v0.3.0

Adds typed authentication v2 for browser sessions and personal API tokens, credential context, and explicit Litestar permission policies.

PAT verification bypasses caches and shared in-flight requests. Protected routes reject PATs unless their permission policy is declared; existing role and object-ownership checks remain required. Malformed verification responses and cacheable PAT responses are rejected.

Existing session behavior and explicitly configured legacy verification remain supported. Configure the verifier with /api/auth/verify/v2 to accept PATs.

Validated with make quality, including behavior tests, branch coverage, and isolated wheel/sdist installation. Release CI repeats the full checks on Python 3.13 and 3.14 before publishing to PyPI.

v0.2.0

0.2.0

• add optional auth options for litestar auth integration

v0.1.0

0.1.0

• Add typed auth principals, role checks, auth-api HTTP verification, and bounded per-process caching.
• Add the optional Litestar plugin with default-deny routes, public-route opt-out, role guards, and no-store responses.
• Add auth-http and litestar extras.
• Add a runnable Litestar example and artifact checks for the optional integrations.
• Fix positive-result caching, request-level redirect/timeout enforcement, strict bearer parsing, and OpenAPI component merging.
• Add backend_sdk.auth.testing with a configurable fake authentication client and bearer-header helper for consumer service tests.
• Allow AuthPlugin to omit HTTP client configuration when an authentication client is injected.