feat: per-API-key repo scoping (fail-closed) + auth-boundary & stack-trace diagnosis tests#12

Merged

csharp36 merged 7 commits into

mainfrom

feat/apikey-repo-scoping

May 30, 2026

Commits on May 30, 2026

docs: plan for API-key repo scoping + auth-boundary & stack-trace tests
csharp36
committed
feat: per-API-key repos allow-list in config
csharp36
committed
feat: carry API-key repo scope onto CallerIdentity.allowedRepos
csharp36
committed
feat: enforce per-API-key repo scope in executeQuery (fail-closed, [*] = all)
csharp36
committed
test: authorization boundary — unentitled remote caller leaks nothing (OAuth + API key)
csharp36
committed
test: poster-child stack-trace diagnosis flow (frame -> source -> callers -> impls -> context)
csharp36
committed
docs: document per-API-key repo scoping (fail-closed, [*] for full access)
csharp36
committed