Garry Tan and Claude Opus 4.7
fed57f4db0
feat(oauth): federated_read read scope ( #876 )
...
Pre-fix, OAuth clients had a single source-scope axis (source_id, added
in v55). A client could either write+read one source OR be a super-reader
across all sources (via NULL source_id). There was no middle ground —
WeCare-style L3 dept clients that need to write to dept-x but read
dept-x + parent canon + shared canon had no expression.
#876 adds federated_read TEXT[] as an orthogonal read-scope axis. source_id
is the WRITE authority; federated_read is the READ authority. They default
to matching values (read scope == write scope, the pre-v0.34 default)
when a client is registered without an explicit federated read list.
Migrations v56-v60 (six new migrations on top of v55):
- v56: ALTER TABLE ... ADD COLUMN federated_read TEXT[] NOT NULL DEFAULT '{}'.
- v57 (F5): explicit CASE backfill so source_id IS NULL → '{}' (not an
array containing NULL — codex caught this ambiguity during plan review).
- v58: post-backfill validation. Fails loud if any row's source_id isn't
in its federated_read array, pointing at a logic bug in v57 if fired.
- v59: flip the source_id FK from ON DELETE SET NULL to ON DELETE
RESTRICT now that federated_read provides the alternative scope-loss
path. Pre-flip, deleting a source could silently widen any oauth_client
to super-reader; post-flip, source delete is refused if any client
references it (operator must revoke/re-scope first).
- v60: GIN index on federated_read for array-containment queries.
Auth wiring:
- GBrainOAuthProvider.verifyAccessToken JOINs c.federated_read and
populates AuthInfo.allowedSources. Pre-v56 / pre-v55 brains degrade
via the existing isUndefinedColumnError fallback chain.
- registerClientManual gains a federatedRead?: string[] parameter
(defaults to [sourceId]).
- DCR registerClient sets source_id='default' + federated_read=['default']
on the inserted row.
- auth.ts CLI adds --federated-read SRC1,SRC2,... flag. The
register-client output now prints "Federated reads:" so operators
confirm the scope they set.
Engines consume the federated array through the SearchOpts.sourceIds /
PageFilters.sourceIds field that #861 added (no engine changes here — the
plumbing was D9). sourceScopeOpts in operations.ts already prefers the
auth.allowedSources array over scalar ctx.sourceId when set.
Test seam:
- test/book-mirror.test.ts now spawns the CLI with GBRAIN_HOME pointed
at a tempdir so the test isn't sensitive to the developer's local
~/.gbrain/config.json. Pre-fix the test could silently inherit a real
Postgres connection and hang past the default 5s test timeout. Fresh
GBRAIN_HOME → "No brain configured" → exit 1 in <1s.
- test/e2e/source-isolation-pglite.test.ts gains one more regression
case: AuthInfo.allowedSources = [] (explicit empty) MUST NOT widen
scope to "all sources" — the silent-widen footgun precedence ladder.
- test/openai-compat-multimodal.test.ts is part of the wave's commits
via the migrate.ts changes that bump the schema chain. typecheck-only
fix on a captured-auth type was already in #875 's tree.
6045 unit tests pass / 0 fail. typecheck clean. PGLite initSchema runs
v55-v60 in ~786ms total (within the test-harness budget for tests using
the canonical beforeAll engine pattern).
Origin: PR #876 + plan-eng-review F5 (CASE backfill).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-05-14 10:12:39 -07:00
..
2026-05-10 20:50:40 -07:00
2026-05-11 22:54:35 -07:00
2026-05-11 19:25:48 -07:00
2026-05-14 10:12:39 -07:00
2026-05-12 14:33:29 -07:00
2026-05-04 12:59:52 -07:00
2026-05-10 11:28:01 -07:00
2026-05-10 20:06:31 -07:00
2026-04-29 23:46:36 -07:00
2026-05-07 21:52:58 -07:00
2026-05-10 20:06:31 -07:00
2026-05-11 19:25:48 -07:00
2026-05-02 08:41:11 -07:00
2026-05-11 22:54:35 -07:00
2026-05-06 21:14:34 -07:00
2026-04-18 16:57:38 +08:00
2026-04-21 18:35:45 -07:00
2026-05-08 13:25:48 -07:00
2026-05-08 13:25:48 -07:00
2026-04-11 21:25:44 -10:00
2026-04-14 19:41:34 -10:00
2026-04-22 01:34:22 -07:00
2026-04-20 07:30:00 +08:00
2026-04-20 07:30:00 +08:00
2026-05-07 21:52:58 -07:00
2026-05-14 10:12:39 -07:00
2026-04-30 20:47:32 -07:00
2026-05-07 21:52:58 -07:00
2026-05-10 20:50:40 -07:00
2026-05-02 22:01:05 -07:00
2026-04-20 23:14:38 +08:00
2026-04-29 10:12:10 -07:00
2026-05-10 20:06:31 -07:00
2026-04-21 11:51:32 -07:00
2026-04-25 12:25:34 -07:00
2026-05-10 13:20:07 -07:00
2026-05-02 08:41:11 -07:00
2026-05-11 19:25:48 -07:00
2026-04-09 12:25:04 -10:00
2026-04-25 12:25:34 -07:00
2026-05-09 21:18:53 -07:00
2026-04-25 12:25:34 -07:00
2026-05-11 22:54:35 -07:00
2026-04-29 23:46:36 -07:00
2026-05-09 19:47:56 -07:00
2026-05-07 13:41:46 -07:00
2026-05-09 19:47:56 -07:00
2026-05-02 08:41:11 -07:00
2026-05-07 10:03:38 -07:00
2026-05-09 20:46:34 -07:00
2026-04-25 12:25:34 -07:00
2026-04-25 12:25:34 -07:00
2026-04-25 12:25:34 -07:00
2026-05-09 22:58:19 -07:00
2026-04-06 16:50:15 -07:00
2026-05-08 13:25:48 -07:00
2026-04-26 15:49:48 -07:00
2026-05-11 21:49:57 -07:00
2026-05-06 20:39:56 -07:00
2026-05-06 20:39:56 -07:00
2026-05-06 20:39:56 -07:00
2026-04-29 22:13:05 -07:00
2026-05-09 16:57:47 -07:00
2026-04-30 01:23:29 -07:00
2026-05-08 17:07:51 -07:00
2026-05-09 20:46:34 -07:00
2026-05-11 23:02:03 -07:00
2026-05-09 20:46:34 -07:00
2026-04-14 19:41:34 -10:00
2026-05-08 13:25:48 -07:00
2026-04-22 16:24:23 -07:00
2026-05-03 20:41:39 -07:00
2026-04-29 22:21:07 -07:00
2026-04-20 21:54:36 +08:00
2026-04-26 15:49:48 -07:00
2026-05-10 18:59:11 -07:00
2026-05-07 22:56:22 -07:00
2026-05-11 21:18:17 -07:00
2026-04-30 01:23:29 -07:00
2026-05-02 22:01:05 -07:00
2026-04-20 21:54:36 +08:00
2026-04-25 12:25:34 -07:00
2026-05-07 21:52:58 -07:00
2026-05-04 12:59:52 -07:00
2026-05-06 20:58:19 -07:00
2026-05-07 21:52:58 -07:00
2026-04-11 00:01:09 -10:00
2026-05-07 10:03:38 -07:00
2026-05-10 06:34:40 -07:00
2026-04-14 19:41:34 -10:00
2026-05-11 23:02:03 -07:00
2026-04-25 12:25:34 -07:00
2026-05-01 09:02:43 -07:00
2026-05-01 09:02:43 -07:00
2026-05-01 09:02:43 -07:00
2026-05-11 22:42:54 -07:00
2026-05-11 22:42:54 -07:00
2026-05-11 22:42:54 -07:00
2026-05-11 22:42:54 -07:00
2026-05-11 22:42:54 -07:00
2026-05-11 22:42:54 -07:00
2026-05-11 22:42:54 -07:00
2026-05-11 22:42:54 -07:00
2026-05-11 22:42:54 -07:00
2026-05-11 22:42:54 -07:00
2026-05-11 22:42:54 -07:00
2026-05-11 22:42:54 -07:00
2026-05-11 22:42:54 -07:00
2026-05-11 22:42:54 -07:00
2026-05-01 09:02:43 -07:00
2026-05-11 19:25:48 -07:00
2026-05-01 09:02:43 -07:00
2026-05-01 09:02:43 -07:00
2026-05-10 06:34:40 -07:00
2026-05-10 06:34:40 -07:00
2026-05-10 06:34:40 -07:00
2026-05-10 06:34:40 -07:00
2026-05-10 06:34:40 -07:00
2026-05-10 06:34:40 -07:00
2026-05-10 06:34:40 -07:00
2026-05-10 06:34:40 -07:00
2026-05-10 06:34:40 -07:00
2026-05-10 06:34:40 -07:00
2026-05-10 06:34:40 -07:00
2026-05-10 06:34:40 -07:00
2026-05-12 14:33:29 -07:00
2026-04-13 21:03:40 -10:00
2026-05-02 22:01:05 -07:00
2026-05-11 19:25:48 -07:00
2026-05-11 19:25:48 -07:00
2026-05-09 20:46:34 -07:00
2026-04-29 10:12:10 -07:00
2026-05-10 06:34:40 -07:00
2026-05-06 21:14:34 -07:00
2026-05-09 20:46:34 -07:00
2026-05-10 12:49:14 -07:00
2026-05-09 16:57:47 -07:00
2026-05-09 16:57:47 -07:00
2026-05-10 12:49:14 -07:00
2026-05-10 12:49:14 -07:00
2026-05-09 16:57:47 -07:00
2026-05-10 12:49:14 -07:00
2026-05-09 16:57:47 -07:00
2026-05-10 12:49:14 -07:00
2026-05-09 16:57:47 -07:00
2026-05-10 12:49:14 -07:00
2026-05-10 12:49:14 -07:00
2026-05-10 20:06:31 -07:00
2026-05-10 12:49:14 -07:00
2026-05-10 12:49:14 -07:00
2026-05-11 19:25:48 -07:00
2026-05-11 19:25:48 -07:00
2026-05-09 16:57:47 -07:00
2026-05-09 16:57:47 -07:00
2026-05-09 16:57:47 -07:00
2026-05-09 16:57:47 -07:00
2026-05-09 16:57:47 -07:00
2026-05-09 16:57:47 -07:00
2026-05-09 16:57:47 -07:00
2026-04-20 07:30:00 +08:00
2026-04-14 21:40:48 -10:00
2026-04-25 12:25:34 -07:00
2026-05-11 19:25:48 -07:00
2026-04-09 10:17:13 -07:00
2026-04-13 07:49:13 -10:00
2026-04-16 23:03:15 -07:00
2026-04-13 07:49:13 -10:00
2026-04-23 19:34:27 -07:00
2026-05-12 14:33:29 -07:00
2026-04-29 23:46:36 -07:00
2026-04-29 23:46:36 -07:00
2026-04-26 20:45:05 -07:00
2026-04-29 23:26:25 -07:00
2026-04-26 20:45:05 -07:00
2026-04-29 23:46:36 -07:00
2026-05-09 19:47:56 -07:00
2026-05-06 21:14:34 -07:00
2026-04-18 18:16:18 +08:00
2026-04-29 22:13:05 -07:00
2026-05-09 22:58:19 -07:00
2026-05-01 09:02:43 -07:00
2026-05-11 22:54:35 -07:00
2026-05-07 10:03:38 -07:00
2026-04-09 10:17:13 -07:00
2026-04-12 07:48:47 -10:00
2026-04-25 12:25:34 -07:00
2026-05-07 22:56:22 -07:00
2026-04-18 16:57:38 +08:00
2026-05-11 19:25:48 -07:00
2026-04-16 23:03:15 -07:00
2026-04-22 01:34:22 -07:00
2026-04-25 12:25:34 -07:00
2026-04-25 12:25:34 -07:00
2026-05-11 21:49:57 -07:00
2026-04-26 20:45:05 -07:00
2026-04-11 21:25:44 -10:00
2026-05-07 13:41:46 -07:00
2026-05-07 19:49:46 -07:00
2026-04-26 20:45:05 -07:00
2026-04-24 00:08:54 -07:00
2026-05-09 19:47:56 -07:00
2026-05-07 22:56:22 -07:00
2026-05-04 21:11:15 -07:00
2026-05-01 09:02:43 -07:00
2026-04-21 21:14:17 -07:00
2026-05-08 13:25:48 -07:00
2026-05-11 19:25:48 -07:00
2026-04-26 20:45:05 -07:00
2026-05-10 12:49:14 -07:00
2026-05-09 20:46:34 -07:00
2026-05-09 20:46:34 -07:00
2026-05-11 22:54:35 -07:00
2026-04-18 16:57:38 +08:00
2026-04-18 16:57:38 +08:00
2026-04-18 18:16:18 +08:00
2026-04-19 07:14:24 +08:00
2026-04-22 01:34:22 -07:00
2026-04-20 07:30:00 +08:00
2026-04-29 23:46:36 -07:00
2026-04-22 01:34:22 -07:00
2026-04-25 12:25:34 -07:00
2026-04-25 12:25:34 -07:00
2026-04-26 20:45:05 -07:00
2026-05-07 10:03:38 -07:00
2026-05-11 19:25:48 -07:00
2026-05-10 06:34:40 -07:00
2026-04-22 01:34:22 -07:00
2026-04-24 01:09:28 -07:00
2026-04-29 23:06:16 -07:00
2026-05-10 20:06:31 -07:00
2026-05-02 22:01:05 -07:00
2026-05-02 22:01:05 -07:00
2026-05-10 13:33:05 -07:00
2026-05-03 20:41:39 -07:00
2026-05-10 12:49:14 -07:00
2026-05-09 19:47:56 -07:00
2026-05-14 08:30:16 -07:00
2026-05-14 10:12:39 -07:00
2026-04-30 01:23:29 -07:00
2026-05-07 21:52:58 -07:00
2026-05-02 22:01:05 -07:00
2026-05-06 21:14:34 -07:00
2026-05-07 10:03:38 -07:00
2026-05-03 20:41:39 -07:00
2026-04-25 12:25:34 -07:00
2026-04-08 23:26:11 -10:00
2026-05-09 20:46:34 -07:00
2026-05-11 22:54:35 -07:00
2026-04-12 17:38:48 -07:00
2026-04-23 19:34:27 -07:00
2026-05-02 08:41:11 -07:00
2026-04-20 07:30:00 +08:00
2026-04-21 18:35:45 -07:00
2026-05-09 20:46:34 -07:00
2026-05-03 20:16:15 -07:00
2026-05-11 19:25:48 -07:00
2026-04-29 23:46:36 -07:00
2026-04-30 20:47:32 -07:00
2026-05-01 09:02:43 -07:00
2026-04-12 13:23:55 -10:00
2026-04-21 21:14:17 -07:00
2026-04-25 12:25:34 -07:00
2026-05-07 10:03:38 -07:00
2026-05-07 21:52:58 -07:00
2026-05-07 21:52:58 -07:00
2026-04-16 23:03:15 -07:00
2026-04-22 01:34:22 -07:00
2026-04-22 01:34:22 -07:00
2026-05-11 23:20:17 -07:00
2026-05-11 23:20:17 -07:00
2026-05-07 21:52:58 -07:00
2026-05-07 21:52:58 -07:00
2026-05-03 20:16:15 -07:00
2026-04-23 19:34:27 -07:00
2026-04-25 12:25:34 -07:00
2026-05-11 22:54:35 -07:00
2026-04-19 07:14:24 +08:00
2026-05-10 13:20:07 -07:00
2026-04-11 21:25:44 -10:00
2026-04-25 12:25:34 -07:00
2026-04-21 18:35:45 -07:00
2026-05-10 13:20:07 -07:00
2026-04-24 01:39:58 -07:00
2026-04-22 01:34:22 -07:00
2026-05-06 16:32:11 -07:00
2026-05-08 13:25:48 -07:00
2026-04-30 23:17:54 -07:00
2026-04-23 19:34:27 -07:00
2026-05-07 21:52:58 -07:00
2026-04-29 23:46:36 -07:00
2026-05-10 12:49:14 -07:00
2026-04-27 22:59:08 -07:00
2026-05-06 21:14:34 -07:00
2026-05-07 10:03:38 -07:00
2026-04-25 12:25:34 -07:00
2026-04-16 23:03:15 -07:00
2026-05-12 14:33:29 -07:00
2026-04-18 18:16:18 +08:00
2026-04-29 23:46:36 -07:00
2026-04-30 20:47:32 -07:00
2026-05-07 13:17:27 -07:00
2026-05-14 08:24:32 -07:00
2026-04-09 10:17:13 -07:00
2026-04-23 19:34:27 -07:00
2026-04-22 02:07:00 -07:00
2026-05-06 20:39:56 -07:00
2026-04-18 16:57:38 +08:00
2026-04-30 23:17:54 -07:00
2026-04-23 19:34:27 -07:00
2026-05-02 08:41:11 -07:00
2026-04-14 19:41:34 -10:00
2026-05-11 22:54:35 -07:00
2026-05-10 13:33:05 -07:00
2026-04-29 22:21:07 -07:00
2026-05-06 21:14:34 -07:00
2026-05-06 21:14:34 -07:00
2026-05-06 21:14:34 -07:00
2026-04-22 16:24:23 -07:00
2026-05-06 11:54:06 -07:00
2026-05-09 22:58:19 -07:00
2026-05-03 20:41:39 -07:00
2026-04-22 16:24:23 -07:00
2026-04-29 22:21:07 -07:00
2026-04-29 22:21:07 -07:00
2026-04-29 22:21:07 -07:00
2026-04-29 22:21:07 -07:00
2026-04-29 22:21:07 -07:00
2026-04-13 07:49:13 -10:00
2026-04-21 21:14:17 -07:00
2026-04-21 21:14:17 -07:00
2026-04-22 01:34:22 -07:00
2026-05-08 17:07:51 -07:00
2026-04-22 01:34:22 -07:00
2026-04-09 10:17:13 -07:00
2026-05-06 11:54:06 -07:00
2026-04-29 23:06:16 -07:00
2026-04-25 12:25:34 -07:00
2026-04-29 22:53:41 -07:00
2026-04-25 12:25:34 -07:00
2026-05-09 20:46:34 -07:00
2026-04-29 22:53:41 -07:00
2026-04-25 12:25:34 -07:00
2026-05-09 21:18:53 -07:00
2026-05-11 22:54:35 -07:00
2026-05-10 06:34:40 -07:00
2026-05-07 23:07:00 -07:00
2026-05-09 20:46:34 -07:00
2026-05-07 23:07:00 -07:00
2026-05-10 06:34:40 -07:00
2026-05-10 06:34:40 -07:00
2026-05-09 20:46:34 -07:00
2026-05-07 23:07:00 -07:00
2026-05-10 06:34:40 -07:00
2026-05-11 23:20:17 -07:00
2026-05-10 18:59:11 -07:00
2026-05-06 21:14:34 -07:00
2026-04-29 23:46:36 -07:00
2026-04-14 19:41:34 -10:00
2026-05-07 21:52:58 -07:00
2026-04-20 23:14:38 +08:00
2026-05-04 21:11:15 -07:00
2026-04-25 12:25:34 -07:00
2026-05-08 13:25:48 -07:00
2026-05-11 22:54:35 -07:00
2026-05-09 20:46:34 -07:00
2026-05-08 13:25:48 -07:00
2026-04-19 18:23:02 +08:00
2026-05-07 21:52:58 -07:00
2026-05-08 13:25:48 -07:00
2026-05-07 13:41:46 -07:00
2026-05-10 13:33:05 -07:00
2026-04-22 01:34:22 -07:00
2026-05-06 21:14:34 -07:00
2026-05-12 14:33:29 -07:00
2026-05-12 14:33:29 -07:00
2026-05-06 11:54:06 -07:00
2026-04-20 07:30:00 +08:00
2026-04-09 10:17:13 -07:00
2026-05-06 11:54:06 -07:00