.run()

Testing

All 559 existing tests pass with no regressions.

[github-actions]

👋 Thanks for your contribution, @NEFORCEO!

Please make sure:

• Code is clean and formatted
• Tests are passing
• PR description is clear

Maintainers will review it soon.

[codspeed-hq]

Merging this PR will improve performance by 37.97%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 7 improved benchmarks
✅ 5 untouched benchmarks

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
⚡	test_response_req_text_from_json	213.2 µs	132.5 µs	+60.87%
⚡	test_response_repr	196.4 µs	130.7 µs	+50.26%
⚡	test_response_property_access	194.5 µs	131.6 µs	+47.76%
⚡	test_response_json_parsing	205.6 µs	140 µs	+46.83%
⚡	test_response_creation	201.3 µs	138.9 µs	+44.86%
⚡	test_middleware_after_response	403.1 µs	354 µs	+13.89%
⚡	test_response_json_parsing_large_payload	666.7 µs	606 µs	+10.02%

Tip

Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing feature/oauth2-client-credentials (4bdad3d) with master (6f3d441)¹}

Footnotes

1. No successful run was found on master (247abed) during the generation of this report, so 6f3d441 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩