Repository navigation
fix: publish authentication client choices atomically - #8275
Conversation
🦋 Changeset detectedLatest commit: deb3653 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
This comment has been minimized.
This comment has been minimized.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 64 files
This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.
View guided diff | Turn on auto-fix | Re-trigger cubic
There was a problem hiding this comment.
All reported issues were addressed across 68 files (changes from recent commits).
Reply with feedback, questions, or to request a fix.
View guided diff | Turn on auto-fix | Re-trigger cubic
Summary
Publish OAuth bindings and typed authentication-client associations in the same transaction, and keep credential-header and Enterprise Managed Authorization choices synchronized during normal configuration changes.
Motivation
New or changed upstream configuration could remain unavailable until a migration or reconciliation ran. A failed association capture could also leave a successful binding write without its corresponding typed choice.
Impact
Enterprise Managed Authorization resource identifiers remain exact throughout configuration and selection. URLs that differ by a trailing slash no longer share authentication choices.
Technical details
One transaction and lock contract
Use a consistent organization, project, source, server, and client lock order across configuration writers, metadata updates, and administrator actions. Keep synchronization with the originating write so failures roll back the binding rather than publishing incomplete configuration.
Retire stale derived links and credentials when their backing configuration leaves scope, while preserving administrator detaches and disabled clients. Configuration does not grant access automatically.