Add SDK methods for agent sub organization auth#11
Merged
Conversation
HasiniSama
changed the title
Yasasr1
reviewed
May 15, 2026
Contributor
Author
|
@CodeRabbit review |
✅ Actions performedReview triggered.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds organization-scoped authorization URL builders (standard + PKCE), methods to obtain and switch agent tokens into sub-organizations, token client support for an organization_switch grant, and corresponding README/API documentation updates. ChangesOrganization-Scoped Authentication
🎯 4 (Complex) | ⏱️ ~45 minutes Sequence DiagramsequenceDiagram
participant Client
participant AgentAuthManager
participant AsgardeoTokenClient
participant AuthServer
Client->>AgentAuthManager: request org auth URL / initiate agent token flow
AgentAuthManager->>AsgardeoTokenClient: get_agent_token(agent_scopes)
AsgardeoTokenClient->>AuthServer: token request (client credentials)
AuthServer->>AsgardeoTokenClient: returns agent token
AgentAuthManager->>AsgardeoTokenClient: get_token(grant_type=organization_switch, token, switching_organization, scope)
AsgardeoTokenClient->>AuthServer: organization_switch token request
AuthServer->>AsgardeoTokenClient: returns org-scoped token
AsgardeoTokenClient->>AgentAuthManager: org-scoped token
AgentAuthManager->>Client: returns org-scoped token / auth URL (+code_verifier if PKCE)
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/asgardeo-ai/src/asgardeo_ai/agent_auth_manager.py`:
- Around line 263-273: The code raises ValueError for unsupported org discovery
types; replace those with the SDK's ValidationError so input validation is
consistent—specifically, change the raise ValueError(...) in the auth parameter
construction logic (the block handling org_discovery_type that sets
auth_params["orgId"/"orgHandle"/"org"/"login_hint"]) to raise ValidationError
with the same message, and make the identical change in the second occurrence
around lines 325-335; locate these in AgentAuthManager (the method that builds
auth_params / handles org_discovery_type) and substitute ValidationError for
ValueError in both places.
- Around line 540-544: The current except block catches a broad Exception and
re-raises TokenError losing the original traceback; replace the generic catch
with either specific exception types you expect (instead of bare Exception) or,
if you must catch Exception, log the full traceback (logger.error(...,
exc_info=True)) and re-raise a chained exception using "raise
TokenError(f'Organization switch failed: {e}') from e" so the original cause is
preserved; update the block around TokenError/ValidationError handling in the
same method where logger.error is called.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 8ff1fc2c-a813-43f8-b7ae-5b4e79cdbca8
📒 Files selected for processing (2)
packages/asgardeo-ai/src/asgardeo_ai/agent_auth_manager.pypackages/asgardeo/src/asgardeo/auth/client.py
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/asgardeo-ai/src/asgardeo_ai/agent_auth_manager.py`:
- Line 320: The call auth_params.update(kwargs) allows callers to overwrite
SDK-managed auth fields; change this to merge only non-reserved keys by
filtering kwargs against the SDK-owned reserved set (which must include org
selector keys, fidp, requested_actor and PKCE fields), i.e., build a new dict of
kwargs items where key not in reserved and then update auth_params with that;
also apply the same guarded merge in the PKCE branch (the code path that sets
code_challenge/code_challenge_method) and add "code_challenge" and
"code_challenge_method" to the reserved set so callers cannot override those
values.
- Around line 262-273: The _build_org_discovery_params function must reject
blank or whitespace-only discovery_value before constructing params; add
validation at the start of _build_org_discovery_params (accepting
org_discovery_type: OrgDiscoveryType, discovery_value: str) that strips
discovery_value and raises ValidationError for empty strings, so callers like
the org ID/handle/org/emailDomain branches never produce keys with empty values;
keep the existing match cases and error handling for unsupported
org_discovery_type.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 17ea2f76-44ef-4358-b7a6-549cb71921f6
📒 Files selected for processing (2)
packages/asgardeo-ai/src/asgardeo_ai/agent_auth_manager.pypackages/asgardeo/src/asgardeo/auth/client.py
🚧 Files skipped from review as they are similar to previous changes (1)
- packages/asgardeo/src/asgardeo/auth/client.py
HasiniSama
force-pushed
the
agent-organization-auth
branch
from
f69165b to
f123650
Compare
SujanSanjula96
approved these changes
May 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
$subject
New method introduced:
get_org_authorization_url(scopes, org_discovery_type, value, ...): Builds an authorization URL targeting a specific sub-organization, identified by org ID, handle, org parameter, or email domain discovery.get_org_authorization_url_with_pkce(...): Same as above, with PKCE (S256) for public clients.switch_token_to_organization(token, switching_organization, scopes): Exchanges an existing access token for one scoped to a target sub-organization using the organization_switch grant type.get_organization_agent_token(switching_organization, agent_scopes, org_scopes,...): To directly get the switched organization token without calling get_agent_token.Issue: wso2/product-is#27526
Summary by CodeRabbit
New Features
Bug Fixes
Documentation