feat(server): add runtime auth and namespace scoping#214
Merged
Conversation
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
abhinav-galileo
force-pushed
the
abhi/runtime-auth-namespace-cutover
branch
from
09cb289 to
19fa65c
Compare
abhinav-galileo
changed the title
abhinav-galileo
force-pushed
the
abhi/controls-auth-framework
branch
from
ad586bb to
3a5b7e4
Compare
abhinav-galileo
force-pushed
the
abhi/runtime-auth-namespace-cutover
branch
2 times, most recently
from
af54543 to
479ca86
Compare
abhinav-galileo
force-pushed
the
abhi/controls-auth-framework
branch
from
8312b99 to
e75cbb7
Compare
abhinav-galileo
force-pushed
the
abhi/runtime-auth-namespace-cutover
branch
from
dce333a to
69aaa49
Compare
abhinav-galileo
force-pushed
the
abhi/controls-auth-framework
branch
from
e75cbb7 to
2935d2d
Compare
abhinav-galileo
force-pushed
the
abhi/runtime-auth-namespace-cutover
branch
from
69aaa49 to
4b778e3
Compare
namrataghadi-galileo
approved these changes
May 14, 2026
abhinav-galileo
force-pushed
the
abhi/controls-auth-framework
branch
from
2935d2d to
0a8aeb6
Compare
abhinav-galileo
force-pushed
the
abhi/runtime-auth-namespace-cutover
branch
3 times, most recently
from
fe8488e to
2a17f73
Compare
abhinav-galileo
force-pushed
the
abhi/controls-auth-framework
branch
from
fba36df to
3cd0ee1
Compare
abhinav-galileo
force-pushed
the
abhi/runtime-auth-namespace-cutover
branch
2 times, most recently
from
ec82ad3 to
c67ea44
Compare
Add explicit none, api_key, and jwt runtime auth modes, including a generic no-auth provider. Move controls, bindings, policies, agents, and evaluation storage lookups onto principal namespace scoping. Cover auth mode selection and principal namespace isolation with server tests.
…stream The default forward set (X-API-Key, Authorization, Cookie) only covers credential headers Agent Control itself reads. Deployments whose upstream authenticates against a different header name (e.g., a deployer-specific API-key header) had no way to surface that credential through HttpUpstreamAuthProvider — the inbound header reached AC but never crossed the upstream call. Add an extra_forward_headers config field on HttpUpstreamConfig (defaulting to the empty tuple) that operators populate via the new AGENT_CONTROL_AUTH_UPSTREAM_EXTRA_FORWARD_HEADERS env var (comma- separated). The provider's _forward_headers iterates over the union of the default set and the extras, deduplicating case-insensitively so a duplicate name (cross-set or within extras) does not produce two copies on the wire. Tests: - forwards a configured extra header alongside defaults - default forward set unchanged when extras are empty - extras dedupe against defaults case-insensitively - _parse_extra_forward_headers parametric: None / empty / single / multiple / whitespace / empty-entries / case-folded duplicates - configure_auth_from_env threads the parsed tuple onto the provider Lint clean, typecheck clean, full server suite (747) green.
abhinav-galileo
force-pushed
the
abhi/runtime-auth-namespace-cutover
branch
from
1272698 to
8163931
Compare
10 tasks
galileo-automation
pushed a commit
that referenced
this pull request
May 28, 2026
## [2.6.0](ts-sdk-v2.5.0...ts-sdk-v2.6.0) (2026-05-28) ### Features * **evaluators:** add new lluna client ([#213](#213)) ([f65beb9](f65beb9)) * **sdk:** add otel support ([#177](#177)) ([9530368](9530368)) * **sdk:** add runtime token auth ([#215](#215)) ([6cc0f38](6cc0f38)) * **server:** add control clone-and-bind endpoint ([#229](#229)) ([1728bf9](1728bf9)) * **server:** add runtime auth and namespace scoping ([#214](#214)) ([56e44fe](56e44fe)) * **server:** allow host-owned logging setup ([#227](#227)) ([c0fd159](c0fd159)) * **server:** bundle migrations in wheel and add agent-control-migrate ([#209](#209)) ([8c5c35e](8c5c35e)) * **server:** migrate controls routes to auth framework ([#212](#212)) ([764bd4b](764bd4b)) ### Bug Fixes * **examples:** declare local SDK workspace deps ([#222](#222)) ([d22aa1d](d22aa1d)) * **sdk:** Get trace context from provider ([#211](#211)) ([1efe30f](1efe30f)) * **sdk-ts:** normalize generated client ([#231](#231)) ([1c097d2](1c097d2)) * **server:** make observability migration retry-safe ([#226](#226)) ([b9dd00d](b9dd00d)) * **server:** prevent migration lock transactions ([#224](#224)) ([e65a2f4](e65a2f4)) * **server:** scope auth upstream CA to HTTP provider ([#232](#232)) ([7a0ce21](7a0ce21)) * **ui:** fix editing of controls in the UI ([#218](#218)) ([981e33d](981e33d)), closes [#Risk](https://github.com/agentcontrol/agent-control/issues/Risk)
Collaborator
|
🎉 This PR is included in version 2.6.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
none,api_key, andjwt.Stack
Testing
make prepushon the stacked branch in feat(sdk): add runtime token auth #215.