SentryAgent.ai Developer
5e465e596a
feat(phase-3): workstream 3 — OpenID Connect (OIDC) Provider
...
Implements full OIDC layer on top of the existing OAuth 2.0 token service:
- Migration 014: oidc_keys table (RSA/EC key pairs, is_current flag, expires_at
for rotation grace period)
- OIDCKeyService: key generation (RS256/ES256), Vault storage, JWKS with Redis
cache, key rotation with grace period, pruneExpiredKeys
- IDTokenService: buildIDTokenClaims (agent claims, nonce, DID), signIDToken
(kid in JWT header), verifyIDToken (alg:none rejected, RS256/ES256 only)
- OIDCController: discovery document, JWKS (Cache-Control), /agent-info
- OIDC routes mounted at / — /.well-known/openid-configuration,
/.well-known/jwks.json, /agent-info
- OAuth2Service: id_token appended to token response when openid scope requested
- 473 unit tests passing (100% OIDCKeyService stmts, 95.91% IDTokenService stmts)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-03-30 09:54:26 +00:00
SentryAgent.ai Developer
3d1fff15f6
feat(phase-3): workstream 2 — W3C DIDs
...
Implements W3C DID Core 1.0 per-agent identity for every registered agent:
Schema:
- agent_did_keys table: stores EC P-256 public key JWK + Vault path for private key
- agents.did + agents.did_created_at columns
Key management:
- EC P-256 key pair generated on every agent registration via Node.js crypto
- Private key stored in Vault KV v2 (dev:no-vault marker when Vault not configured)
- Public key JWK stored in PostgreSQL agent_did_keys table
API (4 new endpoints):
- GET /.well-known/did.json — instance DID Document (public, cached)
- GET /api/v1/agents/:id/did — per-agent DID Document (public, 410 for decommissioned)
- GET /api/v1/agents/:id/did/resolve — W3C DID Resolution result (agents:read scope)
- GET /api/v1/agents/:id/did/card — AGNTCY agent card (public)
Implementation:
- DIDService: DID construction, key generation, Redis caching (TTL configurable)
- DIDController: 410 Gone for decommissioned agents, correct Content-Type on resolve
- AgentService: calls DIDService.generateDIDForAgent on every new registration
Tests: 429 passing, DIDService 98.93% coverage, private key absence verified in all responses
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-03-30 00:47:59 +00:00
SentryAgent.ai Developer
d252097f71
feat(phase-3): workstream 1 — Multi-Tenancy
...
Introduces full multi-tenant organization model to AgentIdP:
Schema:
- 6 migrations: organizations + organization_members tables; organization_id FK
added to agents, credentials, audit_logs; PostgreSQL RLS policies on all three
tables; system org seed + backfill
API:
- 6 new /api/v1/organizations endpoints (CRUD + members) gated by admin:orgs scope
- OPA scopes.json updated with 6 new org endpoint → admin:orgs mappings
Implementation:
- OrgRepository, OrgService, OrgController, createOrgsRouter
- OrgContextMiddleware: sets app.organization_id session variable so RLS enforces
per-request org isolation at the database layer
- JWT payload extended with organization_id claim; auth.ts backfills org_system
for backward-compatible tokens
- New error classes: OrgNotFoundError, OrgHasActiveAgentsError, AlreadyMemberError
Tests: 373 passing, 80.64% branch coverage, zero any types
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-03-30 00:29:32 +00:00
SentryAgent.ai Developer
a504964e5f
feat(phase-2): workstream 7 — Prometheus + Grafana Monitoring
...
- Add prom-client 15; shared registry in src/metrics/registry.ts (7 metrics)
- HTTP request counter + duration histogram via metricsMiddleware
- DB query duration histogram wrapping pg Pool.query
- Redis command duration histogram via typed instrumentRedisMethod wrapper
- agentidp_tokens_issued_total in OAuth2Service
- agentidp_agents_registered_total in AgentService
- GET /metrics unauthenticated endpoint (Prometheus text format)
- docker-compose.monitoring.yml overlay (Prometheus + Grafana)
- Grafana auto-provisioned datasource + pre-built AgentIdP dashboard
- docs/devops/operations.md monitoring section added
- 36/36 unit tests passing, 100% coverage on new metrics code
- Fix pre-existing unused import in tests/integration/agents.test.ts
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-03-29 06:13:41 +00:00
SentryAgent.ai Developer
d3530285b9
feat: Phase 1 MVP — complete AgentIdP implementation
...
Implements all P0 features per OpenSpec change phase-1-mvp-implementation:
- Agent Registry Service (CRUD) — full lifecycle management
- OAuth 2.0 Token Service (Client Credentials flow)
- Credential Management (generate, rotate, revoke)
- Immutable Audit Log Service
Tech: Node.js 18+, TypeScript 5.3+ strict, Express 4.18+, PostgreSQL 14+, Redis 7+
Standards: OpenAPI 3.0 specs, DRY/SOLID, zero `any` types
Quality: 18 unit test suites, 244 tests passing, 97%+ coverage
OpenAPI: 4 complete specs (14 endpoints total)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-03-28 09:14:41 +00:00
