hyperscale-stack / security / 38016983323

95%

master: 98%

Pull #93

github

test(oauth2): pin the replay wire answer and tighten the code-replay contract

Review follow-ups for the authorization-code replay revocation.

An unproven replay — another client, a missing, wrong or malformed
verifier, another redirect_uri, an expired code, a client no longer
allowed the grant — now has its answer pinned to the bare
ErrCodeAlreadyUsed ("authorization code already consumed"), the answer
of any replay and of an unknown code, so the response tells nothing
about which check failed. The former pins only checked the invalid_grant
code, which a grant returning the validation error would have passed.
The revocation a replay triggers is now checked to be bounded by the
detached revocation timeout, not only detached from the request, and
the replay guard also refuses a typed-nil CodeReplayError, which used to
panic.

The storage contract now says that a given CodeHash is saved at most
once — the Redis store overwrites, so a consumed code saved again
becomes redeemable again — and that a decorator of
ConsumeAuthorizationCode returns the store's error unchanged or wrapped
with %w, since normalizing it to ErrCodeAlreadyUsed silently disables
replay revocation. The docs describe both outcomes of a replay racing
the first exchange — it fails that exchange or revokes its tokens — say
that a late replay is refused like any replay, and cite RFC 9700
§4.2.4. The Redis comments explain what the null-flag test checks and
the non-string script reply, and the test doubles lose their dead
nolint directives. Refs #80.

230 of 236 new or added lines in 11 files covered. (97.46%)

4836 of 5103 relevant lines covered (94.77%)

75.68 hits per line