From 88c591336a497d06d1c189011dbab9508c782616 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 21 Oct 2026 07:31:40 +0000 Subject: [PATCH] Point docs at Administration for grants, credentials, and people. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The console moved grants and credential status out of Settings, and Administration → People can provision memberships after the first administrator. These pages still named the old place. Co-authored-by: Shashi Kanth G S --- docs/concepts/identity-and-access.md | 2 +- docs/guides/agent-credentials.md | 2 +- docs/guides/connect-an-agent.md | 2 +- docs/guides/teams-and-grants.md | 4 ++-- docs/security/service-identity.md | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/concepts/identity-and-access.md b/docs/concepts/identity-and-access.md index 7870831..64122df 100644 --- a/docs/concepts/identity-and-access.md +++ b/docs/concepts/identity-and-access.md @@ -26,7 +26,7 @@ There are two modes. **OIDC.** The production mode (the default when `NODE_ENV=production`). The console uses authorization-code login with PKCE, state and nonce, through the `openid-client` library, over HTTPS only. After login it checks that the exact `(issuer, subject)` pair belongs to a user with an enabled membership in the configured organization. Then it discards the provider's tokens. The provider's email, role, organization and tenant claims are never used to create or promote a user. -This means signing in to your identity provider is not enough. An operator must provision the membership first, with a CLI (see [Sign in and roles](../guides/sign-in-and-roles.md)). There is no just-in-time account creation. +This means signing in to your identity provider is not enough. Someone must provision the membership first: the first administrator with `npm run auth:provision`, and later people there or under **Administration → People** (see [Sign in and roles](../guides/sign-in-and-roles.md)). There is no just-in-time account creation. The session is an opaque random cookie named `__Host-a2a-session` (Secure, HttpOnly, SameSite=Lax, no Domain). Only its SHA-256 hash is stored, with an absolute expiry. The default lifetime is 8 hours (`A2A_AUTH_SESSION_SECONDS`, allowed range 60 to 86400). Every request re-resolves the session and the current membership, so disabling a user takes effect on their next request. Requests already running may finish. Browser mutations must carry an `Origin` that exactly matches the configured external origin (`A2A_AUTH_ORIGIN`). diff --git a/docs/guides/agent-credentials.md b/docs/guides/agent-credentials.md index 8f59fd4..b1dfdae 100644 --- a/docs/guides/agent-credentials.md +++ b/docs/guides/agent-credentials.md @@ -3,7 +3,7 @@ > For operators whose agents require authentication, or who run Taskbay outside a trusted laptop. At the end you will know where credentials are stored, how to add, rotate and revoke them, and which outbound network rules apply. When Taskbay calls an agent it needs to prove who it is to the agent (the "agent credential"), and the server needs rules about where it is allowed to connect. Both are server-side configuration. -There is no browser form for secrets. Settings shows only each binding's status. +There is no browser form for secrets. **Administration → Agent access** shows only each binding's status. This is separate from people signing in, which is covered in [Sign in and roles](./sign-in-and-roles.md). diff --git a/docs/guides/connect-an-agent.md b/docs/guides/connect-an-agent.md index 4558bde..b226b37 100644 --- a/docs/guides/connect-an-agent.md +++ b/docs/guides/connect-an-agent.md @@ -2,7 +2,7 @@ > Who this is for: an administrator adding an A2A agent to Agent Taskbay. At the end the agent is registered, reachable, authenticated if it needs to be, and visible to the people who should be able to use it. -Connecting an agent is three separate things: registering its Agent Card URL, giving the console a credential if the agent requires one, and granting people access. Registration is a browser action. Credentials are set on the server, never in the browser. Grants are set in Settings. +Connecting an agent is three separate things: registering its Agent Card URL, giving the console a credential if the agent requires one, and granting people access. Registration is a browser action. Credentials are set on the server, never in the browser. Grants are set in **Administration**, under **Agent access**. ## Before you start diff --git a/docs/guides/teams-and-grants.md b/docs/guides/teams-and-grants.md index 4412b90..8c0458b 100644 --- a/docs/guides/teams-and-grants.md +++ b/docs/guides/teams-and-grants.md @@ -9,7 +9,7 @@ Agent Taskbay is pre-1.0. The screens and API on this page may change between mi ## Before you start - You are signed in as an `admin`. Only administrators see **Administration** and can call `/api/admin/security`. -- The people already have a membership in your organization, provisioned with `npm run auth:provision` (see [Sign in and roles](./sign-in-and-roles.md#provision-people)). Only enabled memberships appear in the lists. +- The people already have a membership in your organization, from **Administration → People** or `npm run auth:provision` (see [Sign in and roles](./sign-in-and-roles.md#provision-people)). Only enabled memberships appear in the lists. - The agent is registered and its card has been discovered. The skill list in **Agent access** comes from the agent's stored card. If it shows only **Whole agent**, open the agent on the **Agents** page so its card loads. - For a skill-only grant that people can use to send work, the agent must advertise the skill-routing extension `https://extensions.allsrc.dev/agent-taskbay/skill-routing/v1` and list the skill id in its card. See the [skill routing reference](../reference/extensions/skill-routing.md). Without it, only whole-agent grants let people send. @@ -122,7 +122,7 @@ Errors from **Administration** appear as a red message above the forms. | Symptom | Cause | Fix | | --- | --- | --- | | **Administration** is missing, or says "Administrators only" | You are not an administrator. `GET /api/admin/security` returns `403`. | Sign in as an `admin`, or ask one to run `auth:provision` with `--role admin` for you. | -| A person is missing from a team's **Add a person…** list or the recipient list | Their membership or user is disabled, or they were never provisioned in this organization. | Provision them with `npm run auth:provision`. | +| A person is missing from a team's **Add a person…** list or the recipient list | Their membership or user is disabled, or they were never provisioned in this organization. | Add them under **Administration → People**, or run `npm run auth:provision`. | | Only **Whole agent** is offered as a scope | The agent's card has not been discovered, or it lists no skills. | Open the agent on the **Agents** page so its card loads, then reload **Agent access**. | | `400 Invalid access management request.` | The API body has a missing or extra field, an ID that is not a UUID, an unknown `permission` or `subjectType`, or a `name` longer than 200 characters. | Match the bodies above exactly. | | `Unknown agent.` | The agent ID is not an enabled agent in your organization. | Use an `id` from `GET /api/agents`. | diff --git a/docs/security/service-identity.md b/docs/security/service-identity.md index d785989..e49ff72 100644 --- a/docs/security/service-identity.md +++ b/docs/security/service-identity.md @@ -10,7 +10,7 @@ Taskbay calls agents on behalf of people. To do that it holds credentials for ea - The key ring is `A2A_VAULT_KEYS` (a JSON map of key ids to 32 random bytes as 64 hex characters) plus `A2A_VAULT_ACTIVE_KEY`. Both are server-only; never use a `NEXT_PUBLIC_` variable. Web and worker processes must share the ring. Back it up separately from the database. - A wrong or missing key, a tampered ciphertext or a revoked binding fails closed. Taskbay does not fall back to unauthenticated calls. - Supported credential kinds: `apiKey`, `bearer`, `oauthClient` (client credentials; tokens are short-lived and kept only in process memory) and `mtls`. Each binding also lists the exact HTTPS origins it may be sent to. -- Provisioning is by an operator CLI that reads JSON from standard input (`npm run security:credentials`). There is no browser form for secrets; Settings shows status only. CLI errors do not print the supplied input. +- Provisioning is by an operator CLI that reads JSON from standard input (`npm run security:credentials`). There is no browser form for secrets; **Administration → Agent access** shows status only. CLI errors do not print the supplied input. ## Where credentials may go