Kyle Isom
39d9ffb79a
Services send service_name and tags in POST /v1/auth/login. MCIAS evaluates auth:login policy with these as the resource context after credentials are verified, enabling rules like: deny guest/viewer human accounts from env:restricted services deny guest accounts from specific named services - loginRequest: add ServiceName and Tags fields - handleLogin: evaluate policy after credential+TOTP check; policy deny returns 403 (not 401) to distinguish access restriction from bad credentials - Go client: Options.ServiceName/Tags stored on Client, sent automatically in every Login() call - Python client: service_name/tags on __init__, sent in login() - Rust client: ClientOptions.service_name/tags, LoginRequest fields, Client stores and sends them in login() - openapi.yaml: document service_name/tags request fields and 403 response for policy-denied logins - engineering-standards.md: document service_name/tags in [mcias] config section with policy examples Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This directory contains client libraries for the MCIAS REST API. All language implementations expose this API:
Client(server_url, [ca_cert_path], [token])
login(username, password, [totp_code]) → (token, expires_at)
logout() → void
renew_token() → (token, expires_at)
validate_token(token) → {valid, sub, roles, expires_at}
get_public_key() → {kty, crv, x}
health() → void # raises/errors on 5xx
create_account(username, account_type, [password]) → account
list_accounts() → [account]
get_account(id) → account
update_account(id, [status]) → account
delete_account(id) → void
get_roles(account_id) → [role]
set_roles(account_id, roles) → void
issue_service_token(account_id) → (token, expires_at)
revoke_token(jti) → void
get_pg_creds(account_id) → pg_creds
set_pg_creds(account_id, host, port, database, username, password) → void
| Name | HTTP Status | Meaning |
|---|---|---|
MciasAuthError |
401 | Token missing, invalid, or expired |
MciasForbiddenError |
403 | Insufficient role |
MciasNotFoundError |
404 | Resource does not exist |
MciasInputError |
400 | Malformed request |
MciasConflictError |
409 | Conflict (e.g. duplicate username) |
MciasServerError |
5xx | Unexpected server error |
testdata/ contains canonical JSON response fixtures shared across language tests. |
go/— Go modulegit.wntrmute.dev/kyle/mcias/clients/gorust/— Rust cratemcias-clientlisp/— ASDF systemmcias-clientpython/— Python packagemcias_client