Repository navigation
feat(connections): a runtime with no client of its own takes consent through Auto's client - #268
Merged
Merged
Conversation
…nsent service `auto` joins the client sources after `registered` and before `metadata_document`: the client Auto registered at a vendor, used through Auto's consent service, had where the service lists the issuer and the client is made with the source on, and taken by every way that takes `registered`. A way still lists the three sources it listed before, `wayClientSources`. - `src/consent/consent-service.ts` is the runtime's side of the service's contract: the seven calls as typed functions over the client's fetch, decoded with `Schema`, bounded as a request to an authorization server is, each refusal read from the problem document. - `src/consent-through-auto` holds the switch and the hourly listing of the service's clients, the start and the finish through the service, its renewal and revocation, and the composition that asks the authorization server or the service by the client's source. - A start of `auto` refuses a Studio base neither hosted nor on loopback before anything is sent, and otherwise sends the challenge of a handoff verifier of its own and the base as the link opens it; a finish takes the handoff by its handle and keeps the connection key inside the sealed tokens. - Renewal and revocation of a connection of `auto` go through the service under the claim, the lease and the words of a renewal at the authorization server. - `sourceTakenOf` is the one rule of the source a start takes, which `hadSources` offers too. - `src/consent-testing/fake-consent-service.ts` serves the contract over the fake authorization server, so the tests start, finish, renew and revoke through it. - Connections reads the sources through `hadSources`, passes the Studio base to a start and says why a start for a Studio elsewhere is refused; the providers `search` offers are an effect, and the OpenAPI document lists `auto` as a client source. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…inishes and is offered
- `start` records the digest of the state the client answers, the service's for `auto`, and
answers `client_source`, the source of the client it was started with, beside `authorize`.
- `finish` takes `{ token, state, code, iss? }` for a start with a client of the runtime's and
`{ token, state, handle }` for one of `auto`, one input schema as a union; the start's client
decides, a finish of the other shape is refused at `/code` or `/handle` in words that say
which the consent answers, and a handle the service refuses is refused at `/handle`.
- `read_link` answers `client_source` for a connection of consent, the source a start would
take now by the rule the start takes it by, so the page can say before the person goes that
Auto's client is used; it is left out where the runtime has no source the way takes.
- `connections.auto_clients`, `auto_clients` of `CONNECTIONS`, says whether a way that takes a
registered client takes Auto's client too; left out, the runtime decides by local mode.
- The tests start, finish and remove a connection through the fake consent service, and list,
add and offer a provider to `search` with the source and without it.
- The OpenAPI document and the configuration file's schema say the new fields.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…SENT_SERVICE_URL - `AUTO_CLIENTS`, `true` or `false`, wins over `connections.auto_clients`, and is `true` by default in local mode, as the access settings judge it, and `false` otherwise. - `CONSENT_SERVICE_URL` names Auto's consent service, `https://consent.on.auto` by default, an `https` origin, or an `http` one on a loopback host for a test; any other stops the start. Both join the variables the runtime reads for itself, which no connection may name. - `src/consent/consent-settings.ts` reads them and gives the consent client the switch, the service and the return a Studio base asks: `loopback` for a base on this computer, `hosted` for the Studio host's own, `elsewhere` otherwise. - The test servers take the source off unless a test turns it on, and a test connects a provider over HTTP through the fake consent service from the served Studio of local mode. - `docs/self-host/connections.md` says how consent through Auto goes, what passes through Auto and what it keeps, the setting, and who registers their own clients instead; `configuration.md` lists the two variables and the key, and the HTTP reference the fields. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… by name and status
The runtime takes as final only the refusals the contract names, at the status it gives
them, and fails any other answer of Auto's consent service as unanswered, breaking nothing.
- A renewal breaks its connection on `invalid_grant` at 400 and on `unknown_key` at 403
alone; a key the service does not know, and a row that holds none, end it as `key_unknown`,
and a service that does not answer is worded as the service, not the authorization server.
- A revocation refuses a row with no key before anything is sent, answers `unknown_key` at
403, and carries the status the authorization server answered, `vendor_status`, as the
status of `not_revoked`, only on a 502.
- A start sends its return as `{ kind, base }` for `hosted` too, and a start the service
refuses is `start_refused`. A Studio elsewhere leaves `auto` out of the sources had, so a
later source serves and the service is asked nothing; `studio_elsewhere` refuses only where
none remains.
- `hadSources` takes the Studio base. The listing is bounded at five seconds, and a failed
one is held five minutes. A finish answers the client the handoff names.
- `consent-service.ts` moves into `src/consent-through-auto`, and the ending of a refresh into
`src/consent-tokens/refresh-endings.ts`.
- The fake answers `code_refused` and `invalid_grant` only where the vendor answered 400 with
that error, any other vendor failure as a 502 without a refusal, `unknown_key` and
`wrong_verifier` by name, a hosted base other than its own Studio with a 400, and a Studio
call without a session with `WWW-Authenticate: Bearer`.
- Connections passes the Studio base to `hadSources` and words `start_refused` and
`key_unknown`.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…t and says what failed - A finish records the client the consent client answers it redeemed with: for `auto`, the `client_id` the handoff names, over the one the start recorded from the listing. - A finish with a handle for a start that answers a code says the consent began with a client of this runtime's, which answers a code, not a handle, whatever its source; the schema of that shape says so too, and the OpenAPI document is made again. - A removal whose revocation Auto's consent service refuses for a key it does not know, or does not answer, logs it in the service's words, and goes on to forget the row. - `read_link` asks the consent client for its sources only for a connection of the kind `authorization`. - Tests hold a Studio neither Auto's nor on this computer to the source the way lists next, on the link and at the start, asking the service nothing, to `list_providers`, `add_connection` and `search` setting the way up first where no source remains, and to a link left without a source where none serves it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…he pages say how it waits - `src/testing/settings/no-consent-through-auto.ts` turns the source of Auto off, and the test servers that compose the root in local mode start with it: the reasoning and traced servers, through `loopbackSettingsOver`, the server that serves the OpenAPI document, every spawned server and the development process; the `auto-runtime` command sets `AUTO_CLIENTS=false` beside `DO_NOT_TRACK`; and so do the tests of access modes, provider setup, a composed stop, playbooks over HTTP, model providers and request tracing, which start the root themselves. A later test there that lists providers asks no address of Auto's. - `docs/self-host/connections.md` says the list of Auto's clients is waited for at most five seconds and, unanswered, asked again five minutes on, and that a Studio neither Auto's nor on the person's computer leaves Auto's client out, so a provider takes the next client its way lists, a start with none being refused in words before the person is sent anywhere. - `docs/self-host/configuration.md` says the runtime reaches the consent service as it reaches the Auto identity service. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
SamHatoum
pushed a commit
that referenced
this pull request
Oct 20, 2026
🤖 I have created a release *beep* *boop* --- ## [0.15.0](v0.14.0...v0.15.0) (2026-10-20) ### Features * **connections:** a runtime with no client of its own takes consent through Auto's client ([#268](#268)) ([b2f38ea](b2f38ea)) * **providers:** github, slack and profound take a sign-in ([#261](#261)) ([0655d3c](0655d3c)) * **providers:** microsoft, amazon and adobe's six providers ([#264](#264)) ([f536378](f536378)) * **providers:** the thirteen providers of Google, with their documents translated from Discovery ([#262](#262)) ([99f0f05](99f0f05)) * **providers:** zoom takes a sign-in, over its HTTP API ([#263](#263)) ([2803ca1](2803ca1)) * **secrets:** an unreadable credential fails the call; the retry-state key is the runtime's own ([#269](#269)) ([53bd32a](53bd32a)) * **secrets:** each secret under its own key, wrapped by a custodian, in rows the ledger keeps ([#267](#267)) ([45e0bc6](45e0bc6)) ### Bug Fixes * **api:** the runtime's page and icon show the Auto mark with its color bands, beside its name ([#270](#270)) ([be7fc82](be7fc82)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: beonautobot[bot] <298957281+beonautobot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A person connects a provider by consenting at its authorization server, which sends them back only to an address registered in advance and hands the tokens only to the client that registered it. Until now a runtime could offer that consent only with a client whoever runs it registered at the vendor, so on a laptop, or in a container whose operator has not been through a vendor's console, the providers that take consent were hidden from the agent. A fourth client source,
auto, afterregisteredand beforemetadata_documentanddynamic, lets such a runtime take consent through Auto's consent service, which holds Auto's client at each vendor: the runtime starts the consent through the service with a verifier it made, the vendor returns the person to Auto's Studio, which has the service redeem the code and takes back a handle, and the runtime fetches the tokens once with its verifier, keeps them sealed in its own store beside a connection key, and renews and revokes them through the service with that key. The service keeps a start and a handoff for ten minutes and nothing of a token beyond them. A client whoever runs the runtime registered always wins at its issuer, and the entries change nothing.The return goes to the Studio the person uses: the hosted Studio, which calls the runtime's finish with the handle, or the Studio the runtime serves on a loopback address, which the hosted one sends the browser on to; a runtime whose Studio is neither is refused before the person is sent anywhere, in words that say to register a client.
finishtakes{ token, state, handle }for a consent started this way and{ token, state, code, iss? }for the others, each refused in the other's place at its field.AUTO_CLIENTSturns the source on, by default in local mode and off elsewhere, andCONSENT_SERVICE_URLnames the service. The self-host page says who the source serves, the one sign-in to Auto on the way back, what passes through Auto and what it keeps, and that a runtime on a private network with its own Studio, or anyone who wants no token through Auto, registers their own clients as the sections below it set out.