SentryAgent.ai Developer
af630b43d4
chore(phase-4): QA fixes + gitignore portal build artifacts
...
- Fix 7 test fixtures missing isPublic field added in WS4 Marketplace
- Add portal/.next/ to .gitignore (build artifacts should not be tracked)
- Mark all Phase 4 tasks 11.1-11.11 complete in tasks.md
QA results: 611/611 tests pass, tsc zero errors, portal build OK, CLI build OK
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-02 10:59:11 +00:00
SentryAgent.ai Developer
fd90b2acd1
feat(phase-3): workstream 6 — SOC 2 Type II Preparation
...
Implements all 22 WS6 tasks completing Phase 3 Enterprise.
Column-level encryption (AES-256-CBC, Vault-backed key) via EncryptionService
applied to credentials.secret_hash, credentials.vault_path,
webhook_subscriptions.vault_secret_path, and agent_did_keys.vault_key_path.
Backward-compatible: isEncrypted() guard skips decryption for existing
plaintext rows until next read-write cycle.
Audit chain integrity (CC7.2): AuditRepository computes SHA-256 Merkle hash
on every INSERT (hash = SHA-256(eventId+timestamp+action+outcome+agentId+orgId+prevHash)).
AuditVerificationService walks the full chain verifying hash continuity.
AuditChainVerificationJob runs hourly; sets agentidp_audit_chain_integrity
Prometheus gauge to 1 (pass) or 0 (fail).
TLS enforcement (CC6.7): TLSEnforcementMiddleware registered as first
middleware in Express stack; 301 redirect on non-https X-Forwarded-Proto
in production.
SecretsRotationJob (CC9.2): hourly scan for credentials expiring within 7
days; increments agentidp_credentials_expiring_soon_total.
ComplianceController + routes: GET /audit/verify (auth+audit:read scope,
30/min rate-limit); GET /compliance/controls (public, Cache-Control 60s).
ComplianceStatusStore: module-level map updated by jobs, consumed by controller.
Prometheus: 2 new metrics (agentidp_credentials_expiring_soon_total,
agentidp_audit_chain_integrity); 6 alerting rules in alerts.yml.
Compliance docs: soc2-controls-matrix.md, encryption-runbook.md,
audit-log-runbook.md, incident-response.md, secrets-rotation.md.
Tests: 557 unit tests passing (35 suites); 26 new tests (EncryptionService,
AuditVerificationService); 19 compliance integration tests. TypeScript clean.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-03-31 00:41:53 +00:00
SentryAgent.ai Developer
d252097f71
feat(phase-3): workstream 1 — Multi-Tenancy
...
Introduces full multi-tenant organization model to AgentIdP:
Schema:
- 6 migrations: organizations + organization_members tables; organization_id FK
added to agents, credentials, audit_logs; PostgreSQL RLS policies on all three
tables; system org seed + backfill
API:
- 6 new /api/v1/organizations endpoints (CRUD + members) gated by admin:orgs scope
- OPA scopes.json updated with 6 new org endpoint → admin:orgs mappings
Implementation:
- OrgRepository, OrgService, OrgController, createOrgsRouter
- OrgContextMiddleware: sets app.organization_id session variable so RLS enforces
per-request org isolation at the database layer
- JWT payload extended with organization_id claim; auth.ts backfills org_system
for backward-compatible tokens
- New error classes: OrgNotFoundError, OrgHasActiveAgentsError, AlreadyMemberError
Tests: 373 passing, 80.64% branch coverage, zero any types
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-03-30 00:29:32 +00:00
SentryAgent.ai Developer
7328a61c44
feat(phase-2): workstream 5 — OPA Policy Engine
...
- policies/authz.rego: Rego policy with path normalisation and scope enforcement
- policies/data/scopes.json: all 13 endpoint → scope mappings
- src/middleware/opa.ts: OpaMiddleware with Wasm primary path + scopes.json fallback;
exports createOpaMiddleware() and reloadOpaPolicy() for SIGHUP hot-reload
- All four route files: opaMiddleware wired after authMiddleware
- AuditController, OAuth2Service: manual scope checks removed (now centralised in OPA)
- src/server.ts: SIGHUP handler calls reloadOpaPolicy()
- docs/devops/environment-variables.md: POLICY_DIR documented
- 38 new tests; 302/302 passing; opa.ts coverage 98.66% statements
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-03-28 23:02:11 +00:00
SentryAgent.ai Developer
d3530285b9
feat: Phase 1 MVP — complete AgentIdP implementation
...
Implements all P0 features per OpenSpec change phase-1-mvp-implementation:
- Agent Registry Service (CRUD) — full lifecycle management
- OAuth 2.0 Token Service (Client Credentials flow)
- Credential Management (generate, rotate, revoke)
- Immutable Audit Log Service
Tech: Node.js 18+, TypeScript 5.3+ strict, Express 4.18+, PostgreSQL 14+, Redis 7+
Standards: OpenAPI 3.0 specs, DRY/SOLID, zero `any` types
Quality: 18 unit test suites, 244 tests passing, 97%+ coverage
OpenAPI: 4 complete specs (14 endpoints total)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-03-28 09:14:41 +00:00
