Repository navigation
Adds typed authentication v2 for browser sessions and personal API tokens, credential context, and explicit Litestar permission policies.
PAT verification bypasses caches and shared in-flight requests. Protected routes reject PATs unless their permission policy is declared; existing role and object-ownership checks remain required. Malformed verification responses and cacheable PAT responses are rejected.
Existing session behavior and explicitly configured legacy verification remain supported. Configure the verifier with /api/auth/verify/v2 to accept PATs.
Validated with make quality, including behavior tests, branch coverage, and isolated wheel/sdist installation. Release CI repeats the full checks on Python 3.13 and 3.14 before publishing to PyPI.