stacklok / toolhive / 33907585027

70%

Build Type

push

github

Committed by web-flow

Commit Message

Allow Cedar delegation without an upstream session (#6506)

* Allow Cedar delegation without an upstream session

RFC 8693 delegated tokens and RFC 7523 JWT-bearer tokens link to no upstream
IdP login, so a configured primary provider rejected them before Cedar ever
evaluated policy.

Both grants can be recognised from the token itself, so let them through on
what the token states rather than on what is missing from the identity. An
absent Identity.UpstreamTokens map says only that no credential was loaded,
never why: an anonymous identity, a local identity and a bearer token from an
unpinned IdP look exactly like a delegated one, and admitting all of them
would let claims from a trust root the deployment never pinned drive policy.

Fall back to request-token claims only when the token affirmatively declares
it has no upstream session. Delegation already says so through the act claim,
parsed into Identity.DelegationChain. The JWT-bearer grant has no standard
marker, so the authorization server stamps a namespaced private claim on the
tokens it mints for that grant. A nil map with neither signal keeps the deny,
as does a session that exists but lacks the pinned provider's credentials.

Two supporting changes keep that boundary visible. The vMCP incoming-auth
factory now rejects a pinned primaryUpstreamProvider under local or anonymous
auth, which can never produce an upstream session; the operator enforces the
same rule, but it does not run for a hand-written vmcp config. And
Identity.UpstreamTokens documents that a nil map states no reason, so no
future reader repeats the inference.

Policies still could not tell which trust root asserted the claims they read,
including on the pre-existing path where an opaque upstream access token
silently degrades to request claims. Every evaluation now carries a
thv_claim_source attribute on the principal and the context naming that root.
It is written after claim prefixing and outside the claim_ namespace, so a
to... (continued)

Coverage Stats

91 of 101 new or added lines in 8 files covered. (90.1%)

58 existing lines in 5 files now uncovered.

77765 of 111206 relevant lines covered (69.93%)

92.74 hits per line