Chris CoutinhoandClaude Opus 4.8 a926210a51 fix(auth): clarify empty-allowlist startup warning when userinfo is configured ...

Address claude-review round 9 on #919: an empty ALLOWED_MGMT_CLIENT is no longer
a kill switch when userinfo_uri is configured (opaque tokens validated via the
userinfo fallback bypass the allowlist). Distinguish the two cases in the
startup warning so operators aren't surprised that Astrolabe tokens are still
accepted.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-17 20:45:43 +02:00

..

static

feat: add Tailscale Funnel config for Claude AI connector testing

2026-03-29 21:00:00 +02:00

templates

fix(auth): address PR #758 review — XSS, CSRF, open redirect, JWKS cache

2026-05-02 18:26:39 +02:00

__init__.py

feat: Implement ADR-005 unified token verifier to eliminate token passthrough vulnerability

2025-11-05 18:53:14 +01:00

astrolabe_client.py

test: address round-2 claude-review on #883

2026-06-10 20:53:54 +02:00

bearer_auth.py

feat(server): Experimental support for OAuth2/OIDC authentication

2025-10-14 01:22:15 +02:00

browser_oauth_routes.py

fix(auth): address PR #758 round-7 medium/minor review

2026-05-03 14:21:12 +02:00

client_registration.py

refactor: convert f-string logging to lazy %-style format (G004)

2026-05-13 01:12:17 +02:00

client_registry.py

refactor(auth): drop built-in well-known MCP client list

2026-06-16 20:50:17 +02:00

context_helper.py

refactor: convert f-string logging to lazy %-style format (G004)

2026-05-13 01:12:17 +02:00

elicitation.py

fix(auth): address PR #757 round-3 review feedback

2026-05-02 17:24:50 +02:00

login_flow.py

fix(auth): login-flow provisioning — public login_url + session app passwords

2026-05-28 23:06:11 +02:00

oauth_routes.py

refactor: convert f-string logging to lazy %-style format (G004)

2026-05-13 01:12:17 +02:00

permissions.py

refactor: convert f-string logging to lazy %-style format (G004)

2026-05-13 01:12:17 +02:00

provision_routes.py

feat(vector-sync): scan provisioned users immediately

2026-06-12 09:48:56 +02:00

provisioning_decorator.py

refactor: convert f-string logging to lazy %-style format (G004)

2026-05-13 01:12:17 +02:00

scope_authorization.py

docs(auth): clarify unconditional offline_access advertising + test

2026-06-11 15:35:28 +02:00

session_backend.py

fix(auth): address PR #758 round-7 medium/minor review

2026-05-03 14:21:12 +02:00

storage.py

feat(usage): record per-tenant usage events into the app DB

2026-06-07 15:13:14 +02:00

token_broker.py

refactor: convert f-string logging to lazy %-style format (G004)

2026-05-13 01:12:17 +02:00

token_utils.py

fix(auth): address PR #758 round-6 medium/low review

2026-05-03 13:03:49 +02:00

unified_verifier.py

fix(auth): clarify empty-allowlist startup warning when userinfo is configured

2026-06-17 20:45:43 +02:00

userinfo_routes.py

feat: harmonize MCP tool + userinfo page to documents/chunks model

2026-06-04 20:28:44 +02:00

viz_routes.py

fix(search): address review feedback on multi-folder path filter

2026-06-03 13:03:42 +02:00

webhook_routes.py

fix(security): require WEBHOOK_SECRET for the Nextcloud webhook receiver

2026-06-14 18:18:34 +02:00