stacklok / toolhive / 41642126424

73%

Build Type

push

github

Committed by web-flow

Commit Message

Return invalid_client for failed client assertions (#7036)

* fix(authserver): return invalid_client for every failed private_key_jwt assertion

An expired, not-yet-valid or future-issued client assertion surfaced as a
plain error (500), an assertion whose exp exceeds MaxAssertionLifespan as a
plain error from SetClientAssertionJWT (500), and an unknown signing key or
a reused jti as invalid_request / jti_known (400). RFC 6749 section 5.2
assigns invalid_client to every failed client authentication.

Map those outcomes to invalid_client in a strategy wrapped around fosite's
default one, and have both storage backends return invalid_client for an
over-long lifetime. Storage failures keep surfacing as server errors.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: Alex Castillo <alex.castillog33@gmail.com>

* Report jti store failures as server_error and tighten client assertion errors

Address review: a Redis failure while reserving the jti stays HTTP 500
server_error (recorded through RecordClientAssertionStoreFailure, since
fosite discards the storage error), a missing client_assertion stays 400
invalid_request, the expired integration case asserts 401 invalid_client,
and the matching rules and docs are explained.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: Alex Castillo <alex.castillog33@gmail.com>

* Move store-failure helpers above the strategy doc comment

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: Alex Castillo <alex.castillog33@gmail.com>

---------

Signed-off-by: Alex Castillo <alex.castillog33@gmail.com>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

Coverage Stats

37 of 37 new or added lines in 4 files covered. (100.0%)

11 existing lines in 3 files now uncovered.

91784 of 126927 relevant lines covered (72.31%)

131.77 hits per line