hyperscale-stack / security / 38188759504

98%

push

github

feat(oauth2): add protocol extension points for an OpenID provider

An OpenID provider built on the authorization-code flow needs to validate
its own /authorize parameters, carry the application's trusted
authentication result from the consent to the token response and keep it
across refreshes, and add an id_token computed from the access token —
without a second /token endpoint and without oauth2 importing OIDC/JOSE.
ServerConfig.Extension takes an oauth2.Extension whose three hooks run
only on what the core accepted: ValidateAuthorizeRequest after every
/authorize check, CompleteAuthorization turning Consent.ExtensionResult
into an ExtensionGrant (narrow-only scope, opaque Data of at most 4096
bytes), and ExtendTokenResponse between minting the tokens and their
single atomic write, returning a typed id_token. A hook failure persists
nothing; the RFC 6749 §5.1 members cannot be overwritten; without an
extension every response is unchanged.

Codes and tokens record their issuer and the grant context, carried
unchanged through every rotation (OIDC Core §12.2); the stores refuse a
rotation that would change them. Codes and refresh tokens are bound to
the issuer resolved at /authorize — another realm's, or one written
before the upgrade, is refused with invalid_grant (OIDC Core §16.15).
/authorize refuses an unsupported response_mode with a bare 400 and the
metadata advertises ["query"]; Consent.Refusal redirects OIDC §3.1.2.6
codes; an approval needs a subject of at most 255 bytes; a callback
modifying the read-only request fails closed; error responses keep to
the RFC 6749 charset. grant.Config.RefreshTokenScope gates refresh
tokens on offline_access (OIDC Core §11) and TokenIssuance reports
whether one is issued.

SQL deployments apply six ALTER TABLE statements (MIGRATION.md); Migrate
still only creates tables. GrantResponse.ExtraParams is removed.
Refs #83.

626 of 627 new or added lines in 24 files covered. (99.84%)

5302 of 5545 relevant lines covered (95.62%)

98.18 hits per line