feat: pluggable auth — AuthProvider contract + Keycloak OIDC module + bearer tokens by antosubash · Pull Request #184 · antosubash/simple_module_python

docs: add design spec for pluggable auth + Keycloak module

antosubash

committed

d3d98ab

docs: add implementation plan for pluggable auth + Keycloak module

antosubash

committed

3b7426d

feat(auth): add AuthProvider protocol for swappable auth backends

antosubash

committed

543e14c

feat(auth): add auth_provider slot to AuthState

antosubash

committed

1b39868

feat(auth): add provider-agnostic AuthMiddleware

antosubash

committed

ab0fafa

refactor(auth,users): move AuthMiddleware + principal_serializer to auth module

antosubash

committed

3c74944

feat(users): implement UsersAuthProvider with session-cookie resolution

antosubash

committed

808b78f

refactor(users): delegate to auth.middleware, keep thin re-export for compat

antosubash

committed

64ab4a3

feat(diagnostics): SM020/SM021 — exactly one auth provider required

antosubash

committed

1af0c19

feat(keycloak): scaffold keycloak module with settings + provider registration

antosubash

committed

1e974b5

feat(keycloak): JWKS key cache with JWT validation and key-rotation retry

antosubash

committed

bbbd895

feat(keycloak): OIDC client with authorization URL, token exchange, logout

antosubash

committed

27c1601

feat(keycloak): KeycloakUserCache model

antosubash

committed

97d0018

feat(keycloak): KeycloakAuthProvider with JWT resolution and role mapping

antosubash

committed

47e1b90

feat(keycloak): OIDC login/callback endpoints + Inertia login/logout pages

antosubash

committed

23b567c

feat(users): bearer token + refresh token endpoints for mobile/API auth

antosubash

committed

f83381a

test: integration tests for pluggable auth provider system

antosubash

committed

9d42e58

docs: document pluggable auth provider contract and SM020/SM021 diagnostics

antosubash

committed

67f89b3

fix(keycloak): require issuer + audience for JWT validation

antosubash

committed

d455086

fix(users): resolve bearer tokens in UsersAuthProvider

antosubash

committed

02afc2a

fix(users): API logout clears session + constant-time token login

antosubash

committed

cdf6a0b

fix(keycloak): await inertia.render() in login view

antosubash

committed

3bea0b3

chore: regenerate i18n keys for keycloak module pages

antosubash

committed

2416cf2

style: auto-format new files with ruff

antosubash

committed

854b2e4

style: fix ruff lint errors (B904, RUF059, UP017)

antosubash

committed

d3149c9

style: format keycloak TSX pages with biome

antosubash

committed

34ef198

style: use module dependency constants in KeycloakModule

antosubash

committed

94fbfba

style: use page constant for Inertia render

antosubash

committed

ba8759f

chore(keycloak): add README.md and fix pyproject metadata

antosubash

committed

d8c6182

Merge branch 'main' into worktree-pluggable-auth-keycloak-design

antosubash

authored

238b7dc

fix(ci): update lockfile, fix httpx_mock strict mode, ignore ty ConfigDict false positive

antosubash

committed

098aae1

fix(ci): regenerate i18n keys with all modules, fix JWKS test mock

antosubash

committed

7a44c6d

fix(ci): remove unused imports, exclude keycloak from E2E smoke job

antosubash

committed

8639029

fix(ci): rewrite JWKS refetch test to monkey-patch _fetch_keys directly

antosubash

committed

642c6e1

chore: add QA verification screenshots

antosubash

committed

806996e

Navigation Menu

feat: pluggable auth — AuthProvider contract + Keycloak OIDC module + bearer tokens - #184

feat: pluggable auth — AuthProvider contract + Keycloak OIDC module + bearer tokens#184
antosubash merged 35 commits into
mainfrom
worktree-pluggable-auth-keycloak-design

Commits on May 27, 2026

docs: add design spec for pluggable auth + Keycloak module

docs: add implementation plan for pluggable auth + Keycloak module

feat(auth): add AuthProvider protocol for swappable auth backends

feat(auth): add auth_provider slot to AuthState

feat(auth): add provider-agnostic AuthMiddleware

refactor(auth,users): move AuthMiddleware + principal_serializer to auth module

feat(users): implement UsersAuthProvider with session-cookie resolution

refactor(users): delegate to auth.middleware, keep thin re-export for compat

feat(diagnostics): SM020/SM021 — exactly one auth provider required

feat(keycloak): scaffold keycloak module with settings + provider registration

feat(keycloak): JWKS key cache with JWT validation and key-rotation retry

feat(keycloak): OIDC client with authorization URL, token exchange, logout

feat(keycloak): KeycloakUserCache model

feat(keycloak): KeycloakAuthProvider with JWT resolution and role mapping

feat(keycloak): OIDC login/callback endpoints + Inertia login/logout pages

feat(users): bearer token + refresh token endpoints for mobile/API auth

test: integration tests for pluggable auth provider system

docs: document pluggable auth provider contract and SM020/SM021 diagnostics

fix(keycloak): require issuer + audience for JWT validation

fix(users): resolve bearer tokens in UsersAuthProvider

fix(users): API logout clears session + constant-time token login

fix(keycloak): await inertia.render() in login view

chore: regenerate i18n keys for keycloak module pages

style: auto-format new files with ruff

style: fix ruff lint errors (B904, RUF059, UP017)

style: format keycloak TSX pages with biome

style: use module dependency constants in KeycloakModule

style: use page constant for Inertia render

chore(keycloak): add README.md and fix pyproject metadata

Merge branch 'main' into worktree-pluggable-auth-keycloak-design

fix(ci): update lockfile, fix httpx_mock strict mode, ignore ty ConfigDict false positive

fix(ci): regenerate i18n keys with all modules, fix JWKS test mock

fix(ci): remove unused imports, exclude keycloak from E2E smoke job

fix(ci): rewrite JWKS refetch test to monkey-patch _fetch_keys directly

chore: add QA verification screenshots