Align public docs with Principal/Vault/Identity terminology, current daemon API paths, and the CLI/proxy/export integration surface instead of the removed AuthService library API.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unifies first-run setup into a single idempotent command that registers
identity, completes claim, and imports API keys from env. Persists
--base-url in client config for remote daemon connections.
Closes#434
Co-authored-by: Cursor <cursoragent@cursor.com>
Adds a `type` field (app | llm | mcp) to ProviderDefinition so consumers
can filter and display providers by category. Backfills all 71 bundled
providers. Also introduces a `parse_jsonc` utility that strips // and /* */
comments before JSON parsing, and wires it into the bundled loader and the
CLI register command so both .json and .jsonc provider files are accepted.
Closes#362
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Enables single-command self-deployment of the authsome daemon in a
container without requiring Python or uv on the host.
- Multi-stage Dockerfile: ui-builder (Node 24/pnpm) → py-builder (uv
wheel) → slim Python 3.13 runtime, non-root authsome user
- docker-compose.yml with named volume and restart: unless-stopped
- .dockerignore to keep the build context minimal
- docs/guides/self-hosting.md covering quick-start, env vars, volume
backup/restore, TLS with Caddy, and local builds
- .github/workflows/docker.yml CI job that builds the image on every PR
- README.md self-hosting quick-start section
Closes#366
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Remove references to five pages that do not exist:
reference/provider-schema, reference/file-layout,
concepts/profiles-vs-connections, security/hosted-deployment,
guides/profiles.
Strategy: strip the links/sentences from the 59 source files rather than
creating stub pages. Card blocks pointing to missing pages are removed;
inline sentence references are removed or reworded so the surrounding
prose stays coherent.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Delete the server-rendered dashboard pages, remove the static asset mount, and route the Next dashboard provider login form through the browser-session auth path.
The guide had drifted well beyond the deployment-flow change:
- Commands moved under the `provider` and `connections` groups
(`provider list`, `provider inspect`, `provider register|remove|revoke`,
`connections inspect`, `connections set-default`). Update every invocation.
- Remove the documented `get`, `export`, `--show-secret`, and `--json`
commands/flags — none exist. `connections inspect` is always redacted
and there is no human-table mode; output is always JSON (`{"v": 1, ...}`).
- Add sections for `scan`, `profile`, and `daemon restart`/`logs`.
- Note admin-only operations (register/revoke) and JSON-shaped expected
output throughout; fix the `daemon status` health block (no `mode`).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Entire-Checkpoint: b68c1ae5d66c
The first protected command now registers the identity and blocks on a
browser email+password registration + claim (first account = admin),
matching the single deployment flow. Also drop the removed `mode` field
from the daemon health block.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Entire-Checkpoint: 68b4ca3c1fc0
The daemon branched on AUTHSOME_DEPLOYMENT_MODE and ran two parallel
implementations of nearly every ownership concept. "Local and hosted
behave the same" was asserted in prose (ADR 0006) but never enforced in
code, so the paths were free to drift, and the synthetic local principal
let a second local identity silently inherit the admin principal.
Collapse to one flow, identical for every deployment: authsome init
registers an identity and gets back a browser claim URL; the user
registers email+password (first principal becomes admin); that principal
confirms the claim; PoP calls are then authorized.
- Remove AUTHSOME_DEPLOYMENT_MODE, get_deployment_mode(),
LOCAL_PRINCIPAL_EMAIL, the Local*/Hosted* resolver and bootstrap
classes, and the AuthService(deployment_mode=...) parameter.
- OwnershipResolver and IdentityBootstrapService become single concrete
classes (the former hosted, claim-based implementations).
- Admin gating is purely role-based: non-admin principals are blocked in
every deployment (previously implicitly allowed in local mode).
- The server UI always requires a hosted browser session; remove the
vestigial HealthResponse.mode field.
- CLI ensure_identity_ready was already mode-agnostic; it now prints the
claim URL to stderr for headless use.
Add ADR 0007 recording the decision; amend ADR 0006 and CONTEXT.md.
BREAKING CHANGE: existing local installs have an unclaimed identity under
local@authsome.internal and are rejected until the user registers a
principal (email+password) and claims the identity.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Entire-Checkpoint: d31cf246f6f2
Login sections (§2–4) now include explicit human action steps — what
to open in the browser, what credentials to enter, and how to confirm
completion. Proxy section (§9) simplified to a single GitHub whoami
call through the proxy. Daemon note updated to reflect the orphaned-
process fix.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: e51d7e04524d
Two bugs found during manual testing:
- `AuthsomeError.__str__` already prepends the class name, but
`app.py` was passing `str(exc)` as the `message` field in error
responses. The client then reconstructed the exception with that
string as its args[0], causing `str()` to prepend the class name a
second time (e.g. "ProviderNotFoundError: ProviderNotFoundError: …").
Fixed by using `Exception.__str__(exc)` so the server sends the raw
message without the class-name prefix.
- `daemon stop` returned a no-op message when no PID file existed,
leaving an orphaned daemon (e.g. after `rm -rf ~/.authsome`) running
on port 7998. Added `_find_pid_by_port` as a fallback: if there is
no PID record but a process is listening on the daemon port, it is
terminated through the normal SIGTERM→SIGKILL path.
Also updates the manual-testing guide to reflect the secure local
browser bridge used by all login flows.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: 37d02f2f4c99
rishabhraj36