Repository navigation
test(seer): Add service account auth matrix - #128814
Merged
Merged
Conversation
gricha
changed the title
gricha
force-pushed
the
feat/sa-auth-matrix
branch
2 times, most recently
from
October 27, 2026 02:37
f4a7f5d to
2ddc384
Compare
gricha
marked this pull request as ready for review
October 27, 2026 16:28
Service account ViewerContext rows in the agent-token auth matrix. Every row is xfail until service account auth lands. After that, rows that don't match the owner-token oracle yet are strict xfail, with the cause as the reason.
gricha
force-pushed
the
feat/sa-auth-matrix
branch
from
October 27, 2026 16:28
2ddc384 to
e9e1823
Compare
skaasten
approved these changes
Oct 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds service account ViewerContext rows to the agent-token auth matrix, so we can iterate on service account authorization endpoint by endpoint.
Oracle: an owner token holding the account's scopes. The account is linked to the project in an open-membership org, so it should reach everything the owner does. User-global routes must deny it.
Until service account auth lands (#128779), every row is a non-strict
xfail. After that, rows that still don't match are listed inSERVICE_ACCOUNT_KNOWN_GAPSas strictxfails, with the cause as the reason. A fixed row XPASSes and fails until its entry is removed. Against #128779, 36 of 261 rows are gaps:request.userrequest.useras an actor