Add opt-in personal access token authentication - #31
Merged
Conversation
Opt-in "personal_access_token" config section (disabled by default): sha256 hashed bearer tokens bound to a user with expiration, revocation, versioned auth cache, throttled last-used tracking, ownership voter, management controller and console commands for creation and expiry notifications (pluggable notifier interface with a no-op default). The entity ships as a mapped superclass targeting the contracts AnzuUser via resolve_target_entities; the host subclasses it and owns the table, indexes and migration.
Final constructor makes the class-string instantiation in the facade safe and getUser() guards the nullable property explicitly.
The user_entity_class validation requires an existing AnzuUser subclass, so the extension test uses a test entity instead of a nonexistent class name; the facade test asserts the random token part without mangling the prefix.
…geApiTokenCommand The personal access token create gate no longer hardcodes ROLE_MCP - hosts using tokens for non-MCP integrations configure create_role instead. The pre-existing class_exists guard on EntityManagerInterface never matched an interface, so ChangeApiTokenCommand was silently unregistered.
Personal access token controller carries attribute routes like the other auth controllers (host imports them with a prefix) and the expiry notifier interface lives in Contracts next to the other extension interfaces.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Opt-in "personal_access_token" config section (disabled by default): sha256 hashed bearer tokens bound to a user with expiration, revocation, versioned auth cache, throttled last-used tracking, ownership voter, management controller and console commands for creation and expiry notifications (pluggable notifier interface with a no-op default). The entity ships as a mapped superclass targeting the contracts AnzuUser via resolve_target_entities; the host subclasses it and owns the table, indexes and migration.