OIDC support #106

ahmedennaifer · 2025-11-27T09:44:23Z

Note

Introduce OIDC-based authentication with JWT/OAuth handlers, Postgres-backed session storage, and supporting API/router, models, and migrations.

Auth
- Add OIDC integration in infrastructure/auth/oidc.py with supporting jwt_handler.py and oauth_handler.py.
- Wire auth dependencies and routes in api/v1/deps.py and api/v1/routers/auth.py.
Sessions & Persistence
- Implement session storage layer: infrastructure/cache/session_storage.py, session_provider.py, and Postgres-backed postgres_session_storage.py.
- Add infrastructure/db/models/session.py and Alembic migration 20251127_1149_add_session_table.py.
Settings & Config
- Extend application settings in core/settings.py and infrastructure/auth/__init__.py.
- Update engine/schema configs: libs/idun_agent_engine/.../config_builder.py, libs/idun_agent_schema/.../manager/settings.py, and deps.py.
API & Domain
- Update error handling in core/errors.py and app bootstrap in main.py.
- Adjust agent domain interfaces/entities in domain/agents/{ports,entities}.py.
Ops
- Update docker-compose.dev.yml and services/idun_agent_manager/pyproject.toml.

^{Written by Cursor Bugbot for commit a3c7f7a. This will update automatically on new commits. Configure here.}

cursor

This is the final PR Bugbot will review for you during this billing cycle

Your free Bugbot reviews will reset on December 19

Details

You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

cursor · 2025-11-27T10:01:57Z

services/idun_agent_manager/src/app/main.py

    app.add_middleware(
        CORSMiddleware,
-        allow_origins=settings.cors_allow_origins,
+        allow_origins=[],


Bug: CORS configuration hardcoded to empty list

The CORS allow_origins is hardcoded to an empty list [], replacing the previous dynamic configuration from settings.cors_allow_origins. This effectively disables CORS for all origins, which will block any cross-origin requests from frontend applications. The new settings structure has CORS origins available at settings.api.cors_origins, but instead of updating the path, the value was hardcoded to empty.

cursor · 2025-11-27T10:01:57Z

libs/idun_agent_engine/src/idun_agent_engine/core/config_builder.py

 from idun_agent_schema.engine.adk import AdkAgentConfig
 from idun_agent_engine.server.server_config import ServerAPIConfig
-from yaml import YAMLError
+from yaml.serializer import YAMLError


Bug: Incorrect import path for YAMLError class

The import was changed from from yaml import YAMLError to from yaml.serializer import YAMLError. However, the yaml.serializer module only exports Serializer and SerializerError, not YAMLError. The YAMLError class is defined in yaml.error and re-exported from the main yaml package. This change will cause an ImportError when the module is loaded.

cursor · 2025-11-27T10:01:57Z

services/idun_agent_manager/src/app/api/v1/deps.py

+        expires_at = int(data.get("expires_at") or 0)
+        print(f"access_token: {access_token}")
+        print(f"refresh_token: {refresh_token}")
+        print(f"expires_at: {expires_at}")


Bug: Debug print statements expose sensitive authentication tokens

Several print() statements output sensitive authentication data including access_token and refresh_token values to stdout. In production environments, these tokens could end up in application logs, exposing credentials that could be used to impersonate users. These appear to be debugging statements that were accidentally left in the code.

Additional Locations (1)

services/idun_agent_manager/src/app/api/v1/routers/auth.py#L134-L135

cursor · 2025-11-27T10:01:57Z

services/idun_agent_manager/src/app/api/v1/routers/auth.py

+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED, detail="Session expired"
+        )
+    return JSONResponse(content={"session": json.loads(raw)})


Bug: Endpoint exposes raw authentication tokens to client

The /me endpoint returns the full session data including raw id_token, access_token, and refresh_token values via JSON response. These tokens are typically kept server-side and never exposed to the client once a session is established. Exposing these tokens increases the attack surface for token theft via XSS vulnerabilities, response interception, or malicious browser extensions. The endpoint could return just the normalized principal information (user_id, email, roles) instead of the complete session with raw tokens.

Possible de regarder cette issue @ahmedennaifer

…lder - Introduced validation for AdkAgentConfig in the ConfigBuilder class. - Enhanced error handling for invalid ADK agent configurations. - Updated imports to include AdkAgentConfig for proper configuration management.

cursor

This is the final PR Bugbot will review for you during this billing cycle

Your free Bugbot reviews will reset on December 19

Details

You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

cursor · 2025-11-28T08:37:34Z

libs/idun_agent_engine/src/idun_agent_engine/core/config_builder.py

                ) from e
            try:
                guardrails = yaml_config.get("guardrails", "")
+                self._guardrails = guardrails


Bug: Guardrails config assigned as raw dict instead of parsed object

The new line self._guardrails = guardrails assigns the raw YAML value (likely a dict) to _guardrails before checking if it's empty. When guardrails is truthy (contains config data), the conditional on line 119 is false, leaving _guardrails as a raw dict instead of a Guardrails instance. The _guardrails attribute is typed as Guardrails | None and is passed to EngineConfig in the build() method, causing type inconsistency. When guardrails config is present, it needs to be converted to a Guardrails object rather than being assigned as a raw value.

Freezaa9 · 2025-11-28T08:40:28Z

libs/idun_agent_schema/src/idun_agent_schema/manager/settings.py

Le fichier setting de la base postgres est déjà creer ici: idun-agent-platform/services/idun_agent_manager/src/app/infrastructure/db/models/settings.py @ahmedennaifer

Freezaa9 · 2025-11-28T08:41:26Z

services/idun_agent_manager/pyproject.toml

  "orjson>=3.10.12,<4.0.0",  # Fast JSON serialization
  "tenacity>=9.0.0,<10.0.0",  # Retry logic
-
+  "redis>=5.2.0,<6.0.0",


A supprimer @ahmedennaifer

Freezaa9 · 2025-11-28T08:42:12Z

services/idun_agent_manager/src/app/api/v1/routers/auth.py

+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED, detail="Session expired"
+        )
+    return JSONResponse(content={"session": json.loads(raw)})


Possible de regarder cette issue @ahmedennaifer

Freezaa9 · 2025-11-28T08:43:50Z

services/idun_agent_manager/src/app/domain/agents/entities.py

Inutilisé ? @ahmedennaifer

Si utilisé dans env.py entre autre

Freezaa9 · 2025-11-28T08:43:57Z

services/idun_agent_manager/src/app/domain/agents/ports.py

Inutilisé ? @ahmedennaifer

Freezaa9 · 2025-11-28T08:46:38Z

services/idun_agent_manager/src/app/infrastructure/db/models/users.py

Comment t'as creer la nouvelle revision alembic sans ajouter UserModel dans idun-agent-platform/services/idun_agent_manager/alembic/env.py ? @ahmedennaifer

j'ai du faire la revision a la main car j'avais des problèmes avec la migration de certaines briques pour SessionModel. Le UserModel n'est pas utilisé encore

Freezaa9 · 2025-11-28T08:46:45Z

services/idun_agent_manager/src/app/infrastructure/db/models/session.py

Comment t'as creer la nouvelle revision alembic sans ajouter SessionModel dans idun-agent-platform/services/idun_agent_manager/alembic/env.py ?

Freezaa9 · 2025-11-28T08:47:14Z

services/idun_agent_manager/alembic/versions/20251128_1004_0b9c84ee82af_add_sessions_table.py

Il manque UserModel @ahmedennaifer

ahmedennaifer added 2 commits November 25, 2025 16:02

fix: guardrails only if enabled + translate schema

873d1b1

feat: migrate auth for oidc

982d5c0

ahmedennaifer requested a review from Freezaa9 November 27, 2025 09:44

Merge remote-tracking branch 'origin/develop' into okta-develop

9951e60

cursor bot reviewed Nov 27, 2025

View reviewed changes

ahmedennaifer and others added 4 commits November 27, 2025 13:03

feat: add pg as session storer, and make the session store-agnostic

f2c5a5e

fix: guardrails not added to config

7da042b

chore: update PostgreSQL image version to 16 in docker-compose.dev.yml

fdd48a2

cursor bot reviewed Nov 28, 2025

View reviewed changes

Freezaa9 reviewed Nov 28, 2025

View reviewed changes

ahmedennaifer added 2 commits November 28, 2025 14:46

fix: remove unused config classes and add automigrate session table

5345991

chore: remove app settings from schema

895a57a

OIDC support #106

Are you sure you want to change the base?

OIDC support #106

Uh oh!

Conversation

ahmedennaifer commented Nov 27, 2025 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

This is the final PR Bugbot will review for you during this billing cycle

Uh oh!

cursor bot Nov 27, 2025

Choose a reason for hiding this comment

Bug: CORS configuration hardcoded to empty list

Uh oh!

cursor bot Nov 27, 2025

Choose a reason for hiding this comment

Bug: Incorrect import path for YAMLError class

Uh oh!

cursor bot Nov 27, 2025

Choose a reason for hiding this comment

Bug: Debug print statements expose sensitive authentication tokens

Uh oh!

cursor bot Nov 27, 2025

Choose a reason for hiding this comment

Bug: Endpoint exposes raw authentication tokens to client

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

This is the final PR Bugbot will review for you during this billing cycle

Uh oh!

cursor bot Nov 28, 2025

Choose a reason for hiding this comment

Bug: Guardrails config assigned as raw dict instead of parsed object

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ahmedennaifer Nov 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ahmedennaifer commented Nov 27, 2025 •

edited by cursor bot

Loading

ahmedennaifer Nov 28, 2025 •

edited

Loading