loom-kernel 5.0.0__tar.gz → 6.0.0__tar.gz

{loom_kernel-5.0.0 → loom_kernel-6.0.0}/CHANGELOG.md

@@ -459,6 +459,10 @@
 
 ### core
 
+- **core:** `sql_endpoint.auth` admits only `identity` and `external`;
+  `auth: jwt` is refused when the config is loaded, and the alias and its
+  `DeprecationWarning` are gone. Migration: replace `auth: jwt` with
+  `auth: identity`.
 - **core:** with no `LOOM_ENV` and no `environment=`, a process starts as
   `production` and runs the deploy checks; an API without authentication now
   fails at startup with `loom.rest.E001` until it configures

{loom_kernel-5.0.0 → loom_kernel-6.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: loom-kernel
-Version: 5.0.0
+Version: 6.0.0
 Summary: Loom Python project
 License-File: LICENSE
 Classifier: Programming Language :: Python :: 3

{loom_kernel-5.0.0 → loom_kernel-6.0.0}/src/loom/core/sql/config.py

@@ -8,7 +8,6 @@ invalid values abort the parse and surface as
 from __future__ import annotations
 
 import re
-import warnings
 from collections.abc import Sequence
 from typing import Any, Literal
 
@@ -24,11 +23,7 @@ _URL_CREDENTIALS_RE = re.compile(r"://[^@]+@")
 
 # The only ``sql_endpoint.auth`` mode carrying a verified caller identity, and
 # therefore the only one able to bind a request to a subset of the allowlist.
-# ``jwt`` is the deprecated spelling of the same mode, kept because it named a
-# mechanism where the contract only ever needed "the framework knows the caller".
 _IDENTITY_BOUND_AUTH = "identity"
-_DEPRECATED_AUTH_ALIAS = "jwt"
-_IDENTITY_BOUND_AUTH_MODES = frozenset({_IDENTITY_BOUND_AUTH, _DEPRECATED_AUTH_ALIAS})
 
 
 def _redact_url(url: str) -> str:
@@ -69,36 +64,25 @@ class SqlEndpointConfig(LoomFrozenStruct, frozen=True, kw_only=True, forbid_unkn
             authenticates the caller with the configured mechanism and binds
             roles to their verified identity) or ``"external"`` (explicit
             acknowledgement that the operator provides authentication, with no
-            identity the framework can read).  ``"jwt"`` is a deprecated alias
-            of ``"identity"``.
+            identity the framework can read).  Any other value fails the
+            parse.
         path: Mount path override. Defaults to ``/sql/{name}`` when ``None``.
         include_in_schema: Whether the endpoint appears in the OpenAPI schema.
     """
 
     enabled: bool = False
-    auth: Literal["identity", "jwt", "external"] | None = None
+    auth: Literal["identity", "external"] | None = None
     path: str | None = None
     include_in_schema: bool = False
 
-    def __post_init__(self) -> None:
-        if self.auth != _DEPRECATED_AUTH_ALIAS:
-            return
-        warnings.warn(
-            f"sql_endpoint.auth: {_DEPRECATED_AUTH_ALIAS!r} is deprecated because it names "
-            f"a mechanism instead of a contract. Use {_IDENTITY_BOUND_AUTH!r}: the endpoint "
-            "requires a verified caller, whichever authenticator provides it.",
-            DeprecationWarning,
-            stacklevel=3,
-        )
-
     @property
     def binds_identity(self) -> bool:
         """Whether this endpoint requires an identity the framework can read.
 
         Returns:
-            ``True`` for ``"identity"`` and its deprecated ``"jwt"`` alias.
+            ``True`` for ``"identity"``.
         """
-        return self.auth in _IDENTITY_BOUND_AUTH_MODES
+        return self.auth == _IDENTITY_BOUND_AUTH
 
 
 class SqlConnectionConfig(LoomFrozenStruct, frozen=True, kw_only=True, forbid_unknown_fields=True):