jif 4e7b9e285b Recheck EMA request authority at HTTP boundaries (#55288) ...

## Why

Authorization can change during token renewal before a revocation watcher runs. Requests must check that their authority is still current before dispatch.

## What changed

- Let `EmaRequestAuthority` accept a cancellation token and a synchronous authority check, revoking itself when the check fails.
- Recheck authority after authentication and after receiving HTTP responses for both regular and streaming requests.
- Add `CloudConfigBundleBinding::invalidated()` to wait until a captured policy binding is no longer current.

## Testing

Update tests to cover ownership changing during token renewal without explicit revocation, preventing HTTP dispatch, and parent-token cancellation ending an existing response stream.

GitOrigin-RevId: a142d6bcd0cd7a3d2e9d438a45dc640d93235656

2026-10-19 14:08:49 +00:00

..

examples

Add remote thread config loader protos (#18892)

2026-04-23 10:06:05 -07:00

scripts

Add remote thread config loader protos (#18892)

2026-04-23 10:06:05 -07:00

src

Recheck EMA request authority at HTTP boundaries (#55288)

2026-10-19 14:08:49 +00:00

BUILD.bazel

Embed defaults in the packaged config layer (#38179)

2026-08-12 12:15:47 +00:00

Cargo.toml

Track MCP enterprise auth cancellation across config reloads (#55287)

2026-10-19 14:07:10 +00:00

defaults.toml

Make environment context date and timezone configurable (#52164)

2026-10-08 16:27:10 +00:00