5.7.0 — 2026-10-03¶

Added¶

AuthenticatedUserDTO and ActorDTO - Added Keycloak DTOs describing the authenticated caller and the acting parties behind a token.
- ActorDTO carries an actor id and type (ActorType.USER or ActorType.CLIENT)
- AuthenticatedUserDTO exposes actor_chain, current_actor, is_impersonated, and propagation_headers()
- The bearer token is stored as a SecretStr and masked in repr and logs
- AuthContext in keycloak_utils remains as an alias of AuthenticatedUserDTO

ActorType - Added ActorType enum (USER, CLIENT) for RFC 8693 act claim entries.

Impersonation tracking - Request authentication now parses the RFC 8693 act claim emitted by Keycloak 26.8.
- Nested act claims are flattened into an actor chain, outermost (current) actor first, capped at 8 entries
- gRPC auth decorators set the actor chain on the auth context; FastAPI dependencies set request.state.actor_chain
- Impersonated requests are logged at INFO with the subject and the full actor chain
- propagation_headers() forwards the same bearer token so downstream services see the same act claim

Token exchange - Added exchange_token to the sync and async Keycloak adapters and ports.
- Pass requested_subject to impersonate a user via RFC 8693 token exchange

Constrained Pydantic types - DTO numeric fields now use PositiveInt, NonNegativeInt, and NonNegativeFloat instead of bare numbers with manual bounds.
- Applies to Parsian and Saman IPG, pagination, rate-limit window, Vault lease, email attachment, and Redis Search DTOs
- Redis KnnQueryDTO.k and the vector field dim must be positive; SearchQueryDTO.offset and limit must be non-negative
SortDTO and SearchInputDTO base class - Both now extend BaseDTO, so they are frozen and support from_attributes like other DTOs.

pydantic-extra-types - Added pydantic-extra-types>=2.11.1 as a direct dependency.