stacklok / toolhive / 30261133808

70%

Build Type

push

github

Committed by web-flow

Commit Message

Audit authentication failures and webhook denials (#5874)

* Audit authentication failures and webhook denials

The audit middleware ran inside auth, the webhooks, and rate limiting,
so their rejections never produced audit events: authentication
failures (401), webhook policy denials (403), and rate-limit
rejections were invisible to the audit trail. The point of audit is to
record every request outcome, especially rejections.

Audit could not simply move outward because it reads the identity and
parsed MCP request from context values that auth and the parser create
for downstream handlers only. Extend the mutable-carrier pattern the
audit package already uses for BackendInfo: audit injects an
auth.IdentityHolder and an mcp.ParsedRequestHolder before calling the
inner chain; auth.WithIdentity (the single point every auth middleware
goes through) and the MCP parser fill them; audit reads them back
after the chain returns.

Move audit to directly inside the body-size limit on both runner
chain-builder paths, and outside the auth middleware on the vMCP Serve
path. Body-limit (413) and origin-validation (403) rejections remain
outside audit by design: body-limit must reject oversized bodies
before audit buffers request data, and origin validation is a pre-auth
DNS-rebind guard.

Stream-open events (SSE / streamable GET) are now logged on the first
response write instead of on arrival, so they carry the real outcome —
including denied stream attempts, previously invisible — and the
authenticated identity.

Fixes #5873

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017attizo5HSwpLcPoimd6Xi

* Clarify audit outcome mapping for rate-limit rejections

The comment implied rate-limit rejections were among the "denied"
outcomes; they are audited but map to outcome "failure" (429 falls in
the generic 4xx bucket; only 401/403 map to "denied"). State the
mapping explicitly.

Co-Authored-By: Claude Fable 5 <nor... (continued)

Coverage Stats

124 of 144 new or added lines in 6 files covered. (86.11%)

8 existing lines in 4 files now uncovered.

80276 of 115335 relevant lines covered (69.6%)

83.64 hits per line