Skip to content

v0.30.0

Choose a tag to compare

View all tags
@rustyconover rustyconover released this 28 Aug 15:30
· 43 commits to main since this release
v0.30.0
e918dc7

Client-driven OAuth (device-code flow)

Client/Client.from_http gained oauth=/oauth_refresh_token=/
oauth_flow=/oauth_timeout_seconds=/oauth_prompt= constructor kwargs,
wired to the new vgi_rpc.http.VgiOAuthAuth (vgi-rpc 0.44.1+): obtain and
refresh bearer tokens automatically via OAuth device-code login whenever
the worker answers 401 with an RFC 9728 challenge. Client.oauth_identity()
reads back the signed-in identity's parsed id_token claims.

oauth/oauth_refresh_token are mutually exclusive with both
bearer_token (two credential sources) and httpx_client (the escape
hatch stays verbatim-or-nothing).

PKCE (browser-driven authorization-code flow) is not yet implemented on
the vgi-rpc side; oauth_flow="pkce" raises a clear NotImplementedError.

Live-verified against a real OAuth-gated worker (Google device-code auth):
discovery, challenge parsing, and the device-code request all completed
correctly against production infrastructure.

Requires vgi-rpc>=0.44.1.

Other changes

  • Fix Worker.run()'s --unix Windows dispatch: named pipe, not AF_UNIX
  • Pre-existing lint/type fixes unrelated to the above (test-only)

Known issue: the Windows CI legs are currently red due to a pre-existing
bug in vgi-rpc's launcher module (unconditional socket.AF_UNIX use) --
tracked separately, does not affect this release's actual functionality
on Windows outside the transport="launch" path.

Assets 2
Loading