xuan/ZY-Agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Commit Graph

  • 0b866a0bee docs(stage-1): mark control-plane scope limitation resolved (Stage 1 收口) feat/multi-tenant 1445043649 2026-06-28 23:07:06 +08:00
  • 428d4e9eb5 docs(stage-1): spec — use path-boundary matching for data-plane allowlist 1445043649 2026-06-28 21:43:27 +08:00
  • b26c5e4dd0 harden(gateway): API keys default-deny on control-plane routes (Stage 1 收口) 1445043649 2026-06-28 21:35:41 +08:00
  • 02628d4e08 test(auth): move bearer probe routes under /api/v1/threads (Stage 1 收口) 1445043649 2026-06-28 21:27:11 +08:00
  • 2d982c3f0b feat(authz): data-plane allowlist helper + INSUFFICIENT_SCOPE code (Stage 1 收口) 1445043649 2026-06-28 21:19:32 +08:00
  • 1b7d8217dd docs(stage-1): implementation plan for control-plane default-deny 1445043649 2026-06-28 21:09:31 +08:00
  • a173d4f93c docs(stage-1): API key control-plane default-deny design spec 1445043649 2026-06-28 21:05:14 +08:00
  • cdd9d6701f docs(stage-1): tick all plan checkboxes to match landed commits (Stage 1) 1445043649 2026-06-28 20:49:34 +08:00
  • 4cd2acc192 feat(apps): 新增 headless(API Key) 多租户冒烟测试，并登记进 apps/README 1445043649 2026-06-28 20:29:35 +08:00
  • 37c3417bfb docs(stage-1): record known scope/least-privilege limitation from final review (Stage 1 PR5) 1445043649 2026-06-28 20:20:36 +08:00
  • 938c2eb0be harden(gateway): uniform 404 on API key revoke to hide cross-tenant existence (Stage 1 PR4) 1445043649 2026-06-28 20:19:20 +08:00
  • dee1eb2374 docs(stage-1): backfill plan link in spec; sync plan with review-driven changes (Stage 1 PR5) 1445043649 2026-06-28 20:12:07 +08:00
  • 190c1dc3c8 feat(frontend): migrate API calls to /api/v1 (Stage 1 PR5) 1445043649 2026-06-28 20:07:20 +08:00
  • e6a12b9a7c test(gateway): strengthen dual-mount coverage to a v1-twin invariant (Stage 1 PR5) 1445043649 2026-06-28 20:01:29 +08:00
  • 2461a923be feat(gateway): dual-mount legacy routers on /api and /api/v1 (Stage 1 PR5) 1445043649 2026-06-28 19:49:05 +08:00
  • 3f0d5c8c96 feat(gateway): X-API-Deprecated header for legacy /api/* paths (Stage 1 PR5) 1445043649 2026-06-28 19:37:36 +08:00
  • 9d6decd91b test(gateway): end-to-end headless API mint/use/isolation smoke (Stage 1 PR4) 1445043649 2026-06-28 19:34:56 +08:00
  • c3c4e57416 harden(gateway): block API key mint on inactive SA; cover cross-workspace IDOR (Stage 1 PR4) 1445043649 2026-06-28 19:25:17 +08:00
  • 950964e0ef feat(gateway): api-keys management endpoints with one-time plaintext (Stage 1 PR4) 1445043649 2026-06-28 19:19:32 +08:00
  • 84e06ca396 harden(gateway): constrain service-account role/identity_mode at API boundary (Stage 1 PR4) 1445043649 2026-06-28 19:15:40 +08:00
  • d16e294185 feat(gateway): service-accounts management endpoints (Stage 1 PR4) 1445043649 2026-06-28 19:11:13 +08:00
  • e92fe0d7fb feat(authz): require_workspace_admin dependency (Stage 1 PR4) 1445043649 2026-06-28 19:07:55 +08:00
  • 9eb6103a4d feat(csrf): skip CSRF for bearer-header requests (Stage 1 PR3) 1445043649 2026-06-28 12:06:23 +08:00
  • 78359c3fd8 harden(auth): guard bearer auth errors as 503; widen AuthContext to ServicePrincipal (Stage 1 PR2) 1445043649 2026-06-28 12:04:19 +08:00
  • 3ec4fb8537 feat(auth): AuthMiddleware bearer dfk_ path (Stage 1 PR2) 1445043649 2026-06-28 11:58:14 +08:00
  • ac8b37bd27 test(auth): cover expired-key rejection in APIKeyAuthBackend (Stage 1 PR2) 1445043649 2026-06-28 11:44:41 +08:00
  • d9a86878f4 feat(auth): APIKeyAuthBackend resolves token to SA principal (Stage 1 PR2) 1445043649 2026-06-28 11:40:27 +08:00
  • 4f9116e3fe fix(auth): keep CurrentUser protocol id-only; is_service_account is opt-in (Stage 1 PR2) 1445043649 2026-06-28 11:37:06 +08:00
  • ec4769a33f feat(auth): ServicePrincipal + is_service_account discriminator (Stage 1 PR2) 1445043649 2026-06-28 11:31:49 +08:00
  • 978b0cf24d test(persistence): cover ExternalUserRepository.get + document upsert semantics (Stage 1 PR1) 1445043649 2026-06-28 11:29:44 +08:00
  • 5093d3d123 feat(persistence): ExternalUserRepository scaffold (Stage 1 PR1) 1445043649 2026-06-28 11:26:34 +08:00
  • ac2ab26a7e refactor(persistence): ApiKeyRepository hot path via indexed prefix + constant-time hash verify (Stage 1 PR1) 1445043649 2026-06-28 11:24:06 +08:00
  • ab40a4a17e feat(persistence): ApiKeyRepository with active-key hot path (Stage 1 PR1) 1445043649 2026-06-28 11:17:07 +08:00
  • 04170205dd fix(persistence): validate status in ServiceAccountRepository.create (Stage 1 PR1) 1445043649 2026-06-28 11:13:14 +08:00
  • 9166ab205d feat(persistence): ServiceAccountRepository (Stage 1 PR1) 1445043649 2026-06-28 11:08:20 +08:00
  • 427709e0a8 test(auth): polish token utility tests + docstring (Stage 1 PR1) 1445043649 2026-06-28 11:05:20 +08:00
  • e5ff6e74f9 feat(auth): API key token generation/hashing utilities (Stage 1 PR1) 1445043649 2026-06-28 11:01:03 +08:00
  • ef32a6de0f docs(stage-1): headless API Pattern A auth foundation implementation plan 1445043649 2026-06-28 10:57:24 +08:00
  • 240c6bd0e2 docs(mt): 统一 multi-tenant-redesign 命名约定 + README 补执行层索引 1445043649 2026-06-28 10:40:42 +08:00
  • 8ea5507d27 docs(spec): 将 Stage 1 鉴权地基 spec 移入 multi-tenant-redesign/01-redesign 1445043649 2026-06-28 10:30:25 +08:00
  • 45b019dae8 docs(spec): Stage 1 headless API Pattern A 鉴权地基设计 1445043649 2026-06-28 10:19:26 +08:00
  • 3a16da6449 docs(stage-0): 记录 multi_tenant.py live smoke PASS，关闭退出门工程项 1445043649 2026-06-28 09:59:18 +08:00
  • 30fa16ba7a feat(apps): 新增 http-chat 多租户并发示例并登记进 apps/README 1445043649 2026-06-27 23:42:24 +08:00
  • c77ee0dc06 docs(readme): 中文 README 改以多租户改造为主线 + 忽略 IDE/agent 产物 1445043649 2026-06-27 23:15:48 +08:00
  • 45efba50e4 docs(db): 补充数据库设计落地版（as-built）并登记进 README 1445043649 2026-06-27 22:55:01 +08:00
  • dd1d40368d feat(scripts): 新增本地调试与示例启动脚本，并登记进 apps/README 1445043649 2026-06-27 22:47:30 +08:00
  • 7dfc9968fe feat(apps): 新增 DeerFlow 应用脚手架，并修复 store 的 database 回退 1445043649 2026-06-27 22:02:44 +08:00
  • 84de632b19 chore(scripts): add verify_stage0.sh — systematic Stage 0 verification 1445043649 2026-05-14 14:54:02 +08:00
  • 6090b9e5b1 docs(impl): PR8 implementation note + STATUS update (Stage 0 收尾) 1445043649 2026-05-14 14:18:18 +08:00
  • f803f393d3 test(persistence): PR8 T8.6 — verify all 3 PR8 tables auto-created 1445043649 2026-05-14 14:14:14 +08:00
  • 6f806ff4a4 feat(persistence): PR8 T8.5 — ExternalUserRow ORM + 2 tests 1445043649 2026-05-14 14:12:43 +08:00
  • 52e9999a61 feat(persistence): PR8 T8.4 — ApiKeyRow ORM + 3 tests 1445043649 2026-05-14 14:10:32 +08:00
  • bb7289781e test(persistence): PR8 T8.2 + T8.3 — ServiceAccount cascade / restrict 1445043649 2026-05-14 14:07:16 +08:00
  • 1fb07e48e6 feat(persistence): PR8 T8.1 — ServiceAccountRow ORM + insert smoke 1445043649 2026-05-14 14:06:21 +08:00
  • b0bf033f15 docs(impl): PR7 implementation note + STATUS update 1445043649 2026-05-14 13:59:22 +08:00
  • d8b13afc59 docs(backend): PR7 T7.5 — document workspace boundary scan in CLAUDE.md 1445043649 2026-05-14 13:54:31 +08:00
  • d0f1877070 test(boundary): PR7 T7.3 — self-tests for the scanner 1445043649 2026-05-14 13:52:36 +08:00
  • ba30d14041 feat(tests): PR7 T7.2 — AST boundary scanner for langgraph.checkpoint 1445043649 2026-05-14 13:50:24 +08:00
  • 1a6ccc9aaa feat(tests): PR7 T7.1 — boundary scan allowlist toml 1445043649 2026-05-14 13:50:12 +08:00
  • 4c0b4fab48 docs(impl): PR6 implementation note + STATUS update 1445043649 2026-05-13 18:09:42 +08:00
  • 87ea715c2a feat(persistence): PR6 T5.11 — ORM workspace_id nullable=False 1445043649 2026-05-13 18:06:53 +08:00
  • c5c66ccbfc feat(gateway/make): PR6 T6.14 — migrate-paths target + lifespan warning 1445043649 2026-05-13 17:50:47 +08:00
  • 56f2c8d873 feat(scripts): PR6 T6.12 + T6.13 — migrate_paths_to_workspace.py + tests 1445043649 2026-05-13 17:48:49 +08:00
  • 2d3b546bf9 feat(agents): PR6 T6.11 — ThreadDataMiddleware switches to workspace layout 1445043649 2026-05-13 17:45:06 +08:00
  • f013fc1a65 feat(paths): PR6 T6.9 + T6.10 — workspace-scoped Paths 1445043649 2026-05-13 17:43:51 +08:00
  • a7ecd76e0a test(boundary): PR6 T6.8 — cross-workspace isolation e2e (4 cases) 1445043649 2026-05-13 17:40:56 +08:00
  • f6a922921b test(routers): PR6 T6.7 — POST /api/threads workspace_id integration 1445043649 2026-05-13 17:35:27 +08:00
  • 0456606dc1 test(authz): PR6 T6.6 — @require_permission workspace_id propagation tests 1445043649 2026-05-13 17:33:02 +08:00
  • b4fa3bf12a feat(persistence): PR6 T6.5 — Run/Feedback/RunEvent repos workspace_id 1445043649 2026-05-13 17:29:03 +08:00
  • 05be7f9ad0 feat(persistence/authz): PR6 T6.4 — check_access takes workspace_id 1445043649 2026-05-13 17:23:38 +08:00
  • 28ad6c2b0b feat(persistence): PR6 T6.3 — search/update_*/delete workspace_id sentinel 1445043649 2026-05-13 17:20:40 +08:00
  • 296a4f1950 feat(persistence): PR6 T6.2 — ThreadMetaRepository.get filters by workspace_id 1445043649 2026-05-13 17:19:00 +08:00
  • 361e653d37 feat(persistence): PR6 T6.1 — ThreadMetaRepository.create workspace_id sentinel 1445043649 2026-05-13 17:17:56 +08:00
  • 430f4a1132 docs(impl): PR5 implementation note + STATUS update 1445043649 2026-05-13 09:22:19 +08:00
  • 30f2bd0084 test(persistence): alembic 0003 — NOT NULL + UNIQUE coverage 1445043649 2026-05-13 09:16:24 +08:00
  • 73d0b7017b feat(persistence): alembic 0003 — workspace_id NOT NULL + UNIQUE(wid, tid) 1445043649 2026-05-13 09:15:07 +08:00
  • 8a03abac75 test(persistence): backfill --dry-run end-to-end no-write proof 1445043649 2026-05-13 09:13:16 +08:00
  • def45dd0c6 feat(persistence): backfill Step 3 — orphan rows -> legacy_workspace 1445043649 2026-05-13 09:12:26 +08:00
  • 56f6572086 feat(persistence): backfill Step 2 — UPDATE 4 tables from users.default_workspace_id 1445043649 2026-05-13 09:10:49 +08:00
  • e6bb220979 feat(persistence): backfill Step 1 — workspace per user without default 1445043649 2026-05-13 09:09:16 +08:00
  • ad322543d0 feat(persistence): backfill_workspace_id.py — script skeleton 1445043649 2026-05-13 09:07:44 +08:00
  • d3361dba59 feat(persistence): 4 business ORM models — nullable workspace_id 1445043649 2026-05-13 09:06:08 +08:00
  • 4e26ec9884 test(persistence): alembic 0002 round-trip on SQLite + Postgres 1445043649 2026-05-13 09:04:21 +08:00
  • a732697855 feat(persistence): alembic 0002 — business tables nullable workspace_id 1445043649 2026-05-13 09:04:13 +08:00
  • 44f84800e9 docs(impl): PR4 implementation note + STATUS update 1445043649 2026-05-12 22:43:04 +08:00
  • 5c7753c0b8 feat(auth): lifespan _ensure_admin_user backfills missing workspace 1445043649 2026-05-12 22:39:09 +08:00
  • 91846a201e feat(auth): /auth/me returns workspaces[] with id/name/slug/role 1445043649 2026-05-12 22:37:29 +08:00
  • 634e5119e1 feat(auth): login + change_password re-issue JWTs with wid + role 1445043649 2026-05-12 22:35:06 +08:00
  • 84701730da feat(auth): /register auto-creates default workspace + owner membership 1445043649 2026-05-12 22:32:39 +08:00
  • a657d17995 feat(auth): /initialize auto-creates default workspace + owner membership 1445043649 2026-05-12 22:31:53 +08:00
  • a06e88d58b feat(auth): workspace slug helpers — auto_slug_from_email + next_available_slug 1445043649 2026-05-12 22:27:42 +08:00
  • 2145d36744 feat(auth): AuthMiddleware injects workspace ContextVar from JWT wid/role 1445043649 2026-05-12 22:25:43 +08:00
  • b4bef65079 feat(auth): decode_token rejects legacy 4-field JWTs as WORKSPACE_MISSING 1445043649 2026-05-12 22:22:10 +08:00
  • 54cb94c30f feat(auth): JWT TokenPayload accepts wid + role 1445043649 2026-05-12 22:17:55 +08:00
  • 54762f491c feat(persistence): UserRow.default_workspace_id 1445043649 2026-05-12 22:15:05 +08:00
  • 917d8fbeaf test(persistence): alembic 0001 round-trip on SQLite + Postgres 1445043649 2026-05-12 22:11:11 +08:00
  • 8efbb2f9e5 feat(persistence): alembic 0001 — users.default_workspace_id 1445043649 2026-05-12 22:08:44 +08:00
  • d98498b705 docs(impl): T4.1 — confirm alembic baseline is not needed 1445043649 2026-05-12 22:07:34 +08:00
  • c70c6594de docs(impl): STATUS — record LOCK sign-off and origin push 1445043649 2026-05-12 22:02:33 +08:00
  • a592319e3c docs(impl): STATUS update after PR3 merge 1445043649 2026-05-12 21:34:05 +08:00