stacklok / toolhive / 30251979566

73%

Build Type

push

github

Committed by web-flow

Commit Message

Validate subject tokens from external OIDC issuers (#5995)

* Extract SubjectTokenValidator interface for multi-issuer support

Introduce a SubjectTokenValidator interface with a single Validate method,
preparing for multi-issuer token validation where external OIDC tokens
(e.g., Keycloak) need different JWKS resolution than self-issued tokens.

Rename the existing concrete struct to SelfIssuedTokenValidator to clarify
its role. The handler now depends on the interface, not the concrete type,
following Go's "accept interfaces, return structs" pattern.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add multi-issuer token validator for external OIDC token exchange

Implement MultiIssuerTokenValidator that routes JWT validation based on
the token's issuer claim. Self-issued tokens delegate to the existing
SelfIssuedTokenValidator. External tokens (e.g., Keycloak) are validated
against the issuer's JWKS, fetched via OIDC discovery with caching.

Security: JWKS URLs from OIDC discovery are validated to require HTTPS
and reject private/loopback addresses (SSRF prevention). Discovered URLs
are re-resolved when the JWKS cache expires.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Fail loudly on empty ExpectedAudience, fix subject-token error code

Address panel review feedback on the multi-issuer validator:
NewMultiIssuerTokenValidator silently accepted a TrustedIssuer with no
ExpectedAudience instead of rejecting it, and subject-token validation
failures returned invalid_grant instead of invalid_request. Also drain
response bodies before closing on non-200 discovery/JWKS fetches.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Harden multi-issuer validator, fix review findings

Address code-review findings on the multi-issuer subject-token
validator. Fix the self-issued routing test, which handed the private
JWKS to the validator instead of the public set. Require an "exp" claim
on external tok... (continued)

Coverage Stats

152 of 219 new or added lines in 4 files covered. (69.41%)

6 existing lines in 3 files now uncovered.

80028 of 115178 relevant lines covered (69.48%)

82.42 hits per line