stacklok / toolhive / 32234982675

70%

Build Type

push

github

Committed by web-flow

Commit Message

Add CEL actor matching for trusted issuers (#6364)

* Add CEL actor matching for trusted issuers

Trusted external issuers previously authorized delegation only when a single configured actor claim matched an exact allowedActors entry. That model cannot express issuer-signed delegation classes or policies based on multiple verified claims, while accepting a valid external token without explicit consent would create a confused-deputy risk.

Add actorMatcher as an optional CEL predicate over the complete signature-verified subject-token claims map. A true matcher result is additive to allowedActors; both paths still require the authenticated ToolHive client to match allowedDelegateClients. may_act remains opt-in, authoritative when present, and is evaluated before actor authorization.

Expose actorMatcher through the shared embedded-auth-server CRD configuration, convert it into the auth-server RunConfig, and validate/compile it before server startup. Keep runtime matcher failures fail-closed, preserve generic OAuth client errors, and log only safe DEBUG diagnostics.

Document CEL has() guards for optional claims, strengthen matcher unit/integration coverage, and add kind E2E coverage for successful and rejected CRD-configured matchers.

Fixes #6322

* Regenerate CRD API docs for actorMatcher field

* Redact CEL matcher errors and refresh actor doc comments

CEL evaluation errors can embed raw claim values (e.g. timestamp()
on a malformed string quotes it verbatim), so the actor matcher's
evaluation error is no longer logged or returned to the caller in
its raw form. The AllowedActors/AllowMayAct doc comments are also
updated to describe actorMatcher as an additional authorization
signal, since the generated CRD schema and operator API docs still
described the pre-matcher, allowlist-only behavior.

Addresses review feedback on #6364.

* Note ActorMatcher in the standalone TrustedIssuer wire docs

The AllowMayAct comment on the TrustedIssuer wire type st... (continued)

Coverage Stats

86 of 88 new or added lines in 3 files covered. (97.73%)

7 existing lines in 3 files now uncovered.

85754 of 121666 relevant lines covered (70.48%)

99.46 hits per line