Repository navigation

fix(auth): enforce path ACLs with RelayAuth scopes - #423

Merged

khaliqgant merged 12 commits into

mainfrom

factory/2174-agentworkforce-relayfile-e6773ae7

Sep 8, 2026

Merged

fix(auth): enforce path ACLs with RelayAuth scopes#423
khaliqgant merged 12 commits into
mainfrom
factory/2174-agentworkforce-relayfile-e6773ae7

Commits on Sep 8, 2026
- fix(auth): enforce path ACLs with RelayAuth scopes
  khaliqgant
  committed
  2285998
- Enforce ACL scope shapes
  khaliqgant
  committed
  99a4e28
- fix(auth): preserve exact scopes across current bulk reads
  khaliqgant
  committed
  c874e09
- fix(auth): filter directory ACLs per returned file
  khaliqgant
  committed
  c5c5e06
- fix(auth): filter ACL-hidden filesystem events
  khaliqgant
  committed
  a765271
- fix(auth): snapshot ACL on draft deletes; fail closed on unsnapshotted deletes
  khaliqgant
  committed
  b0df4ad
- fix(auth): route provider-sync deletes through snapshotACLPermissions; fail closed on empty-path deletes
  khaliqgant
  committed
  45820e7
- fix: reconcile pathless provider deletes safely
  khaliqgant
  committed
  d99d41e
- fix: resolve provider deletes by verified object identity
  khaliqgant
  committed
  e11a5b7
- fix: make provider projections and reconcile events safe
  khaliqgant
  committed
  9d5f256
- fix: reject ambiguous provider upserts
  khaliqgant
  committed
  d64547f
- test(acl): prove relative paths cannot bypass denies
  khaliqgant
  committed
  0035845