stacklok / toolhive / 25756530938

66%

Build Type

push

github

Committed by web-flow

Commit Message

Wire identityFromToken into the OAuth2 upstream provider (#5222)

* Extract and consume identity from OAuth2 token response

Wire identityFromToken into the embedded auth server's OAuth2 upstream
provider. Extension point: the existing tokenResponseRewriter (which
already reads and parses every successful token-endpoint response to
normalise non-standard envelopes) gains a parallel responsibility —
extract user identity claims from the same body when the operator
configures IdentityFromTokenConfig with gjson dot-notation paths.

Identity extraction runs on the RAW pre-rewrite body, so paths are
resolved against the original provider response even when
TokenResponseMapping is also configured. The rewriter passes the
extracted *partialIdentity back to exchangeCodeForTokens via a
returned reference; RefreshTokens passes nil and the rewriter is
either omitted entirely or runs with identityCfg=nil because
providers like Snowflake omit username on refresh and identity is
cached at auth-code time in session storage.

The new priority chain in BaseOAuth2Provider.ExchangeCodeForIdentity:

  1. IdentityFromToken — when configured, return the extracted
     identity. If extraction failed (path didn't resolve), return
     ErrIdentityResolutionFailed without consulting userInfo or
     synthesising — the operator's "identity is in the token" claim
     is explicit and we surface its failure rather than silently
     fall through.
  2. UserInfo — existing fetchUserInfo path, unchanged.
  3. Synthesis — existing synthesizeIdentity path (PR 5094),
     unchanged.

OIDC providers always have ID-token-derived identity, so the OIDC
provider's ExchangeCodeForIdentity discards the rewriter's
identityFromToken return value with a defensive WARN if a future
config-loader bug ever sets IdentityFromToken on an OIDC base config
(structurally absent on the OIDC CRD type today).

The tripwire test asserts userinfo HTTP is never contacted when
identityFromToken is configured, in... (continued)

Coverage Stats

96 of 104 new or added lines in 3 files covered. (92.31%)

34 existing lines in 4 files now uncovered.

64317 of 98714 relevant lines covered (65.15%)

62.45 hits per line