stacklok / toolhive / 41696227393

73%

Build Type

push

github

Committed by web-flow

Commit Message

Derive child exchange grants from refresh tokens (#7007)

* Derive child refresh tokens from grants

A client holding a grant that allows refresh_token had no way to hand
out narrower credentials. Token exchange with a refresh-token subject
and a refresh-token requested type now derives a child grant that
allows one other token type (id-jag), copies the parent's client and
subject, and never outlives the parent or the client's cap for the
child's type.

This replaces the blanket refusal of refresh-token subjects for clients
with exchange_refresh_tokens. A refresh-token subject that asks for any
other requested_token_type, and every refresh-token subject from a
client without exchange_refresh_tokens, keep the unsupported
subject_token_type refusal.

The presented token is checked in a fixed order that reveals nothing
before the client check: HMAC only (no store call), lookup, same
client, the grant's own liveness, the parent's liveness, then the
refresh_token type. A forged, unknown, other-client or login refresh
token all get one invalid_request with the stable description
grant_invalid, so a caller learns nothing about which case applied.
Later refusals use the exact reasons revoked, parent_revoked and
not_issuable. An expired grant is not found in the store, so it gets
grant_invalid too. A child lists no refresh_token, so it cannot be
derived from (depth 1).

A derive logs "Exchange grant derived" at debug level with
has_parent=true. A child has no replay marker, so a derive can be
repeated, and a lost response leaves an orphan child until its parent
ends; this is documented.

* Drop the expired reason for exchange grants

A client learns when a grant ends from the expires_at echoed in the
response that issued it, so a separate expired reason tells it nothing.
Both stores already hide expired records, so an expired grant reached
the handler only when the server and store clocks disagreed.

An expired grant is now answered like an unknown grant: the ... (continued)

Coverage Stats

124 of 138 new or added lines in 3 files covered. (89.86%)

13 existing lines in 6 files now uncovered.

91978 of 127133 relevant lines covered (72.35%)

133.26 hits per line