stacklok / toolhive / 34469696838

71%

Build Type

push

github

Committed by web-flow

Commit Message

Add SPIFFE client authentication dispatch (#6562)

* Add SPIFFE client authentication dispatch

X.509-SVID (#6202) and JWT-SVID (#6203) client authentication both replace
the same fosite ClientAuthenticationStrategy: one dispatches on an assertion
type in the request form, the other on a SPIFFE ID placed in the request
context by an mTLS listener. Introducing that hook once, before either lands,
keeps both credential types resolving through a single path so they cannot
grow divergent principals.

Behaviour is unchanged. Both SPIFFE arms return invalid_client with a
not-implemented hint, and everything else falls through to fosite's default
strategy, so RFC 7523 jwt-bearer and secret-based client authentication are
untouched. The strategy is installed after NewOAuth2Provider because the
default strategy is a method on the provider and fosite reads the config
field per request.

Also restores the fail-closed token-endpoint coverage that was reduced to
principal-equivalence assertions, and renames those assertions to match what
they check.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* Break SPIFFE resolver import cycle

Both client-authentication arms must resolve a verified SPIFFE ID through
SPIFFEAssociationRegistry.Resolve, but the registry lives in package
authserver and the strategy in package authserver/server, which authserver
already imports. The strategy could not reach it. Left unresolved, #6202 and
the divergence this dispatch exists to prevent.

The two arms, built independently on the pre-resolver base, converged on the
same shape: a function type in package server returning fosite.Client (what
fosite.ClientAuthenticationStrategy needs), implemented as a closure built in
server_impl.go where the association registry and storage are already in
scope. A resolver interface returning a principal was a dead end here since
the strategy still needs a fosite.Client. Adopt that shape as
server.SPIFFEClientResolver, covering both X.509 and... (continued)

Coverage Stats

111 of 118 new or added lines in 5 files covered. (94.07%)

33 existing lines in 9 files now uncovered.

80483 of 114158 relevant lines covered (70.5%)

93.19 hits per line