v0.2.0 — WCL user-endpoint routing

Highlights

WCL: route through /api/v2/user when authenticated

Every report and guild GraphQL query previously went to /api/v2/client with the client-credentials token, even after a user completed an OAuth login. Private and guild-stealth reports therefore returned "permission denied" no matter how many times the user re-authenticated.

_graphql now delegates to _graphql_user whenever a non-expired user token is saved, so private reports become accessible as soon as the user has the right OAuth scope. Cache payloads are namespaced by endpoint family so client- and user-API responses can never collide on disk.

view-user-profile scope is now first-class

WCL requires the view-user-profile scope to establish a user identity; without it, userData.currentUser resolves to null and ACL checks fall through to anonymous. auth login, auth pkce-login, auth token, auth status, and doctor now expose scopes.granted, scopes.requested, scopes.has_view_user_profile, and a scope_warning when the scope is missing.

Authenticate with:

warcraftlogs auth login --scope view-user-profile --redirect-uri http://localhost:8787/callback

Public-API probes stay pinned to the client endpoint

rate_limit() and probe_live_public_api() use a new force_client=True opt-out so client-credential health checks always exercise /api/v2/client, even when a user token is saved. Without this, broken client credentials could be masked by a working user token.

Resilient auth state loading

load_provider_auth_state now returns None on OSError / JSONDecodeError, matching the contract provider_auth_status already followed. Corrupt or hand-edited state files no longer crash the CLI.

auth token no longer cries wolf

The scope_warning now only fires when there's actually a saved user token; fresh setup, logged-out, and corrupt-state cases report scope_warning: null.

Upgrading

pip install -U -e '.[dev]'
warcraftlogs auth login --scope view-user-profile --redirect-uri http://localhost:8787/callback

Existing tokens issued without view-user-profile will continue to work for public queries — auth status will report the missing scope so you know to re-auth before reaching for private data.

Full changelog

#7

🤖 Reviewed by Codex across 5 iterations until clean.