feat: Introduce a unified RequestContext for standalone, OIDC, and TrueFoundry authentication - #565
feat: Introduce a unified RequestContext for standalone, OIDC, and TrueFoundry authentication#565thesujai wants to merge 3 commits into
Conversation
🦋 Changeset detectedLatest commit: e6df9b3 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
|
||
| const { subject } = session.user; | ||
| return { | ||
| tenant_id: session.user.tenantName, |
There was a problem hiding this comment.
TrueFoundry tenant orphans local data
Medium Severity
TrueFoundry auth now scopes every local store read and write to session.user.tenantName. Previously all local rows used the fixed tenant default. Existing agents, sessions, schedules, skills, and sandbox settings stored under default become invisible, with no migration.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 7941001. Configure here.
There was a problem hiding this comment.
Correct, will write another PR for that
There was a problem hiding this comment.
Cant fix this is an expected break cc @chiragjn
…ueFoundry authentication
…ross multiple files
2d106c3 to
e6df9b3
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.
There are 3 total unresolved issues (including 1 from previous review).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit e6df9b3. Configure here.
| tenant_id: requestContext.tenant_id, | ||
| subject: requestContext.subject, | ||
| is_admin: requestContext.is_admin, | ||
| }; |
There was a problem hiding this comment.
Frontend still expects old /me shape
High Severity
GET /auth/me now returns { tenant_id, subject, is_admin } and drops type, but the bundled UI still treats auth.me() as { type: "oidc-connected" }. After a successful OIDC login, isOidcConnectedSession is always false, so the logout control never appears. Schema and SDK changed without the frontend layer.
Additional Locations (1)
Triggered by project rule: TrueForge review rules
Reviewed by Cursor Bugbot for commit e6df9b3. Configure here.
| message: 'TrueFoundry ServiceFoundry session response was malformed', | ||
| cause: parsed.error, | ||
| }); | ||
| } |
There was a problem hiding this comment.
Session parse failure returns 500
Low Severity
getSession documents a 502 on ServiceFoundry schema mismatch but throws HTTPException(500). A drifted GET /v1/session body then fails every authenticated TrueFoundry request as an internal server error instead of a bad-gateway/upstream fault.
Reviewed by Cursor Bugbot for commit e6df9b3. Configure here.
1 participant
…
Summary
feat: Introduce a unified RequestContext for standalone, OIDC, and TrueFoundry authentication
Closes AGE-2066
Changes
feat: Introduce a unified RequestContext for standalone, OIDC, and TrueFoundry authentication
How was this tested?
MANUALLY and through unit tests
Checklist
pnpm build,pnpm test,pnpm typecheck,pnpm lint:ci, andpnpm format:checkpass locallypackages/trueforge-sdk,.github/fern/openapi/openapi.json,docs/openapi.json) — fork PRs omit SDK regen; maintainers regenerate after merge.env.exampleupdated if configuration or behavior changedNote
High Risk
Central authentication and authorization refactor with a breaking
/auth/meresponse and tenant-scoped data access across most API surfaces; misconfiguration could affect access control and multi-tenant isolation.Overview
Introduces a single request-scoped
RequestContext(tenant_id,subject,is_admin, optionaluser_credential) and pluggableAuthenticatorimplementations for standalone, OIDC JWT, and TrueFoundry ServiceFoundry session lookup. Auth middleware is built from the startup-selected authenticator instead of inline OIDC-only logic./api/v1/auth/meis a breaking contract change: it now returns{ tenant_id, subject: { id, type, display_name }, is_admin }instead ofemail/role/ sessiontype. OpenAPI, SDK types, and docs are updated accordingly.Protected APIs stop using a hardcoded tenant and
UserContext: handlers takeresolveRequestContextand scope DB/MCP work withrequestContext.tenant_idandrequestContext.subject.id(schedules, sessions, settings admin gate viais_admin). TrueFoundry model/MCP stores read the bearer token fromuser_credentialon the context.OIDC adds configurable
OIDC_USER_DISPLAY_NAME_CLAIM(defaultname, Helm/docs), mapped intosubject.display_namewith fallback to the user reference claim.Reviewed by Cursor Bugbot for commit e6df9b3. Bugbot is set up for automated code reviews on this repo. Configure here.