refactor(auth): key session team resolution on canonical user_id - #6732
Open
jonpspri wants to merge 1 commit into
Open
refactor(auth): key session team resolution on canonical user_id#6732jonpspri wants to merge 1 commit into
jonpspri wants to merge 1 commit into
Conversation
jonpspri
added this pull request to stack #6729
September 9, 2026 19:56
jonpspri
marked this pull request as ready for review
September 9, 2026 19:56
jonpspri
requested review from
Lang-Akshay,
brian-hussey,
crivetimihai,
ja8zyjits and
msureshkumar88
as code owners
September 9, 2026 19:56
jonpspri
force-pushed
the
refactor/5890-team-user-id
branch
from
September 10, 2026 06:22
d079a73 to
9664afc
Compare
jonpspri
removed this pull request from stack #6729
September 12, 2026 08:50
jonpspri
force-pushed
the
refactor/5890-team-user-id
branch
from
September 12, 2026 09:07
9664afc to
175761f
Compare
jonpspri
added this pull request to stack #6798
September 12, 2026 09:08
jonpspri
force-pushed
the
refactor/5890-team-user-id
branch
from
September 12, 2026 09:48
175761f to
2e26964
Compare
resolve_session_teams derives the identity with get_user_id(payload) and passes it to _resolve_teams_from_db, _get_user_team_ids_sync, and the team-cache keys. The e-mail argument stays the fallback for a missing identity and for a UUID session subject, which is an opaque reference and not an identity. Phase-1 values are e-mail strings, so the EmailTeamMember.user_email queries, the DB-authority contract, and normalize_token_teams() are unchanged. _narrow_by_jwt_teams uses no identity and is unchanged. Docstrings state the new parameter meaning. Signed-off-by: Jonathan Springer <jps@s390x.com>
jonpspri
force-pushed
the
refactor/5890-team-user-id
branch
from
September 12, 2026 16:45
2e26964 to
fd2032b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR keys session team resolution on the canonical user_id.
resolve_session_teamsderives the identity withget_user_id(payload)and passes it to_resolve_teams_from_db,_get_user_team_ids_sync, and the team-cache keys. A UUID session subject is an opaque reference, not an identity: it falls back to the e-mail argument, exactly like a missing identity. Phase-1 values are e-mail strings, so theEmailTeamMember.user_emailqueries, the DB-authority contract, andnormalize_token_teams()are unchanged._narrow_by_jwt_teamsuses no identity and is unchanged. Docstrings state the new parameter meaning inauth.pyandteam_management_service.py.Tested with:
uv run pytest tests/unit/mcpgateway/middleware/test_token_scoping.py::TestUserIdKeyedTeamResolution -q— failed first with the expected mode (spy received'e@x.test'instead of'u-1'), then 4 passeduv run pytest tests -k "team or scoping" -q— 2475 passed, 73 skippeduv run pytest tests/unit/mcpgateway/transports/test_streamablehttp_transport.py -q— 601 passed (call sites verified unchanged)make ruff— all checks passedAcceptance criteria of #5890 are met. Risk to existing users: none; phase-1 values are identical, including UUID-subject session tokens.
Stack: A.5 of epic #5884 (base: #6731).
Closes #5890