feat(BA-5584): migrate keypair auth plugin into core repository#10771
Open
feat(BA-5584): migrate keypair auth plugin into core repository#10771
Conversation
github-actions
bot
added
size:L
fregataa
added a commit
that referenced
this pull request
Apr 3, 2026
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR migrates the keypair auth plugin into the manager core codebase and registers it via the manager’s plugin entrypoints, while also fixing a BUILD configuration issue that previously overwrote some plugin registrations.
Changes:
- Add keypair auth webapp + hook plugin implementations under
src/ai/backend/manager/plugin/keypair/. - Register the new keypair plugin entrypoints and fix duplicate dict keys in
src/ai/backend/manager/BUILDso TOTP/OpenID entries don’t get overwritten. - Add a Towncrier feature fragment documenting the migration.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 11 comments.
Show a summary per file
| File | Description |
|---|---|
| src/ai/backend/manager/plugin/keypair/webapp.py | Adds /custom-auth/login webapp endpoint that issues an sToken and redirects. |
| src/ai/backend/manager/plugin/keypair/utils.py | Implements JWT-based sToken serialize/deserialize helpers and config lookup. |
| src/ai/backend/manager/plugin/keypair/hook.py | Adds AUTHORIZE hook plugin intended to authenticate via sToken/HMAC-like token parsing. |
| src/ai/backend/manager/plugin/keypair/exception.py | Defines plugin-specific exceptions for invalid/expired sTokens. |
| src/ai/backend/manager/plugin/keypair/init.py | Defines plugin version. |
| src/ai/backend/manager/BUILD | Registers keypair plugin entrypoints and fixes duplicate hook/webapp dict keys. |
| changes/10764.feature.md | Documents the migration as a feature. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Move backend.ai-auth-keypair-plugin source into src/ai/backend/manager/plugin/keypair/ and register entry points. Also fix duplicate dict keys in BUILD for openid/totp entry points. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
These plugins are now part of the core package and no longer need individual version identifiers. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fregataa
force-pushed
the
feat/BA-5584-migrate-keypair-auth-plugin
branch
from
32ae8b2 to
3a11a52
Compare
The openid plugin's webapp.py still imported __version__ which was removed in the previous commit. This caused CI typecheck and component test failures. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Read sign_params from request body instead of hook params - Use attribute access on Row objects instead of dict access - Select full user row for downstream compatibility Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
backend.ai-auth-keypair-pluginsource intosrc/ai/backend/manager/plugin/keypair/and register hook/webapp entry points in BUILDRootContext→_root_apppattern,ai.backend.auth.keypair→ai.backend.manager.plugin.keypair)backendai_hook_v20/backendai_webapp_v20dict keys in BUILD that caused TOTP entries to be silently overwritten by OpenID entriesTest plan
/custom-auth/login) redirects with valid sTokenResolves BA-5584