stacklok / toolhive / 40946339513

73%

Build Type

push

github

Committed by web-flow

Commit Message

Limit delegate token exchange to source clients (#6988)

* Add token-exchange source policy for clients

A configured delegate client may exchange any self-issued token the
server has issued, including tokens issued to unrelated clients. Those
tokens are bearer credentials, so a token that leaks from one client, or
that a malicious dynamically registered client collects through normal
consent, can be laundered through any delegate into that delegate's own
downstream access. RFC 8693 leaves exchange policy to the authorization
server, and RFC 8707 audience limits do not stop this when both clients
share an audience, so the server has to bind the source itself.

Add an optional token_exchange block per delegate with
self_issued_subject_tokens (any or restricted). Restricted limits the
delegate to subject tokens issued to itself or to its
allowed_source_clients, and requires any may_act to match. A may_act
claim cannot replace this check: the server never writes may_act into
its own tokens, and when one is present it skips the client_id binding,
so it cannot narrow access on the self-issued path.

Examples:

- Blocked laundering: a dashboard client B logs a user in, and a broker
  delegate A holds the token-exchange grant. With restricted and no
  allowed_source_clients, A cannot exchange B's token for its own
  downstream access.
- Intended sharing: A brokers requests for a CLI client B. Listing B in
  allowed_source_clients lets A exchange B's tokens and nothing else.
- Audience grant: A is granted api_audience for a reporting API with no
  subject-token coverage. This is an explicit, operator-chosen exception
  for self-issued tokens only.

The default stays any, so existing delegates keep today's behaviour and
get the startup WARN. A client that sets grant_types must declare the
block and a mode, so the trust level is an explicit choice.

Not closed here: a stolen bearer token can still be exchanged by a
delegate on the source list, and api_audience ... (continued)

Coverage Stats

156 of 156 new or added lines in 7 files covered. (100.0%)

6 existing lines in 2 files now uncovered.

90976 of 126129 relevant lines covered (72.13%)

131.07 hits per line