feat!: unwrap authup single-resource envelope - #128
Open
tada5hi wants to merge 2 commits into
Open
Conversation
authup wraps every single-record entity response in a data/meta envelope since 1.0.0-beta.57 (authup/authup@00f2f4c3a, "feat: query-capability discovery via meta.schema + entity record response envelope", #3332). getOne, create, update and delete of all entity controllers now respond with {"data": ..., "meta": ...} instead of the entity itself, mirroring the envelope that collection responses have always used. meta carries response-scoped extras such as the queryable schema of the endpoint. The OAuth2 protocol surface (token, introspect, revoke, ...) stays flat, so _auth_flows is unaffected. Add the _unwrap_single_resource hook to BaseClient, which returns the response body unchanged, and call it in _create_resource, _get_single_resource and _update_resource. AuthClient overrides the hook to return the data property and raises a ValueError naming the required authup version if the property is absent. The FLAME Hub core and storage services keep responding with the bare entity, so CoreClient and StorageClient are untouched. Collection responses were already validated as an envelope by ResourceList. BREAKING CHANGE: AuthClient requires authup 1.0.0-beta.57 or newer.
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…single-resource-envelope Rebuild the envelope handling on top of the merged base. _base_client gained the _request indirection and per-request auth on main, so the _unwrap_single_resource hook is re-applied to the three call sites that validate a single resource, and the AuthClient override is re-applied to the camelCase auth client.
This was referenced Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #117.
Why
authup wraps every single-record entity response in a
data/metaenvelope since1.0.0-beta.57(authup/authup#3332).getOne,create,updateanddeleteof all entity controllers now respond with{"data": ..., "meta": ...}instead of the entity itself, mirroring the envelope that collection responses have always used.metacarries response-scoped extras such as the queryable schema of the endpoint. The OAuth2 protocol surface (token,introspect,revoke, …) stays flat, so_auth_flowsis unaffected.What
BaseClient._unwrap_single_resourceextracts the entity from the body of a single-resource response and returns it unchanged by default. It is called in_create_resource,_get_single_resourceand_update_resource.AuthClientoverrides the hook to return thedataproperty and raises aValueErrornaming the required authup version if the property is absent, instead of failing with aKeyErrordeep inside pydantic.CoreClientandStorageClientare untouched. Collection responses were already validated as an envelope byResourceList.Verification
Unit tests over a mocked transport cover get/create/update unwrapping, the rejection of an unwrapped body, untouched collection responses and the untouched
BaseClientdefault.Additionally smoke tested against a live
authup/authup:latest(1.0.0-beta.57) container: realm, role and user create → get → update → delete round-trip, as doesget_userwith an included realm.Follow-ups (not in this PR)
Two further beta.57 breaks surfaced while testing against the live instance:
/robots,/robot-permissionsand/robot-rolesrespond with 404, therobot_credentialsgrant is gone, and machine identities are OAuth2 clients now.create_robotand friends, theRobot*models,RobotAuthand the robot fixtures intests/test_auth.pyare dead against beta.57.Permission.policyIdno longer exists on the wire, which also breaks every response that includes a permission, such asfind_role_permissions.Client.isConfidentialis gone as well. New wire properties that the models do not expose:Permission.decisionStrategy,Client.authMethod,Client.tokenBindingMethod,Client.postLogoutRedirectUri,Client.accessPolicyId,Role.builtIn,Role.clientId,User.status,User.statusMessageandRolePermission.realmScope.