Stability#
What you can build against today, and what may change before 1.0.0.
The two packages#
Backend |
|
Frontend |
|
They are versioned and released together. See Install the backend and Install the frontend.
What alpha means here#
A change to a registry record, a content type or a plugin reaches an existing site when the profile is reapplied, and only then.
pas.plugins.identity:default is at version 1010 and declares an upgrade step for each thing a reapplied profile cannot carry: a persistent object written at install, and a value only a walk of the site can compute.
pas.plugins.identity.server:default is at 1001 and does the same.
Upgrade lists what each step does.
Plan for that: treat an alpha site as one you can rebuild, and read Upgrade before taking a new release.
Settled#
These are covered by tests that fail loudly if they change.
Area |
What holds |
Enforced by |
|---|---|---|
Layer boundaries |
Core imports nothing from the |
four import-linter contracts, run in CI |
No-extras install |
The package installs and imports with no extras |
the |
The Python import path |
Names published by Python API are imported from |
a test for each group of calls, asserting the names it documents |
Uninstall |
Every profile has a matching uninstall profile that leaves nothing behind |
uninstall tests per profile |
Account data |
Uninstalling removes types, catalog and workflows, and no |
uninstall tests |
Security properties |
The list in Security guarantees |
the test suite |
Python and Plone |
Plone 6.2 on Python 3.12, 3.13 and 3.14 |
the CI matrix |
Not settled#
Expect these to change without a migration path before 1.0.0.
Area |
Why it may move |
|---|---|
REST endpoint names and payloads |
Named in Endpoints; no deprecation cycle yet |
Registry keys and defaults |
Named in Settings; a rename means a reinstall |
The driver contract |
Driver contract is the current shape; a third-party driver may need edits |
The scope serializer contract |
Serialize a claim is the current shape; a downstream serializer may need edits |
Frontend routes and component names |
Named in Frontend; shadowed components especially |
The |
One table today, and no migration tooling for it |
Event interfaces |
Named in Events |
Individual names in the Python API |
The import path is settled; what is published at it may still gain and rename members before 1.0.0. Python API is the current surface |
Classic UI#
Sign-in requires the Volto frontend. The add-on registers no Classic UI login view, viewlet or form, so a site without Volto has no way to start a sign-in.
Classic UI support is intended, and is not in this release.
One part already works without Volto: the authorization server's consent screen is a server-rendered page template, so a site running the server layer can be an identity provider for other applications regardless of which frontend it uses itself.
Reporting#
Report a security vulnerability privately, following SECURITY.md. Report anything else as a GitHub issue.