feat: mount the admin API at the router root by default - #318
Merged
Conversation
BREAKING: DefaultAdminPathPrefix changes from "/api/v1" to "" — admin routes (identities, agents, credential-policies, signals, attestation, oauth/clients, delegations) now serve at the server root, matching the SaaS deployment shape and what the highflame SDKs expect from 0.3.23 (both the Python and TypeScript SDKs address admin routes at the root, so they 404ed against a stock deployment). Deployments that scripted against /api/v1 set server.admin_path_prefix: "/api/v1" (or ZEROID_ADMIN_PATH_PREFIX) to keep the old shape. - server: when the admin group shares the router root, register its huma instances speclessly — a spec-carrying instance there shadowed the canonical /openapi.json behind the agent-auth 401 middleware (TestOAuthFormCompatOpenAPIAdvertisesFormContentType caught it) - CI: bump SDK pins to 0.3.23 (python smoke, TS smoke, notebook check) - CLI: bump @highflame/sdk ^0.3.9 → ^0.3.23; tokens.issue → issueApiKey; CIBA admin-prefix default "" to match the server; test mocks moved to root paths and given a mint handler for the SDK's admin-token exchange (0.3.23 authenticates admin calls when constructed with an apiKey) - CLI tests: isolate profile reads/writes via ZID_CONFIG_DIR — init tests were writing profiles into the developer's real ~/.config/zeroid - quickstart: tokens.revoke now requires RFC 7009 client auth in 0.3.23; pass the OAuth client credentials (verified end-to-end via nbmake against a fresh compose build; ipynb re-normalized by nbformat) - docs: attestation.md / dpop-and-dcr.md examples use root admin paths Verified: go vet, 497 unit + 680 integration tests (race), 110 CLI tests, quickstart notebook executed against the rebuilt compose stack with highflame==0.3.23. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
sdk-integration.yml still pinned 0.3.17 (missed alongside pr-check.yml),
and both smoke suites called tokens.revoke without client credentials,
which 0.3.23 refuses client-side per RFC 7009.
- token-lifecycle tests: deactivate the agent instead (the SDK's own
guidance for clientless revocation) and assert introspection dies
- Python delegation test: authenticate the revoke with the confidential
client the flow already creates
- TS delegation test: the TS SDK's tokens.revoke cannot carry client
credentials yet (body is just {token}) — deactivate the subject
identity instead; SDK gap noted inline
Verified locally against a root-mount server build: Python smoke 8/8,
TypeScript smoke 8/8 (testcontainers, SDK 0.3.23).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
jalbrethsen-highflame
approved these changes
Sep 4, 2026
rsharath
added a commit
that referenced
this pull request
Sep 4, 2026
…3.23 Follows #318 (admin API at the router root by default; SDK pins at 0.3.23). The raw-HTTP walkthrough's admin calls drop the /api/v1 prefix, the SDK walkthrough pins highflame==0.3.23 (which speaks the root-mounted admin plane natively), and the statement re-pins its evidence commit to current main (d2531cd: #304's require_dpop/attestation/CIBA fixes plus #318's root mount). The L1-09 caveat stands — 0.3.23 still cannot construct DPoP proofs (sdk#105). Both notebooks re-executed against a fresh compose build of this branch; committed outputs real, secrets lint clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
BREAKING:
DefaultAdminPathPrefixchanges from"/api/v1"to""— admin routes now serve at the server root.The current highflame SDKs (Python and TypeScript, ≥0.3.23) address admin routes at the server root, matching the SaaS deployment shape — so against a stock OSS deployment every admin call 404ed, and the repo was frozen on 0.3.17 pins throughout CI. Nothing inside the org consumes
/api/v1, so rather than adding a path knob to two SDKs, this aligns the OSS default with the shape the SDKs already speak:pip install highflame/npm install @highflame/sdknow work against a stock deployment with zero config.Deployments that scripted against
/api/v1keep the old shape with one line:server.admin_path_prefix: "/api/v1"(orZEROID_ADMIN_PATH_PREFIX).Changes
/openapi.jsonbehind the agent-auth 401 middleware (caught byTestOAuthFormCompatOpenAPIAdvertisesFormContentType)@highflame/sdk^0.3.9 → ^0.3.23;tokens.issue→issueApiKey; CIBA--admin-prefixdefault now matches the server; test mocks moved to root paths plus a mint handler for the SDK's admin-token exchange (0.3.23 authenticates admin calls when constructed with anapiKey)ZID_CONFIG_DIR— the init tests were silently writing profiles into the developer's real~/.config/zeroidtokens.revokerequires RFC 7009 client authentication in 0.3.23 — the notebook now passes the OAuth client credentialsattestation.md/dpop-and-dcr.mdexamples use root admin pathsVerification
go vet; 497 unit + 680 integration tests with-race(integration tests derive paths fromDefaultAdminPathPrefix, so they exercised the new mount)highflame==0.3.23api_key=(admin-bearer mint + authenticatedidentities.list)Follow-up
PR #317's ODIS notebooks/README still document 0.3.17 +
/api/v1; once this merges I'll rebase #317, migrate its raw-HTTP paths, and re-execute both notebooks.🤖 Generated with Claude Code