stacklok / toolhive / 42060020665

73%

Build Type

push

github

Committed by web-flow

Commit Message

Return invalid_target when token exchange refuses an audience (#7050)

* Return invalid_target when token exchange refuses an audience

RFC 8693 section 2.2.2 says invalid_target SHOULD be returned when the
authorization server refuses a requested resource or audience. The token
exchange handler surfaced fosite's invalid_request instead.

Map a refused audience or resource to invalid_target with a hint naming
the offending value. Unparsable audience URIs and the default-audience
path keep invalid_request, since no valid target was requested there.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: Alex Castillo <alex.castillog33@gmail.com>

* Update authserver integration tests for invalid_target audience error

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: Alex Castillo <alex.castillog33@gmail.com>

---------

Signed-off-by: Alex Castillo <alex.castillog33@gmail.com>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

Coverage Stats

15 of 15 new or added lines in 2 files covered. (100.0%)

410 existing lines in 7 files now uncovered.

93833 of 128939 relevant lines covered (72.77%)

850.12 hits per line