fix(keycardai-starlette): audience in Quick Start, RFC 6750 scope attribute, opaque-mount docs#206
Draft
Larry-Osakwe wants to merge 4 commits into
Draft
fix(keycardai-starlette): audience in Quick Start, RFC 6750 scope attribute, opaque-mount docs#206Larry-Osakwe wants to merge 4 commits into
Larry-Osakwe wants to merge 4 commits into
Conversation
The example app sets audience= with an RFC 8707 comment, but the README Quick Start and the module docstrings (the actual copy-paste path) omitted it. An unset audience silently disables audience validation in the shared verifier, so servers built from the Quick Start accepted tokens minted for any resource in the zone. Show audience= in every Quick Start example and state plainly that leaving it unset disables the audience check. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…t_scope challenge The 403 insufficient_scope challenge told clients they were missing scopes without saying which ones. RFC 6750 section 3 defines the scope attribute as the space-delimited list of scopes needed to access the protected resource, which lets clients re-request authorization with the right scopes. The challenge now carries scope="..." built from the @requires(...) scope list. The synthetic "authenticated" gating scope is excluded since it is a Starlette convention, not an OAuth scope a client can request. Existing challenge attributes (error, error_description, resource_metadata) are unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… mounts require_authentication=True (the escape hatch for mounted sub-apps that bypass route decorators) was only discoverable through docstrings. Add a README section under protected_router() showing when the flag is needed and the one-liner to enable it, including the KeycardAuthBackend spelling for direct middleware registration. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
📦 Release PreviewThis analysis shows the expected release impact: 📈 Expected Version Changes📋 Package Details[
{
"package_name": "keycardai-starlette",
"package_dir": "packages/starlette",
"has_changes": true,
"current_version": "0.11.0",
"next_version": "0.11.1",
"increment": "PATCH"
}
]📝 Changelog PreviewThis comment was automatically generated by the release preview workflow. |
…veloper input Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
📦 Release PreviewThis analysis shows the expected release impact: 📈 Expected Version Changes📋 Package Details[
{
"package_name": "keycardai-starlette",
"package_dir": "packages/starlette",
"has_changes": true,
"current_version": "0.11.0",
"next_version": "0.11.1",
"increment": "PATCH"
}
]📝 Changelog PreviewThis comment was automatically generated by the release preview workflow. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The three PR-sized items from the ECO-113 eval of
keycardai-starlette(full scorecard on the ticket). All changes confined topackages/starlette.audience= in the copy-paste path
An unset
audiencesilently disables audience validation in the shared verifier. The example app set it correctly; the README Quick Start and module docstrings (the actual copy-paste path) omitted it. All Quick Start examples now setaudience=with the example app's RFC 8707 comment, plus one plain line stating that leaving it unset disables the check. TheAuthProvider.__init__docstring states the None behavior explicitly.RFC 6750 scope attribute on insufficient_scope challenges
The 403
insufficient_scopechallenge omitted the RFC 6750 section 3scopeattribute.requires()now passes the required scopes through to the challenge builder, emitted asscope="read admin"alongside the existing attributes. Design note: the synthetic"authenticated"scope is excluded from the attribute, since it is a Starlette gating convention, not an OAuth scope a client can request from the AS.require_authentication documented for opaque mounts
The escape hatch for mounted sub-apps that bypass route decorators (MCP JSONRPC dispatchers, non-Starlette ASGI apps) existed only in a docstring. New README subsection shows the one-line flag on
protected_router()andKeycardAuthBackend, and notes/.well-known/metadata stays public regardless.Validation
Package suite 105/105 (1 new test), ruff clean, commit messages validate.
🤖 Generated with Claude Code