stacklok / toolhive / 39942369741

73%

Build Type

push

github

Committed by web-flow

Commit Message

Decouple authserver identity from host auth types (#6923)

The embedded authorization server's callback and upstream filter took
ToolHive's host authentication types (auth.PrincipalInfo, the host
context helpers, and the host claims package). That ties the server to
the host's webhook and audit model and blocks moving it into a package
of its own.

Add a FilterPrincipal getter interface for the upstream filter, backed
by a private projection of the callback principal that carries no
credentials. Move the canonical-user context key into
pkg/authserver/identity. The host package keeps its existing names as
aliases and wrappers, including the fallback to the authenticated
request. Move strict string-array claim decoding into
pkg/oauthproto/claims and leave the old pkg/auth/claims function as a
wrapper around it.

Behavior is unchanged. Mapped upstream subjects stay distinct from
canonical storage users, malformed group claims still fail closed, and
bearer authentication and audit identity are untouched.

External UpstreamFilter implementations must move from reading
auth.PrincipalInfo fields to the FilterPrincipal getters.

Co-authored-by: Mecatl <noreply@mecatl.dev>

Coverage Stats

51 of 51 new or added lines in 7 files covered. (100.0%)

6 existing lines in 1 file now uncovered.

89326 of 124553 relevant lines covered (71.72%)

127.48 hits per line