Comparing c4eb7edb65...fc8f396b9a - AutoGPT - AtHeartEngineering

github/AutoGPT

mirror of https://github.com/Significant-Gravitas/AutoGPT.git synced 2026-02-08 13:55:06 -05:00

Author	SHA1	Message	Date
Nicholas Tindle	fc8f396b9a	Fix formatting issues in OAuth provider design doc	2025-12-08 10:46:04 -06:00
Nicholas Tindle	e858416f22	remove proxy from design	2025-12-08 10:42:22 -06:00
Claude	308a299f3a	docs: Add team summary with sequence diagrams and endpoint inventory Added comprehensive team-ready documentation: - 4 detailed mermaid sequence diagrams with data flow tables: 1. Sign in with AutoGPT (OAuth provider flow) 2. Connect Google via AutoGPT (integration popup flow) 3. Agent execution via external app 4. Credential proxy API flow - Complete endpoint inventory (NEW vs EXISTING markers) - New database tables summary - New scopes (AutoGPT OAuth + integration scopes) - Implementation dependencies - Migration considerations - Security review checklist - Estimated effort by phase	2025-12-08 16:18:11 +00:00
Claude	781e78fa82	docs: Enhance OAuth design with security improvements and agent execution API Security improvements: - Replace iframe with popup window (industry standard, avoids clickjacking) - Mandatory PKCE for all OAuth flows (including confidential clients) - Scoped credential grants (apps request specific capabilities, not blanket access) - Proxy allowlists (only pre-defined API paths can be proxied) - SSRF prevention via strict URL validation - Comprehensive audit logging for all operations - postMessage nonce validation to prevent replay attacks New Agent Execution API: - GET /api/v1/capabilities - capability-based discovery (not raw credential lists) - POST /api/v1/agents/{agent_id}/execute - grant-scoped agent execution - GET /api/v1/executions/{execution_id} - poll execution status - GrantBasedCredentialResolver for secure credential isolation - Webhook notifications with HMAC signatures - Rate limiting and concurrent execution limits	2025-12-08 16:02:56 +00:00
Claude	6be81de73e	docs: Add OAuth Provider & Credential Broker design document Design for making AutoGPT serve as: 1. OAuth Provider - external platforms can "Sign in with AutoGPT" 2. Credential Broker - handle third-party OAuth (Google, etc.) via iframe while keeping tokens secure from calling applications Key features: - Full OAuth 2.0/OIDC authorization server implementation - Embeddable integration OAuth page for iframe flows - Credential proxy API for secure token usage - postMessage-based communication for iframe isolation	2025-12-08 15:19:59 +00:00

1 changed files with 1944 additions and 0 deletions

1944

docs/content/platform/contributing/oauth-provider-design.md Normal file

View File

File diff suppressed because it is too large Load Diff