b374fb49a0
fix: address production readiness review
2026-06-10 16:55:14 +05:30
10f6e8ae41
fix: Remove type checking hacks
2026-06-04 21:28:22 +05:30
54ba227341
refactor: move server secret resolution out of vault
2026-05-27 16:42:18 +05:30
52c8c2aec6
refactor: simplify create_vault dependency and remove unused server store tests
2026-05-27 16:18:51 +05:30
5a6c12cd75
Merge branch 'main' into feature/server-store-refactor
2026-05-27 16:06:30 +05:30
6f0f61c372
refactor: replace file-based registry storage with a unified SQL-backed ServerStore implementation
2026-05-27 16:02:24 +05:30
b76903d74b
feat: replace flat master-key vault encryption with Argon2id KEK/DEK model
...
Replaces the flat FernetEncryptionWrapper + EncryptionConfig model with a
proper envelope encryption scheme:
- MasterSecretResolver: unified resolution order (env → file → keyring →
auto-generate) under a single AUTHSOME_MASTER_KEY env var; no separate
passphrase vs raw-key distinction — both go through Argon2id
- DekManager: generates a random 256-bit DEK, wraps it with an
Argon2id-derived KEK (AES-256-GCM), and stores the wrapped record in the
KV store under __vault_meta__:__dek__ so it works with any KV backend
- AesGcmEncryptionWrapper: drop-in BaseEncryptionWrapper using AES-256-GCM
per-value encryption via closure; replaces FernetEncryptionWrapper
- Vault: simplified — no longer owns crypto or lifecycle; receives an
already-encrypted AsyncKeyValue; close() removed (caller manages store)
- EncryptionConfig removed from ServerConfig and models __all__
- Health route updated to report crypto_source from Vault properties
- Tests rewritten with fixtures and SimpleStore (in-memory); no DiskStore
BREAKING CHANGE: existing Fernet-encrypted vaults cannot be read back;
migration requires re-importing credentials.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
Entire-Checkpoint: a778dfa71075
2026-05-27 14:01:42 +05:30
7e3a63480c
refactor: remove vault rekey functionality and associated endpoints
2026-05-25 18:03:47 +05:30
39b3419137
refactor: delegate vault rekey persistence and validation to crypto backends
2026-05-21 15:24:08 +05:30
83709f4e37
fix: improve whoami robustness by handling connection failures gracefully and isolating keyring tests
2026-05-21 15:11:01 +05:30
e7f418707a
feat: implement vault rekey functionality with encryption source validation and add corresponding API and unit tests.
2026-05-21 14:50:04 +05:30
84f879985b
Merge branch 'main' into feat/authsome-rekey
2026-05-21 14:41:37 +05:30
bb5a2a6152
refactor!: Create version 0.4 which adds support for principal, identity, vault key loading precedence and many more fixes
2026-05-20 21:29:50 +05:30
3c80c7e01e
feat: implement master key rotation via rekey command and API endpoint
2026-05-18 16:15:32 +05:30
112fe8ba8a
refactor: migrate LocalAppStore from SQLite to key-value-aio DiskStore
2026-05-12 12:56:05 +05:30
b0835eb299
refactor: decompose monolithic CLI tests into modular, feature-specific test files
2026-05-08 17:41:50 +05:30
0499c70a4f
refactor: consolidate initialization logic into AuthsomeContext and remove legacy init command
2026-04-27 14:32:19 +05:30
bfd75eeae0
feat!: v0.2.0 — Vault + AuthLayer architecture, InputProvider, FlowResult
...
BREAKING CHANGE: Complete internal restructuring. All public Python API
has moved; CLI commands and flags are unchanged.
Architecture changes:
- Introduce Vault layer (vault/) — generic encrypted KV store; replaces
store/ + crypto/ monolith. Compact AES-256-GCM format, LocalFile and
Keyring backends.
- Introduce AuthLayer (auth/) — owns flows, token refresh, login/logout/
revoke. Receives Vault + ProviderRegistry as deps; no direct crypto.
- Introduce AuthsomeContext (context.py) — thin wiring container
replacing AuthClient as the CLI entry point.
- Move flows/ → auth/flows/, models/ → auth/models/,
providers/ → auth/providers/. Delete store/, crypto/, client.py.
New features:
- InputProvider protocol: BridgeInputProvider, InteractiveInputProvider,
MockInputProvider — replaces ad-hoc secure_input_bridge calls and
simplifies test setup.
- FlowResult dataclass: flows now return FlowResult(connection,
client_record) instead of a bare ConnectionRecord. DCR flow populates
client_record only when it actually registered a new client.
- RequestRouter class removed; routing inlined as _route() module-level
function in proxy/server.py. AuthProxyAddon takes only auth: AuthLayer.
- ConnectionRecord v2: tokens are plaintext str (Vault handles
encryption at rest). Sensitive annotation marks fields for redaction.
Docs:
- docs/UBIQUITOUS_LANGUAGE.md: added Architecture Layers section (Vault,
AuthLayer, AuthsomeContext, Sensitive); deprecated CredentialStore,
CryptoBackend, EncryptedField.
- docs/manual-testing.md: end-to-end manual testing guide.
Tests reorganized under tests/auth/, tests/vault/, tests/proxy/,
tests/common/. 262 tests pass.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-26 13:15:05 +05:30
beubax