stacklok / toolhive / 33625521813

70%

Build Type

push

github

Committed by web-flow

Commit Message

Define SPIFFE trust configuration (#6467)

Both SPIFFE credential methods (X.509-SVID and JWT-SVID) need one
fail-closed identity and association model before authentication can
produce equivalent authorization outcomes for either method. Without
a shared model, adding live SVID verification later would force a
choice between duplicating trust-domain/scope/audience checks per
credential type or bolting authorization onto whichever method lands
first.

This commit defines that model as pure config validation, deliberately
without loading trust bundles or authenticating credentials — those
are separate, later steps on this stacked branch (refs #6200). It is,
however, independently fail-closed: `RunConfig.Validate()` now
validates `spiffe_trust_domains`/`inbound_grants.spiffe_client_auth`
directly, and `Config.SPIFFETrust` is built in the embedded auth
server constructor, so a malformed or half-configured declaration
cannot start successfully and silently have no effect.

`SPIFFETrustDomainRunConfig` declares a named trust domain, the
credential methods it enables, and exactly one bundle source: a SPIFFE
Bundle Endpoint (an HTTPS URL plus an `https_web`/`https_spiffe`
authentication profile, so a future loader knows whether to trust the
endpoint's TLS connection via Web PKI or a separately distributed
X.509-SVID root) or the local Workload API. Both are validated for
shape now so the field exists in the authoritative model before
consumption is built, even though fetching a bundle is out of scope
here. `SPIFFEClientAuthRunConfig` associates a SPIFFE principal
pattern (a concrete ID or a terminal `/*` wildcard) within a declared
trust domain with an explicit OAuth client_id, methods, and
permissions — client_id is never derived from the SPIFFE ID, so an
operator always states which OAuth identity a workload maps to.

Permissions are three independent dimensions instead of one combined
list: `resources` (RFC 8707, optional, must be an absolute HTTP(S) URI
... (continued)

Coverage Stats

348 of 417 new or added lines in 3 files covered. (83.45%)

3 existing lines in 1 file now uncovered.

77136 of 110460 relevant lines covered (69.83%)

91.65 hits per line