stacklok / toolhive / 28446911783

68%

Build Type

push

github

Committed by web-flow

Commit Message

Surface upstream ID tokens through auth middleware (#5682)

Extend the in-process upstream token reader to return the OIDC ID tokens
captured during login alongside the refreshed access tokens, so that auth
strategies can use them as RFC 8693 subject tokens.

The TokenReader interface is consolidated to a single bulk method,
GetAllUpstreamCredentials, returning map[string]UpstreamCredential where
UpstreamCredential{AccessToken, IDToken} carries both tokens for a given
provider. This avoids the two-round-trips pattern of separate bulk-access
and bulk-ID methods reading from the same storage backend.

Identity gains an UpstreamIDTokens map populated by the auth middleware in
parallel with the existing UpstreamTokens map; values are redacted in
MarshalJSON. The serialized claims map also strips the tsid (token session
id) claim so session identifiers do not leak through Identity JSON.

ID tokens are captured at the initial OIDC login and refreshed
opportunistically: when an upstream returns a rotated id_token on refresh
(OIDC Core 1.0 section 12.2) the new one is surfaced and persisted;
otherwise the original login ID token is carried forward so it is not erased
from storage on a non-rotating refresh. ID tokens are not independently
re-validated for freshness, so callers MUST check the exp claim before using
one as an RFC 8693 subject token.

Fixes: #5679

Signed-off-by: Jakub Hrozek <jakub@stacklok.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Coverage Stats

85 of 87 new or added lines in 5 files covered. (97.7%)

7 existing lines in 2 files now uncovered.

70723 of 104864 relevant lines covered (67.44%)

64.49 hits per line