stacklok / toolhive / 40724487955

73%

Build Type

push

github

Committed by web-flow

Commit Message

Add exchange grant storage with memory backend (#6968)

* Add exchange grant storage interface

Refresh tokens issued through RFC 8693 token exchange need a server-side
record that can be revoked and that tracks which grant a child came from.
Add the ExchangeGrant record, its Live check (revoked wins over expired),
the ErrRevoked sentinel, and an ExchangeGrantStorage capability interface
with its contract for atomic create, lookup, and idempotent revocation.
The interface is not embedded in Storage, so backends opt in. Backends
arrive in later steps, so nothing uses the interface yet.

Co-authored-by: Mecatl <noreply@mecatl.dev>

* Add memory exchange grant storage

The in-memory backend needs to hold exchange grant records so the
token exchange handlers can issue and revoke refresh tokens without a
Redis dependency in single-process deployments.

MemoryStorage now implements ExchangeGrantStorage. Create checks the
signature and the (issuer, jti) replay key first, then writes the record
and marker under one lock, so a failed call leaves nothing behind.
Records are copied in and out, and the existing cleanup loop removes
them after ExpiresAt and markers after SourceExpiresAt. Markers live in
their own map and store the grant signature.

A backend-agnostic contract suite covers replay, atomicity, revocation,
expiry and copy semantics, and will be reused for the Redis backend.

Co-authored-by: Mecatl <noreply@mecatl.dev>

* Validate exchange grant shape and expiry

The CreateExchangeGrant contract says a top-level grant sets its source
and a child does not, and that a failed call writes nothing. Memory
enforced neither: a grant with no parent and no source was stored with
no replay marker, a child could consume a jti, and a grant already past
ExpiresAt was accepted after writing its marker, so a corrected retry
got ErrJTIKnown.

Move the checks into validateExchangeGrantShape, shared by every
backend, and add the parent/source exclusive-or, a required Ex... (continued)

Coverage Stats

106 of 139 new or added lines in 3 files covered. (76.26%)

23 existing lines in 6 files now uncovered.

90363 of 125554 relevant lines covered (71.97%)

130.67 hits per line