cayu.proxies.passthrough

Public Cayu API. Definitions are grouped by their public source module, and definitions from private implementation modules appear on their package’s page; adding a symbol does not move existing links. The import shown at each entry is a supported public namespace. Read the Python API overview and install the required extra.

`AllowlistProxy`

from cayu.proxies import AllowlistProxy

Vault-backed credential proxy gated by an explicit destination allowlist.

authorize_request allows only destinations whose host matches the allowlist (exact hostnames or *.example.com subdomain wildcards), the confused-deputy containment the passthrough tier skips. resolve is fail-closed: it requires scope["destination"] and refuses to hand out a secret bound for a destination that is not on the allowlist.

Bases: CredentialProxy.

supports_webbridge_credential_authority (method)

AllowlistProxy.supports_webbridge_credential_authority(authority: WebBridgeCredentialAuthority) -> bool

Declare compatibility only when the hosted origin is allowlisted.

resolve (method)

async AllowlistProxy.resolve(ref: SecretRef, *, scope: dict[str, Any] | None=None) -> ResolvedSecret

authorize_request (method)

async AllowlistProxy.authorize_request(*, destination: str, credential: SecretRef | None=None, action: str | None=None, metadata: dict[str, Any] | None=None) -> ProxyAuthorizationResult

init (method)

AllowlistProxy.__init__(vault: Vault, *, allowed_destinations: Sequence[str]) -> None

allowed_destinations (property)

AllowlistProxy.allowed_destinations() -> tuple[str, ...]

Release source · Runtime guarantees · Capability guides

`PassthroughProxy`

from cayu.proxies import PassthroughProxy

Credential proxy for trusted local development.

This adapter delegates secret resolution directly to the configured vault and allows every outbound destination. It is not a sandbox security boundary; production apps should provide a scoped proxy implementation.