feat: extend MCP sessions for agent subjects - #6072
Conversation
|
|
Running ultrareview automatically — This change introduces a new agent session type with a delegated credential profile, touching session issuance, refresh, validation, and DB schema—core auth paths where a subtle bug could cause unauthorized access or break existing sessions.. I'll post findings when complete. |
bc9c34e to
08ca0e9
Compare
This comment has been minimized.
This comment has been minimized.
671e349 to
dc80739
Compare
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
Ultrareview completed in 10m 31s
Review completed against the latest diff
Linked issue analysis
Linked issue: AIM-197: feat: extend existing MCP sessions for agent subjects
| Status | Acceptance criteria | Notes |
|---|---|---|
| ✅ | Create an existing user session for the agent subject with immutable authorizer, endpoint-scoped delegated policy, and supported policy version | The token flow mints an agent: subject, stores the authorizer and delegated grants on user_sessions, and tests verify the persisted profile and policy binding. |
| ✅ | Preserve the agent subject, authorizer, delegated policy, and policy version across refresh | Refresh passes the existing credential fields into mintSession, and tests compare the old and rotated session profiles. |
| Re-admit the live parent agent on access and refresh, denying suspended or otherwise invalid credentials | Access and refresh call admitAgentSession, and suspension denial is tested. The diff does not directly demonstrate every required lifecycle case such as deletion, owner loss, cross-tenant mismatch, or live-policy denial. | |
| ✅ | Honor direct session revocation and deny refresh replay when the successor session is revoked | Agent access uses an authoritative non-deleted session lookup, while replay reloads and validates the successor session; a directly revoked successor is covered by a test. |
| Continue using the existing MCP OAuth issuer, client, redirect, PKCE, resource, endpoint, and session contracts without agent-specific OAuth or token persistence surfaces | The implementation extends the existing token and session paths and validates endpoint binding, with no dedicated agent endpoint or token store added. The diff does not independently test every exact issuer, redirect, PKCE, and resource contract listed in the issue. | |
| Leave existing human sessions and MCP behavior unchanged when agent delegation fields are absent | Non-agent minting rejects unexpected delegation fields and the existing session path remains in use, but no focused regression test for unchanged human behavior is included in this diff. |
Tip: instead of fixing issues one by one fix them all with cubic
Re-trigger cubic
There was a problem hiding this comment.
All reported issues were addressed across 11 files (changes from recent commits).
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
All reported issues were addressed across 13 files (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Fix all with cubic | Re-trigger cubic
fad05e3 to
15b9aab
Compare
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
All reported issues were addressed across 2 files (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Fix all with cubic | Re-trigger cubic
1 participant
Summary
Extends existing MCP user-session issuance and refresh flows to support agent subjects. Agent sessions retain immutable authorizer and delegated policy provenance while every access and refresh admission resolves the live parent and applies the credential admission boundary.
Motivation
Agent principals need delegated MCP sessions without introducing a parallel OAuth transport or dedicated token persistence model.
Technical details
Credential profile and admission
Agent subjects use the existing session, challenge, token, refresh, and revocation machinery. The stored profile carries the immutable authorizer plus delegated restriction, while admission enforces the effective
R ∩ A ∩ Opolicy against current lifecycle and ownership state.Refresh and revocation
Refresh rotation preserves the credential profile and re-admits the parent. Replay responses are denied when the authoritative successor session has been directly revoked.
Dependency and retargeting
This PR depends on #6068 (AIM-193 credential admission) and #6066 (AIM-196 prerequisite model work). It temporarily targets
integration/aim-197-prerequisites, built from the recorded prerequisite heads. After both dependencies land onmain, this branch should be rebased or otherwise reconciled and the PR retargeted tomain.Design context: First-class agent principals and delegated credentials RFC.
Summary by cubic
Extends existing MCP session issuance and refresh flows to support agent subjects, minting delegated MCP sessions from the authorized agent handoff instead of rejecting it.
agent:<uuid>) and identity kind, classified separately in tool-execution killswitch coverage, where it fails closed until agent principals are supported.integration/aim-197-prerequisitesand should be retargeted tomainafter those land.Written for commit 982fd0c. Summary will update on new commits.