Abhinav 2994f545a7 Enforce managed authentication requirements locally (#37132) ...

## Why

Authentication restrictions must apply before stored or environment-provided credentials can be used, including during bootstrap before cloud requirements are fetched.

## What changed

- Add local `requirements.toml` allowlists for login methods and ChatGPT workspaces. Ignore these fields in cloud-provided requirements.
- Combine managed workspace allowlists with existing workspace restrictions by intersection, and fail closed when the resulting policy permits no usable login method.
- Centralize policy checks in the authentication manager so CLI, TUI, app-server, external-auth, and credential-loading paths consistently reject disallowed authentication before token hydration or network requests.

## Testing

- Cover policy composition, workspace intersection, invalid stored and external credentials, bootstrap enforcement, and login endpoint restrictions.

GitOrigin-RevId: efef22b248f3c3333e9aa55423e539efa2d2dd48

2026-08-05 18:09:26 +00:00

..

src

Enforce managed authentication requirements locally (#37132)

2026-08-05 18:09:26 +00:00

BUILD.bazel

Move cloud requirements crate to cloud config (#24621)

2026-06-01 16:43:52 -07:00

Cargo.toml

Route backend requests through the HTTP client factory (#34490)

2026-07-21 08:28:51 +00:00