stacklok / toolhive / 39818120099

73%

Build Type

push

github

Committed by web-flow

Commit Message

Let embedders refuse refresh grants on dead upstreams (#6902)

* Let embedders refuse refresh grants

The embedded auth server's refresh_token grant keeps the token session,
so a client whose upstream credential is dead gets a new access token
that the bearer validator rejects again, and a client that only ever
refreshes loops. Embedders had no way to refuse that grant, and could
not tell an IdP's invalid_grant from a transient upstream failure.

Implements items 1 and 2 of #6901 (the default guard is a follow-up):
- Add Config.RefreshGrantHandlers: fosite token endpoint handlers that
  run only on the refresh_token grant, after the built-in refresh
  handler and before any tokens are issued or the refresh token rotates
- Wrap a new upstream.ErrInvalidGrant when the IdP answers a token
  request with invalid_grant and a 4xx status
- Return per-provider errors from GetAllUpstreamCredentials (failed is
  now map[string]error) so errors.Is reaches the sentinel there too

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Address review feedback on refresh-grant seam

- Never delegate the response phase to embedder handlers: it runs after
  the refresh token is rotated, so an error there would strand the
  client, and it would let an embedder rewrite the issued response
- On an upstream invalid_grant, re-read the row and return it if another
  replica already rotated it, so a lost cross-replica race is not
  reported as a dead credential; document the remaining window
- Document that non-OAuth handler errors answer 500, and that the
  code exchange also wraps ErrInvalidGrant

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Register refresh-grant handlers as one validator

fosite drops a token endpoint handler whose concrete type is already
registered, so wrapping each handler separately kept only the first.

Addresses stacklok/toolhive#6902 review comments:
- HIGH pkg/authserver/refresh_grant_handlers.go (4340715142): run all
  handlers... (continued)

Coverage Stats

76 of 76 new or added lines in 8 files covered. (100.0%)

306 existing lines in 7 files now uncovered.

88702 of 123951 relevant lines covered (71.56%)

127.49 hits per line