SentryAgent.ai Developer
af630b43d4
chore(phase-4): QA fixes + gitignore portal build artifacts
...
- Fix 7 test fixtures missing isPublic field added in WS4 Marketplace
- Add portal/.next/ to .gitignore (build artifacts should not be tracked)
- Mark all Phase 4 tasks 11.1-11.11 complete in tasks.md
QA results: 611/611 tests pass, tsc zero errors, portal build OK, CLI build OK
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-02 10:59:11 +00:00
SentryAgent.ai Developer
d252097f71
feat(phase-3): workstream 1 — Multi-Tenancy
...
Introduces full multi-tenant organization model to AgentIdP:
Schema:
- 6 migrations: organizations + organization_members tables; organization_id FK
added to agents, credentials, audit_logs; PostgreSQL RLS policies on all three
tables; system org seed + backfill
API:
- 6 new /api/v1/organizations endpoints (CRUD + members) gated by admin:orgs scope
- OPA scopes.json updated with 6 new org endpoint → admin:orgs mappings
Implementation:
- OrgRepository, OrgService, OrgController, createOrgsRouter
- OrgContextMiddleware: sets app.organization_id session variable so RLS enforces
per-request org isolation at the database layer
- JWT payload extended with organization_id claim; auth.ts backfills org_system
for backward-compatible tokens
- New error classes: OrgNotFoundError, OrgHasActiveAgentsError, AlreadyMemberError
Tests: 373 passing, 80.64% branch coverage, zero any types
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-03-30 00:29:32 +00:00
SentryAgent.ai Developer
90a4addb21
feat(phase-2): workstream 1 — HashiCorp Vault credential storage
...
Vault is optional — server falls back to bcrypt (Phase 1 behaviour)
when VAULT_ADDR is not set. Full coexistence: existing bcrypt credentials
continue to work until rotated.
Changes:
- src/vault/VaultClient.ts — wraps node-vault KV v2; writeSecret,
readSecret, verifySecret (constant-time), deleteSecret
- src/db/migrations/005_add_vault_path.sql — vault_path column on credentials
- CredentialRepository — createWithVaultPath, updateVaultPath methods
- CredentialService — routes generate/rotate through Vault when configured;
bcrypt path unchanged
- OAuth2Service — verifies via Vault when vaultPath set, bcrypt otherwise
- src/app.ts — createVaultClientFromEnv() wired into service layer
- ICredentialRow — vaultPath field added
- docs/devops/environment-variables.md — VAULT_ADDR, VAULT_TOKEN, VAULT_MOUNT
- docs/devops/vault-setup.md — dev quickstart, production config, migration guide
- tests: 33/33 unit tests pass (VaultClient + CredentialService Vault path)
- node-vault + @types/node-vault installed
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-03-28 15:02:33 +00:00
SentryAgent.ai Developer
d3530285b9
feat: Phase 1 MVP — complete AgentIdP implementation
...
Implements all P0 features per OpenSpec change phase-1-mvp-implementation:
- Agent Registry Service (CRUD) — full lifecycle management
- OAuth 2.0 Token Service (Client Credentials flow)
- Credential Management (generate, rotate, revoke)
- Immutable Audit Log Service
Tech: Node.js 18+, TypeScript 5.3+ strict, Express 4.18+, PostgreSQL 14+, Redis 7+
Standards: OpenAPI 3.0 specs, DRY/SOLID, zero `any` types
Quality: 18 unit test suites, 244 tests passing, 97%+ coverage
OpenAPI: 4 complete specs (14 endpoints total)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-03-28 09:14:41 +00:00
