Chris CoutinhoandClaude Opus 4.8 7ef0e9d83b docs(auth): document userinfo path in security model; drop dead guard; pin MCP asymmetry ...

Address claude-review round 8 on #919:
- Security-model docstring: note that opaque cross-client tokens authenticate
  via the userinfo liveness check (not JWKS/expiry) and bypass the client
  allowlist, with per-user authz as the gate.
- Remove the redundant `if not payload: return None` after the JWT/opaque
  branches (both already return None on failure) — replace with a comment.
- Add test_mcp_path_does_not_use_userinfo_for_opaque_token to pin that the
  userinfo fallback is management-path-only (MCP path still 401s).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-17 20:40:05 +02:00

..

admin

fix: address PR #814 review + SonarCloud gate

2026-05-29 18:36:42 +02:00

alembic

fix(ocr): round-4 review — defensive poll + drop dead tracking columns

2026-06-15 11:04:03 +02:00

api

fix(vector-sync): address round-7 — only log purge endpoint when enabled

2026-06-16 02:03:26 +02:00

auth

docs(auth): document userinfo path in security model; drop dead guard; pin MCP asymmetry

2026-06-17 20:40:05 +02:00

client

Merge pull request #832 from Janhouse/fix/830-external-calendars

2026-06-15 06:34:16 +02:00

controllers

fix: return all notes when search query is empty

2025-11-13 21:57:14 +01:00

document_processors

fix(document-processors): make glyph-corruption ratio of 0 disable the signal

2026-06-16 20:43:25 +02:00

embedding

fix(ocr): round-5 review nits — empty-pages failure, comments, test cleanup

2026-06-15 11:12:42 +02:00

models

Merge pull request #832 from Janhouse/fix/830-external-calendars

2026-06-15 06:34:16 +02:00

observability

fix(document-processors): make glyph-corruption ratio of 0 disable the signal

2026-06-16 20:43:25 +02:00

providers

test(providers): Mistral batch retry + retry-log detail + comment (#893 r4)

2026-06-11 06:45:56 +02:00

search

refactor(search): structural per-instance query side-channel; doc search billing gap

2026-06-08 13:52:51 +02:00

server

refactor(scanner): _should_scan helper to cut scan_user_documents complexity

2026-06-16 02:27:17 +02:00

usage

feat(usage): rename metrics → tokens_embedded/pages_embedded + export token cost to Prometheus

2026-06-08 13:17:53 +02:00

utils

feat(search): ADR-027 Phase 1 — modified-date range filter

2026-06-03 00:35:20 +02:00

vector

fix(vector): propagate cancel in cleanup task; cover 403 + sweep-failure

2026-06-16 19:23:46 +02:00

__init__.py

Initial commit

2025-05-04 23:24:55 +02:00

acl_hash.py

feat: add opt-in MCP decomposition hook points (design §10)

2026-05-29 13:13:25 +02:00

app.py

fix(vector): propagate cancel in cleanup task; cover 403 + sweep-failure

2026-06-16 19:23:46 +02:00

canonical.py

feat: replace NATS ingest with procrastinate Postgres queue (#183)

2026-06-03 04:11:11 +02:00

capabilities.py

test(vector-sync): close round-8 coverage gaps (500 path, non-string list)

2026-06-16 02:10:54 +02:00

cli.py

fix(ingest): address review round 1 (reclaim queue + tests)

2026-06-13 13:34:03 +02:00

config_validators.py

chore: round-4 polish + standardize on module-level loggers

2026-06-03 15:44:59 +02:00

config.py

fix(document-processors): escalate glyph-corrupt PDFs to the structured tier

2026-06-16 20:06:35 +02:00

context.py

fix(auth): authenticate stored app passwords with loginName, not UID

2026-05-31 21:34:05 +02:00

http.py

feat: add self-signed SSL certificate support for Nextcloud connections

2026-02-16 09:21:21 +01:00

migrations.py

fix(storage): address PR #798 round-4 review (NOSONAR syntax + pg_advisory_lock + engine dispose + nits)

2026-05-17 09:25:42 +02:00

stdio.py

fix: address third round of review feedback

2026-04-07 23:59:39 +02:00