stacklok / toolhive / 39842073365

73%

Build Type

push

github

Committed by web-flow

Commit Message

Support authorization_details on token exchange (#6921)

* Add authorizationdetails package

Token exchange needs RFC 9396 authorization_details support for delegated
clients (#6894). Add a Go-only, immutable registry that maps a type name to
the grant types it applies to and a Grant hook. Parsing enforces the RFC 9396
structure plus ToolHive policy: duplicate and case-folded member names, a
64 KiB limit and depth 64. Grant calls each hook once with all of its
entries and the request context, validates the hook output to the same
limits, and returns the granted details in a fixed order. Hooks decide only;
the package does not persist details or put them in tokens.

Co-authored-by: Mecatl <noreply@mecatl.dev>

* Support authorization_details on token exchange

Delegated clients such as Mecatl name a session or schedule grant with an
authorization_details entry on token exchange (#6894). With a registry
configured, the handler rejects a repeated parameter with invalid_request
(RFC 6749 section 5.2), parses the details before the subject token is
checked, and calls the type hooks after the subject, consent, scope and
audience checks. The response echoes what the hooks granted, only after the
token is issued. Typed hook errors become invalid_authorization_details or
invalid_request with a safe reason; other hook failures become server_error.
Each rejection is logged once at WARN with a fixed reason; hook error text
is never logged, since it could carry credentials or request data. Without
a registry the parameter is ignored, as before.

The registry is passed through a functional factory option,
authserver.Config and runner.WithAuthorizationDetailsRegistry. Setting it
while token exchange is disabled is a startup error. Docs describe the
behaviour and its limits: details are not put in tokens, persisted or sent
to resource servers yet (#6909, #6895).

Co-authored-by: Mecatl <noreply@mecatl.dev>

* Fix golangci-lint findings in authorization_details

CI's ... (continued)

Coverage Stats

331 of 337 new or added lines in 10 files covered. (98.22%)

7 existing lines in 2 files now uncovered.

89034 of 124268 relevant lines covered (71.65%)

127.37 hits per line