hataa 6091ce7576

feat(authz): derive Gateway route permissions from AuthorizationProvider (#4439) ...

* feat(authz): derive Gateway route permissions from AuthorizationProvider (Phase 2A, #4063)

Phase 2A: replace legacy _ALL_PERMISSIONS with provider-derived route
permissions. When authorization.enabled, each threads:*/runs:* permission
is evaluated independently via provider.aauthorize(resource='route').
Disabled mode preserves legacy behavior. owner_check and require_admin_user
remain unchanged.

10 new tests: disabled/enabled/RBAC policy/fail-closed/fail-open/
authenticate integration/middleware integration.

* fix(authz): move AuthorizationConfig import to runtime for fallback in _get_route_authorization_config

2026-07-27 14:19:04 +08:00

..

agents

feat(skill): strengthen maintainer orchestrator review workflow (#3606)

2026-06-16 23:33:09 +08:00

plans

feat(authz): derive Gateway route permissions from AuthorizationProvider (#4439)

2026-07-27 14:19:04 +08:00

pr-evidence

Implement skill self-evolution and skill_manage flow (#1874)

2026-04-06 22:07:11 +08:00

superpowers

docs: fix scheduled-task source links (#4397)

2026-07-26 15:34:59 +08:00

tui

feat(tui): Hermes-like terminal workbench (deerflow) backed by DeerFlowClient (#3760)

2026-06-25 20:10:49 +08:00

CODE_CHANGE_SUMMARY_BY_FILE.md

docs: clean gateway runtime transition remnants (#3334)

2026-06-02 10:03:28 +08:00

SKILL_NAME_CONFLICT_FIX.md

refactor: split backend into harness (deerflow.*) and app (app.*) (#1131)

2026-03-14 22:55:52 +08:00