stacklok / toolhive / 38371566567

71%

Build Type

push

github

Committed by web-flow

Commit Message

Add group-based upstream filter for vMCP auth (#6739)

* Add shared JWT claim string-array decoder

JWT/OIDC claim values that are string arrays commonly arrive at Go as
either []string (from typed JWT libraries) or []any whose elements are
all strings (from standard encoding/json). The Cedar authorizer decodes
that split inline today, and the upcoming group-based upstream filter
needs the same decoding with a stricter contract.

Add pkg/auth/claims so neither caller has to carry its own copy. The
decoder in this commit is strict by design: nil values, non-array types,
and non-string array elements are errors, so a security-relevant caller
can rely on it to fail closed on a malformed claim. Returned slices
never alias the caller's input.

The next commit moves Cedar onto the same package, which needs a second,
permissive contract to preserve its current behavior.

Refs: #6675

Signed-off-by: hellouz818 <hellouz818@gmail.com>

* Adopt the shared claim decoder in Cedar

The decoder added in the previous commit is strict by design, and Cedar
cannot use it as-is. Cedar reads a present-but-malformed group claim as
"the IdP asserted no usable names" and relies on that to suppress the
fallback to well-known claim names. Decoding it to nil instead would let
an explicitly empty custom claim fall through to "roles" and grant
access the operator did not intend.

Add DecodeStringArrayLenient next to the strict decoder, preserving
Cedar's existing semantics: non-string elements are dropped from []any,
empty or typed-nil []any values produce a non-nil empty slice, and
[]string values retain their nil-ness. Rewrite extractGroups on top of
it, so both contracts live in one place and the difference between them
is documented rather than implicit.

The one deliberate change is that the result no longer aliases a
[]string claim value. authorizeWithClaims appends the role claim onto
the slice returned for the group claim, which could write a role name
into the token's ow... (continued)

Coverage Stats

147 of 151 new or added lines in 3 files covered. (97.35%)

2 existing lines in 2 files now uncovered.

86166 of 121058 relevant lines covered (71.18%)

126.07 hits per line