feat(connect): managed connectors via public org — cloud auth, local data#1038

Merged

buremba merged 15 commits into

mainfrom

feat/oauth-broker-spike

May 25, 2026

Commits on May 25, 2026

feat(connect): broker-delegated oauth_app profiles (spike)
buremba
committed
fix(connect): broker resolves provider endpoints server-side; pkce verifier reuse
buremba
committed
refactor(connect): consolidate broker delegation
buremba
committed
refactor(connect)!: grant-on-broker model
buremba
committed
fix(connect): require broker:token scope on /broker/oauth/token
buremba
committed
refactor(connect): first-class oauth_broker profile kind
buremba
committed
fix(connect): create broker-backed connections via tool; wire resolveCredentialSource seam
buremba
committed
refactor(connect): collapse broker seam, harden broker_url, fix update validation
buremba
committed
fix(connect): SSRF — gate broker fetch on operator origin allowlist
buremba
committed
refactor(connect)!: managed connectors via public org (drop bespoke broker)
buremba
committed
feat(connect): consent-only connections (no feeds) for managed-app grants
buremba
committed
fix(connect): pin managed-token PAT to LOBU_CLOUD_URL; scope token endpoint to public consent-only grants
buremba
committed
fix(connect): reject making a feed-having connection consent_only
buremba
committed
fix(connect): require connections:token scope on /oauth/connection-token
buremba
committed
fix(connect): make connections:token mintable via PAT route; drop dead authedOrgId
buremba
committed