stacklok / toolhive / 35202690433

71%

Build Type

push

github

Committed by web-flow

Commit Message

feat(authserver): accept ID-JAG assertions with a bound JWT-bearer handler (#6677)

Add bound JWT-bearer handler for ID-JAG assertions

The embedded authorization server's RFC 7523 JWT-bearer grant only
accepted plain assertions: JWTBearerHandler deliberately declines any
assertion whose JOSE typ is oauth-id-jag+jwt, reserving it for a bound
handler that did not exist. An IdP-minted Identity Assertion
Authorization Grant (draft-ietf-oauth-identity-assertion-authz-grant,
the inbound half of Cross App Access) therefore could not be redeemed
at the token endpoint at all - no handler claimed the grant and fosite
returned its generic invalid_request.

Add IDJAGHandler, claiming exactly the assertions the plain handler
declines. Bound means client authentication is never skipped: fosite
must resolve the caller before the handler runs, and the handler
enforces the draft's client_id continuity - the assertion's client_id
claim must name that client. jti is required and consumed under its own
replay purpose. The issued token keeps the plain handler's subject form
and no-upstream-session marker, carries the real redeeming client
instead of a synthetic one, and copies the assertion's act claim
through so the acting agent stays auditable after redemption.

Both handlers are registered from the same per-issuer policy whenever
the grant is enabled; no new configuration surface. The shared
consume/lifetime/issuance plumbing and the factory core are extracted
so the two handlers cannot drift.

Signed-off-by: Aron <aron@muonspace.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Coverage Stats

99 of 120 new or added lines in 3 files covered. (82.5%)

21 existing lines in 5 files now uncovered.

81742 of 115606 relevant lines covered (70.71%)

96.95 hits per line