stacklok / toolhive / 41715364486

73%

Build Type

push

github

Committed by web-flow

Commit Message

Close gaps left by the go-jose v4 move in the auth server (#7018)

* Move the JWS guard check into fositejose

IsUnsafeFositeJWS was exported from the public server package only so
the authorize handler could call it, yet it is a temporary workaround
for the go-jose v3 advisory that goes away with fosite's move to v4.
Put it next to the other go-jose v3 shims in the internal fositejose
package, with its table test, so it can be deleted together with them.

No behavior change.

Co-authored-by: Mecatl <noreply@mecatl.dev>

* Check request objects when the query is malformed

rejectUnsafeRequestObject returned early when ParseForm failed, so a
request carrying a malformed pair such as x=%zz skipped the check.
net/http still fills req.Form with every pair that parsed and only
returns the first error. fosite ignores that error on GET, finds Form
already set and reads the request object from it, which let an
embedded-key JWS reach go-jose v3.

Ignore the ParseForm error and always check Form["request"]. The
authorize test now covers a malformed pair next to an unsafe request
object.

Co-authored-by: Mecatl <noreply@mecatl.dev>

* Convert the signing key with fositejose

server_impl.go hand-built a go-jose v3 JSONWebKey from the v4 signing
key, duplicating the field copy that fositejose.ToFositeKey already
does. The signing key only carries Key, KeyID, Algorithm and Use, so
the converted value is identical. Use the shared helper and drop the
direct go-jose v3 import.

Co-authored-by: Mecatl <noreply@mecatl.dev>

* Accept padded base64url in client JWKS

go-jose v3 stripped trailing "=" from base64url JWK members before
decoding them. v4 decodes with RawURLEncoding and rejects padding, so
after the v4 move a delegate-client JWKS file with a padded modulus
stopped loading and a padded private_key_jwt registration got 400.

Add oauthproto.UnmarshalJWKS, which trims padding from exactly the
members v3 trimmed (k, x, y, n, e, d, p, q, dp, dq, qi, x5t, x5t#S256)
a... (continued)

Coverage Stats

73 of 79 new or added lines in 7 files covered. (92.41%)

54 existing lines in 5 files now uncovered.

92134 of 127328 relevant lines covered (72.36%)

134.79 hits per line