[fix] Land the v7 audit findings that need no product decision

api/oss/databases/postgres/migrations/core_oss/versions/oss000000010_backfill_workflow_revision_flags.py

@@ -28,7 +28,43 @@
 def upgrade() -> None:
     conn = op.get_bind()
 
-    # Only add each key where absent — never overwrite an already-set value.
+    # Record which rows this backfill touched, and which keys it added to each, in a
+    # side table — not inside `flags` itself. An explicit false is indistinguishable
+    # from one a caller stored, so downgrade needs provenance; but `flags` is
+    # user-facing and typed (Dict[str, bool | str | dict]), so bookkeeping must not
+    # live there.
+    conn.execute(
+        sa.text(
+            """
+            CREATE TABLE IF NOT EXISTS oss000000010_backfilled_flags (
+                revision_id uuid NOT NULL,
+                project_id  uuid NOT NULL,
+                added_keys  text[] NOT NULL,
+                PRIMARY KEY (project_id, revision_id)
+            )
+            """
+        )
+    )
+
+    conn.execute(
+        sa.text(
+            """
+            INSERT INTO oss000000010_backfilled_flags (revision_id, project_id, added_keys)
+            SELECT id, project_id,
+                   ARRAY(
+                       SELECT k FROM unnest(ARRAY['is_agent', 'is_skill']) AS k
+                       WHERE NOT (COALESCE(flags, '{}'::jsonb) ? k)
+                   )
+            FROM workflow_revisions
+            WHERE flags IS NULL
+               OR NOT (flags ? 'is_agent')
+               OR NOT (flags ? 'is_skill')
+            ON CONFLICT DO NOTHING
+            """
+        )
+    )
+
+    # Add each key only where absent; never overwrite a value a caller already stored.
     conn.execute(
         sa.text(
             """
@@ -47,16 +83,24 @@ def upgrade() -> None:
 
 
 def downgrade() -> None:
-    # Strip only the false values this backfill added; leave rows that carried
-    # a real (true) value or predate the keys untouched beyond the removal.
     conn = op.get_bind()
+
+    # Strip only the keys this backfill added, per row, from its recorded provenance.
     conn.execute(
         sa.text(
             """
-            UPDATE workflow_revisions
-            SET flags = flags - 'is_agent' - 'is_skill'
-            WHERE (flags ->> 'is_agent') = 'false'
-               OR (flags ->> 'is_skill') = 'false'
+            UPDATE workflow_revisions AS wr
+            SET flags = (
+                    SELECT COALESCE(jsonb_object_agg(kv.key, kv.value), '{}'::jsonb)
+                    FROM jsonb_each(wr.flags) AS kv
+                    WHERE NOT (kv.key = ANY(b.added_keys))
+                )
+            FROM oss000000010_backfilled_flags AS b
+            WHERE wr.id = b.revision_id
+              AND wr.project_id = b.project_id
+              AND wr.flags IS NOT NULL
             """
         )
     )
+
+    conn.execute(sa.text("DROP TABLE IF EXISTS oss000000010_backfilled_flags"))

api/oss/databases/postgres/migrations/core_oss/versions/oss000000012_add_gateway_connections_provider_account_index.py

@@ -0,0 +1,48 @@
+"""add expression index for gateway_connections provider account lookups
+
+find_connection_by_provider_id / activate_connection_by_provider_connection_id
+(the OAuth-callback hot path, called on every Composio connect completion)
+filter on project_id + data->>'connected_account_id' with no index backing the
+JSON key extraction, forcing a per-project sequential scan. Add a btree
+expression index on the extracted text (the `data` column is plain `json`,
+not `jsonb`, so a GIN path-ops index isn't an option here).
+
+Revision ID: oss000000012
+Revises: oss000000011
+Create Date: 2026-07-13 00:00:00.000000
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+from sqlalchemy import text
+
+revision: str = "oss000000012"
+down_revision: Union[str, None] = "oss000000011"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # CREATE INDEX CONCURRENTLY cannot run inside a transaction.
+    with op.get_context().autocommit_block():
+        op.execute(
+            text(
+                """
+                CREATE INDEX CONCURRENTLY IF NOT EXISTS
+                ix_gateway_connections_project_id_connected_account_id
+                ON gateway_connections (project_id, (data ->> 'connected_account_id'));
+                """
+            )
+        )
+
+
+def downgrade() -> None:
+    with op.get_context().autocommit_block():
+        op.execute(
+            text(
+                "DROP INDEX CONCURRENTLY IF EXISTS "
+                "ix_gateway_connections_project_id_connected_account_id;"
+            )
+        )

api/oss/databases/postgres/migrations/core_oss/versions/oss000000013_drop_redundant_unique_constraint_indexes.py

@@ -0,0 +1,92 @@
+"""drop indexes redundant with an identical unique constraint
+
+Postgres backs every UNIQUE constraint with its own implicit b-tree index,
+so an explicit Index() on the exact same column tuple/order is dead weight
+(extra write cost + storage, no read benefit). Drops the redundant explicit
+indexes across the git-artifact/variant/revision tables (project_id, slug)
+and the two session tables + folders (project_id, session_id / path).
+
+Revision ID: oss000000013
+Revises: oss000000012
+Create Date: 2026-07-13 00:00:01.000000
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+
+revision: str = "oss000000013"
+down_revision: Union[str, None] = "oss000000012"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+# (index_name, table_name, [columns...]) — columns/order match the surviving
+# UniqueConstraint exactly, so downgrade recreates a byte-identical index.
+_REDUNDANT_INDEXES = [
+    (
+        "ix_environment_artifacts_project_id_slug",
+        "environment_artifacts",
+        ["project_id", "slug"],
+    ),
+    (
+        "ix_environment_variants_project_id_slug",
+        "environment_variants",
+        ["project_id", "slug"],
+    ),
+    (
+        "ix_environment_revisions_project_id_slug",
+        "environment_revisions",
+        ["project_id", "slug"],
+    ),
+    (
+        "ix_workflow_artifacts_project_id_slug",
+        "workflow_artifacts",
+        ["project_id", "slug"],
+    ),
+    (
+        "ix_workflow_variants_project_id_slug",
+        "workflow_variants",
+        ["project_id", "slug"],
+    ),
+    (
+        "ix_workflow_revisions_project_id_slug",
+        "workflow_revisions",
+        ["project_id", "slug"],
+    ),
+    (
+        "ix_testset_artifacts_project_id_slug",
+        "testset_artifacts",
+        ["project_id", "slug"],
+    ),
+    ("ix_testset_variants_project_id_slug", "testset_variants", ["project_id", "slug"]),
+    (
+        "ix_testset_revisions_project_id_slug",
+        "testset_revisions",
+        ["project_id", "slug"],
+    ),
+    ("ix_query_artifacts_project_id_slug", "query_artifacts", ["project_id", "slug"]),
+    ("ix_query_variants_project_id_slug", "query_variants", ["project_id", "slug"]),
+    ("ix_query_revisions_project_id_slug", "query_revisions", ["project_id", "slug"]),
+    (
+        "ix_session_states_project_id_session_id",
+        "session_states",
+        ["project_id", "session_id"],
+    ),
+    (
+        "ix_session_streams_project_id_session_id",
+        "session_streams",
+        ["project_id", "session_id"],
+    ),
+    ("ix_folders_project_path", "folders", ["project_id", "path"]),
+]
+
+
+def upgrade() -> None:
+    for index_name, table_name, _columns in _REDUNDANT_INDEXES:
+        op.drop_index(index_name, table_name=table_name, if_exists=True)
+
+
+def downgrade() -> None:
+    for index_name, table_name, columns in _REDUNDANT_INDEXES:
+        op.create_index(index_name, table_name, columns, unique=False)

api/oss/src/apis/fastapi/auth/models.py

@@ -1,5 +1,20 @@
 from pydantic import BaseModel, EmailStr
-from typing import Optional, List, Dict
+from typing import Optional
+
+from oss.src.core.auth.dtos import (
+    DiscoverResponse,
+    SSOProviderInfo,
+    SSOProviders,
+)
+
+__all__ = [
+    "DiscoverRequest",
+    "DiscoverResponse",
+    "SSOProviderInfo",
+    "SSOProviders",
+    "OIDCAuthorizeRequest",
+    "OIDCCallbackRequest",
+]
 
 
 # ============================================================================
@@ -11,21 +26,6 @@ class DiscoverRequest(BaseModel):
     email: EmailStr
 
 
-class SSOProviderInfo(BaseModel):
-    id: str
-    slug: str
-    third_party_id: str
-
-
-class SSOProviders(BaseModel):
-    providers: List[SSOProviderInfo]
-
-
-class DiscoverResponse(BaseModel):
-    exists: bool
-    methods: Dict[str, bool | SSOProviders]
-
-
 # ============================================================================
 # OIDC AUTHORIZE
 # ============================================================================

api/oss/src/apis/fastapi/auth/router.py

@@ -44,8 +44,7 @@ async def discover(request: DiscoverRequest):
     Returns minimal information needed for authentication flow.
     """
     try:
-        result = await auth_service.discover(request.email)
-        return DiscoverResponse(**result)
+        return await auth_service.discover(request.email)
     except Exception as e:
         log.error("[DISCOVERY]", exc_info=True)
         raise HTTPException(status_code=500, detail=str(e))

api/oss/src/apis/fastapi/tools/router.py

@@ -987,14 +987,41 @@ async def callback_connection(
             )
 
         # Fetch integration metadata for the success card (best-effort decoration).
+        # Shares the catalog cache keyed identically to get_integration() below so a
+        # burst of OAuth callbacks doesn't re-fetch Composio live on every redirect.
         integration_label = conn.integration_key.replace("_", " ").title()
         integration_logo = None
         integration_url = None
         try:
-            integration = await self.tools_service.get_integration(
-                provider_key=conn.provider_key.value,
-                integration_key=conn.integration_key,
+            integration_cache_key = {
+                "provider_key": conn.provider_key.value,
+                "integration_key": conn.integration_key,
+                "full_details": True,
+            }
+            cached_integration = await get_cache(
+                project_id=None,  # catalog is global; not per-project
+                namespace="tools:catalog:integration",
+                key=integration_cache_key,
+                model=ToolCatalogIntegrationResponse,
             )
+            if cached_integration:
+                integration = cached_integration.integration
+            else:
+                integration = await self.tools_service.get_integration(
+                    provider_key=conn.provider_key.value,
+                    integration_key=conn.integration_key,
+                )
+                if integration:
+                    await set_cache(
+                        project_id=None,  # catalog is global; not per-project
+                        namespace="tools:catalog:integration",
+                        key=integration_cache_key,
+                        value=ToolCatalogIntegrationResponse(
+                            count=1,
+                            integration=integration,
+                        ),
+                        ttl=5 * 60,  # 5 minutes
+                    )
             if integration:
                 integration_logo = integration.logo
                 integration_url = integration.url

api/oss/src/core/auth/dtos.py

@@ -0,0 +1,18 @@
+from typing import Dict, List
+
+from pydantic import BaseModel
+
+
+class SSOProviderInfo(BaseModel):
+    id: str
+    slug: str
+    third_party_id: str
+
+
+class SSOProviders(BaseModel):
+    providers: List[SSOProviderInfo]
+
+
+class DiscoverResponse(BaseModel):
+    exists: bool
+    methods: Dict[str, bool | SSOProviders]

api/oss/src/core/auth/service.py

@@ -8,6 +8,8 @@
 from oss.src.utils.logging import get_module_logger
 from oss.src.utils.caching import invalidate_cache
 
+from oss.src.core.auth.dtos import DiscoverResponse
+
 from oss.src.models.db_models import InvitationDB, ProjectDB, OrganizationDB
 from oss.src.services import db_manager
 
@@ -52,7 +54,7 @@ def __init__(self):
     # DISCOVERY: Determine available authentication methods
     # ============================================================================
 
-    async def discover(self, email: str) -> Dict[str, Any]:
+    async def discover(self, email: str) -> DiscoverResponse:
         """
         Discover authentication methods available for a given email.
 
@@ -287,11 +289,7 @@ async def discover(self, email: str) -> Dict[str, Any]:
             # SSO enforcement: only SSO providers, no email or social
             if sso_providers:
                 methods["sso"] = {"providers": sso_providers}
-            response = {
-                "exists": user_exists,
-                "methods": methods,
-            }
-            return response
+            return DiscoverResponse(exists=user_exists, methods=methods)
 
         # Otherwise, include all allowed methods based on policy
         # Email methods - check both specific method and wildcard
@@ -369,12 +367,7 @@ async def discover(self, email: str) -> Dict[str, Any]:
         if sso_providers:
             methods["sso"] = {"providers": sso_providers}
 
-        response = {
-            "exists": user_exists,
-            "methods": methods,
-        }
-
-        return response
+        return DiscoverResponse(exists=user_exists, methods=methods)
 
     # ============================================================================
     # AUTHENTICATION: Support authentication flows