app.routers.auth_dev

Dev-only endpoints: POST /auth/dev/token and GET /auth/dev/roles.

Never enabled in production. app.main.create_app() imports and mounts this router only when ADRIANO_DEV_AUTH_ENABLED is true and ADRIANO_DEV_SHARED_SECRET is set, so the path is a plain 404 otherwise. It mints an HS256 token (app.auth.dev.mint_dev_token()) for any requested identity – that is the point of a dev login. GET /auth/dev/roles lists the loaded catalog’s role names so the dev sign-in dialog can offer presets that match this catalog.

app.routers.auth_dev.create_dev_token(body, settings=Depends(dependency=<functools._lru_cache_wrapper object>, use_cache=True, scope=None))

Mint a dev access token for the requested identity.

Parameters:

  • body (DevTokenIn) – Subject, name, email and roles.

  • settings (Settings) – Application settings.

Return type:

DevTokenOut

Returns:

The token and its lifetime in seconds.

Raises:

AuthUnavailableError – If the shared secret is not set.

app.routers.auth_dev.list_dev_roles(runtime=Depends(dependency=<function get_catalog_runtime>, use_cache=True, scope=None))

List the role names of the loaded catalog for dev sign-in presets.

Unauthenticated like the token route: the dev dialog calls it before anyone is signed in. It exposes role names and permissions only, never reviewer users.

Parameters:

runtime (CatalogRuntime | None) – Startup state (loaded configuration).

Return type:

DevRolesOut

Returns:

The rbac roles with their permissions and the approval-policy reviewer roles.