Three new env vars wire the Google OAuth callback to a configurable Workspace prefix and route admin/everyone Workspace groups onto the seeded system rows: AGNES_GOOGLE_GROUP_PREFIX, AGNES_GROUP_ADMIN_EMAIL, AGNES_GROUP_EVERYONE_EMAIL. Login gate redirects users with no prefix-matching group to /login?error=not_in_allowed_group. BREAKING: auto-Everyone membership for new users removed. Admin UI/API are read-only on Google-managed groups. See docs/auth-groups.md. |
||
|---|---|---|
| .. | ||
| providers | ||
| __init__.py | ||
| _common.py | ||
| access.py | ||
| dependencies.py | ||
| group_sync.py | ||
| jwt.py | ||
| pat_resolver.py | ||
| router.py | ||
| scheduler_token.py | ||