bfd75eeae0
feat!: v0.2.0 — Vault + AuthLayer architecture, InputProvider, FlowResult
...
BREAKING CHANGE: Complete internal restructuring. All public Python API
has moved; CLI commands and flags are unchanged.
Architecture changes:
- Introduce Vault layer (vault/) — generic encrypted KV store; replaces
store/ + crypto/ monolith. Compact AES-256-GCM format, LocalFile and
Keyring backends.
- Introduce AuthLayer (auth/) — owns flows, token refresh, login/logout/
revoke. Receives Vault + ProviderRegistry as deps; no direct crypto.
- Introduce AuthsomeContext (context.py) — thin wiring container
replacing AuthClient as the CLI entry point.
- Move flows/ → auth/flows/, models/ → auth/models/,
providers/ → auth/providers/. Delete store/, crypto/, client.py.
New features:
- InputProvider protocol: BridgeInputProvider, InteractiveInputProvider,
MockInputProvider — replaces ad-hoc secure_input_bridge calls and
simplifies test setup.
- FlowResult dataclass: flows now return FlowResult(connection,
client_record) instead of a bare ConnectionRecord. DCR flow populates
client_record only when it actually registered a new client.
- RequestRouter class removed; routing inlined as _route() module-level
function in proxy/server.py. AuthProxyAddon takes only auth: AuthLayer.
- ConnectionRecord v2: tokens are plaintext str (Vault handles
encryption at rest). Sensitive annotation marks fields for redaction.
Docs:
- docs/UBIQUITOUS_LANGUAGE.md: added Architecture Layers section (Vault,
AuthLayer, AuthsomeContext, Sensitive); deprecated CredentialStore,
CryptoBackend, EncryptedField.
- docs/manual-testing.md: end-to-end manual testing guide.
Tests reorganized under tests/auth/, tests/vault/, tests/proxy/,
tests/common/. 262 tests pass.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-26 13:15:05 +05:30
Manoj Bajaj