stacklok / toolhive / 29750174539

69%

Build Type

push

github

Committed by web-flow

Commit Message

Bound delegated token audience by subject token (#5882)

* Bound delegated token audience by subject token

Token exchange bounded the delegated token's scopes by the subject
token but not its audience. A confidential client registered for
audiences A and B could exchange a user token minted only for A into a
delegated token for B — an escalation to a resource the user never
consented to.

Add ensureAudienceSubsetOfSubject, enforced after all audiences are
granted, so every granted audience must be covered by the subject
token's own aud. Delegation narrows, never broadens, the resource
boundary, mirroring how grantScopes already bounds scopes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Group audience granting to bound function complexity

Extract the audience grant sequence and subset check into
grantAndBoundAudiences, keeping HandleTokenEndpointRequest under the
gocyclo threshold. No behavior change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Coverage Stats

23 of 23 new or added lines in 1 file covered. (100.0%)

14 existing lines in 5 files now uncovered.

75316 of 109577 relevant lines covered (68.73%)

72.15 hits per line