Repository navigation

feat(aauth): introspection-aauth, a Person Server and Access Server library - #193

Merged

brightsparc merged 34 commits into

mainfrom

feat/introspection-aauth

Oct 22, 2026

Merged

feat(aauth): introspection-aauth, a Person Server and Access Server library#193
brightsparc merged 34 commits into
mainfrom
feat/introspection-aauth

Commits on Oct 21, 2026
- feat(aauth): introspection-aauth, a Person Server and Access Server library
  
  brightsparc
  and
  claude
  committed
  ee5306a
- fix(aauth): a mission names its approval and person, and federation retries then ends as_unreachable
  
  brightsparc
  and
  claude
  committed
  f67d1b3
- test(aauth): refuse a taken mission hash with a store, not a swapped method
  
  brightsparc
  and
  claude
  committed
  96651ea
- feat(aauth): the FastAPI routers take a router of the host's, for its tags, dependencies and schema
  
  brightsparc
  and
  claude
  committed
  a8b0c0b
- feat(aauth): routers resolve their server per request, read pending paths back, document themselves, and cache well-known documents; Clock and IdFactory protocols
  
  brightsparc
  and
  claude
  committed
  20e5288
- feat(aauth): a store transaction yields the unit of work, and decide takes the host's
  
  brightsparc
  and
  claude
  committed
  936a82b
- refactor(aauth): every wire body and token is a pydantic model, with typed claims and named expectation failures
  
  brightsparc
  and
  claude
  committed
  b0feada
- refactor(aauth): the example builds each server with its own builder, over models
  
  brightsparc
  and
  claude
  committed
  9e10e63
- feat(aauth): discovery reads only AAuth identifiers over https, follows no redirect, and a signed Authorization is covered
  
  brightsparc
  and
  claude
  committed
  1335811
- feat(aauth): export MissionGrant from person_server
  
  brightsparc
  and
  claude
  committed
  10035ea
- refactor(aauth)!: stores insert approvals and pending requests, as they insert missions
  
  brightsparc
  and
  claude
  committed
  4b1c0ef
- fix(aauth): collect an approved auth token once, read proposals only from their resource, and check each token as its type requires
  
  brightsparc
  and
  claude
  committed
  45f8310
- fix(aauth): verify a signed request at the path its signer sent, still percent-encoded
  
  brightsparc
  and
  claude
  committed
  ef3c239
- fix(aauth): a pending URL gives its terminal answer once, then answers 410
  
  brightsparc
  and
  claude
  committed
  83b2cac
- fix(aauth): a proposal's summary is written without making a decision or federation stale
  
  brightsparc
  and
  claude
  committed
  4501373
- fix(aauth): an Access Server's token endpoint and keys must be on its own origin
  
  brightsparc
  and
  claude
  committed
  1afb891
- fix(aauth): a key without alg takes its algorithm from its type
  
  brightsparc
  and
  claude
  committed
  db5b721
- test(aauth): the type guard reads the AST for every way of writing Any, object or a bare dict
  
  brightsparc
  and
  claude
  committed
  14a56f1
- fix(aauth): a delivered answer is recorded apart from its decision
  
  brightsparc
  and
  claude
  committed
  60d1215
- refactor(aauth)!: federation steps on PersonServer, typed error classes, retries on the http client
  
  brightsparc
  and
  claude
  committed
  8f306f6
- refactor(aauth)!: the Access Server client takes what it uses; every check has a test
  
  brightsparc
  and
  claude
  committed
  1eda313
- build(aauth): ban relative imports, type-check the package's tests, raise its coverage floor
  
  brightsparc
  and
  claude
  committed
  b8bab82
- build(aauth): jscpd skips the re-export __init__ modules
  
  brightsparc
  and
  claude
  committed
  6116c5a
- refactor(aauth): no underscore on classes, constants or type variables
  
  brightsparc
  and
  claude
  committed
  bfe588f
- refactor(aauth)!: person_server.federation becomes access_server_client
  
  brightsparc
  and
  claude
  committed
  a7e3ca8
- refactor(aauth): one concept per module
  
  brightsparc
  and
  claude
  committed
  94f396b
- feat(aauth): trace federation and log decisions as the platform does
  
  brightsparc
  and
  claude
  committed
  aca284e
- test(aauth): no log field the platform's formatter would drop; jscpd skips imports
  
  brightsparc
  and
  claude
  committed
  da76e1c
- refactor(aauth): fastapi becomes a package, one module per server
  
  brightsparc
  and
  claude
  committed
  8b07b8e
- refactor(aauth): each server's resolver is the generic Resolver
  
  brightsparc
  and
  claude
  committed
  4cf1bb1
- ci: write each suite's coverage table to the run summary
  
  brightsparc
  and
  claude
  committed
  b55fef6
- refactor(aauth): httpsig becomes a package, signing and verification apart
  
  brightsparc
  and
  claude
  committed
  f794426
- docs(examples): build each AAuth app in a factory whose lifespan owns its http client
  
  brightsparc
  and
  claude
  committed
  6d72db7
- refactor(aauth): name the in-process transport for what it is
  
  brightsparc
  and
  claude
  committed
  3bf5cc0

Navigation Menu

Repository navigation

feat(aauth): introspection-aauth, a Person Server and Access Server library - #193

feat(aauth): introspection-aauth, a Person Server and Access Server library#193
brightsparc merged 34 commits into
mainfrom
feat/introspection-aauth

Commits on Oct 21, 2026

feat(aauth): introspection-aauth, a Person Server and Access Server library

fix(aauth): a mission names its approval and person, and federation retries then ends as_unreachable

test(aauth): refuse a taken mission hash with a store, not a swapped method

feat(aauth): the FastAPI routers take a router of the host's, for its tags, dependencies and schema

feat(aauth): routers resolve their server per request, read pending paths back, document themselves, and cache well-known documents; Clock and IdFactory protocols

feat(aauth): a store transaction yields the unit of work, and decide takes the host's

refactor(aauth): every wire body and token is a pydantic model, with typed claims and named expectation failures

refactor(aauth): the example builds each server with its own builder, over models

feat(aauth): discovery reads only AAuth identifiers over https, follows no redirect, and a signed Authorization is covered

feat(aauth): export MissionGrant from person_server

refactor(aauth)!: stores insert approvals and pending requests, as they insert missions

fix(aauth): collect an approved auth token once, read proposals only from their resource, and check each token as its type requires

fix(aauth): verify a signed request at the path its signer sent, still percent-encoded

fix(aauth): a pending URL gives its terminal answer once, then answers 410

fix(aauth): a proposal's summary is written without making a decision or federation stale

fix(aauth): an Access Server's token endpoint and keys must be on its own origin

fix(aauth): a key without alg takes its algorithm from its type

test(aauth): the type guard reads the AST for every way of writing Any, object or a bare dict

fix(aauth): a delivered answer is recorded apart from its decision

refactor(aauth)!: federation steps on PersonServer, typed error classes, retries on the http client

refactor(aauth)!: the Access Server client takes what it uses; every check has a test

build(aauth): ban relative imports, type-check the package's tests, raise its coverage floor

build(aauth): jscpd skips the re-export init modules

refactor(aauth): no underscore on classes, constants or type variables

refactor(aauth)!: person_server.federation becomes access_server_client

refactor(aauth): one concept per module

feat(aauth): trace federation and log decisions as the platform does

test(aauth): no log field the platform's formatter would drop; jscpd skips imports

refactor(aauth): fastapi becomes a package, one module per server

refactor(aauth): each server's resolver is the generic Resolver

ci: write each suite's coverage table to the run summary

refactor(aauth): httpsig becomes a package, signing and verification apart

docs(examples): build each AAuth app in a factory whose lifespan owns its http client

refactor(aauth): name the in-process transport for what it is