Delete the server-rendered dashboard pages, remove the static asset mount, and route the Next dashboard provider login form through the browser-session auth path.
Implement ADR 005 by routing audit events through OpenTelemetry with a server-owned SQLite exporter and query endpoint. Implement ADR 006 by persisting principal roles, assigning first principal admin, and enforcing admin-only routes at the FastAPI dependency layer.
Entire-Checkpoint: df60966364f1
Phases A–I of TODOS.md:
- Move all five registry classes (IdentityRegistry, PrincipalRegistry,
VaultRegistry, IdentityClaimRegistry, PrincipalVaultBindingRegistry) from
identity/ to server/registries.py. Domain model types stay in identity/.
- Break identity/local.py → cli/ coupling: inline _read/_write_active_identity_handle
helpers so identity/ imports nothing from cli/.
- Remove VaultRegistry + get_server_home imports from auth/service.py; refactor
revoke() to accept explicit vault_ids from the server layer.
- Move proxy_routes() and _build_route_entry() out of AuthService into
server/proxy_catalog.py; proxy route delegates to build_proxy_routes().
- Move AuthService from auth/service.py to server/credential_service.py so
auth/ becomes a true leaf (no vault/, audit/, or server/ imports). Update
all 10+ import sites in server/, cli/ test files, and the top-level __init__.
- Remove global AuthService(identity="server") from app.py. Refactor /ready
to resolve the local identity at request time and use app.state.vault directly.
- Remove vault.home property from Vault; replace all callers with store.home.
- Update AGENTS.md architecture table to reflect new file locations.
All 293 tests pass. ruff and ty clean.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: 5c8526a4e7d2
- Add ClaimStatus enum (PENDING/ACCEPTED/REJECTED) to IdentityClaimRecord
with accept_claim() and reject_claim() on IdentityClaimRegistry
- HostedOwnershipResolver.resolve() now gates vault access on ACCEPTED;
PENDING raises 403, REJECTED raises 403 with distinct message
- ensure_claimed_identity() auto-accepts on UI form submission — the form
IS the approval act in this release; PENDING is transit state only
- Remove AuthService vault_id fallback (vault_id or identity); _coll now
raises ValueError if vault_id is None, making missing wiring explicit
- /ready endpoint resolves vault_id via ownership_resolver instead of
constructing AuthService with the identity handle as a stopgap
- create_auth_service() requires explicit vault_id parameter
- Rewrite ADR 0003 and update UBIQUITOUS_LANGUAGE.md to reflect opaque
VaultId design (single segment, not principal_handle/vault_handle)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: 8f56337e3615
Profile is now a pure credential namespace scoped by the Identity handle,
not an independently managed entity. The two were always 1:1 but modelled
as separate concepts; this commit makes that explicit.
Key changes:
- Add `active_identity` to GlobalConfig; `ensure_local_identity` reads it
and errors hard if the configured handle is missing on disk (no silent
re-creation)
- `authsome init` writes `active_identity` to config after registration
- Collapse `registered: bool` + `registration_status: str` on
IdentityMetadata into a single `registered: bool`; add `mark_registered()`
- Remove vestigial `Identity` dataclass, `DEFAULT_IDENTITY`, `current()`
- Remove `name`, `description`, `owner_email` from IdentityMetadata (deferred
to hosted version)
- Remove `ProfileMetadata`, `ProfileNotFoundError`, `create_profile`,
`list_profiles`, `get_profile`, `set_default_profile`, `default_profile`
shim in save_config — profile is a side-effect of identity registration
- Add hard-error test for missing configured identity
- Update UBIQUITOUS_LANGUAGE.md, AGENTS.md architecture section, and
ADR 0002 to reflect current code (fix stale AuthsomeContext, AuthClient,
config.json path, ProfileMetadata references)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: 614885258a45
Make the daemon identity registry authoritative for protected PoP requests and remove implicit default-profile identity behavior.
Store daemon-owned state under server/ while keeping CLI signing identity files under identities/.
BREAKING CHANGE: Existing implicit default-profile installs must run authsome init again; profile:default credentials are not migrated.
Entire-Checkpoint: 557455816515
Go's crypto/x509 on macOS delegates certificate verification to the native
Security framework (SecTrustEvaluateWithError), which ignores SSL_CERT_FILE.
This caused gh, terraform, kubectl, and other Go-based CLI tools to fail with
x509 certificate errors when run via `authsome run`.
Add _add_ca_to_macos_keychain() to temporarily register the mitmproxy CA in
the login keychain before the subprocess starts, and _remove_ca_from_macos_keychain()
to clean it up in the finally block. The add is skipped if a cert with CN=mitmproxy
is already present, preserving any pre-existing user configuration.
Fixes#234
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: a67cae1674f7
beubax