ryan-crabbe-berri 78addb230b fix(proxy): deny agent access when key and team grants resolve to nothing (#36221) ... * fix(proxy): deny when agent grants resolve to nothing `get_allowed_agents` returned a plain list where the empty value meant both "this caller was never restricted" and "this caller's grants resolved to nothing". Downstream read either as allow-all, so a key restricted to one agent inside a team restricted to another reached every agent on the proxy, and an access group that resolved to no agents did the same. Replace it with `resolve_agent_access`, returning a tagged UnrestrictedAgentAccess | RestrictedAgentAccess. Only a caller with no grant anywhere is unrestricted; an empty restricted set denies. Access group lookup failures now propagate to the key/team resolvers so a DB error still fails open exactly as before, while a group that genuinely resolves to nothing denies. * style(proxy): drop redundant comments from the agent access match		2026-08-07 20:44:11 +00:00
..
__init__.py	[Feat] Agent Access Control - Enforce Allowed agents by key, team + add agent access groups on backend (#17502)	2025-12-04 16:31:00 -08:00
test_agent_permission_handler.py	fix(proxy): deny agent access when key and team grants resolve to nothing (#36221)	2026-08-07 20:44:11 +00:00