added spire-headless and updated readme and licence - #3
Open
apauthnull wants to merge 1 commit into
Open
Conversation
ritamAN77
pushed a commit
that referenced
this pull request
Jul 9, 2026
#1 One-transaction grant: GrantAssignment now creates the connector assignment + broker-RS registration (approved) + connector-executor role binding on the client's service account in a single transaction (repo.GrantAssignmentTx). RevokeAssignment tears down the registration + binding only when it's the client's last assignment. Replaces the manual 4-table / raw-SQL enablement with one API call. #2 last_seen_at: service_accounts.last_seen_at is now updated on M2M token issuance and on a successful broker action (was NULL forever). #3 Agent activity: GET /uflow/admin/agents/:id/activity returns the agent lens over connector_action_audit (matched by actor_client_id / subject_id / actor_spiffe_id) for Agent 360. Build/vet/gofmt clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ritamAN77
pushed a commit
that referenced
this pull request
Jul 10, 2026
…put constraints (F3)
F1 — GitHub App support. The GitHub connector can now use an org-installed
GitHub App (bot identity, no human attached) instead of an OAuth App that
impersonates whoever authorized it.
- connector_provider_apps gains app_kind ('oauth2'|'github_app') + github_app_id;
connector_connections.auth_method CHECK now allows 'github_app'.
- internal/connectoradapters/githubapp.go: signs the App JWT (RS256, <=10m) and
exchanges it at /app/installations/:id/access_tokens for a ~1h installation
token, cached per installation (re-mint within 5m of expiry). No refresh flow.
- Broker runAction mints the installation token on demand for github_app
connections and injects it (never a static Vault token).
- Endpoints: POST /providers/github/app-github (set App id + key PEM -> Vault);
POST /:id/connections/github-app (bind installation id, no OAuth dance).
Realizes D2 (connector-per-org-installation).
F3 — action-input constraints. An assignment can now bound WHERE an action
runs, not just WHICH action.
- connector_assignments gains input_constraints (jsonb): a per-field predicate
{"owner":{"equals":"acme-eng"},"repo":{"glob":"release-*"}} with equals /
one_of / glob rules (AND across fields), injection-safe glob (only *).
- Enforced as Gate 3 in runAction, AFTER input-schema validation and BEFORE the
provider call; a violation is a policy_deny (403), fail-closed on malformed
constraints or missing/non-string fields.
- Gate 2 now uses MatchingAssignment (action-specific row wins over all-actions)
so the correct row's constraints apply. Threaded through the grant API/service/tx.
Schema change requires wipe+rebootstrap (or additive ADD COLUMNs) on deploy.
Build/vet/gofmt clean; Gin routes verified conflict-free.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ritamAN77
pushed a commit
that referenced
this pull request
Jul 10, 2026
The broker now gates WHICH TEAM an agent may act FOR, not just which agent
calls — enforced inside the broker chain, not at the agent's own front door.
- connectors.allowed_subject_groups (uuid[]): group ids the on-behalf-of user
must belong to; empty = no restriction.
- Gate 4 in runAction: for a delegated (XAA) call, the token subject must be a
member of an allowed group (SubjectInAnyGroup over user_groups). A connector
with a group policy but no human subject (M2M) is denied — the policy is
meaningless without a subject.
- PUT /authsec/connectors/:id/subject-groups {group_ids} (connector:assign).
Closes Track A (design-review D5): #1 owner/D6, #2 schema-harden+refresh-lock+
F8, #3 GitHub App (F1), #4 input constraints (F3), #5 user consent (R4), #6
this. Additive column; rides the existing rebootstrap window. Build/vet/gofmt
clean; routes conflict-free.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.