Repository navigation

feat(api-server): RBAC enforcement with scope-aware authorization - #1660

Merged

mergify[bot] merged 64 commits into

mainfrom

jsell/feat/rbac-enforcement

Jun 9, 2026

Merged

feat(api-server): RBAC enforcement with scope-aware authorization#1660
mergify[bot] merged 64 commits into
mainfrom
jsell/feat/rbac-enforcement

Commits on Jun 5, 2026
- Merge branch 'main' of https://github.com/ambient-code/platform
  jsell-rh
  committed
  f7191f9
- Merge branch 'main' of https://github.com/ambient-code/platform
  jsell-rh
  committed
  6f757e1
- feat(api-server): implement scope-aware RBAC enforcement
  
  jsell-rh
  and
  claude
  committed
  c51e5e0
- feat(api-server): add gRPC RBAC authorization for watch streams
  
  jsell-rh
  and
  claude
  committed
  f60ebf8
- test(api-server): add RBAC enforcement integration tests
  
  jsell-rh
  and
  claude
  committed
  234beb6
- style(api-server): fix gofmt formatting in rbac package
  
  jsell-rh
  and
  claude
  committed
  9cf280e
- test(api-server): add RBAC enforcement e2e test script
  
  jsell-rh
  and
  claude
  committed
  5049fde
- feat(api-server): wire RBAC list filtering and fix e2e test failures
  
  jsell-rh
  and
  claude
  committed
  09da075
- ci: add RBAC enforcement e2e test step to CI pipeline
  
  jsell-rh
  and
  claude
  committed
  f480919
- feat: new project button, escalation checks, e2e assertions
  
  jsell-rh
  and
  claude
  committed
  93da15d
- fix(api-server): extract RBAC scope from request body for top-level POSTs
  
  jsell-rh
  and
  claude
  committed
  92db2de
- fix(api-server): credential binding requires both credential:owner and project:owner
  
  jsell-rh
  and
  claude
  committed
  7b07b1a
- test(api-server): comprehensive RBAC e2e covering 30+ spec scenarios
  
  jsell-rh
  and
  claude
  committed
  636a23c
- fix(api-server): scoped escalation checks + generative e2e matrix
  
  jsell-rh
  and
  claude
  committed
  ab11b5c
- fix(api-server): idempotent e2e cleanup + generative escalation matrix
  
  jsell-rh
  and
  claude
  committed
  8809bb8
- fix(api-server): close RBAC gaps in session sub-resources and role binding list
  
  jsell-rh
  and
  claude
  committed
  730e3c5
- fix(api-server): unique constraint on role_bindings + RBAC gap fixes
  
  jsell-rh
  and
  claude
  committed
  5391597
- test(api-server): red tests for audit findings — 13 failures
  
  jsell-rh
  and
  claude
  committed
  e210732
- fix(api-server): address 7 audit findings — PATCH escalation, list filtering, sub-resources
  
  jsell-rh
  and
  claude
  committed
  cb6be83
- fix(api-server): all 156 RBAC e2e tests passing — zero gaps
  
  jsell-rh
  and
  claude
  committed
  33977a3
- fix(api-server): remove unused test helpers to fix CI lint
  
  jsell-rh
  and
  claude
  committed
  65dc811
- test(api-server): red tests proving PATCH scope widening attack
  
  jsell-rh
  and
  claude
  committed
  e9826d5
- fix(api-server): close PATCH scope widening + nil sessionFactory guard
  
  jsell-rh
  and
  claude
  committed
  348eb4a
- fix(api-server): close platform:viewer→admin escalation + fail-closed ApplyListFilter
  
  jsell-rh
  and
  claude
  committed
  9b5c5d7
Commits on Jun 6, 2026
- fix(api-server): eliminate raw SQL, fix runner 404→502, session health wait in e2e
  
  jsell-rh
  and
  claude
  committed
  55a9772
- ci: add OpenAPI generated code drift check
  
  jsell-rh
  and
  claude
  committed
  e70b3de
- fix(api-server): fix OpenAPI generator + regenerate client
  
  jsell-rh
  and
  claude
  committed
  f93c181
- fix: address CodeRabbit review findings + CI compile errors
  
  jsell-rh
  and
  claude
  committed
  a12498e
- fix(api-server): revert operationId, regenerate clean + fix CI errors
  
  jsell-rh
  and
  claude
  committed
  8a1dc2b
- fix(api-server): remove Credential.ProjectId from integration test
  
  jsell-rh
  and
  claude
  committed
  321c69d
- fix(api-server): address all remaining CodeRabbit findings
  
  jsell-rh
  and
  claude
  committed
  f13bc88
- lint
  jsell-rh
  committed
  5bab7b7
- fix(e2e): self-contained JWT + RBAC enforcement setup in e2e test
  
  jsell-rh
  and
  claude
  committed
  135af17
- feat(api-server): replace service caller RBAC bypass with RoleBinding
  
  jsell-rh
  and
  claude
  committed
  15c0fcc
- fix(e2e): curl timeout, session cleanup, CP ordering fix
  
  jsell-rh
  and
  claude
  committed
  f10507b
- fix(api-server): close 3 security council findings
  
  jsell-rh
  and
  claude
  committed
  e75de97
Commits on Jun 7, 2026
- fix(api-server): gate service caller detection on verified JWT payload
  
  jsell-rh
  and
  claude
  committed
  98b4c22
- fix(e2e): move session cleanup after Phase 19
  
  jsell-rh
  and
  claude
  committed
  4d9010a
- fix(e2e): always restart CP for fresh gRPC watch streams
  
  jsell-rh
  and
  claude
  committed
  3428df1
- fix(api-server): init ordering bug prevented gRPC service caller detection
  
  jsell-rh
  and
  claude
  committed
  5e3d19c
- fix(e2e): auto-reconnect port-forward on connection failure
  
  jsell-rh
  and
  claude
  committed
  478ad7f
Commits on Jun 8, 2026
- Merge branch 'main' into jsell/feat/rbac-enforcement
  mergify[bot]
  authored
  39bacd9
- Merge branch 'main' into jsell/feat/rbac-enforcement
  mergify[bot]
  authored
  d4e07a5
- Merge branch 'main' into jsell/feat/rbac-enforcement
  mergify[bot]
  authored
  44e82bd
- fix(e2e): port-forward readiness check fails when JWT is enabled
  
  jsell-rh
  and
  claude
  committed
  20547eb
- fix(e2e): wait for CP watch streams and retry transient errors
  
  jsell-rh
  and
  claude
  committed
  e9ce4c2
- Merge branch 'jsell/feat/rbac-enforcement' of https://github.com/ambient-code/platform into jsell/feat/rbac-enforcement
  jsell-rh
  committed
  97ffeef
- fix(e2e): port-forward Keycloak in CI and harden cleanup trap
  
  jsell-rh
  and
  claude
  committed
  c2a7e3b
- test(e2e): add failing test for F5 — owner can delete admin binding
  
  jsell-rh
  and
  claude
  committed
  969a634
- fix(api-server): close F2, F3, F5 from security council review
  
  jsell-rh
  and
  claude
  committed
  eee4b99
- style(api-server): gofmt sessions grpc_handler.go
  
  jsell-rh
  and
  claude
  committed
  6af2da5
- ci(e2e): build and deploy ambient-api-server from branch code
  
  jsell-rh
  and
  claude
  committed
  251c01f
- Merge branch 'main' into jsell/feat/rbac-enforcement
  mergify[bot]
  authored
  5b7a6fd
- fix(ci): let test script handle RBAC setup instead of inline workflow
  
  jsell-rh
  and
  claude
  committed
  0c3ed32
- Merge branch 'jsell/feat/rbac-enforcement' of https://github.com/ambient-code/platform into jsell/feat/rbac-enforcement
  jsell-rh
  committed
  e7df51c
- fix(api-server): production env clears jwk-cert-file CLI flag
  
  jsell-rh
  and
  claude
  committed
  e2e2604
- debug(api-server): add RBAC middleware diagnostic log for CI 403
  
  jsell-rh
  and
  claude
  committed
  b92b839
- fix(ci): always build api-server from branch code
  
  jsell-rh
  and
  claude
  committed
  34b725b
- debug(e2e): dump api-server image and config on JWT verification failure
  
  jsell-rh
  and
  claude
  committed
  32dfb38
Commits on Jun 9, 2026
- Merge branch 'main' into jsell/feat/rbac-enforcement
  mergify[bot]
  authored
  4efbff2
- Merge branch 'jsell/feat/rbac-enforcement' of https://github.com/ambient-code/platform into jsell/feat/rbac-enforcement
  jsell-rh
  committed
  9d3dd3f
- fix(e2e): substitute api-server image in deploy script
  
  jsell-rh
  and
  claude
  committed
  936779e
- fix(e2e): treat runner-proxy 502/503 as RBAC-pass in session tests
  
  jsell-rh
  and
  claude
  committed
  5e000f6
- ci: re-trigger e2e tests (slow runner)
  
  jsell-rh
  and
  claude
  committed
  640c051

Commits

Commits on Jun 5, 2026

Commits on Jun 6, 2026

Commits on Jun 7, 2026

Commits on Jun 8, 2026

Commits on Jun 9, 2026