stacklok / toolhive / 42793114256

73%

Build Type

push

github

Committed by web-flow

Commit Message

Prevent ID-JAGs from being used as access tokens (#7089)

* Separate grant validity from derivation eligibility

A live exchange grant is not necessarily eligible to create a child.
For example, an ID-JAG-only grant can be valid but must not derive
another refresh-token grant.

Move the top-level and refresh-token issuability checks into
decideChild, leaving presentedGrant to validate the grant itself.
This prepares validation for ID-JAG issuance without adding that path
or changing the derivation refusal order.

Refs: #6898
Co-authored-by: Mecatl <noreply@mecatl.dev>

* Refuse ID-JAGs where access tokens are expected

An ID-JAG is an assertion for an authorization server, not an access
token. When an issuer signs both with the same key, an ID-JAG could
otherwise pass access-token validation if its claims also satisfy the
checks. Refuse its JOSE type in resource-server and token-exchange
access-token validators while keeping ID-JAG redemption separate.

The check covers subject and actor tokens and login tokens used to
create exchange grants. It matches the type case-insensitively and
with an optional application/ prefix; missing or non-string types are
not rejected by this check. vMCP uses the same matcher for its ID-JAG
diagnostic.

JWT-bearer redemption retains its exact type match for routing. Type
variants therefore fail closed rather than reaching the ID-JAG handler;
normalizing redemption routing is a follow-up.

Refs: #6898
Co-authored-by: Mecatl <noreply@mecatl.dev>

* Keep ID-JAG redemption typ matching exact

Redemption routing compares the ID-JAG typ exactly, as the ID-JAG
draft requires of an issuer, while the access-token checks normalize
it per RFC 7515 Section 4.1.9. Document that as intended and fail
closed, not as a known gap.

Remove the ID-JAG case from the plain JWT-bearer typ allowlist. It
was unreachable: IDJAGHandler claims the exact type first. Keeping it
would let a mis-routed ID-JAG skip client authentication. Pin the
refusa... (continued)

Coverage Stats

35 of 38 new or added lines in 7 files covered. (92.11%)

48 existing lines in 2 files now uncovered.

93964 of 129088 relevant lines covered (72.79%)

849.9 hits per line