fix(iroh): compose framework identity and published RPC package

Author: rustyconover

docs/how-to/iroh.md

@@ -66,7 +66,7 @@ route, and configure the worker to trust only the intermediary's exact address.
 
 The same high-level client accepts both endpoint schemes:
 
-```python
+```python test="skip"
 from vgi.client import Client
 
 with Client.from_iroh("iroh://<endpoint-id>") as client:
@@ -78,7 +78,7 @@ with Client.from_iroh("httpi://<endpoint-id>/vgi") as client:
 
 For a private relay:
 
-```python
+```python test="skip"
 client = Client.from_iroh(
     "httpi://<endpoint-id>/vgi",
     relay_urls=["https://relay.example.com"],

pyproject.toml

@@ -265,10 +265,6 @@ members = ["packages/vgi-fixtures"]
 [tool.uv.sources]
 # duckdb = { path = "/path/to/duckdb-python/dist/duckdb-*.whl" }  # local engine-build override
 vgi-fixtures = { workspace = true }
-# Peer-identity support is on vgi-rpc main while 0.45.0 awaits publication.
-# The built wheel still declares the normal PyPI requirement above; this pin
-# only makes source-checkout development and CI reproducible in the interim.
-vgi-rpc = { git = "https://github.com/Query-farm/vgi-rpc-python.git", rev = "ab3108e242ed3fa35ee684c882f74813c35ad7ab" }
 
 [dependency-groups]
 dev = ["lxml>=6.0.2", "pytest-timeout>=2.4.0", "vgi-fixtures"]

tests/test_serve.py

@@ -264,6 +264,32 @@ def test_accepts_trusted_iroh_bridge_identity(self) -> None:
         )
         assert isinstance(app, falcon.App)
 
+    def test_iroh_identity_composes_with_explicit_peer_authentication(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        """Adding Iroh evidence preserves existing providers and policy."""
+        import falcon
+
+        seen: dict[str, Any] = {}
+        provider = _StaticTailnetProvider()
+        policy = peer_identity_primary("tailscale")
+
+        def fake_make_wsgi_app(server: object, **kwargs: Any) -> falcon.App:
+            seen.update(server=server, **kwargs)
+            return falcon.App()
+
+        monkeypatch.setattr("vgi_rpc.http.make_wsgi_app", fake_make_wsgi_app)
+        create_app(
+            _SingleWorker,
+            describe=False,
+            peer_identity_providers=(provider,),
+            peer_authentication_policy=policy,
+            iroh_bridge_issuer="test-mesh",
+        )
+
+        providers = seen["peer_identity_providers"]
+        assert providers[0] is provider
+        assert len(providers) == 2
+        assert seen["peer_authentication_policy"] is policy
+
     def test_custom_prefix(self) -> None:
         """Custom prefix is used in the app."""
         app = create_app(_SingleWorker, prefix="/api")

uv.lock

@@ -1137,11 +1137,7 @@ def _get_or_create_httpx_client(self) -> Any:
             assert self._iroh_endpoint is not None
             target = parse_iroh_uri(self._iroh_endpoint)
             native_transport = IrohHttpTransport(self._iroh_endpoint, **self._iroh_options)
-            iroh_headers = (
-                {"Authorization": f"Bearer {self._bearer_token}"}
-                if self._bearer_token is not None
-                else None
-            )
+            iroh_headers = {"Authorization": f"Bearer {self._bearer_token}"} if self._bearer_token is not None else None
             self._httpx_client = httpx2.Client(
                 base_url=f"http://{target.endpoint_hex}",
                 transport=cast("Any", native_transport),

vgi/client/client.py

@@ -335,31 +335,32 @@ def create_app(
             "introspect_rate_limit": _resolve_introspect_rate_limit(introspect_rate_limit),
         }
 
-    peer_identity_providers: tuple[Any, ...] = ()
-    peer_authentication_policy: Any = None
+    effective_peer_identity_providers = tuple(peer_identity_providers)
+    effective_peer_authentication_policy = peer_authentication_policy
     if iroh_bridge_issuer is not None:
         from vgi_rpc.http import iroh_forwarded_header_provider
         from vgi_rpc.rpc import observe_peer_identity, peer_identity_primary
 
         trusted_iroh_addresses = tuple(iroh_trusted_proxy_addresses) or ("127.0.0.1",)
-        peer_identity_providers = (
+        effective_peer_identity_providers += (
             iroh_forwarded_header_provider(
                 issuer=iroh_bridge_issuer,
                 trusted_proxy_addresses=trusted_iroh_addresses,
             ),
         )
-        peer_authentication_policy = (
-            peer_identity_primary("iroh") if iroh_authenticate else observe_peer_identity
-        )
+        if effective_peer_authentication_policy is None:
+            effective_peer_authentication_policy = (
+                peer_identity_primary("iroh") if iroh_authenticate else observe_peer_identity
+            )
 
     wsgi_app = make_wsgi_app(
         server,
         prefix=prefix,
         cors_origins=cors_origins,
         token_key=signing_key,
         authenticate=authenticate,
-        peer_identity_providers=peer_identity_providers,
-        peer_authentication_policy=peer_authentication_policy,
+        peer_identity_providers=effective_peer_identity_providers,
+        peer_authentication_policy=effective_peer_authentication_policy,
         peer_service_name=peer_service_name,
         peer_resolution_timeout=peer_resolution_timeout,
         peer_provider_concurrency=peer_provider_concurrency,
@@ -368,8 +369,6 @@ def create_app(
         otel_config=otel_config,
         max_stream_response_bytes=max_stream_response_bytes,
         max_externalized_response_bytes=max_externalized_response_bytes,
-        peer_identity_providers=peer_identity_providers,
-        peer_authentication_policy=peer_authentication_policy,
         enable_landing_page=False,
         **introspect_kwargs,
     )
@@ -623,9 +622,7 @@ def serve(
             try:
                 raw_port = int(raw_port_text)
             except ValueError:
-                raise SystemExit(
-                    f"--iroh-raw-upstream expects [HOST:]PORT, got {iroh_raw_upstream!r}"
-                ) from None
+                raise SystemExit(f"--iroh-raw-upstream expects [HOST:]PORT, got {iroh_raw_upstream!r}") from None
 
             worker = worker_cls(quiet=quiet, log_level=effective_level)
             # Iroh is also a directly addressable RPC endpoint, so advertise