metaclassing
9adde920d4
feat(models): per-alias backend auth via Entra OBO and app identity ( #898 )
...
Adds a per-alias `auth_mode` on model definitions so a model backend can
authenticate to an Entra-fronted gateway with a per-request minted token instead
of one shared static API key, letting the gateway attribute calls to the actual
user or to the app as a machine identity.
- `static` (default, unchanged) sends the stored `api_key`.
- `entra_obo` mints a per-user On-Behalf-Of token for `obo_audience` from the
caller's captured refresh credential.
- `entra_app` mints an app-identity token via the client-credentials grant, and
covers userless turns that OBO cannot.
Reuses the existing OBO grant legs, refresh-token rotation CAS, cluster advisory
lock and the `mcp_user_tokens` mint-cache, keyed under synthetic
`__model_obo__:<audience>` / `__model_app__:<audience>` rows. The token binds at
the call site through `client.with_options(api_key=...)` so each SDK emits it on
its own auth path rather than through header injection.
Migration 068 adds `auth_mode` and `obo_audience`. Both are additive and existing
rows default to `static`, so behaviour is unchanged unless an alias opts in.
Operator controls: `model.auth_audience_allowlist` is an exact-match allow-list
that gates which audiences may be configured and denies all by default, and
changing a mode or audience requires `admin.mcp`. `model.auth_fail_closed`
decides whether a failed mint may fall back to an explicitly configured static
key. A delegated call with no user, or a dynamic alias with no real static key,
always refuses.
Two changes here apply regardless of whether any alias opts in:
- Storage and app state are now wired into the console MCP client manager. This
fixes per-user `oauth_user` / `oauth_obo` dispatch for coordinator-hosted
sessions, which previously raised `RuntimeError` on first call because
`set_app_state` was only ever called on the node.
- Unattended watch restores and `--resume` resolve the persisted workstream
owner instead of constructing the session under an empty principal. A
workstream with no owner is now a permanent refusal rather than an anonymous,
auto-approved run.
2026-08-02 15:15:02 -07:00
..
2026-07-13 08:48:27 -07:00
2026-03-02 00:33:37 -08:00
2026-04-30 23:20:14 -07:00
2026-07-07 16:42:36 -07:00
2026-08-02 06:15:40 -07:00
2026-07-10 15:42:33 -07:00
2026-07-05 01:57:54 -07:00
2026-07-13 22:39:19 -07:00
2026-07-20 22:38:32 -07:00
2026-07-24 18:15:03 -07:00
2026-07-04 20:54:20 -07:00
2026-07-18 16:12:59 -07:00
2026-05-05 15:27:14 -07:00
2026-06-01 21:34:12 -07:00
2026-07-11 18:15:48 -07:00
2026-05-19 08:09:33 -07:00
2026-05-29 21:11:16 -07:00
2026-08-02 15:15:02 -07:00
2026-06-01 15:47:14 -07:00
2026-04-26 22:14:22 -07:00
2026-08-02 06:15:40 -07:00
2026-06-04 11:03:13 -07:00
2026-06-16 00:48:14 -07:00
2026-06-16 19:49:31 -07:00
2026-04-27 22:51:31 -07:00
2026-06-15 02:48:50 -07:00
2026-08-02 15:15:02 -07:00
2026-07-10 15:42:33 -07:00
2026-07-10 15:42:33 -07:00
2026-07-20 22:38:32 -07:00
2026-08-02 01:48:30 -07:00
2026-07-07 08:20:57 -07:00
2026-05-23 14:20:36 -07:00
2026-07-29 22:11:38 -07:00
2026-04-18 05:49:54 -07:00
2026-07-05 01:57:54 -07:00
2026-07-29 22:11:38 -07:00
2026-04-18 05:49:54 -07:00
2026-03-23 11:11:40 -07:00
2026-05-12 13:15:09 -07:00
2026-05-11 01:06:47 -07:00
2026-04-30 23:20:14 -07:00
2026-04-30 23:20:14 -07:00
2026-05-24 18:31:23 -07:00
2026-05-30 16:27:15 -07:00
2026-07-17 11:28:44 -07:00
2026-07-29 22:11:38 -07:00
2026-05-31 19:54:43 -07:00
2026-07-19 19:09:58 -07:00
2026-07-05 01:59:38 -07:00
2026-07-05 01:59:38 -07:00
2026-05-11 01:06:47 -07:00
2026-04-27 21:52:57 -07:00
2026-04-16 13:30:25 -07:00
2026-04-18 19:02:52 -07:00
2026-07-03 00:29:26 -07:00
2026-07-20 07:25:56 -07:00
2026-07-25 00:50:29 -07:00
2026-06-08 10:08:30 -07:00
2026-07-17 11:28:44 -07:00
2026-07-17 11:28:44 -07:00
2026-07-17 11:28:44 -07:00
2026-07-05 01:57:54 -07:00
2026-07-07 16:42:36 -07:00
2026-07-29 22:11:38 -07:00
2026-06-26 03:28:06 -07:00
2026-05-11 01:06:47 -07:00
2026-07-06 19:16:09 -07:00
2026-06-26 03:28:06 -07:00
2026-07-29 22:11:38 -07:00
2026-07-29 22:11:38 -07:00
2026-04-16 21:40:50 -07:00
2026-07-29 22:11:38 -07:00
2026-08-02 06:15:40 -07:00
2026-07-19 19:09:58 -07:00
2026-03-13 21:21:09 -07:00
2026-07-13 22:39:19 -07:00
2026-06-17 18:07:45 -07:00
2026-06-26 04:57:20 -07:00
2026-07-13 22:39:19 -07:00
2026-04-04 17:53:20 -07:00
2026-03-02 00:33:37 -08:00
2026-07-05 01:59:38 -07:00
2026-07-13 22:39:19 -07:00
2026-05-04 00:46:43 -07:00
2026-07-29 22:11:38 -07:00
2026-07-29 22:11:38 -07:00
2026-06-04 11:03:13 -07:00
2026-06-26 19:37:01 -07:00
2026-03-03 22:57:34 -08:00
2026-07-22 23:44:04 -07:00
2026-07-03 00:29:26 -07:00
2026-07-03 00:29:26 -07:00
2026-06-10 13:31:53 -07:00
2026-06-09 18:37:46 -07:00
2026-04-04 23:44:29 -07:00
2026-07-13 08:48:27 -07:00
2026-06-04 11:03:13 -07:00
2026-05-30 01:11:48 -07:00
2026-07-29 22:11:38 -07:00
2026-07-17 11:28:44 -07:00
2026-06-16 03:41:51 -07:00
2026-05-31 19:54:43 -07:00
2026-07-24 18:15:03 -07:00
2026-06-04 11:03:13 -07:00
2026-05-31 19:54:43 -07:00
2026-04-05 01:53:33 -07:00
2026-06-09 20:00:55 -07:00
2026-07-13 22:39:19 -07:00
2026-03-04 06:47:30 -08:00
2026-07-11 16:37:13 -07:00
2026-03-02 16:55:12 -08:00
2026-08-02 15:15:02 -07:00
2026-07-12 19:03:35 -07:00
2026-08-02 15:15:02 -07:00
2026-07-13 21:13:42 -07:00
2026-05-04 22:00:23 -07:00
2026-08-02 01:48:30 -07:00
2026-05-06 11:29:25 -07:00
2026-05-04 22:00:23 -07:00
2026-07-14 11:39:25 -07:00
2026-07-14 11:39:25 -07:00
2026-08-02 15:15:02 -07:00
2026-06-25 20:42:22 -07:00
2026-07-04 03:27:55 -07:00
2026-05-04 22:00:23 -07:00
2026-05-04 22:00:23 -07:00
2026-07-12 19:03:35 -07:00
2026-05-07 13:59:50 -07:00
2026-05-07 13:59:50 -07:00
2026-07-12 19:03:35 -07:00
2026-05-12 13:15:09 -07:00
2026-07-04 03:27:55 -07:00
2026-07-12 19:03:35 -07:00
2026-06-17 18:07:45 -07:00
2026-07-14 11:39:25 -07:00
2026-06-17 18:07:45 -07:00
2026-06-17 18:07:45 -07:00
2026-07-13 21:13:42 -07:00
2026-03-12 16:57:31 -07:00
2026-03-21 16:12:50 -07:00
2026-03-20 20:01:26 -07:00
2026-03-23 11:11:40 -07:00
2026-05-07 13:59:50 -07:00
2026-05-04 22:00:23 -07:00
2026-07-06 18:46:28 -07:00
2026-07-14 11:39:25 -07:00
2026-08-02 15:15:02 -07:00
2026-06-26 17:24:06 -07:00
2026-06-26 17:24:06 -07:00
2026-07-29 22:11:38 -07:00
2026-05-04 22:00:23 -07:00
2026-06-04 11:03:13 -07:00
2026-06-12 13:54:49 -07:00
2026-06-26 17:24:06 -07:00
2026-07-03 00:29:26 -07:00
2026-07-04 16:48:52 -07:00
2026-07-08 00:59:14 -07:00
2026-05-31 16:05:21 -07:00
2026-05-09 02:45:13 -07:00
2026-07-13 22:39:19 -07:00
2026-08-02 15:15:02 -07:00
2026-08-02 15:15:02 -07:00
2026-08-02 15:15:02 -07:00
2026-06-11 20:27:29 -07:00
2026-06-04 11:03:13 -07:00
2026-04-28 13:49:31 -07:00
2026-04-06 03:08:19 -07:00
2026-06-04 11:03:13 -07:00
2026-05-11 01:23:54 -07:00
2026-04-05 17:18:26 -07:00
2026-07-17 11:28:44 -07:00
2026-07-29 22:11:38 -07:00
2026-07-06 21:52:42 -07:00
2026-07-12 19:03:35 -07:00
2026-08-02 15:15:02 -07:00
2026-07-04 16:48:52 -07:00
2026-07-12 19:03:35 -07:00
2026-07-07 08:20:57 -07:00
2026-05-31 19:54:43 -07:00
2026-07-05 11:59:52 -07:00
2026-06-11 14:00:42 -07:00
2026-05-24 17:49:27 -07:00
2026-07-13 22:39:19 -07:00
2026-07-06 21:42:51 -07:00
2026-06-16 00:48:14 -07:00
2026-07-02 19:23:04 -07:00
2026-08-02 15:15:02 -07:00
2026-07-03 00:29:26 -07:00
2026-07-29 22:11:38 -07:00
2026-07-06 19:58:36 -07:00
2026-07-03 00:29:26 -07:00
2026-07-06 19:16:09 -07:00
2026-07-07 22:07:20 -07:00
2026-07-07 08:20:57 -07:00
2026-07-01 18:01:50 -07:00
2026-06-26 17:24:06 -07:00
2026-07-01 18:01:50 -07:00
2026-07-06 19:16:09 -07:00
2026-07-03 19:16:36 -07:00
2026-07-03 00:29:26 -07:00
2026-07-13 22:39:19 -07:00
2026-05-09 02:45:13 -07:00
2026-06-04 11:03:13 -07:00
2026-06-04 11:03:13 -07:00
2026-07-11 16:37:13 -07:00
2026-07-13 22:39:19 -07:00
2026-07-13 22:39:19 -07:00
2026-07-25 01:12:04 -07:00
2026-04-26 22:14:22 -07:00
2026-07-13 08:48:27 -07:00
2026-07-01 21:05:57 -07:00
2026-06-04 11:03:13 -07:00
2026-08-02 06:15:40 -07:00
2026-04-18 19:02:52 -07:00
2026-07-20 11:16:08 -07:00
2026-06-01 14:44:30 -07:00
2026-06-01 21:34:12 -07:00
2026-03-30 20:30:05 -07:00
2026-07-24 15:04:31 -07:00
2026-05-31 19:54:43 -07:00
2026-05-31 19:54:43 -07:00
2026-03-02 00:33:37 -08:00
2026-07-03 00:29:26 -07:00
2026-07-08 00:59:14 -07:00
2026-07-08 00:59:14 -07:00
2026-07-08 00:59:14 -07:00
2026-07-03 00:29:26 -07:00
2026-03-02 16:55:12 -08:00
2026-07-08 00:59:14 -07:00
2026-05-31 19:54:43 -07:00
2026-04-04 22:19:03 -07:00
2026-04-16 13:30:25 -07:00
2026-07-08 00:59:14 -07:00
2026-04-26 22:14:22 -07:00
2026-04-26 13:11:07 -07:00
2026-07-01 21:05:57 -07:00
2026-07-17 11:28:44 -07:00
2026-07-17 20:08:56 -07:00
2026-07-29 22:11:38 -07:00
2026-05-30 14:03:39 -07:00
2026-07-04 20:54:20 -07:00
2026-07-12 19:03:35 -07:00
2026-07-03 00:29:26 -07:00
2026-05-02 20:22:25 -07:00
2026-05-22 15:13:39 -07:00
2026-03-30 20:30:05 -07:00
2026-07-13 22:39:19 -07:00
2026-07-17 20:08:56 -07:00
2026-08-02 15:15:02 -07:00
2026-07-03 00:29:26 -07:00
2026-06-26 08:38:31 -07:00
2026-07-13 22:39:19 -07:00
2026-07-07 08:20:57 -07:00
2026-07-13 08:48:27 -07:00
2026-07-07 23:32:20 -07:00
2026-07-17 11:28:44 -07:00
2026-07-29 22:11:38 -07:00
2026-08-02 01:48:30 -07:00
2026-05-31 19:03:16 -07:00
2026-05-31 19:54:43 -07:00
2026-08-02 06:15:40 -07:00
2026-07-03 17:30:33 -07:00
2026-05-24 14:56:43 -07:00
2026-05-24 14:56:43 -07:00
2026-05-24 14:56:43 -07:00
2026-07-03 19:16:36 -07:00
2026-03-17 01:26:44 -07:00
2026-03-23 11:11:40 -07:00
2026-03-16 15:45:21 -07:00
2026-05-08 13:58:02 -07:00
2026-07-03 19:16:36 -07:00
2026-07-03 19:16:36 -07:00
2026-07-03 19:16:36 -07:00
2026-07-20 22:38:32 -07:00
2026-07-17 11:28:44 -07:00
2026-07-24 18:15:03 -07:00
2026-07-20 22:38:32 -07:00
2026-07-20 22:38:32 -07:00
2026-07-20 22:38:32 -07:00
2026-04-25 20:11:47 -07:00
2026-07-07 08:20:57 -07:00
2026-05-11 01:23:54 -07:00
2026-04-04 17:53:20 -07:00
2026-05-24 14:56:43 -07:00
2026-04-18 10:20:19 -07:00
2026-06-04 11:03:13 -07:00
2026-07-07 08:20:57 -07:00
2026-06-28 20:24:20 -07:00
2026-06-28 20:24:20 -07:00
2026-07-03 19:16:36 -07:00
2026-06-16 03:41:51 -07:00
2026-04-01 19:38:24 -07:00
2026-06-16 17:10:12 -07:00
2026-04-01 19:38:24 -07:00
2026-05-30 16:27:15 -07:00
2026-03-25 16:07:05 -07:00
2026-06-04 11:03:13 -07:00
2026-03-30 20:30:05 -07:00
2026-03-12 14:49:58 -07:00
2026-08-02 01:48:30 -07:00
2026-07-21 17:48:09 -07:00
2026-07-20 07:25:56 -07:00
2026-06-04 11:03:13 -07:00
2026-06-04 11:03:13 -07:00
2026-03-23 11:11:40 -07:00
2026-06-16 17:10:12 -07:00
2026-07-10 15:42:33 -07:00
2026-08-02 15:15:02 -07:00
2026-05-14 15:13:00 -07:00
2026-07-07 16:42:36 -07:00
2026-07-20 07:21:23 -07:00
2026-06-01 11:01:30 -07:00
2026-07-03 19:16:16 -07:00
2026-07-07 23:32:20 -07:00
2026-07-10 15:59:40 -07:00
2026-07-24 15:04:31 -07:00
2026-07-20 07:25:56 -07:00