Latest Results
fix(proxy): carry __match_args__ too, and document what stays off
Audited every class attribute `@dataclass` writes (CPython 3.10-3.14
`_process_class`) against what a synthesized proxy class exposes. Three are
plain data read off the class, where the proxy's instance forwarding cannot
answer: `__dataclass_fields__`, `__dataclass_params__` and `__match_args__`.
The last was still missing, so `type(value).__match_args__` raised on a
proxied dataclass while `value.__match_args__` worked.
Everything else it writes stays off the proxy class, now stated in the
comment so the set is not widened by reflex: the generated methods
(`__init__`, `__repr__`, `__eq__`, the ordering set, the frozen
`__setattr__`/`__delattr__` pair, `__replace__`, `__getstate__`) already
resolve through the wrapped object and would sidestep dirty tracking if
rebound here, while field defaults, ClassVars and `__slots__` would shadow
the wrapped instance outright -- a class attribute is found before
`__getattr__` runs, so a copied default wins over the instance's own value.
Tests cover a slots dataclass (layout must not leak), a
`match_args=False` one (absent metadata must not be invented), that no
behavior is copied, and that a frozen dataclass stays frozen through its
proxy.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VFzJWvNNwomK7nhsEN2ELRclaude/mutableproxy-dataclass-params-3wiemv docs: add a complete auth example app and sharpen authentication-vs-authorization framing (#7010)
* docs: add a complete auth example app and sharpen authn-vs-authz framing
Add docs/enterprise/auth/example-app.md: one small, complete app (public
landing page, protected dashboard, admin-only action) showing the whole
rxe.AuthPlugin pattern — authentication owned by the plugin, authorization
expressed with auth= checks — plus the common failure modes (rx.App() vs
rxe.App(), blank-when-logged-out, redirect_uri_mismatch, the deprecated
register_auth_endpoints).
Link it from the overview and secure-by-default pages and add it to the
enterprise sidebar after Secure by Default.
* docs: make the example app's public toggle observable and its per-client state explicit
The landing page now renders dark_mode (button label, page colors), so the
public field and handler have a visible effect, and the example states that
Reflex state is per-client — each user sees their own notes — instead of
presenting itself as a shared notepad.
* docs: make the example's notes truly multi-user and drop the ad-hoc dark mode
Per review: NotesState is now an rx.SharedState linked to one team token
from the dashboard's on_load (behind the page guard), so signed-in users
share one live board; the landing page's public surface is a dismissible
promo banner instead of a hand-rolled dark-mode toggle that shadowed the
framework's color-mode support.
* docs: trim redundant asides from the example page
The linked-token underscore rule lives in the Shared State doc this page
links to, and the SharedState version note is moot when the auth plugin
already requires a newer reflex.
* docs: fail closed on non-list groups claims in the example checks
Some providers serialize the groups claim as one string, and Python's 'in'
on a string is a substring test, so both example checks now require a list
before testing membership; a short note explains the guard.
* docs: cover app-owned roles and where the groups claim comes from
The example only showed a role the identity provider already manages, which
is the cheapest check there is but also the case an app rarely has. Roles
like author/editor/reviewer are the app's own, and promoting someone from
inside the app is impossible against an IdP -- there is no write-back. With
no guidance for that, the natural next step is a check that opens a database
session, and a check runs on every gated event.
Adds the variant: load the member's row into a state at sign-in and have an
async check read it through get_state, keyed on sub (or provider_name+sub,
since sub is unique only per issuer) rather than the optional email claim.
Also states where the claims actually come from. extra_scopes asks for a
scope, but a check reads whatever the provider's userinfo endpoint returns --
_get_userinfo prefers _fetch_userinfo and uses its response verbatim, falling
back to ID token claims only when the issuer advertises no userinfo endpoint.
A groups claim mapped only into the ID token therefore never reaches the
check, which returns False for everyone with nothing in the logs to explain
it. The 30-minute claim cache is noted beside it, since it is the same
surprise arriving later.
---------
Co-authored-by: Masen Furer <m_github@0x26.net> Latest Branches
+3%
claude/mutableproxy-dataclass-params-3wiemv +5%
claude/optimize-deterministic-hash-u1dl2j 0%
harsh21234i:fix/6975-bundled-library-subpaths © 2026 CodSpeed Technology