docs(workflow-executor): document FOREST_EXECUTOR_ENCRYPTION_KEY#1725

Open

hercemer42 wants to merge 25 commits into

feat/prd-367-pr1-executor-oauth-credentialsfrom

docs/prd-367-pr4-executor-encryption-key

Commits on Jun 29, 2026

feat(workflow-executor): add OAuth MCP credential store + deposit/delete endpoint [PRD-367]

hercemer42
and
claude
committed
fix(workflow-executor): harden oauth store wiring + boot + clientSecret [PRD-621]

hercemer42
and
claude
committed
feat(workflow-executor): use stored OAuth credentials for MCP steps

hercemer42
and
claude
committed
fix(workflow-executor): write rotated refresh token to the current row

hercemer42
and
claude
committed
fix(ai-proxy): treat only 401 (not 403) as a refreshable MCP auth error

hercemer42
and
claude
committed
feat(workflow-executor): support OAuth MCP steps in the in-memory executor [PRD-367]

hercemer42
and
claude
committed
fix(workflow-executor): repoint token service at the relocated credentials port [PRD-367]

hercemer42
and
claude
committed
feat(workflow-executor): re-consent on decrypt failure after key rotation [PRD-367]

hercemer42
and
claude
committed
feat(workflow-executor): add GET /list-mcp-tools design-time tool listing [PRD-367]

hercemer42
and
claude
committed
fix(workflow-executor): guard against non-object token-endpoint responses [PRD-367]

hercemer42
and
claude
committed
fix(workflow-executor): evict cached access token on credential disconnect [PRD-367]

hercemer42
and
claude
committed
fix(workflow-executor): address PR review on oauth2 runtime [PRD-624]

hercemer42
and
claude
committed
docs(workflow-executor): correct write-back-failure comment [PRD-624]

hercemer42
and
claude
committed
fix(workflow-executor): validate OAuth token endpoint against SSRF [PRD-624]

hercemer42
and
claude
committed
fix(workflow-executor): block IPv4-mapped IPv6 in token-endpoint guard [PRD-624]

hercemer42
and
claude
committed
docs(workflow-executor): use US spelling "defense" in refresh-grant comment [PRD-624]

hercemer42
and
claude
committed
docs(workflow-executor): rewrite token-endpoint guard comment [PRD-624]

hercemer42
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

docs(workflow-executor): document FOREST_EXECUTOR_ENCRYPTION_KEY#1725

docs(workflow-executor): document FOREST_EXECUTOR_ENCRYPTION_KEY#1725
hercemer42 wants to merge 25 commits into
feat/prd-367-pr1-executor-oauth-credentialsfrom
docs/prd-367-pr4-executor-encryption-key

Commits on Jun 29, 2026

feat(workflow-executor): add OAuth MCP credential store + deposit/delete endpoint [PRD-367]

fix(workflow-executor): harden oauth store wiring + boot + clientSecret [PRD-621]

feat(workflow-executor): use stored OAuth credentials for MCP steps

fix(workflow-executor): write rotated refresh token to the current row

fix(ai-proxy): treat only 401 (not 403) as a refreshable MCP auth error

feat(workflow-executor): support OAuth MCP steps in the in-memory executor [PRD-367]

fix(workflow-executor): repoint token service at the relocated credentials port [PRD-367]

feat(workflow-executor): re-consent on decrypt failure after key rotation [PRD-367]

feat(workflow-executor): add GET /list-mcp-tools design-time tool listing [PRD-367]

fix(workflow-executor): guard against non-object token-endpoint responses [PRD-367]

fix(workflow-executor): evict cached access token on credential disconnect [PRD-367]

fix(workflow-executor): address PR review on oauth2 runtime [PRD-624]

docs(workflow-executor): correct write-back-failure comment [PRD-624]

fix(workflow-executor): validate OAuth token endpoint against SSRF [PRD-624]

fix(workflow-executor): block IPv4-mapped IPv6 in token-endpoint guard [PRD-624]

docs(workflow-executor): use US spelling "defense" in refresh-grant comment [PRD-624]

docs(workflow-executor): rewrite token-endpoint guard comment [PRD-624]

Commits on Jun 30, 2026

fix(workflow-executor): block the unspecified address in token-endpoint guard [PRD-624]

fix(workflow-executor): reject localhost FQDN/.localhost aliases in token guard [PRD-624]

test(workflow-executor): cover trailing-dot IP forms in token-endpoint guard [PRD-624]

fix(workflow-executor): harden OAuth reauth and token write-back

test(workflow-executor): strengthen reauth-pause audit assertion

fix(workflow-executor): make OAuth refresh write-back atomic

fix(workflow-executor): audit a re-auth-paused MCP call as failed

docs(workflow-executor): document FOREST_EXECUTOR_ENCRYPTION_KEY