stacklok / toolhive / 32059902390

70%

Build Type

push

github

Committed by web-flow

Commit Message

fix(auth): require audience when introspecting via Google tokeninfo (#6236)

* fix(auth): require audience when introspecting via Google tokeninfo

Google's tokeninfo response carries no iss claim; the GoogleProvider
synthesises iss locally, so a configured-issuer check against it is
self-satisfying and proves nothing about which OAuth client the token
was minted for. The only real binding to the deployment is the audience
check - which is skipped when audience is empty. A deployment pointed
at https://oauth2.googleapis.com/tokeninfo with no audience accepted
ANY valid Google access token, including one minted for an unrelated
attacker-controlled OAuth client.

NewTokenValidator now refuses that combination at startup instead of
silently accepting cross-client tokens at runtime.

* Fix gocyclo lint failure and address review nits

Extract JWKS-discovery resolution and the Google tokeninfo audience
check into their own functions so NewTokenValidator's cyclomatic
complexity drops back under the gocyclo threshold, which CI was
failing on. Also apply the two open review nits: trim whitespace on
the audience check and make the new test table-driven.

---------

Co-authored-by: Jakub Hrozek <jakub@stacklok.com>

Coverage Stats

30 of 30 new or added lines in 1 file covered. (100.0%)

299 existing lines in 15 files now uncovered.

85357 of 121224 relevant lines covered (70.41%)

97.91 hits per line