stacklok / toolhive / 41671625562

73%

Build Type

push

github

Committed by web-flow

Commit Message

Require offline_access to open an exchange grant (#7038)

An exchange grant outlives the sign-in session, so opening one is
offline access. The authorization code flow already requires offline
or offline_access before it issues a refresh token (OIDC Core
section 11), but the exchange-grant path never checked the subject
token's scope, so a user who had not granted offline access could
still open a long-lived grant.

Opening a grant now requires the subject token's scope to contain one
of the server's refresh-token scopes. A token without one is refused
with invalid_request and the reason subject_token_offline_access. The
scopes come from one function, server.RefreshTokenScopes, which is set
on the fosite config so the token endpoint, this check and startup
validation use the same list. Startup also refuses
exchange_refresh_tokens when scopes_supported has neither scope,
because no grant could ever open.

Co-authored-by: Mecatl <noreply@mecatl.dev>

Coverage Stats

32 of 32 new or added lines in 3 files covered. (100.0%)

53 existing lines in 2 files now uncovered.

91821 of 127007 relevant lines covered (72.3%)

133.12 hits per line