* fix: skip expiry notifications for app embed and SDK tokens
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* refactor: share app token label prefixes between mint sites and the check
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: skip expiry alerts for impersonation and test-connection tokens
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix: credit the token owner instead of the token label in the audit trail
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: address review findings on token-owner audit attribution
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: carry token-label provenance explicitly instead of inferring it
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: point ee-repo-ref at the companion branch
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: trust only non-forgeable token labels to name the acting entity
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: reject reserved system-token labels at token creation
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: narrow the token-label guard to server-minted namespaces
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: add the provenance field to the remaining ApiAuthed literals
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: stop trusting the email- label, which no mint produces
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: prevent token label collision bypassing job read access control
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test: regression tests for token label collision job read access
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: bind job-read override fast-path to permissioned_as_email
Replaces the reserved-label / label-* exclusion approach: webhook-/http-/email-
labels are created through the public token API by the trigger panels, so they
cannot be reserved, and blocking label-* regressed legitimate re-reads. Instead
the username_override fast-path now requires the job's permissioned_as_email
(non-forgeable, never derived from the label) to equal the caller's email.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
hugocasaandClaude Opus 5
Ruben FiszelandClaude Opus 5