Skip to content

feat(connections): a runtime with no client of its own takes consent through Auto's client #268

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rami-hatoum merged 6 commits into from
Oct 20, 2026
Merged

feat(connections): a runtime with no client of its own takes consent through Auto's client #268

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
ea01146
feat(tool-servers): the client source auto, consent through Auto's co…
rami-hatoum Oct 20, 2026
8119820
feat(connections): a consent through Auto's consent service starts, f…
rami-hatoum Oct 20, 2026
2e85c77
feat(server): consent through Auto's clients, by AUTO_CLIENTS and CON…
rami-hatoum Oct 20, 2026
d522714
feat(tool-servers): consent through Auto reads the service's refusals…
rami-hatoum Oct 20, 2026
9eeb21f
feat(connections): a consent through Auto records its handoff's clien…
rami-hatoum Oct 20, 2026
a15bd3b
feat(server): test servers start with consent through Auto off, and t…
rami-hatoum Oct 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion auto-runtime.example.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,9 +100,12 @@ model_aliases:
# leaving the section out lets people add any connection. providers adds
# providers of your own beside those the runtime ships, which a person connects
# by name and an entry of tool_servers may name; one named as a shipped
# provider takes its place.
# provider takes its place. auto_clients lets a provider take Auto's client,
# through Auto's consent service, where you register none at its vendor: on in
# local mode and off otherwise when left out.
# connections:
# people_may_add: true
# auto_clients: true
# allowed_hosts: ['*.example.com', 'crm.example.com']
# credential_kinds: [none, reference, secret, client_credentials, authorization]
# providers:
Expand Down
6 changes: 5 additions & 1 deletion auto-runtime.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -407,6 +407,10 @@
},
"description": "The clients whoever runs the runtime registered at authorization servers, each with the issuers it is registered at, its client_id, and its client_secret, or its private_key with its algorithm, as a reference, or neither for a public client"
},
"auto_clients": {
"type": "boolean",
"description": "Whether a provider whose way takes a registered client takes Auto's client too, through Auto's consent service, where none is registered at its issuer; true in local mode and false otherwise when left out. AUTO_CLIENTS wins over it"
},
"providers": {
"type": "array",
"items": {
Expand Down Expand Up @@ -583,7 +587,7 @@
}
},
"additionalProperties": false,
"description": "What people may add as connections through their agents, tool servers of an org which every playbook of the org may use; the clients whoever runs the runtime registered at authorization servers; and the providers it adds beside those the runtime ships. CONNECTIONS wins over it"
"description": "What people may add as connections through their agents, tool servers of an org which every playbook of the org may use; the clients whoever runs the runtime registered at authorization servers, and whether Auto's clients serve as well; and the providers it adds beside those the runtime ships. CONNECTIONS wins over it"
},
"usage_ping": {
"type": "boolean",
Expand Down
119 changes: 91 additions & 28 deletions docs/assets/openapi.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1664,6 +1664,7 @@
"type": "string",
"enum": [
"registered",
"auto",
"metadata_document",
"dynamic"
],
Expand Down Expand Up @@ -2052,6 +2053,7 @@
"type": "string",
"enum": [
"registered",
"auto",
"metadata_document",
"dynamic"
],
Expand Down Expand Up @@ -2408,6 +2410,7 @@
"type": "string",
"enum": [
"registered",
"auto",
"metadata_document",
"dynamic"
],
Expand Down Expand Up @@ -2760,6 +2763,7 @@
"type": "string",
"enum": [
"registered",
"auto",
"metadata_document",
"dynamic"
],
Expand Down Expand Up @@ -3128,6 +3132,7 @@
"type": "string",
"enum": [
"registered",
"auto",
"metadata_document",
"dynamic"
],
Expand Down Expand Up @@ -3233,6 +3238,16 @@
],
"additionalProperties": false,
"description": "The consent started and not finished, while it is open"
},
"client_source": {
"type": "string",
"enum": [
"registered",
"auto",
"metadata_document",
"dynamic"
],
"description": "For a connection connected by consent, the source of the client a start would take now, by the rule the start takes it by: auto where it would begin through Auto's consent service. Left out where the runtime has no client the way takes"
}
},
"required": [
Expand Down Expand Up @@ -3554,6 +3569,7 @@
"type": "string",
"enum": [
"registered",
"auto",
"metadata_document",
"dynamic"
],
Expand Down Expand Up @@ -3974,6 +3990,7 @@
"type": "string",
"enum": [
"registered",
"auto",
"metadata_document",
"dynamic"
],
Expand Down Expand Up @@ -4206,10 +4223,21 @@
"expires_at"
],
"additionalProperties": false
},
"client_source": {
"type": "string",
"enum": [
"registered",
"auto",
"metadata_document",
"dynamic"
],
"description": "The source of the client the consent was started with; auto where it began through Auto's consent service, whose finish takes a handle in place of a code"
}
},
"required": [
"authorize"
"authorize",
"client_source"
],
"additionalProperties": false,
"description": "Where the person signs in to the provider and allows Auto"
Expand Down Expand Up @@ -4282,7 +4310,7 @@
"post": {
"operationId": "finish",
"summary": "Finish consent",
"description": "Finishes the consent of a connection with the code and the state its authorization server sent the person back with, which connects it, and answers it connected. The runtime keeps the tokens sealed in its secret store, and no answer, record or history of the org ever holds them. On a runtime that signs people in, only the person who added the connection may finish it.",
"description": "Finishes the consent of a connection with the code and the state its authorization server sent the person back with, which connects it, and answers it connected. A consent begun through Auto's consent service is finished with the handle and the state the service sent the person back with instead. The runtime keeps the tokens sealed in its secret store, and no answer, record or history of the org ever holds them. On a runtime that signs people in, only the person who added the connection may finish it.",
"tags": [
"connections"
],
Expand All @@ -4309,34 +4337,68 @@
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://on.auto/schemas/runtime/finish/input",
"type": "object",
"additionalProperties": false,
"properties": {
"token": {
"type": "string",
"minLength": 1,
"maxLength": 128,
"description": "The token of the link add_connection gave"
},
"code": {
"type": "string",
"minLength": 1,
"description": "The code the authorization server sent the person back with"
},
"state": {
"type": "string",
"minLength": 1,
"description": "The state the authorization server sent the person back with"
"anyOf": [
{
"type": "object",
"additionalProperties": false,
"description": "The finish of a consent begun with a client of this runtime's, which answers a code",
"properties": {
"token": {
"type": "string",
"minLength": 1,
"maxLength": 128,
"description": "The token of the link add_connection gave"
},
"state": {
"type": "string",
"minLength": 1,
"description": "The state the person was sent back with"
},
"code": {
"type": "string",
"minLength": 1,
"description": "The code the authorization server sent the person back with"
},
"iss": {
"type": "string",
"minLength": 1,
"description": "The issuer the authorization server sent the person back with, where it sent one"
}
},
"required": [
"token",
"state",
"code"
]
},
"iss": {
"type": "string",
"minLength": 1,
"description": "The issuer the authorization server sent the person back with, where it sent one"
{
"type": "object",
"additionalProperties": false,
"description": "The finish of a consent begun through Auto's consent service",
"properties": {
"token": {
"type": "string",
"minLength": 1,
"maxLength": 128,
"description": "The token of the link add_connection gave"
},
"state": {
"type": "string",
"minLength": 1,
"description": "The state the person was sent back with"
},
"handle": {
"type": "string",
"minLength": 1,
"description": "The handle Auto's consent service sent the person back with, which its tokens are handed over for"
}
},
"required": [
"token",
"state",
"handle"
]
}
},
"required": [
"token",
"code",
"state"
]
}
}
Expand Down Expand Up @@ -4533,6 +4595,7 @@
"type": "string",
"enum": [
"registered",
"auto",
"metadata_document",
"dynamic"
],
Expand Down
Loading
Loading