hyperscale-stack / security / 32661594570

92%

push

github

feat(oauth2): add an error hook so server_error causes are observable

An RFC 6749 §5.2 response carries a code, a description and a URI — never
the cause. A server_error therefore reached the client as an opaque 500 and
was dropped everywhere else, leaving an operator with nothing to diagnose.
RFC 7009 §2.2 made it worse on /revoke: a failed revocation still answers
200 OK, so the failure was unobservable too.

ServerConfig.OnError (type ErrorHook) is called with the normalized *Error
envelope — cause intact — at the point the server decides on its answer:
every RFC 6749 §5.2 body, every /authorize redirect, the pre-redirect
refusals answered with a bare 400, and the best-effort revocations /revoke
swallows. grant.Config.OnError does the same for the family revocation a
grant swallows during BCP §8.10.3 reuse detection.

The hook is purely observational — no response, status code or redirect
changes. Refs #63.

57 of 70 new or added lines in 8 files covered. (81.43%)

3906 of 4257 relevant lines covered (91.75%)

12.53 hits per line