Repository navigation
feat(hub): store a login as a tenant-owned credential - #43
Merged
Merged
Conversation
owner: "tenant" on mountOAuthLogin and persistOAuthCredential stores principalId null and no creator grant, the organizational credential Interchange lets a catalog model provider use. A tenant-owned login never replaces an existing credential: changing an organizational one stays with the stock PATCH and its manage grant. The default stays principal-owned.
TheGreatAxios
force-pushed
the
feat/tenant-owned-login
branch
from
October 29, 2026 19:37
0072b4c to
04f5a2c
Compare
TheGreatAxios
marked this pull request as ready for review
October 29, 2026 19:41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #42
What changed
OAuthCredentialOwner("principal" | "tenant") onmountOAuthLogin,persistOAuthCredentialandcheckOAuthCredentialTarget; defaultprincipal.tenantstoresprincipalIdnull and writes no creator grant, matching the stockPOST /credentialsorganizational credential.POST), so a login cannot overwrite an organizational credential that only the stockPATCHand its manage grant may change. Personal re-login is unchanged.Verification
bun run check(typecheck, lint, format, 89 unit tests) passes.bun run test:e2eagainst Postgres 16 passes 18/18, twice. New e2e tests: a tenant-owned login stores no principal and no grant; neither a tenant nor a personal login replaces an existing org credential; a tenant mount's full login (start, loopback callback, exchange) stores the credential with no principal.