hataa 6091ce7576

feat(authz): derive Gateway route permissions from AuthorizationProvider (#4439) ...

* feat(authz): derive Gateway route permissions from AuthorizationProvider (Phase 2A, #4063)

Phase 2A: replace legacy _ALL_PERMISSIONS with provider-derived route
permissions. When authorization.enabled, each threads:*/runs:* permission
is evaluated independently via provider.aauthorize(resource='route').
Disabled mode preserves legacy behavior. owner_check and require_admin_user
remain unchanged.

10 new tests: disabled/enabled/RBAC policy/fail-closed/fail-open/
authenticate integration/middleware integration.

* fix(authz): move AuthorizationConfig import to runtime for fallback in _get_route_authorization_config

2026-07-27 14:19:04 +08:00

..

2026-04-01-langfuse-tracing.md

feat(tracing): add optional Langfuse support (#1717)

2026-04-02 13:06:10 +08:00

2026-07-10-pluggable-authorization-implementation-notes.md

feat(authz): derive Gateway route permissions from AuthorizationProvider (#4439)

2026-07-27 14:19:04 +08:00

2026-07-10-pluggable-authorization-rfc.md

feat(browser): add agentic browser control (#4187)

2026-07-21 11:46:33 +08:00

2026-07-15-authz-phase1a1-trusted-principal-implementation-plan.md

feat(authz): propagate trusted authorization principal context (#4203)

2026-07-17 14:49:51 +08:00

2026-07-15-authz-phase1a-implementation-plan.md

feat(authz): propagate trusted authorization principal context (#4203)

2026-07-17 14:49:51 +08:00

2026-07-17-remember-login.md

feat(auth): add keep me signed in login option (#4255)

2026-07-18 22:17:15 +08:00

STORAGE_REWRITE_CHANGES.md

feat(memory): add incremental agent-scoped Markdown fact storage (#4279)

2026-07-22 07:46:03 +08:00

STORAGE_REWRITE_PLAN.md

feat(memory): add incremental agent-scoped Markdown fact storage (#4279)

2026-07-22 07:46:03 +08:00