Add an OAuth authorization server for external agents - #2415

Draft

MarceloRGonc wants to merge 30 commits into

mainfrom

Commits on Jul 28, 2026

Add OAuth configuration, entities and schema
MarceloRGonc
committed
956ff8b
Add OAuth protocol primitives
MarceloRGonc
committed
b6f62ab
Add OAuth issuance, revocation and token exchange
MarceloRGonc
committed
c1f7a89
Authenticate OAuth tokens with positive audience enforcement
MarceloRGonc
committed
5fe3eba
Add OAuth endpoints, discovery and cleanup, behind a feature flag
MarceloRGonc
committed
d9e2270
Cover OAuth database semantics with integration tests
MarceloRGonc
committed
15c917a
Document external-agent OAuth and add a flow script
MarceloRGonc
committed
5814799
Make OAuth config tests independent of the local environment

MarceloRGonc
and
claude
committed
640deca
Pass the tool allow-list to the MCP server as a file

MarceloRGonc
and
claude
committed
d826965
Add the OAuth consent screen

MarceloRGonc
and
claude
committed
bc4c289

Commits on Jul 29, 2026

Move consent into a dialog on a Connected apps settings page

MarceloRGonc
and
claude
committed
04156b7
Record why the OAuth principal must stay SERVICE

MarceloRGonc
and
claude
committed
c348055
Let a connection switch project, bounded by membership

MarceloRGonc
and
claude
committed
4539448
Drop the project row from the consent screen

MarceloRGonc
and
claude
committed
244827b
Stop tracking the local engine code cache

MarceloRGonc
and
claude
committed
9df350a
Bring the design doc back in line with what shipped

MarceloRGonc
and
claude
committed
9638167
Drop three write-only columns and the responses that carried them

MarceloRGonc
and
claude
committed
3a5314f
Move the project off the grant, onto the refresh token

MarceloRGonc
and
claude
committed
458da69
Style connected apps after the integrations card, with a red Disconnect

MarceloRGonc
and
claude
committed
3a904a8
Drop the divider under the connected apps heading

MarceloRGonc
and
claude
committed
79f4a76
Match the settings page title to the other settings routes

MarceloRGonc
and
claude
committed
8337fcc
Merge branch 'main' into mg/OPS-4673
MarceloRGonc
authored
c02430e
Address PR review: cleanup handler, retention anchor, module-scope t()

MarceloRGonc
and
claude
committed
06e5d5c

Commits on Jul 30, 2026

Import accessTokenManager after the mocks in the signup test

MarceloRGonc
and
claude
committed
5a1c6f1
Fix the SonarCloud findings worth fixing

MarceloRGonc
and
claude
committed
b975ebd
Bound the grant caches and validate the OAuth TTLs at boot

MarceloRGonc
and
claude
committed
c00f09c

Commits on Aug 5, 2026

WIP
MarceloRGonc
committed
b1024aa

Commits on Aug 12, 2026

Merge main
MarceloRGonc
committed
49164a2
Revert
MarceloRGonc
committed
44fab3f

Commits on Aug 14, 2026

Merge branch 'main' into mg/OPS-4673
MarceloRGonc
authored
6a5491f