SentryAgent.ai Developer
|
03b5de300c
|
feat(phase-3): workstream 4 — AGNTCY Federation
Implements cross-IdP token verification for the AGNTCY ecosystem:
- Migration 015: federation_partners table (issuer, jwks_uri,
allowed_organizations JSONB, status, expires_at)
- FederationService: registerPartner (JWKS validation at registration),
listPartners, getPartner, updatePartner, deletePartner,
verifyFederatedToken (alg:none rejected, RS256/ES256 only,
allowedOrganizations filter, expiry enforcement)
- JWKS caching in Redis (TTL: FEDERATION_JWKS_CACHE_TTL_SECONDS);
cache invalidated on partner delete and jwks_uri change
- FederationController + routes: 5 admin:orgs endpoints +
POST /federation/verify (agents:read)
- OPA policy: 5 federation admin endpoint → admin:orgs mappings
- 499 unit tests passing; 94.69% statement coverage on FederationService
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-03-30 10:13:49 +00:00 |
|
SentryAgent.ai Developer
|
d252097f71
|
feat(phase-3): workstream 1 — Multi-Tenancy
Introduces full multi-tenant organization model to AgentIdP:
Schema:
- 6 migrations: organizations + organization_members tables; organization_id FK
added to agents, credentials, audit_logs; PostgreSQL RLS policies on all three
tables; system org seed + backfill
API:
- 6 new /api/v1/organizations endpoints (CRUD + members) gated by admin:orgs scope
- OPA scopes.json updated with 6 new org endpoint → admin:orgs mappings
Implementation:
- OrgRepository, OrgService, OrgController, createOrgsRouter
- OrgContextMiddleware: sets app.organization_id session variable so RLS enforces
per-request org isolation at the database layer
- JWT payload extended with organization_id claim; auth.ts backfills org_system
for backward-compatible tokens
- New error classes: OrgNotFoundError, OrgHasActiveAgentsError, AlreadyMemberError
Tests: 373 passing, 80.64% branch coverage, zero any types
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-03-30 00:29:32 +00:00 |
|
SentryAgent.ai Developer
|
7328a61c44
|
feat(phase-2): workstream 5 — OPA Policy Engine
- policies/authz.rego: Rego policy with path normalisation and scope enforcement
- policies/data/scopes.json: all 13 endpoint → scope mappings
- src/middleware/opa.ts: OpaMiddleware with Wasm primary path + scopes.json fallback;
exports createOpaMiddleware() and reloadOpaPolicy() for SIGHUP hot-reload
- All four route files: opaMiddleware wired after authMiddleware
- AuditController, OAuth2Service: manual scope checks removed (now centralised in OPA)
- src/server.ts: SIGHUP handler calls reloadOpaPolicy()
- docs/devops/environment-variables.md: POLICY_DIR documented
- 38 new tests; 302/302 passing; opa.ts coverage 98.66% statements
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-03-28 23:02:11 +00:00 |
|