stacklok / toolhive / 30358722331

70%

Build Type

push

github

Committed by web-flow

Commit Message

Fix review findings in the act claim audit capture (#6096)

* Honor maxDelegationDepth above the auth default

The audit config knob was silently ineffective for any value above 10.
claimsToIdentity parses the RFC 8693 "act" claim at the hardcoded
DefaultMaxDelegationDepth, and rebindDelegationChain can only shrink an
already-parsed actor slice, so it could never recover actors the identity
layer dropped. An operator setting maxDelegationDepth to 25 still got 10
actors and no warning, even though the full chain was still present in
the raw claim.

Re-parse the raw "act" claim at the configured depth when the
identity-layer chain was truncated and audit asks for more actors than it
kept. The re-parse is trusted only when it yields at least as many actors
as are already parsed, so it can widen the chain but never narrow it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* Drop the test-only log-writer hook from Auditor

SetLogWriterForTest added exported, immediately-deprecated test surface to
a production type, and both call sites needed //nolint:staticcheck to mute
the deprecation the same change introduced. It also wrote auditLogger with
no synchronization on a type whose Middleware reads it from concurrent
request goroutines, and never closed the writer it replaced.

None of it was necessary: NewAuditorWithTransport already selects its
writer from Config.LogFile, so the integration tests can point it at a
t.TempDir() file and read the events back. That also converges these tests
on the capture pattern the vMCP authz integration tests already use.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* Assert delegation capture across all Log* methods

attachDelegation is hand-repeated in all eight WorkflowAuditor Log*
methods, but only LogWorkflowStarted and LogStepStarted were covered, so
dropping the call from any of the other six -- including every terminal
failed/timed-out event, which is what an investigator reads -- would ship
silen... (continued)

Coverage Stats

45 of 0 new or added lines in 0 files covered. (NaN%)

83 existing lines in 6 files now uncovered.

81620 of 116896 relevant lines covered (69.82%)

98.21 hits per line