stacklok / toolhive / 31184989406

70%

Build Type

push

github

Committed by web-flow

Commit Message

Add a consent model for external OIDC subject tokens (#6149)

* Accept subject tokens from trusted external OIDC issuers

The embedded auth server's RFC 8693 token exchange only accepted subject
tokens it had minted itself. MultiIssuerTokenValidator could already
verify tokens from external issuers but was unreachable — factory.go
built only the self-issued validator — and even wired in it would have
rejected every external token, since they carry no client_id and
checkDelegationConsent treats that as unbound.

The gap was a missing authorization decision, not a bug: a trusted
issuer, a valid signature and a matching audience authorize ToolHive as
a resource, not any particular client to act for the subject. Accepting
such a token wholesale is a confused-deputy risk.

Add a fail-closed consent policy and ship it in the same change that
first makes external tokens reachable. may_act stays authoritative when
present; otherwise the per-issuer actor claim (azp by default, appid for
Entra v1, cid for Okta) must appear in that issuer's allowed_actors, and
an issuer with none accepts only may_act-bearing tokens. Provenance is
recorded in the act chain so a delegation's origin stays auditable.

trusted_issuers is plumbed through RunConfig and validated at both the
config and constructor layers, so a typo fails before live client
registration rather than crash-looping after it. Each issuer gets its
own HTTP client with a dial-time private-IP guard and same-host redirect
policy, and JWKS URLs pass a single validation choke point whether they
were configured or discovered.

* Correct documentation drift and error reporting

Review of the first round found comments and docs that had fallen out of
step with the code, plus two reporting defects.

The arch doc claimed may_act bypasses allowedDelegateClients and that
the JWKS cache used a 5-minute TTL; neither matched the implementation.
Six references named resolveJWKS, a function that no longer exists, and
a config... (continued)

Coverage Stats

566 of 586 new or added lines in 7 files covered. (96.59%)

13 existing lines in 6 files now uncovered.

83778 of 119492 relevant lines covered (70.11%)

98.66 hits per line