feat(agents): end-to-end group-restricted agent visibility#923
Merged
feat(agents): end-to-end group-restricted agent visibility#923
Conversation
Add allowed_groups support across the full stack so agent publishers can restrict visibility to specific IdP groups without requiring an admin to change IAM scopes. Backend: - Parse X-Groups header from nginx auth subrequest in dependencies.py - Enforce group-restricted filtering for non-admin users even when their IAM scope includes "all" (agent_routes.py) - Add allowed_groups field to AgentInfo summary model - Add allowed_groups query parameter to list endpoint - Extend registry_client.py and registry_management.py CLI Nginx: - Forward X-Groups from auth server via auth_request_set in both HTTP and HTTPS proxy configs Frontend: - Add Visibility dropdown and Allowed Groups input to agent registration and edit forms (Dashboard.tsx, RegisterPage.tsx) Docs: - New full doc: agent-visibility-and-group-access.md explaining the two-layer access control model with concrete scenarios - Rewritten FAQ: group-restricted-agent-visibility.md with correct curl commands and decision table Tests: - Update unit tests for admin-only fast path in list endpoint - Add AgentInfo schema tests for allowed_groups serialization - Fix test_schemas_protocol_trust_fields and visibility normalization tests for the new field
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements full-stack support for
allowed_groupson agents, enabling publishers to restrict agent visibility to specific IdP groups without admin intervention. Closes #883 and closes #922.X-Groupsheader from nginx auth subrequest, enforce group-restricted filtering for non-admin broad-scoped users, addallowed_groupstoAgentInfoand as a query parameter on the list endpoint, extend CLI toolingX-Groupsfrom auth server viaauth_request_setin both HTTP and HTTPS proxy configsallowed_groups) with concrete scenarios, rewritten FAQ with correct API examplesAgentInfoschema tests, fixed protocol/trust and visibility normalization testsTest plan
?allowed_groups=hr-teamfilter works correctly for authorized and unauthorized users