stacklok / toolhive / 41657639155

73%

Build Type

push

github

Committed by web-flow

Commit Message

Separate delegate input audiences from output audiences (#7037)

* Stop exempting api_audience from subject coverage

A delegate client with token_exchange.api_audience could exchange a
self-issued token for an access token for that audience even when the
subject token's aud did not cover it, including its own re-exchanged
tokens. api_audience was meant only as the audience a subject token
must carry to open an exchange grant.

Token exchange now requires every granted audience to be covered by
the subject token, with no exception. The api_audience docs and the
generated API docs describe it as an input only.

Co-authored-by: Mecatl <noreply@mecatl.dev>

* Replace api_audience with subject_token_audiences

api_audience was one field with two meanings: the audience a subject
token must carry to open an exchange grant, and an audience the
delegate could obtain, since it had to be listed in audiences. A
delegate set up for refresh tokens could therefore also mint access
tokens for it.

subject_token_audiences is input only. A self-issued subject token
must carry one of the listed audiences on every exchange path, and
audiences lists only what the client may obtain. While
exchange_refresh_tokens is set, startup refuses an input audience that
any client audience covers under the server's audience matching rule,
so a delegate can never get an access token for it. A refresh-token-only
client may have no audiences when token exchange is its only grant.

The exchange-grant path now applies the same source rule as plain
token exchange, so the exchanging client's own login tokens are
accepted, and exchange_refresh_tokens no longer requires
allowed_source_clients.

Co-authored-by: Mecatl <noreply@mecatl.dev>

* Document delegate input and output audiences

The architecture doc still described api_audience and the exemption
from subject coverage. Rewrite the delegate-client section around
subject_token_audiences (input) and audiences (output): one meaning
per sett... (continued)

Coverage Stats

79 of 79 new or added lines in 5 files covered. (100.0%)

8 existing lines in 3 files now uncovered.

91836 of 126975 relevant lines covered (72.33%)

133.04 hits per line