stacklok / toolhive / 43200992482

73%

Build Type

push

github

Committed by web-flow

Commit Message

Add the ID-JAG minting core and align token minting (#7117)

* Add the ID-JAG minting core

Issuing an ID-JAG needs the same steps whatever the subject came
from: check the request shape, find the configured target, pick the
subject claims, run the policy, sign, and write the response. These
steps are collected in one unexported core that knows nothing about
grants, so each subject source built later reuses them and cannot skip
the policy call.

The core refuses scope, authorization_details and actor tokens, signs
with the oauth-id-jag+jwt typ, and emits a closed set of claims. A
test redeems a minted ID-JAG through the real multi-issuer validator.
Nothing calls the core yet.

Co-authored-by: Mecatl <noreply@mecatl.dev>

* Sign ID-JAGs through Signer.SignIDJAG

The base PR replaced the free-form Signer.Sign(claims, typ) with
SignIDJAG, which always sets typ oauth-id-jag+jwt, and removed the
exported tokenexchange.IDJAGSigner after review.

The mint core now depends on an unexported idJAGSigner interface that
*server.Signer satisfies, so tests can still fake signing failures.
The recording test signer counts calls instead of recording typ, and
the golden test checks typ in the produced token's JOSE header.

Co-authored-by: Mecatl <noreply@mecatl.dev>

* Fix lint in the ID-JAG minting tests

Use jose.ParseSignedCompact instead of the deprecated
jose.ParseSigned (SA1019), and apply gofmt -s to a
json.RawMessage composite literal that the formatter check
flagged.

Co-authored-by: Mecatl <noreply@mecatl.dev>

* Refuse an ID-JAG whose cap has elapsed

When a NotAfter cap pulled exp down to now or earlier, mintIDJAG
returned a server_error, which blamed the operator for a grant the
client holds that has expired.

respondWithIDJAG now checks the bounds after the policy and before
minting. A target lifetime that does not reach the next second is
still a server_error. If a cap pushed exp to now or earlier, the
request is refused with invalid_grant and the stabl... (continued)

Coverage Stats

207 of 213 new or added lines in 3 files covered. (97.18%)

117 existing lines in 6 files now uncovered.

95203 of 130232 relevant lines covered (73.1%)

890.97 hits per line