fix(auth): keep credentials scoped to the final routed provider (carry of #4081) - #4102

Merged

lidge-jun merged 14 commits into

devfrom

codex/pr4081-credential-scope-carry

Sep 9, 2026

Commits on Sep 9, 2026

fix(auth): scope caller credentials to the selected route

luvs01
authored and
lidge-jun
committed
b483a54
fix(auth): retain explicit OpenAI credentials within their destination scope

luvs01
authored and
lidge-jun
committed
a093f1d
fix(auth): keep ChatGPT-claimed and combined bearers off noncanonical caller-auth routes

t
authored and
lidge-jun
committed
e6d8f09
fix(auth): restore caller Direct credentials on canonical reroutes under Direct own predicate

t
authored and
lidge-jun
committed
30d2b85
fix(auth): require an account claim for Direct credential restore across reroutes

t
authored and
lidge-jun
committed
c9bbd64
fix(auth): restore only provably ChatGPT-domain caller credentials across reroutes
lidge-jun
committed
f13f531
docs(auth): note that the reroute restore is stricter than unchanged Direct forwarding
lidge-jun
committed
945734c
test(auth): pin the canonical caller restore boundary

luvs01
authored and
lidge-jun
committed
8663fef
test(auth): assert claimed bearer rejection outcomes

luvs01
authored and
lidge-jun
committed
545a8e4
fix(auth): distinguish ChatGPT-domain markers from generic org claims at the new credential boundaries
lidge-jun
committed
bf8f36f
fix(auth): treat a present ChatGPT marker key as marked regardless of its shape
lidge-jun
committed
7939ff3
fix(auth): keep the ChatGPT-domain inspector total for non-object JWT payloads
lidge-jun
committed
3af5402
fix(auth): retain stored sidecar auth for caller-auth Chat
luvs01
committed
8db0ab4
test(auth): avoid sidecar model migration in credential fixture
luvs01
committed
4a201df

Navigation Menu

fix(auth): keep credentials scoped to the final routed provider (carry of #4081) - #4102

fix(auth): keep credentials scoped to the final routed provider (carry of #4081)#4102
lidge-jun merged 14 commits into
devfrom
codex/pr4081-credential-scope-carry

Commits on Sep 9, 2026

fix(auth): scope caller credentials to the selected route

fix(auth): retain explicit OpenAI credentials within their destination scope

fix(auth): keep ChatGPT-claimed and combined bearers off noncanonical caller-auth routes

fix(auth): restore caller Direct credentials on canonical reroutes under Direct own predicate

fix(auth): require an account claim for Direct credential restore across reroutes

fix(auth): restore only provably ChatGPT-domain caller credentials across reroutes

docs(auth): note that the reroute restore is stricter than unchanged Direct forwarding

test(auth): pin the canonical caller restore boundary

test(auth): assert claimed bearer rejection outcomes

fix(auth): distinguish ChatGPT-domain markers from generic org claims at the new credential boundaries

fix(auth): treat a present ChatGPT marker key as marked regardless of its shape

fix(auth): keep the ChatGPT-domain inspector total for non-object JWT payloads

fix(auth): retain stored sidecar auth for caller-auth Chat

test(auth): avoid sidecar model migration in credential fixture