Skip to content

v0.0.9

New

  • Users, Roles, and Grants (woodglue.auth_store, woodglue.access): auth.db holds Users, Role assignments, and Personal Access Tokens, and every request is authorized against Grants defined as Roles in woodglue.yaml. Discovery (list_namespaces, list_methods, describe_method, llms.txt, method docs, openapi.json) shows only what the Caller may see. New system methods: whoami, create_token, list_tokens, revoke_token, and admin-only User management. New CLI: wgl user. Existing tokens migrate to the built-in admin Service User, and wgl token keeps working.
  • Sign-in with Identity Providers: auth.providers with kind: oidc (Google, Entra ID, Auth0, Okta) or kind: github. woodglue is its own OAuth client (PKCE, state, nonce). Each provider needs admit rules (email_domains, emails, groups, or anyone: true); default_roles, group_roles, and auth.admins are re-synced at every sign-in. A second provider with the same verified email links to the same User.
  • Trusted-proxy Identity Providers: kind: trusted_proxy_jwt (Cloudflare Access, Google IAP, oauth2-proxy; checked against jwks_url, issuer, audience, expiry) and kind: trusted_proxy_header (honored only from trusted_sources).
  • Sessions: browsers hold an HttpOnly, SameSite=Lax Session cookie (12h idle, 7 days at most), set by /auth/login, ended by /auth/logout. The cookie is Secure when auth.public_url is https.
  • Static UIs at /ui/<name>/ via uis.<name> in woodglue.yaml, with spa_fallback, public, and ui.default to choose what / opens. Opening a UI needs view on ui:<name>.
  • Process-backed UIs (Streamlit or any web server) via a Tornado proxy at /ui/<name>/: woodglue supervises the process on a loopback port, relays HTTP and websockets, strips its own Session cookie, and passes X-Woodglue-User and a Delegated Token. uis.<name>.grants narrows that token. App code uses woodglue.ui_support.current_user / current_client. Example in examples/streamlit/.
  • Caddy as an optional edge: GET /auth/verify answers Caddy's forward_auth, and wgl caddy config <site> prints a Caddyfile that serves Static UIs from disk and proxies everything else to woodglue.
  • wgl login --server=URL gets a Personal Access Token for a remote server through a loopback redirect with PKCE, storing it in $WOODGLUE_CONFIG_DIR/credentials.json (mode 0600). WoodglueClient uses the stored token when given none. wgl logout revokes and forgets it.
  • Run attribution: DAG runs record initiated_by (the User for RPC calls, cli:<os user> for wgl run, scheduler for scheduled runs), and trigger changes record changed_by. system.describe_initiators resolves User ids; the Console shows who started each run.

Changed

  • Breaking: the Console moves from /ui/ to /console/, behind view on ui:console. It has a Tokens page and Sign out, and no longer handles tokens.
  • Breaking: cookie-authenticated /rpc requests must be same-origin application/json (CSRF check). Bearer requests are unaffected.
  • Breaking: /rpc hides namespaces the Caller cannot see and returns -32003 for a visible namespace without a call Grant.
  • Breaking: /docs/* no longer accepts ?token=.
  • Breaking: woodglue.engine.activate_triggers and woodglue.engine.TriggerActivationResult are removed; use engine.trigger_manager.activate_configured(), which returns lythonic's TriggerActivationResult with the same fields.
  • Breaking: woodglue.token_store, woodglue.crypto, woodglue.service, and woodglue.utils.caddy are removed.
  • Enabling auth without storage.auth_db is now a startup error instead of serving everyone as an anonymous all-Grants Caller.
  • Delegated Tokens and narrowed tokens cannot mint lasting credentials (create_token, /auth/login, /auth/cli).

Documentation

  • README, index, and Getting Started describe Users, sign-in, the Console, project UIs, run attribution, wgl login, and Caddy.
  • New how-tos: access control, identity providers, static UIs, Streamlit UIs, and Caddy.
  • Glossary and ADRs for the auth and UI design.
  • Fixed namespace config and method-name examples that did not work.
  • Docs deploy pins Python 3.13.

Dependencies

  • lythonic upgraded 0.0.26 -> 0.0.28
  • New: pyjwt[crypto], strif

Decisions and tickets

New ADRs:

Closed:

  • 12 Auth: Users, Roles, Grants, and Personal Access Tokens

  • 13 Auth: HttpOnly Session cookie, CSRF checks, Console moves to /console/

  • 14 Auth: login with OIDC providers and GitHub

  • 15 UIs: host Static UIs at /ui//

  • 16 UIs: Process-backed UIs (Streamlit) via Tornado proxy

  • 17 Auth: trusted-proxy Identity Providers (JWT and header)

  • 18 Caddy: optional edge with forward_auth and wgl caddy config

  • 19 Runs: record which User caused each run

  • 20 CLI: wgl login with loopback redirect