stacklok / toolhive / 39767439722

73%

Build Type

push

github

Committed by web-flow

Commit Message

Merge commit from fork

* Reject multipart bodies on OAuth authorization GET

Multipart GET parameters reached Fosite without passing through the CIMD rate limiter or the back-channel client check. Reject these bodies at the route boundary and cover both bypasses with regression tests.

* Rate-limit CIMD fetches in the storage decorator

The CIMD limiter only guarded GET /oauth/authorize, so POST
/oauth/token (via form client_id, Basic auth, or an unsigned
client_assertion) could trigger unbounded outbound document fetches
and persisted client rows.

Move the limit into CIMDStorageDecorator, charged only on a real
fetch, so every route that resolves a CIMD client_id is covered.
Refused lookups return ErrCIMDRateLimited, which the token,
authorize and device authorization handlers answer with 429 instead
of invalid_client. The authorize-only middleware is removed.

* Document stale snapshot in CIMD rate-limit fallback

When the fetch limiter is exhausted, the decorator serves the
write-through row, so a changed or revoked document keeps resolving
until the row's TTL expires. Record that trade-off next to the code
and in the storage architecture doc.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Limit CIMD rate-limit fallback to the callback

Serving the persisted row from the decorator whenever the fetch
limiter refused let a drained bucket keep stale or revoked document
metadata alive indefinitely: Redis renews the row TTL on token use
and the memory backend has no wall-clock TTL. It also turned storage
errors into misleading 429s.

Drop the decorator fallback. Only /oauth/callback, where the pending
authorization is already consumed, reads the persisted row on
ErrCIMDRateLimited; its staleness is bounded by the pending
authorization lifetime. Other storage errors propagate unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Serve stale CIMD client under fetch pressure

The process-wide CIMD fetch limiter also guards /... (continued)

Coverage Stats

110 of 110 new or added lines in 7 files covered. (100.0%)

11 existing lines in 4 files now uncovered.

88537 of 123841 relevant lines covered (71.49%)

127.19 hits per line