Repository navigation
mig: add issuance selection profiles for headless callers - #8041
Merged
danielkov merged 100 commits intoOct 29, 2026
Merged
Conversation
Administrators can create remote_session, service_account, static_credential and pass_through auth clients, offer an existing client on another server, and replace an administrator-created client's headers. The typed resolver treats administrator-created clients and associations as authoritative instead of checking them against the server settings that backfilled copies mirror.
Server settings add a credential another server already offers or create a new one, and a credential's sheet edits and rotates its headers. The static Authorization identity choice is renamed to a shared credential. Agent pages edit credential blocks for managers and connection owners.
…o daniel/aim-596-feat-dashboard-auth-client-setup
Where typed auth client resolution is enforced, consent offers each server's permitted auth clients, preselects the remembered choice or the fixed order, and records the picked client and its own registration on the new credential. Gateways offer the choice per member and capture tools through it.
A member added after a credential was issued gets no-auth or its single ready permitted client recorded atomically the first time it is used, where typed auth client resolution is enforced. Otherwise it stays unavailable until the person reconnects to choose.
Agent key creation records an auth client choice per server under a new api_key credential kind, rotation copies it, and under enforcement the key is served through those choices on direct servers and agent gateway members. The key wizard asks for a credential on servers offering several.
🦋 Changeset detectedLatest commit: dcc7c5c The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
Contributor
|
|
||||||||||||||||
Contributor
|
|
||||||||||||||||
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 5 files
Reply with feedback, questions, or to request a fix.
View guided diff | Turn on auto-fix | Re-trigger cubic
Bind a registration's issuer to the client's project, refuse empty header entries, keep stored secrets across '_'/'-' spellings, report members' choice among several credentials in get_my_mcp_connection_status, map the post-offer read failure, and cover admin clients and cross-server offers.
…o daniel/aim-596-feat-dashboard-auth-client-setup
…aniel/aim-596-feat-consent-auth-client-picker
Let an agent approval proceed when only the person lacks access, offer connect and reconnect for identity-provider clients, record no client for a no-auth server, and let a later no-auth approval clear the remembered client.
…niel/aim-596-feat-gateway-new-member-choices # Conflicts: # server/internal/mcpservers/upstreamclients/queries.sql
…niel/aim-596-feat-agent-key-auth-client-choices
…ctions UI Keep the full agent policy as the permission editor's baseline so a credential restriction no longer makes every save report a conflict. Load every page of credentials, connections and connection blocks; show connection-owner blocks read-only; reset the block dialogs on close; refresh the agent policy after a connection block changes. Keep stored non-secret header values by name when is_secret is unchanged, keep header descriptions on save, ask for a new value when a stored header is renamed, and refuse reserved headers while editing. Say when sign-ins fail to load, describe both shared credential formats, and point the Platform MCP setup skill at Static credential for API key and Basic upstreams.
Fail closed when a key's choices cannot be read or name a legacy choice, decide gateway key choices before the token path, apply the self-held credential exception to reconnect checks, block issuing when a server's credentials cannot be loaded, and clear stale picks.
… daniel/aim-597-mig-issuance-selection-profiles
…ut a sign-in issuer
The agent gateway does not forward the caller's headers to its servers, so a key set up with a pass-through credential could not authenticate there.
…reate-and-attach-auth-clients # Conflicts: # server/internal/testenv/queries.sql
…o daniel/aim-596-feat-dashboard-auth-client-setup
…aniel/aim-596-feat-consent-auth-client-picker # Conflicts: # server/internal/mcp/authnchallenge_consent_template_test.go # server/internal/mcp/export_test.go
…niel/aim-596-feat-gateway-new-member-choices
…niel/aim-596-feat-agent-key-auth-client-choices # Conflicts: # client/dashboard/src/pages/agents/credentials/CredentialsWizard.tsx # server/internal/mcp/serve_meta.go
… daniel/aim-597-mig-issuance-selection-profiles # Conflicts: # server/migrations/atlas.sum
…o daniel/aim-596-feat-dashboard-auth-client-setup
…aniel/aim-596-feat-consent-auth-client-picker
…niel/aim-596-feat-gateway-new-member-choices
…niel/aim-596-feat-agent-key-auth-client-choices
… daniel/aim-597-mig-issuance-selection-profiles
This comment has been minimized.
This comment has been minimized.
Drops the "New:" prefix, names the reuse option "Existing credential" and leaves it out when no other server has a credential to share. The upstream sign-in row now says what probing a remote upstream found.
…aniel/aim-596-feat-consent-auth-client-picker
…niel/aim-596-feat-gateway-new-member-choices
…niel/aim-596-feat-agent-key-auth-client-choices
… daniel/aim-597-mig-issuance-selection-profiles
Base automatically changed from
daniel/aim-596-feat-agent-key-auth-client-choices
to
main
October 29, 2026 22:01
…suance-selection-profiles Regenerate the issuance selection profiles migration on top of main (SQL unchanged).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AIM-597 (1 of 2)
Stacked on #8040.
Summary
issuance_selection_profiles: one profile per user session issuer and headless caller. The caller is either a client (user_session_client_id) or a workload subject (workload_issuer_id+workload_subject). Each is unique among live rows. Application code enforces that exactly one is set; no cross-column CHECK, per the repo's schema rules.(organization_id, project_id)→projects (organization_id, id).(organization_id, workload_issuer_id)→workload_issuers (organization_id, id).(user_session_issuer_id, user_session_client_id)→user_session_clients (user_session_issuer_id, id), so a profile's client always belongs to its issuer.organization_id. The next PR's API checks the issuer is the organization's before writing.user_session_clients (user_session_issuer_id, id). Atlas emits itCONCURRENTLY, which makes this migration-- atlas:txmode none. The new table is empty and its constraints are declared insideCREATE TABLE, so there is no PG305/PG306 scan.upstream_client_selectionsrows of credential kindissuance_profilethat name the profile, so there is no second choices table. In the next PR, issuance copies the choices that still validate onto each new session.atlas.sumand sqlc models only. Nothing reads or writes the table yet.Motivation
RFC section 7.7, "Standard grant compatibility": unmodified jwt-bearer clients and workloads can't send per-server choices. Instead, an admin configures a profile scoped to the authenticated client or workload and the target sign-in, and its validated choices are copied onto each issued session.