Wire authorization into workspace model - #2445

Merged

derekwaynecarr merged 14 commits into

NVIDIA:mainfrom

derekwaynecarr:decarr/workspace-authz

Jul 30, 2026

Commits on Jul 29, 2026

feat(auth): implement RFC 0011 Phase 2 workspace authorization
derekwaynecarr
committed
c968e5e
fix(auth): address PR review feedback on workspace authorization
derekwaynecarr
committed
676eeab
fix(server): use authed request in delete telemetry test
derekwaynecarr
committed
421fcb2
fix(auth): address gator review findings for workspace authorization
derekwaynecarr
committed
145c007
fix(auth): close workspace-name oracle and label-selector truncation
derekwaynecarr
committed
814e8c0
test(auth): add non-member rejection and membership+label persistence tests
derekwaynecarr
committed
a8ad0c0
fix(auth): format merged import line in sandbox tests
derekwaynecarr
committed
ad60502
fix(auth): address gator re-review findings on workspace authorization
derekwaynecarr
committed
8083f58
fix(auth): address second gator re-review findings
derekwaynecarr
committed
3b5a656
fix(auth): address third gator review findings
derekwaynecarr
committed
d8f54e0
fix(auth): extend CWE-203 normalization to policy.rs sandbox handlers
derekwaynecarr
committed
542b259
test(auth): update assertions for CWE-203 sandbox ID normalization
derekwaynecarr
committed
baf9ced
fix(auth): narrow CWE-203 error mapping and correct whoami output formats
derekwaynecarr
committed
595195c
fix(ci): share network namespace with Keycloak in containerized CI
derekwaynecarr
committed
0e43f1c