stacklok / toolhive / 39420908284

73%

Build Type

push

github

Committed by web-flow

Commit Message

Let embedders skip consent for preauthorized clients (#6882)

* Add consent preauthorization policy validation

Embedders of the authorization server need a way to let trusted
confidential clients skip ToolHive's consent page. A list of
preauthorized client IDs is only safe if bad entries and unsafe
deployments are rejected before any request is served, so this commit
adds the configuration and its validation. Nothing reads the list at
request time yet.

Config.ConsentExemptClientIDs and handlers.WithConsentExemptClientIDs
carry the list. The shared checks live in the new internal package
pkg/authserver/internal/consentpolicy. Config.Validate and NewHandler
both call it, so direct handler callers get the same checks as the
core server. When the list is not empty, consentpolicy.Validate
rejects:

- empty or duplicate IDs
- URL-shaped IDs (any parsed scheme, or a "//host" authority), which
  covers CIMD IDs that a remote party can change
- a server with no upstreams
- an effective authorization base (AuthorizationEndpointBaseURL,
  otherwise the issuer) that is not HTTPS

InsecureAllowHTTP does not relax the HTTPS rule. An empty list leaves
all existing validation as it was. The option copies the caller's
slice and replaces earlier values instead of adding to them.
NewHandler turns the list into a lookup set and does no storage
lookups.

Co-authored-by: Mecatl <noreply@mecatl.dev>

* Validate preauthorized client registrations

The syntax checks alone do not stop an operator from listing an ID
that is missing, public, or cannot do the interactive flow. Such an
entry would only show up later, at request time. This commit makes
authserver.New resolve each listed ID and fail construction if the
registration is not usable.

validateConsentExemptClients in server_impl.go looks up every ID
through the storage passed to newServer. That is the decorated
storage, so encryption and policy decorators still apply and
storage.Unwrap is not used. A storage error or a... (continued)

Coverage Stats

202 of 213 new or added lines in 6 files covered. (94.84%)

2 existing lines in 2 files now uncovered.

87654 of 122821 relevant lines covered (71.37%)

126.9 hits per line