stacklok / toolhive / 40967065924

73%

Build Type

push

github

Committed by web-flow

Commit Message

Add exchange refresh token client config (#6989)

* Add exchange refresh token client config

A delegate client that exchanges a login token for a refresh token gets
a credential that outlives the login. Without per-client limits, one
leaked token can become long-term access, and if the server accepts
any self-issued subject token, one client can spend another client's
token.

Threat this closes. reporting-svc is a confidential client whose access
token AT1 (5 minutes, aud=crm.example) is issued for alice. AT1 leaks
from a log line. Without the source policy in the parent commit,
mallory-cli, another confidential client, exchanges AT1 for a token
with aud=payroll.example. If exchange can also mint refresh tokens,
the same leak becomes a refresh token whose life is limited only by
the server default, and it keeps renewing while it is used.

This commit adds the configuration that lets an operator decide, for
each client, whether exchange may issue refresh tokens and how long
they may live:

    token_exchange:
      self_issued_subject_tokens: restricted
      api_audience: https://crm.example
      exchange_refresh_tokens:
        id_jag_max_lifetime: 5m
        refresh_token_max_lifetime: 720h

Validation requires at least one cap, each positive and at most 720h,
api_audience set, restricted subject tokens, and a confidential client
with the token-exchange grant. An empty cap refuses that grant kind.
The 720h ceiling is a local choice; no specification sets it. The caps
are projected into ConfiguredClientPolicy keyed by token type. Nothing
reads the projection yet, so this commit changes no behaviour.

The source check reads the client_id of the subject token, which names
the client that obtained it. Only that client, or a listed source
client, may exchange it. The check does not compare sub with iss. For
a login token, sub is the user and iss is the server, so requiring them
to match would reject every valid login token.

Still open after this commi... (continued)

Coverage Stats

78 of 84 new or added lines in 3 files covered. (92.86%)

62 existing lines in 4 files now uncovered.

90990 of 126209 relevant lines covered (72.09%)

130.54 hits per line