Repository navigation
feat(auth): support Machine Identity JWT login - #62
Draft
Kayvan-Zahiri wants to merge 2 commits into
Draft
Kayvan-Zahiri wants to merge 2 commits into
Kayvan-Zahiri wants to merge 2 commits into
Conversation
|
✅ CLA satisfied. All contributors have signed the current CLA. The |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
…dentity-jwt-auth # Conflicts: # README.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Machine Identities configured with JWT Auth cannot use the Python SDK's authentication helpers:
client.auth.jwt_authis missing, whileoidc_authcorrectly targets a different endpoint and returns 404 for JWT-only identities.Add
client.auth.jwt_auth.login(identity_id, jwt, organization_slug=None)using the documented/api/v1/auth/jwt-auth/loginendpoint, parse the existingMachineIdentityLoginResponse, and set the client token after successful login. Keep OIDC behavior unchanged. Document the public entry point and add the HTTP-interception test dependency.Fixes #59. API contract: https://infisical.com/docs/api-reference/endpoints/jwt-auth/login
Validation:
pytest testspasses all 10 new offline tests. Before: 8 failed (missing jwt_auth), 2 OIDC controls passed. Tests use real Requests serialization throughresponses, check later-request Authorization headers, optional organization scoping, and 401/403 failures preserving the previous token. Repository-wide CI blocking Flake8 checks pass; new implementation/test files also pass full Flake8 at 99 columns.git diff --checkpasses.No live identities, JWTs, credentials, or Infisical resources used. The repository previously had no automated test suite enabled in CI. Bare pytest also discovers existing sink/example scripts that require unavailable local files; only the new offline
testssuite was run successfully.