stacklok / toolhive / 30351240605

70%

Build Type

push

github

Committed by web-flow

Commit Message

Capture RFC 8693 act claim in audit logs (#6046)

* Capture RFC 8693 act claim in audit logs (#6035)

Add first-class support for the RFC 8693 actor claim in ToolHive's
audit pipeline so delegated requests record the full chain of acting
parties, not just the terminal subject.

- Introduce auth.DelegationChain and auth.ParseDelegationChain to
  parse nested act claims with a bounded depth (default 10, aligned
  with the token-exchange issuance cap) and explicit truncation
  reporting (dropped_count).
- Promote the parsed chain into auth.Identity / auth.PrincipalInfo
  during claimsToIdentity so downstream consumers see it as a
  structured field rather than an opaque JWT claim.
- Extend audit.AuditEvent with a delegationChain member and teach
  both the HTTP Auditor and WorkflowAuditor to populate it from the
  request identity, respecting the configured maxDelegationDepth.
- Cover issuance → validation → audit extraction with unit tests,
  middleware-level tests (including SSE stream opens), and an
  end-to-end integration test that mints a delegated token via the
  real token-exchange handler and asserts the audit event.
- Document the new audit field and maxDelegationDepth config knob;
  regenerate operator CRD/swagger docs.

Closes #6035

* Regenerate operator CRDs and CRD docs for maxDelegationDepth

Run task operator-manifests and task crdref-gen to pick up the new
maxDelegationDepth audit config field introduced in #6035.

Coverage Stats

124 of 131 new or added lines in 8 files covered. (94.66%)

23 existing lines in 5 files now uncovered.

81344 of 116647 relevant lines covered (69.74%)

98.04 hits per line