feat(PSGO-261): PAT/AT exchange, local PKCE login, multi-project scope, and OAuth session exchange - #605

Open

Matovidlo wants to merge 90 commits into

mainfrom

martinvasko-psgo-261-pat-token-exchange-implementation

Commits on Aug 13, 2026

feat(PSGO-261): exchange programmatic tokens for Storage tokens via auth-bridge

Matovidlo
and
claude
committed
edc7b77
feat(PSGO-261): local browser PKCE login (stack-only) with token refresh

Matovidlo
and
claude
committed
57f6bd4
docs(PSGO-261): extend RFC with multi-project scope

Matovidlo
and
claude
committed
3c242ce
feat(PSGO-261): multi-project scope via introspect + scoped exchange

Matovidlo
and
claude
committed
8c9f13c
feat(PSGO-261): per-call project filter for read tools

Matovidlo
and
claude
committed
9dc5550
feat(PSGO-261): surface current scope in get_accessible_projects

Matovidlo
and
claude
committed
546cac0
feat(PSGO-261): fan out query_data across scoped projects

Matovidlo
and
claude
committed
5200b63
feat(PSGO-261): enrich get_accessible_projects with per-project SQL dialect

Matovidlo
and
claude
committed
5d54a89
refactor(PSGO-261): rename get_accessible_projects llm_instructions -> base_instructions

Matovidlo
and
claude
committed
21b6897
docs(PSGO-261): RFC increment 3 — query fan-out, dialect bootstrap, service-token gaps

Matovidlo
and
claude
committed
ac95137
test(PSGO-261): add get_accessible_projects + set_project_scope to integtest tool set

Matovidlo
and
claude
committed
5bc49e4
test(PSGO-261): CI integration coverage for the multi-project PAT flow

Matovidlo
and
claude
committed
e54bc49
test(PSGO-261): run integtests across sapi/pat_single/pat_mpa auth over the same pool

Matovidlo
and
claude
committed
a55e015
feat(PSGO-261): auto-login on local server start when no/dead session

Matovidlo
and
claude
committed
475624a
feat(PSGO-261): login --pat leases a PAT over all projects (sudo MFA + create)

Matovidlo
and
claude
committed
207004b
feat(PSGO-261): scope-first tool visibility for programmatic sessions

Matovidlo
and
claude
committed
ee7677b
feat(PSGO-261): count-first fan-out with a safety cap for big projects

Matovidlo
and
claude
committed
b561c17
feat(PSGO-261): refresh-first login + partial-result fan-out on per-project errors

Matovidlo
and
claude
committed
196b6a6
feat(PSGO-261): login --show-token to print the session access token

Matovidlo
and
claude
committed
9fc4aa6
feat(PSGO-261): local HTTP server self-refreshes from the stored PKCE session

Matovidlo
and
claude
committed
bb85cc4
fix(PSGO-261): call-time tool gating + drop surfaced active_project_id

Matovidlo
and
claude
committed
09a9236
fix(PSGO-261): don't introspect on /list requests (tools/list 30s timeout)

Matovidlo
and
claude
committed
d95e700
fix(PSGO-261): add --no-stateless-http so multi-project scope persists over HTTP

Matovidlo
and
claude
committed
8d3ed0e
fix(PSGO-261): skip list-time feature filtering for all programmatic sessions

Matovidlo
and
claude
committed
a50671d
feat(PSGO-261): add logout command and login --force to switch tokens

Matovidlo
and
claude
committed
3de5d0d
fix(PSGO-261): stop fanning out argument-validation errors across projects

Matovidlo
and
claude
committed
0d12f27
fix(PSGO-261): stop polling workspace-creation job after terminal failure

Matovidlo
and
claude
committed
4029bd3
fix(PSGO-261): send PAT as Bearer token on jobs-queue, ai-service and sync-actions

Matovidlo
and
claude
committed
abbd61c
docs(PSGO-261): reconcile as-built RFC with shipped per-service token wiring

Matovidlo
and
claude
committed
3dfad98
chore(PSGO-261): regenerate TOOLS.md with locked pydantic 2.13.4

Matovidlo
and
claude
committed
353c0a2
refactor(PSGO-261): apply post-rebase review cleanups (simplify/reuse/altitude)

Matovidlo
and
claude
committed
c36fb8f
docs(PSGO-261): document browser login for local setup; drop legacy token paste

Matovidlo
and
claude
committed
44a3a8f
fix(PSGO-261): normalize inbound Bearer scheme to avoid Bearer Bearer headers

Matovidlo
and
claude
committed
d88d949
docs(PSGO-261): use conventional Note: marker in _swap_project docstring

Matovidlo
and
claude
committed
8f5903e
fix(PSGO-261): safer dialect fallback, login timeout, traceback logging

Matovidlo
and
claude
committed
68095e7
refactor(PSGO-261): public client_for_project, legacy-token instructions, store polish

Matovidlo
and
claude
committed
03b54fa
fix(PSGO-261): propagate cancellation in dialect fan-out; correct /list comment

Matovidlo
and
claude
committed
b05b4d3
fix(PSGO-261): keep the workspace when creation ends with a 'warning' status

Matovidlo
and
claude
committed
5b923b8
fix(PSGO-261): reject empty project_ids; chmod credentials before writing tokens

Matovidlo
and
claude
committed
c1916fd
fix(PSGO-261): refresh an expired stored token on /list (keep valid tokens network-free)

Matovidlo
and
claude
committed
be5a848
fix(PSGO-261): log swallowed auth-refresh errors with traceback; don't mask exchange client errors

Matovidlo
and
claude
committed
8fdb8dd
docs(PSGO-261): RFC for OAuth login exchanging into a programmatic session

Matovidlo
and
claude
committed
200cd5c
feat(PSGO-261): implement OAuth login exchange into a programmatic session

Matovidlo
and
claude
committed
f893055
refactor(PSGO-261): dedupe StorageTokenResolver/OAuthSessionExchanger boilerplate

Matovidlo
and
claude
committed
228d1e8
fix(PSGO-261): map refresh network errors to HTTPException; dedupe token-wrap

Matovidlo
and
claude
committed
aaf6c97
fix(PSGO-261): stop logging token material; don't require project_id for OAuth sessions

Matovidlo
and
claude
committed
e8ff640
fix(PSGO-261): correct with_llm_instruction wording; log dialect failures with traceback

Matovidlo
and
claude
committed
8ecc889
fix(PSGO-261): use per-request Storage API URL in fan-out; don't duplicate refresh token

Matovidlo
and
claude
committed
5f414c3
fix(PSGO-261): re-run per-project authorization during fan-out; decouple refresh-token TTL

Matovidlo
and
claude
committed
f49c74a
fix(PSGO-261): validate _parent_subject_token's bearer is actually programmatic

Matovidlo
and
claude
committed
d64779e
fix(PSGO-261): raise the right exception class for OAuth-visible errors

Matovidlo
and
claude
committed
4d7a5d6
fix(PSGO-261): stop sending X-KBC-ManageApiToken to exchange-oauth-token

Matovidlo
and
claude
committed
7fbeb25
fix(PSGO-261): never consult the local PKCE store on the deployed server

Matovidlo
and
claude
committed
660aab9
fix(PSGO-261): exempt bootstrap tools from ToolsFilteringMiddleware's verify

Matovidlo
and
claude
committed
eba47d9
fix(PSGO-261): apply confirmed scope's project id on deployed sessions; fix step-up bearer

Matovidlo
and
claude
committed
1c2bd36
fix(PSGO-261): carry multi-project scope as a signed scope_token instead of session state

Matovidlo
and
claude
committed
b79e298
fix(PSGO-261): drop the auth-bridge resolve-storage-token exchange for programmatic tokens

Matovidlo
and
claude
committed
78a0bf6
docs(PSGO-261): add Postgres-backed OAuth session store RFC; reconcile prior RFCs with as-built code

Matovidlo
and
claude
committed
7dff1af
feat(PSGO-261): add Postgres-backed session_store package (Phase 1, no behavior change yet)

Matovidlo
and
claude
committed
9abc2a5
fix(PSGO-261): alias postgres_dsn to MCP_DB_URL, matching this infra's naming convention

Matovidlo
and
claude
committed
f214cad
feat(PSGO-261): wire SimpleOAuthProvider onto the Postgres session store (Phase 2)

Matovidlo
and
claude
committed
7e3e6e9
feat(PSGO-261): persist multi-project scope on the OAuth session row
Matovidlo
committed
a406aec
feat(PSGO-261): tag merged fan-out items with their source project
Matovidlo
committed
0b28517
feat(PSGO-261): partition oauth_sessions by month, 2-month retention
Matovidlo
committed
10e3b3d
refactor(PSGO-261): split mcp.py under 1k lines; address code-quality review
Matovidlo
committed
b6fc782
fix(PSGO-261): keep exactly retention_months of oauth_sessions partitions
Matovidlo
committed
11d7d45
fix(PSGO-261): move overlapping default-partition rows before attaching a new oauth_sessions partition
Matovidlo
committed
a3d1ba2
fix(PSGO-261): log lazy Keboola-session token refresh in load_access_token
Matovidlo
committed
8a7b5c1
fix(PSGO-261): require KBC_SESSION_ENCRYPTION_KEY when OAuth is enabled
Matovidlo
committed
0e64b37
fix(PSGO-261): enforce real per-partition uniqueness on oauth_sessions token hashes
Matovidlo
committed
5958223
fix(PSGO-261): require explicit project_id on write tools instead of active-project re-scope

Matovidlo
and
claude
committed
18b9613
feat(PSGO-261): surface organization_id/organization_name on get_accessible_projects

Matovidlo
and
claude
committed
099d13e
fix(PSGO-261): give get_project_info an explicit project_id like write tools

Matovidlo
and
claude
committed
9e1b967
fix(PSGO-261): scope_token clutter + OAuth scoped-token never refreshing

Matovidlo
and
claude
committed
12b6ff8
feat(PSGO-261): Kai (header-token) session-scope persistence + post-rebase ruff fixes
Matovidlo
committed
1c4fefd
docs(PSGO-261): RFC increment 7 -- security hardening response to PR review
Matovidlo
committed
56b035b
fix(PSGO-261): allowlist header-derived Config fields, close domain-check bypass
Matovidlo
committed
3471706
fix(PSGO-261): stop read_only from failing open for the active project
Matovidlo
committed
b0ed1ae
fix(PSGO-261): encrypt scope_token instead of just signing it, wire login-time scoping
Matovidlo
committed
de372da
fix(PSGO-261): scope login-time, key credentials per interface, prompt MFA, redact errors
Matovidlo
committed
7584d63
feat(PSGO-261): skip scoping when a session can only reach one project
Matovidlo
committed
f214738
fix(PSGO-261): extend local-login token fallback to streamable-http
Matovidlo
committed
28dbd70
fix(PSGO-261): stop instructing the LLM to re-scope an already-scoped session
Matovidlo
committed
6e1b70e
fix(PSGO-261): stop X-KBC-ProjectId from overriding a confirmed scope
Matovidlo
committed
4c6264f
test(PSGO-261): drop a redundant no-scope test added in c0d8fe02
Matovidlo
committed
6fa5844
fix(PSGO-261): stop the login fallback from crashing streamable-http with no token
Matovidlo
committed
f50a90b
docs(PSGO-261): restructure RFC around architecture, not a fix changelog
Matovidlo
committed
13d2c8e
docs(PSGO-261): fix RFC claim about login-time scoped-token minting
Matovidlo
committed
bf10d41
fix(PSGO-261): post-rebase fixups — stale call sites, dead import, dup test, ruff 0.16 lint
Matovidlo
committed
4a54436

Commits on Aug 17, 2026

fix(PSGO-261): bind scope_token to the presenting caller, closing a replay vector

Matovidlo
and
claude
committed
fc11d7d