toolframe-auth 0.2.0__tar.gz → 0.3.0__tar.gz

{toolframe_auth-0.2.0 → toolframe_auth-0.3.0}/.github/workflows/ci.yml

@@ -3,6 +3,7 @@ name: Python CI
 on:
   pull_request:
   push:
+    branches: [main]
   workflow_dispatch:
   workflow_call:
     inputs:
@@ -37,7 +38,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ vars.TOOLFRAME_REPOSITORY_OWNER || github.repository_owner }}/toolframe-sdk
-          ref: ef91b609137a5fe7bae8e0c893e74b096ff06ffe
+          ref: 2cd153ec36c585a9adb5ad566effc2985d9e222d
           path: toolframe-sdk
           token: ${{ secrets.TOOLFRAME_READ_TOKEN || secrets.TOOLFRAME_DEPENDENCIES_TOKEN || github.token }}
           persist-credentials: false
@@ -45,9 +46,9 @@ jobs:
       - name: Check out the pinned SQLite provider
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          repository: ${{ vars.TOOLFRAME_REPOSITORY_OWNER || github.repository_owner }}/toolframe-storage-sqlite
-          ref: 67c3b0ac4365db81c6c866083330c6405f299dfd
-          path: toolframe-storage-sqlite
+          repository: ${{ vars.TOOLFRAME_REPOSITORY_OWNER || github.repository_owner }}/toolframe-sql-sqlite
+          ref: a2764f83840fb8ad71d7eaf138c7e09799ce19bd
+          path: toolframe-sql-sqlite
           token: ${{ secrets.TOOLFRAME_READ_TOKEN || secrets.TOOLFRAME_DEPENDENCIES_TOKEN || github.token }}
           persist-credentials: false
 

toolframe_auth-0.3.0/.github/workflows/quality.yml

@@ -0,0 +1,63 @@
+name: Code quality
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  branch-policy:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - name: Check the actual source branch
+        env:
+          BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
+        run: python scripts/check_branch_name.py "$BRANCH_NAME"
+
+  code-quality:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: '0.12.8'
+          enable-cache: false
+      - name: Check Python lint and formatting
+        run: uvx prek==0.5.5 run ruff-check ruff-format --all-files --show-diff-on-failure
+
+  commit-policy:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - uses: commit-check/commit-check-action@a61779784a953fd9047c001c102cfeac5cf26964 # commit-check 2.18.3
+        with:
+          message: true
+          branch: false
+          pr-title: true
+          pr-comments: false

toolframe_auth-0.3.0/.pre-commit-config.yaml

@@ -0,0 +1,29 @@
+default_install_hook_types: [pre-commit, commit-msg]
+default_stages: [pre-commit]
+default_language_version:
+  python: python3.11
+
+repos:
+  - repo: local
+    hooks:
+      - id: check-branch-name
+        name: Check branch naming policy
+        entry: python scripts/check_branch_name.py
+        language: python
+        always_run: true
+        pass_filenames: false
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.16.8
+    hooks:
+      - id: ruff-check
+        types_or: [python, pyi]
+        files: '^(src|tests|scripts)/'
+      - id: ruff-format
+        types_or: [python, pyi]
+        args: [--check]
+        files: '^(src|tests|scripts)/'
+  - repo: https://github.com/commit-check/commit-check
+    rev: v2.18.3
+    hooks:
+      - id: check-message
+        stages: [commit-msg]

toolframe_auth-0.3.0/CONTRIBUTING.md

@@ -0,0 +1,47 @@
+# Contributing
+
+## Commit hooks
+
+Install [prek](https://prek.j178.dev/) and enable the repository's hooks:
+
+```sh
+uv tool install prek==0.5.5
+prek install --allow-missing-config
+prek run --all-files
+```
+
+The missing-config option allows older worktrees without this configuration to
+keep working. Worktrees containing `.pre-commit-config.yaml` still run the checks.
+The `pre-commit` hook checks the branch name, Python lint, and formatting. The
+`commit-msg` hook checks Conventional Commits. Both Ruff hooks only check files;
+they do not rewrite a commit's contents. Fix lint and formatting explicitly:
+
+```sh
+uvx ruff==0.16.8 check --fix src tests scripts
+uvx ruff==0.16.8 format src tests scripts
+prek run --all-files
+```
+
+The Ruff version and checked paths are pinned in
+[the hook configuration](.pre-commit-config.yaml); the Python rules remain in
+[pyproject.toml](pyproject.toml). CI uses these same hooks on all tracked files
+within their configured paths. Existing package, integration, and release checks
+run independently.
+
+## Branches and commits
+
+[cchk.toml](cchk.toml) defines the allowed branch and commit types. Work branches
+use `feat/`, `fix/`, `release/`, or `chore/`, followed by lowercase ASCII letters
+and digits separated by single hyphens. Release versions may also contain dots,
+as in `release/v1.2.0-rc.1`; every separator must have an alphanumeric character on
+both sides. The default branch `main` is the standalone exception.
+
+Commit types are independent of branch types: for example,
+`docs: clarify setup` is valid on `chore/update-docs`. Commit-check uses Conventional
+Commits with its default subject length of 5–80 characters. Pull requests check
+their commits and title so the title can be used for a Conventional Commit when
+squash merging.
+
+Local hooks can be bypassed. CI reports `branch-policy`, `code-quality`, and
+`commit-policy`; maintainers must configure required status checks separately to
+make passing checks a merge requirement.

{toolframe_auth-0.2.0 → toolframe_auth-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: toolframe-auth
-Version: 0.2.0
+Version: 0.3.0
 Summary: Managed access passwords and sessions for Toolframe
 Project-URL: Homepage, https://github.com/toolframe/toolframe-auth
 Project-URL: Repository, https://github.com/toolframe/toolframe-auth
@@ -11,21 +11,21 @@ License-Expression: Apache-2.0
 License-File: LICENSE
 License-File: NOTICE
 Requires-Python: >=3.14
-Requires-Dist: toolframe-sdk==0.3.0
+Requires-Dist: toolframe-sdk==0.4.0
 Description-Content-Type: text/markdown
 
 # Toolframe Auth
 
 Authentication and grant decisions for access passwords, federated users and
 revocable agent delegation. This provider owns `auth`'s managed SQL store; it never opens
-database files itself. It requires SDK 0.3.0 and `toolframe.storage.sql`.
+database files itself. It requires SDK 0.4.0 and `toolframe.sql`.
 
 ## Install
 
 With a running Toolframe application and an active SQL storage provider:
 
 ```sh
-toolframe --home APP plugin add pypi:toolframe-auth==0.2.0 --enable
+toolframe --home APP plugin add pypi:toolframe-auth==0.3.0 --enable
 ```
 
 The [Entry Register template](https://github.com/toolframe/toolframe-core#readme)
@@ -127,3 +127,5 @@ unchanged SQLite history. Provision this plugin’s stable store owner with the
 PostgreSQL provider before enabling it. The application still runs one Core;
 retain its private keys and configuration with the application home. Existing
 SQLite records are not imported automatically.
+
+For development hooks and contribution rules, see [Contributing](CONTRIBUTING.md).

{toolframe_auth-0.2.0 → toolframe_auth-0.3.0}/README.md

@@ -2,14 +2,14 @@
 
 Authentication and grant decisions for access passwords, federated users and
 revocable agent delegation. This provider owns `auth`'s managed SQL store; it never opens
-database files itself. It requires SDK 0.3.0 and `toolframe.storage.sql`.
+database files itself. It requires SDK 0.4.0 and `toolframe.sql`.
 
 ## Install
 
 With a running Toolframe application and an active SQL storage provider:
 
 ```sh
-toolframe --home APP plugin add pypi:toolframe-auth==0.2.0 --enable
+toolframe --home APP plugin add pypi:toolframe-auth==0.3.0 --enable
 ```
 
 The [Entry Register template](https://github.com/toolframe/toolframe-core#readme)
@@ -111,3 +111,5 @@ unchanged SQLite history. Provision this plugin’s stable store owner with the
 PostgreSQL provider before enabling it. The application still runs one Core;
 retain its private keys and configuration with the application home. Existing
 SQLite records are not imported automatically.
+
+For development hooks and contribution rules, see [Contributing](CONTRIBUTING.md).

toolframe_auth-0.3.0/cchk.toml

@@ -0,0 +1,10 @@
+[commit]
+conventional_commits = true
+allow_commit_types = ["feat", "fix", "docs", "style", "refactor", "test", "chore", "perf", "build", "ci"]
+
+[branch]
+conventional_branch = true
+allow_branch_types = ["feat", "fix", "release", "chore"]
+allow_branch_names = ["main"]
+# scripts/check_branch_name.py enforces these names literally, without the
+# additional standalone branch exceptions built into commit-check.

{toolframe_auth-0.2.0 → toolframe_auth-0.3.0}/docs/ci.md

@@ -14,8 +14,8 @@ never used or modified.
 
 | Repository | Required commit |
 | --- | --- |
-| `toolframe-sdk` | `ef91b609137a5fe7bae8e0c893e74b096ff06ffe` |
-| `toolframe-storage-sqlite` | `67c3b0ac4365db81c6c866083330c6405f299dfd` |
+| `toolframe-sdk` | `2cd153ec36c585a9adb5ad566effc2985d9e222d` |
+| `toolframe-sql-sqlite` | `a2764f83840fb8ad71d7eaf138c7e09799ce19bd` |
 
 By default, both repositories are siblings of this checkout. Use `--sdk-repo`
 and `--storage-repo` to point to other local clones. Internet access is required
@@ -51,8 +51,8 @@ uses editable installs or `--no-deps`.
 
 ## GitHub Actions
 
-`ci.yml` runs for pushes, pull requests, manual dispatch and calls from the
-publish workflow. It runs the local script on `ubuntu-24.04`, Python 3.14.7 and
+`ci.yml` runs for pushes to `main`, pull requests, manual dispatch and calls from
+the publish workflow. It runs the local script on `ubuntu-24.04`, Python 3.14.7 and
 uv 0.12.8, then stores `toolframe-auth-dist` for seven days. Validation has a
 20-minute timeout and read-only `contents` permission. Action versions are
 pinned to full commit SHAs. The reusable workflow has no concurrency group that

{toolframe_auth-0.2.0 → toolframe_auth-0.3.0}/docs/releasing.md

@@ -10,7 +10,7 @@ artifacts produced by that successful run.
 Run the repository's existing validation workflow; its local commands and
 integration coverage are described in [CI](ci.md).
 
-Publish `toolframe-sdk==0.3.0` first. The coordinated order and native CLI channels are documented in
+Publish `toolframe-sdk==0.4.0` first. The coordinated order and native CLI channels are documented in
 [Toolframe's release guide](https://github.com/toolframe/toolframe-core/blob/main/docs/releasing.md).
 
 ## Trusted Publishers
@@ -49,7 +49,7 @@ After PyPI publication, verify a clean installation:
 
 ```sh
 uv venv --python 3.14.7 build/consumer
-uv pip install --python build/consumer/bin/python 'toolframe-auth==0.2.0'
+uv pip install --python build/consumer/bin/python 'toolframe-auth==0.3.0'
 uv pip check --python build/consumer/bin/python
 ```
 

{toolframe_auth-0.2.0 → toolframe_auth-0.3.0}/pyproject.toml

@@ -4,14 +4,14 @@ build-backend = "hatchling.build"
 
 [project]
 name = "toolframe-auth"
-version = "0.2.0"
+version = "0.3.0"
 description = "Managed access passwords and sessions for Toolframe"
 readme = "README.md"
 license = "Apache-2.0"
 license-files = ["LICENSE", "NOTICE"]
 authors = [{ name = "byfb", email = "62798989+byfb@users.noreply.github.com" }]
 requires-python = ">=3.14"
-dependencies = ["toolframe-sdk==0.3.0"]
+dependencies = ["toolframe-sdk==0.4.0"]
 
 [project.urls]
 Homepage = "https://github.com/toolframe/toolframe-auth"
@@ -23,11 +23,11 @@ Issues = "https://github.com/toolframe/toolframe-auth/issues"
 auth = "toolframe_auth.plugin:plugin"
 
 [dependency-groups]
-dev = ["pytest>=8,<10", "pytest-asyncio>=1,<2", "ruff>=0.12,<1", "toolframe-storage-sqlite==0.3.1"]
+dev = ["pytest>=8,<10", "pytest-asyncio>=1,<2", "ruff>=0.12,<1", "toolframe-sql-sqlite==0.4.0"]
 
 [tool.uv.sources]
 toolframe-sdk = { path = "../toolframe-sdk", editable = true }
-toolframe-storage-sqlite = { path = "../toolframe-storage-sqlite", editable = true }
+toolframe-sql-sqlite = { path = "../toolframe-sql-sqlite", editable = true }
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]

toolframe_auth-0.3.0/scripts/check_branch_name.py

@@ -0,0 +1,59 @@
+"""Validate a working branch using the repository's cchk.toml policy."""
+
+import argparse
+import re
+import subprocess
+import sys
+import tomllib
+from pathlib import Path
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("branch", nargs="?", help="actual source branch in CI")
+    args = parser.parse_args()
+    root = Path(__file__).resolve().parent.parent
+    policy = tomllib.loads((root / "cchk.toml").read_text())["branch"]
+    branch = args.branch
+    if branch is None:
+        result = subprocess.run(
+            ["git", "symbolic-ref", "--quiet", "--short", "HEAD"],
+            cwd=root,
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        if result.returncode:
+            print(
+                "Pass the actual source branch when HEAD is detached.", file=sys.stderr
+            )
+            return 1
+        branch = result.stdout.strip()
+
+    if branch in policy["allow_branch_names"]:
+        return 0
+    prefix, separator, description = branch.partition("/")
+    pattern = (
+        r"[a-z0-9]+(?:[.-][a-z0-9]+)*"
+        if prefix == "release"
+        else r"[a-z0-9]+(?:-[a-z0-9]+)*"
+    )
+    if (
+        separator
+        and prefix in policy["allow_branch_types"]
+        and re.fullmatch(pattern, description)
+    ):
+        return 0
+
+    allowed = ", ".join(policy["allow_branch_types"])
+    print(
+        f"Invalid branch {branch!r}. Use <type>/<description> with type: {allowed}. "
+        "Use lowercase letters and digits separated by single hyphens; "
+        "release versions may also contain dots.",
+        file=sys.stderr,
+    )
+    return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{toolframe_auth-0.2.0 → toolframe_auth-0.3.0}/scripts/ci.py

@@ -16,8 +16,8 @@ from pathlib import Path
 
 ROOT = Path(__file__).resolve().parents[1]
 DEPENDENCIES = {
-    "toolframe-sdk": "ef91b609137a5fe7bae8e0c893e74b096ff06ffe",
-    "toolframe-storage-sqlite": "67c3b0ac4365db81c6c866083330c6405f299dfd",
+    "toolframe-sdk": "2cd153ec36c585a9adb5ad566effc2985d9e222d",
+    "toolframe-sql-sqlite": "a2764f83840fb8ad71d7eaf138c7e09799ce19bd",
 }
 
 
@@ -57,7 +57,7 @@ def main():
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("--sdk-repo", type=Path, default=ROOT.parent / "toolframe-sdk")
     parser.add_argument(
-        "--storage-repo", type=Path, default=ROOT.parent / "toolframe-storage-sqlite"
+        "--storage-repo", type=Path, default=ROOT.parent / "toolframe-sql-sqlite"
     )
     parser.add_argument(
         "--output", type=Path, help="Empty directory for validated artifacts"
@@ -110,7 +110,7 @@ def main():
         wheelhouse = workspace / "dependency-wheels"
         for name, repository in (
             ("toolframe-sdk", args.sdk_repo),
-            ("toolframe-storage-sqlite", args.storage_repo),
+            ("toolframe-sql-sqlite", args.storage_repo),
         ):
             destination = workspace / name
             destination.mkdir()
@@ -229,11 +229,11 @@ from toolframe_auth.crypto import new_verifier, verifier
 location = pathlib.Path(toolframe_auth.__file__).resolve()
 assert location.is_relative_to(pathlib.Path(sys.prefix).resolve())
 assert metadata.version("toolframe-auth") == sys.argv[1]
-assert metadata.version("toolframe-sdk") == "0.3.0"
+assert metadata.version("toolframe-sdk") == "0.4.0"
 entry_point, = metadata.distribution("toolframe-auth").entry_points
 assert entry_point.group == "toolframe.plugins" and entry_point.name == "auth"
 assert entry_point.load() is plugin
-assert importlib.util.find_spec("toolframe_storage_sqlite") is None
+assert importlib.util.find_spec("toolframe_sql_sqlite") is None
 assert importlib.util.find_spec("pytest") is None
 salt, hashed = new_verifier("smoke-password")
 assert verifier("smoke-password", salt) == hashed

{toolframe_auth-0.2.0 → toolframe_auth-0.3.0}/src/toolframe_auth/plugin.py

@@ -99,7 +99,7 @@ class AuthProvider(Plugin):
         super().__init__(context)
         self.lock = asyncio.Lock()
         self.key = None
-        self.store = context.storage()
+        self.store = context.sql()
         self.idle = context.config.get("session_idle_seconds", 86400)
         self.lifetime = context.config.get("session_max_seconds", 604800)
         self.pending_hashes = 0
@@ -413,7 +413,7 @@ plugin = PluginDefinition(
     factory="toolframe_auth.plugin:AuthProvider",
     authorization=AuthorizationSpec(),
     private_secrets=("password-lookup",),
-    requires={"storage": Requirement(service="toolframe.storage.sql")},
+    requires={"sql": Requirement(service="toolframe.sql")},
     services={
         SERVICE: ServiceSpec(
             methods={

{toolframe_auth-0.2.0 → toolframe_auth-0.3.0}/tests/test_auth.py

@@ -7,7 +7,7 @@ from contextlib import contextmanager
 
 import pytest
 from toolframe_sdk import PluginError, Principal, RuntimeContext, call_context
-from toolframe_storage_sqlite.plugin import ADMIN_SERVICE, SQL_SERVICE, SqliteProvider
+from toolframe_sql_sqlite.plugin import ADMIN_SERVICE, SQL_SERVICE, SqliteProvider
 
 from toolframe_auth.crypto import lookup, new_verifier
 from toolframe_auth.plugin import SERVICE, AuthProvider, plugin
@@ -43,7 +43,7 @@ class StoragePeer:
         self.provider = provider
 
     async def request(self, method, params, timeout=None):
-        assert method == "service.call" and params["alias"] == "storage"
+        assert method == "service.call" and params["alias"] == "sql"
         token = call_context.set(
             {
                 "application_id": "test",
@@ -65,7 +65,7 @@ class StoragePeer:
 async def auth(tmp_path):
     storage = SqliteProvider(
         RuntimeContext(
-            None, plugin_id="storage-sqlite", generation="one", state_directory=tmp_path
+            None, plugin_id="sql-sqlite", generation="one", state_directory=tmp_path
         )
     )
     await storage.activate()

{toolframe_auth-0.2.0 → toolframe_auth-0.3.0}/uv.lock

@@ -282,7 +282,7 @@ wheels = [
 
 [[package]]
 name = "toolframe-auth"
-version = "0.2.0"
+version = "0.3.0"
 source = { editable = "." }
 dependencies = [
     { name = "toolframe-sdk" },
@@ -293,7 +293,7 @@ dev = [
     { name = "pytest" },
     { name = "pytest-asyncio" },
     { name = "ruff" },
-    { name = "toolframe-storage-sqlite" },
+    { name = "toolframe-sql-sqlite" },
 ]
 
 [package.metadata]
@@ -304,12 +304,12 @@ dev = [
     { name = "pytest", specifier = ">=8,<10" },
     { name = "pytest-asyncio", specifier = ">=1,<2" },
     { name = "ruff", specifier = ">=0.12,<1" },
-    { name = "toolframe-storage-sqlite", editable = "../toolframe-storage-sqlite" },
+    { name = "toolframe-sql-sqlite", editable = "../toolframe-sql-sqlite" },
 ]
 
 [[package]]
 name = "toolframe-sdk"
-version = "0.3.0"
+version = "0.4.0"
 source = { editable = "../toolframe-sdk" }
 dependencies = [
     { name = "jsonschema" },
@@ -335,9 +335,9 @@ dev = [
 ]
 
 [[package]]
-name = "toolframe-storage-sqlite"
-version = "0.3.1"
-source = { editable = "../toolframe-storage-sqlite" }
+name = "toolframe-sql-sqlite"
+version = "0.4.0"
+source = { editable = "../toolframe-sql-sqlite" }
 dependencies = [
     { name = "toolframe-sdk" },
 ]