fix(security): prevent admin bypass from accessing private resources#4341

Merged

jonpspri merged 13 commits intomainfrom

4323-icacf-21-securitypen-testing-restrict-outbound-requests-from-the-gateway-test-endpoint-to-approved-hosts

Apr 26, 2026

Commits on Apr 26, 2026

fix: prevent admin bypass from accessing private resources

Bogdan-Marius-Catanus
authored and
jonpspri
committed
test: add coverage tests for admin bypass and access control paths

Bogdan-Marius-Catanus
authored and
jonpspri
committed
fix(security): extend admin-bypass private-resource denial across all access paths
jonpspri
committed
refactor(auth): extract per-request auth helpers into auth_context module
jonpspri
committed
fix(security): hybrid admin-bypass policy after rebase onto main #4107
jonpspri
committed
fix(security): close 6 admin-bypass leak paths flagged by review cycle 1
jonpspri
committed
fix(security)+test(security): close residual #4341 review-cycle-1 findings
jonpspri
committed
refactor(security): harden hybrid call sites + restore get_agent_card in-service gate
jonpspri
committed
docs+test(security): tighten admin-bypass changelog + add endpoint 404 regressions
jonpspri
committed
fix+test+docs(security): cycle-2 review follow-ups (vacuous test, doc accuracy, test hardening)
jonpspri
committed
test(security): adapt 12 stale tests to PR #4341 surface changes
jonpspri
committed
test(security): close diff-coverage gaps in PR #4341 hybrid policy helpers
jonpspri
committed
test(security): adapt mcp_rbac e2e admin visibility test to PR #4341 HTTP collapse
jonpspri
committed