David/HERMES-GIELIE
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
HERMES-GIELIE/api
History
nesquena-hermes c4284529b0
Release: OIDC allowlist whitespace fix (#6244, @webtecnica) (#6259) 
* fix: split OIDC allowlist on commas only, preserve scope whitespace-split (#6244)

_normalize_text_list is shared with _normalize_scopes — OAuth scopes
are space-delimited per RFC 6749 §3.3. Created _normalize_allow_values
that splits on commas/newlines only, keeping multi-word group names
like 'Hermes Users' intact.

* fix(oidc): filter blank allow_values list elements + add parser-split test (gate follow-up)

The new comma/newline-only _normalize_allow_values() list-path retained empty
strings that the shared _normalize_text_list() had filtered, so a YAML
allow_values: [""] would brick an OIDC-only deployment (every callback 403s).
Filter stripped-empty collection elements. Adds a regression test asserting
allowlist multi-word preservation, comma/newline splitting, blank filtering,
and that scopes stay space-delimited (RFC 6749 §3.3).

Co-authored-by: webtecnica <webtecnica@users.noreply.github.com>

* CHANGELOG: OIDC allowlist whitespace fix (#6244)

---------

Co-authored-by: webtecnica <webtecnica@users.noreply.github.com>
Co-authored-by: nesquena-hermes <agent@nesquena-hermes>
2026-07-18 10:36:17 -07:00
..
__init__.py
agent_health.py fix: fail closed on wrapped gateway pid helpers 2026-07-14 16:36:23 +08:00
agent_runtime.py fix(runtime): ignore in-memory agent module swaps 2026-07-16 22:28:35 +08:00
agent_sessions.py Release exp-v0.52.40: ACP sessions in sidebar (#5939) + date-stamped Claude 3.0 reasoning fix (#5934) (#5951) 2026-07-11 15:20:41 -07:00
auth.py Release exp-v0.52.43: trusted-header auth / reverse-proxy SSO (#5568, #3351) (#5956) 2026-07-11 16:34:14 -07:00
auth_oidc.py Release: OIDC allowlist whitespace fix (#6244, @webtecnica) (#6259) 2026-07-18 10:36:17 -07:00
background.py
background_process.py Merge remote-tracking branch 'origin/master' into paperclip/pr-5732 2026-07-09 09:43:54 +08:00
clarify.py
commands.py fix(webui): guard non-dict resolve_moa_preset result in resolve_moa_config 2026-07-01 07:54:48 -05:00
compression_anchor.py Address compaction marker and redaction review 2026-06-26 00:12:09 +00:00
compression_recovery.py Live Stream: add compression recovery action 2026-07-04 21:42:32 +08:00
config.py Release: GLM per-version reasoning controls (#6219, @rh-id) (#6243) 2026-07-18 05:44:33 -07:00
crash_visibility.py fix(webui): crash visibility — faulthandler + thread excepthook + exit audit (#4633) 2026-07-01 18:01:39 +00:00
dashboard_probe.py
extensions.py fix: prefer IPv4 for extension gallery downloads to prevent timeout on broken IPv6 2026-07-03 20:26:18 +00:00
gateway_chat.py Release: durable run-journal recovery + full tool args (#6197, @franksong2702) (#6236) 2026-07-18 03:18:20 -07:00
gateway_restart.py fix: harden gateway restart recovery targeting 2026-07-14 16:01:56 +08:00
gateway_watcher.py fix(sessions): open state.db read-only for lineage reads + watcher projection 2026-07-08 20:17:45 +00:00
goals.py
helpers.py Release exp-v0.52.43: trusted-header auth / reverse-proxy SSO (#5568, #3351) (#5956) 2026-07-11 16:34:14 -07:00
kanban_bridge.py
metering.py feat(#6006): instrument send-to-first-token latency 2026-07-13 17:56:44 -04:00
models.py fix(streaming): skip reasoning rows for tool anchors 2026-07-18 04:36:00 +08:00
oauth.py perf(providers): invalidate cache on oauth credential changes 2026-07-13 19:58:41 +08:00
office_documents.py #5142: office-doc preview + safe docx editing (#540), rebased on master; optional deps 2026-07-02 01:15:57 +00:00
onboarding.py Release exp-v0.52.42: ?profile= deep links (#5730) + Russian locale refresh (#5778) (#5953) 2026-07-11 15:58:47 -07:00
passkeys.py Release Batch D: terminal resource-leak fix + fsync atomic writers (#5835, #5843) (#5848) 2026-07-09 10:54:06 -07:00
paths.py
plugin_providers.py
plugins.py
profiles.py fix(#5696): revert profiles cache TTL 60s->4s (stale profile rows); contributor-flagged follow-up 2026-07-06 20:40:08 +00:00
providers.py perf(providers): invalidate cache on oauth credential changes 2026-07-13 19:58:41 +08:00
request_diagnostics.py perf(webui/session-load-latency) tier4: fix CI failures — lint B009/B905 + _emit_slow format args 2026-07-09 04:22:21 +00:00
rollback.py
route_approvals.py fix(#5000): relay mirrored gateway approvals after stream loss 2026-06-27 06:03:24 +00:00
route_session_list_cache.py fix(cache): keep streaming TTLs above poll cadence 2026-07-15 20:59:59 +00:00
routes.py Release: durable run-journal recovery + full tool args (#6197, @franksong2702) (#6236) 2026-07-18 03:18:20 -07:00
run_journal.py Release: durable run-journal recovery + full tool args (#6197, @franksong2702) (#6236) 2026-07-18 03:18:20 -07:00
runner_client.py
runtime_adapter.py
session_discoverability.py Release Batch D: terminal resource-leak fix + fsync atomic writers (#5835, #5843) (#5848) 2026-07-09 10:54:06 -07:00
session_events.py
session_export_html.py #4968: export chat to self-contained themed HTML, rebased on master 2026-07-02 02:36:09 +00:00
session_lifecycle.py fix(#5543): fire-and-forget commit_session_memory + drain-safe managed stop 2026-07-04 21:40:21 +00:00
session_ops.py fix: preserve lazy alignment semantics 2026-07-17 15:36:55 -06:00
session_recovery.py Merge latest master into compression recovery action 2026-07-05 10:23:15 +08:00
shares.py fix(share): reject dict-valued text-blocks and dict titles (re-gate edge) 2026-07-11 02:14:07 +00:00
skill_usage.py
sse_chunked.py
startup.py
state_sync.py fix(state-sync): mirror WebUI API call counts 2026-07-07 19:48:19 +00:00
streaming.py Release: stop false Compressing-context card (#6184, @carlotestor) (#6223) 2026-07-18 00:03:30 -07:00
system_health.py fix: keep psutil optional for system health 2026-06-26 20:49:13 +00:00
terminal.py Release Batch D: terminal resource-leak fix + fsync atomic writers (#5835, #5843) (#5848) 2026-07-09 10:54:06 -07:00
todo_state.py
turn_journal.py
updates.py fix: pin agent update gateway restart profile 2026-07-14 14:46:00 +08:00
upload.py Release: write Office upload sidecars (#5734, #540) (#5859) 2026-07-09 15:57:21 -07:00
usage.py
webui_session_db.py fix: preserve compression recovery child markers in sidecar rebuild 2026-07-05 06:45:50 +08:00
workspace.py #5142: office-doc preview + safe docx editing (#540), rebased on master; optional deps 2026-07-02 01:15:57 +00:00
workspace_git.py fix(workspace-git): hide git subprocess console windows on Windows (#5692) 2026-07-07 02:07:39 +00:00
worktrees.py fix(worktrees): unlock before remove so WebUI-created worktrees can be reaped 2026-07-13 17:47:58 +00:00